Play interactive tour

Edit tour

Windows Analysis Report kCcJdlYm9t.bin

Overview

General Information

Sample Name:	kCcJdlYm9t.bin (renamed file extension from bin to exe)
Analysis ID:	542163
MD5:	5559e9f5e1645f8554ea020a29a5a3ee
SHA1:	d74bd70862707cd2c7ab946903f6fa0aab066151
SHA256:	5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4
Tags:	AtomSiloexeRansomware
Infos:
Most interesting Screenshot:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Found Tor onion address

Writes a notice file (html or txt) to demand a ransom

Creates HTA files

Machine Learning detection for sample

Detected TCP or UDP traffic on non-standard ports

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Stores files to the Windows start menu directory

Entry point lies outside standard sections

Classification

Process Tree

System is w10x64

kCcJdlYm9t.exe (PID: 6536 cmdline: "C:\Users\user\Desktop\kCcJdlYm9t.exe" MD5: 5559E9F5E1645F8554EA020A29A5A3EE)

conhost.exe (PID: 6520 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: kCcJdlYm9t.exe	Virustotal: Detection: 37%	Perma Link
Source: kCcJdlYm9t.exe	Metadefender: Detection: 20%	Perma Link
Source: kCcJdlYm9t.exe	ReversingLabs: Detection: 46%

Machine Learning detection for sample

Show sources

Source: kCcJdlYm9t.exe

Joe Sandbox ML: detected

Source: kCcJdlYm9t.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source: C:\Users\user\Desktop\kCcJdlYm9t.exe	File opened: c:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\README-FILE-562258-1639906857.hta	Jump to behavior
Source: C:\Users\user\Desktop\kCcJdlYm9t.exe	File opened: c:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\README-FILE-562258-1639906857.hta	Jump to behavior
Source: C:\Users\user\Desktop\kCcJdlYm9t.exe	File opened: c:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\README-FILE-562258-1639906857.hta	Jump to behavior
Source: C:\Users\user\Desktop\kCcJdlYm9t.exe	File opened: c:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\README-FILE-562258-1639906857.hta	Jump to behavior
Source: C:\Users\user\Desktop\kCcJdlYm9t.exe	File opened: c:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\README-FILE-562258-1639906857.hta	Jump to behavior
Source: C:\Users\user\Desktop\kCcJdlYm9t.exe	File opened: c:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\README-FILE-562258-1639906857.hta	Jump to behavior

Networking:

Found Tor onion address

Show sources

Source: kCcJdlYm9t.exe, 00000000.00000002.551127517.00007FF763F36000.00000004.00020000.sdmp	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: kCcJdlYm9t.exe, 00000000.00000002.548149705.00000287BFDCB000.00000004.00000020.sdmp	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta15.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta6.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta25.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta24.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta7.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta28.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta0.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta2.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta33.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta34.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta14.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta18.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta19.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta20.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta26.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta23.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta30.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta12.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta22.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta11.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta35.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta13.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta5.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta21.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta29.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta32.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta3.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta8.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta27.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta31.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta1.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta10.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta16.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta17.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta4.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>
Source: README-FILE-562258-1639906857.hta9.0.dr	String found in binary or memory: <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p>

Source: global traffic

TCP traffic: 192.168.2.3:49747 -> 139.180.184.147:45532

Source: unknown	TCP traffic detected without corresponding DNS query: 139.180.184.147
Source: unknown	TCP traffic detected without corresponding DNS query: 139.180.184.147
Source: unknown	TCP traffic detected without corresponding DNS query: 139.180.184.147

Source: README-FILE-562258-1639906857.hta9.0.dr

String found in binary or memory: If you have any problems during installation or use of TorBrowser, please, visit <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> and type request in the search bar "Install TorBrowser Windows" and you will find a lot of training videos about TorBrowser installation and use. equals www.youtube.com (Youtube)

Source: kCcJdlYm9t.exe, 00000000.00000002.550851837.00007FF763EF7000.00000002.00020000.sdmp	String found in binary or memory: http://139.180.184.147:45532/fake.php
Source: kCcJdlYm9t.exe, 00000000.00000002.550851837.00007FF763EF7000.00000002.00020000.sdmp	String found in binary or memory: http://139.180.184.147:45532/fake.phpwinsta0
Source: README-FILE-562258-1639906857.hta9.0.dr	String found in binary or memory: http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion
Source: README-FILE-562258-1639906857.hta9.0.dr	String found in binary or memory: https://www.torproject.org/download/download-easy.html.en
Source: kCcJdlYm9t.exe, 00000000.00000002.551127517.00007FF763F36000.00000004.00020000.sdmp, kCcJdlYm9t.exe, 00000000.00000002.548149705.00000287BFDCB000.00000004.00000020.sdmp, README-FILE-562258-1639906857.hta15.0.dr, README-FILE-562258-1639906857.hta6.0.dr, README-FILE-562258-1639906857.hta25.0.dr, README-FILE-562258-1639906857.hta24.0.dr, README-FILE-562258-1639906857.hta7.0.dr, README-FILE-562258-1639906857.hta28.0.dr, README-FILE-562258-1639906857.hta0.0.dr, README-FILE-562258-1639906857.hta2.0.dr, README-FILE-562258-1639906857.hta33.0.dr, README-FILE-562258-1639906857.hta34.0.dr, README-FILE-562258-1639906857.hta14.0.dr, README-FILE-562258-1639906857.hta18.0.dr, README-FILE-562258-1639906857.hta19.0.dr, README-FILE-562258-1639906857.hta20.0.dr, README-FILE-562258-1639906857.hta26.0.dr, README-FILE-562258-1639906857.hta23.0.dr, README-FILE-562258-1639906857.hta30.0.dr, README-FILE-562258-1639906857.hta12.0.dr, README-FILE-562258-1639906857.hta22.0.dr, README-FILE-562258-1639906857.hta11.0.dr, README-FILE-562258-1639906857.hta.0.dr, README-FILE-562258-1639906857.hta35.0.dr, README-FILE-562258-1639906857.hta13.0.dr, README-FILE-562258-1639906857.hta5.0.dr, README-FILE-562258-1639906857.hta21.0.dr, index.html.0.dr, README-FILE-562258-1639906857.hta29.0.dr, README-FILE-562258-1639906857.hta32.0.dr, README-FILE-562258-1639906857.hta3.0.dr, README-FILE-562258-1639906857.hta8.0.dr, README-FILE-562258-1639906857.hta27.0.dr, README-FILE-562258-1639906857.hta31.0.dr, README-FILE-562258-1639906857.hta1.0.dr, README-FILE-562258-1639906857.hta10.0.dr, README-FILE-562258-1639906857.hta16.0.dr, README-FILE-562258-1639906857.hta17.0.dr, README-FILE-562258-1639906857.hta4.0.dr, README-FILE-562258-1639906857.hta9.0.dr	String found in binary or memory: https://www.youtube.com
Source: kCcJdlYm9t.exe, 00000000.00000002.551127517.00007FF763F36000.00000004.00020000.sdmp, kCcJdlYm9t.exe, 00000000.00000002.548149705.00000287BFDCB000.00000004.00000020.sdmp, README-FILE-562258-1639906857.hta15.0.dr, README-FILE-562258-1639906857.hta6.0.dr, README-FILE-562258-1639906857.hta25.0.dr, README-FILE-562258-1639906857.hta24.0.dr, README-FILE-562258-1639906857.hta7.0.dr, README-FILE-562258-1639906857.hta28.0.dr, README-FILE-562258-1639906857.hta0.0.dr, README-FILE-562258-1639906857.hta2.0.dr, README-FILE-562258-1639906857.hta33.0.dr, README-FILE-562258-1639906857.hta34.0.dr, README-FILE-562258-1639906857.hta14.0.dr, README-FILE-562258-1639906857.hta18.0.dr, README-FILE-562258-1639906857.hta19.0.dr, README-FILE-562258-1639906857.hta20.0.dr, README-FILE-562258-1639906857.hta26.0.dr, README-FILE-562258-1639906857.hta23.0.dr, README-FILE-562258-1639906857.hta30.0.dr, README-FILE-562258-1639906857.hta12.0.dr, README-FILE-562258-1639906857.hta22.0.dr, README-FILE-562258-1639906857.hta11.0.dr, README-FILE-562258-1639906857.hta.0.dr, README-FILE-562258-1639906857.hta35.0.dr, README-FILE-562258-1639906857.hta13.0.dr, README-FILE-562258-1639906857.hta5.0.dr, README-FILE-562258-1639906857.hta21.0.dr, index.html.0.dr, README-FILE-562258-1639906857.hta29.0.dr, README-FILE-562258-1639906857.hta32.0.dr, README-FILE-562258-1639906857.hta3.0.dr, README-FILE-562258-1639906857.hta8.0.dr, README-FILE-562258-1639906857.hta27.0.dr, README-FILE-562258-1639906857.hta31.0.dr, README-FILE-562258-1639906857.hta1.0.dr, README-FILE-562258-1639906857.hta10.0.dr, README-FILE-562258-1639906857.hta16.0.dr, README-FILE-562258-1639906857.hta17.0.dr, README-FILE-562258-1639906857.hta4.0.dr, README-FILE-562258-1639906857.hta9.0.dr	String found in binary or memory: https://www.youtube.com/results?search_query=Install

Source: C:\Users\user\Desktop\kCcJdlYm9t.exe

File created: c:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\README-FILE-562258-1639906857.hta

Jump to behavior

Spam, unwanted Advertisements and Ransom Demands:

Writes a notice file (html or txt) to demand a ransom

Show sources

Source: C:\Users\user\Desktop\kCcJdlYm9t.exe

File dropped: C:\Users\Public\index.html -> decrypt your files safely is to buy the special decryption software from us. the price of decryption software is 500000 dollars. if you pay within 48 hours, you only need to pay 70% off dollars. no price reduction is accepted.we only accept bitcoin payment,you can buy it from bitpay,coinbase,binance or others. you have five days to decide whether to pay or not. after a week, we will no longer provide decryption tools and publish your files </div><hr></hr><div align="center">time starts at 0:00 on december 10 <hr></hr><a>survival time</a></div><script type="text/javascript">function getrtime(){var

Jump to dropped file

System Summary:

Creates HTA files

Show sources

Source: C:\Users\user\Desktop\kCcJdlYm9t.exe

File created: c:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\README-FILE-562258-1639906857.hta

Jump to behavior

Source: kCcJdlYm9t.exe	Virustotal: Detection: 37%
Source: kCcJdlYm9t.exe	Metadefender: Detection: 20%
Source: kCcJdlYm9t.exe	ReversingLabs: Detection: 46%

Source: C:\Users\user\Desktop\kCcJdlYm9t.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\kCcJdlYm9t.exe "C:\Users\user\Desktop\kCcJdlYm9t.exe"
Source: C:\Users\user\Desktop\kCcJdlYm9t.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\kCcJdlYm9t.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\kCcJdlYm9t.exe	Mutant created: \Sessions\1\BaseNamedObjects\8d5e957f297893487bd98fa830fa6413
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6520:120:WilError_01

Source: C:\Users\user\Desktop\kCcJdlYm9t.exe

File created: C:\Users\Public\index.html

Jump to behavior

Source: C:\Users\user\Desktop\kCcJdlYm9t.exe

File created: c:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\README-FILE-562258-1639906857.hta

Jump to behavior

Source: classification engine

Classification label: mal68.rans.evad.winEXE@2/38@0/1

Source: kCcJdlYm9t.exe

Static file information: File size 6242816 > 1048576

Source: kCcJdlYm9t.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: kCcJdlYm9t.exe

Static PE information: Raw size of .zuF2 is bigger than: 0x100000 < 0x5f2e00

Source: kCcJdlYm9t.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source: kCcJdlYm9t.exe	Static PE information: section name: .zuF0
Source: kCcJdlYm9t.exe	Static PE information: section name: .zuF1
Source: kCcJdlYm9t.exe	Static PE information: section name: .zuF2

Source: initial sample

Static PE information: section where entry point is pointing to: .zuF2

Source: C:\Users\user\Desktop\kCcJdlYm9t.exe	File created: c:\Documents and Settings\Default\Start Menu\README-FILE-562258-1639906857.hta	Jump to behavior
Source: C:\Users\user\Desktop\kCcJdlYm9t.exe	File created: c:\Documents and Settings\Default\Start Menu\Programs\README-FILE-562258-1639906857.hta	Jump to behavior
Source: C:\Users\user\Desktop\kCcJdlYm9t.exe	File created: c:\Documents and Settings\Default\Start Menu\Programs\Accessibility\README-FILE-562258-1639906857.hta	Jump to behavior
Source: C:\Users\user\Desktop\kCcJdlYm9t.exe	File created: c:\Documents and Settings\Default\Start Menu\Programs\Accessories\README-FILE-562258-1639906857.hta	Jump to behavior
Source: C:\Users\user\Desktop\kCcJdlYm9t.exe	File created: c:\Documents and Settings\Default\Start Menu\Programs\Maintenance\README-FILE-562258-1639906857.hta	Jump to behavior
Source: C:\Users\user\Desktop\kCcJdlYm9t.exe	File created: c:\Documents and Settings\Default\Start Menu\Programs\System Tools\README-FILE-562258-1639906857.hta	Jump to behavior
Source: C:\Users\user\Desktop\kCcJdlYm9t.exe	File created: c:\Documents and Settings\Default\Start Menu\Programs\Windows PowerShell\README-FILE-562258-1639906857.hta	Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Show sources

Source: C:\Users\user\Desktop\kCcJdlYm9t.exe	Memory written: PID: 6536 base: 7FFC8DE30008 value: E9 7B A9 EA FF			Jump to behavior
Source: C:\Users\user\Desktop\kCcJdlYm9t.exe	Memory written: PID: 6536 base: 7FFC8DCDA980 value: E9 90 56 15 00			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\kCcJdlYm9t.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\kCcJdlYm9t.exe	File opened: c:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\README-FILE-562258-1639906857.hta	Jump to behavior
Source: C:\Users\user\Desktop\kCcJdlYm9t.exe	File opened: c:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\README-FILE-562258-1639906857.hta	Jump to behavior
Source: C:\Users\user\Desktop\kCcJdlYm9t.exe	File opened: c:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\README-FILE-562258-1639906857.hta	Jump to behavior
Source: C:\Users\user\Desktop\kCcJdlYm9t.exe	File opened: c:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\README-FILE-562258-1639906857.hta	Jump to behavior
Source: C:\Users\user\Desktop\kCcJdlYm9t.exe	File opened: c:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\README-FILE-562258-1639906857.hta	Jump to behavior
Source: C:\Users\user\Desktop\kCcJdlYm9t.exe	File opened: c:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\README-FILE-562258-1639906857.hta	Jump to behavior

Source: kCcJdlYm9t.exe, 00000000.00000003.370360775.00000287BFE09000.00000004.00000001.sdmp, kCcJdlYm9t.exe, 00000000.00000002.548149705.00000287BFDCB000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAWPk
Source: kCcJdlYm9t.exe, 00000000.00000002.548227792.00000287BFE1F000.00000004.00000020.sdmp, kCcJdlYm9t.exe, 00000000.00000003.370294995.00000287BFE3F000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW>
Source: kCcJdlYm9t.exe, 00000000.00000002.548227792.00000287BFE1F000.00000004.00000020.sdmp, kCcJdlYm9t.exe, 00000000.00000003.370294995.00000287BFE3F000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW

Source: kCcJdlYm9t.exe, 00000000.00000002.548680306.00000287C0270000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: kCcJdlYm9t.exe, 00000000.00000002.548680306.00000287C0270000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: kCcJdlYm9t.exe, 00000000.00000002.548680306.00000287C0270000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: kCcJdlYm9t.exe, 00000000.00000002.548680306.00000287C0270000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Registry Run Keys / Startup Folder1	Process Injection2	Masquerading1	Credential API Hooking1	Security Software Discovery1	Remote Services	Credential API Hooking1	Exfiltration Over Other Network Medium	Non-Standard Port1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Data Encrypted for Impact1
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Registry Run Keys / Startup Folder1	Process Injection2	LSASS Memory	Process Discovery2	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Proxy1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Mshta1	Security Account Manager	File and Directory Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Ingress Tool Transfer1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Information Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
kCcJdlYm9t.exe	37%	Virustotal		Browse
kCcJdlYm9t.exe	21%	Metadefender		Browse
kCcJdlYm9t.exe	47%	ReversingLabs	Win64.Ransomware.LockFile
kCcJdlYm9t.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion	0%	Avira URL Cloud	safe
http://139.180.184.147:45532/fake.php	4%	Virustotal		Browse
http://139.180.184.147:45532/fake.php	0%	Avira URL Cloud	safe
http://139.180.184.147:45532/fake.phpwinsta0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.youtube.com/results?search_query=Install	kCcJdlYm9t.exe, 00000000.00000002.551127517.00007FF763F36000.00000004.00020000.sdmp, kCcJdlYm9t.exe, 00000000.00000002.548149705.00000287BFDCB000.00000004.00000020.sdmp, README-FILE-562258-1639906857.hta15.0.dr, README-FILE-562258-1639906857.hta6.0.dr, README-FILE-562258-1639906857.hta25.0.dr, README-FILE-562258-1639906857.hta24.0.dr, README-FILE-562258-1639906857.hta7.0.dr, README-FILE-562258-1639906857.hta28.0.dr, README-FILE-562258-1639906857.hta0.0.dr, README-FILE-562258-1639906857.hta2.0.dr, README-FILE-562258-1639906857.hta33.0.dr, README-FILE-562258-1639906857.hta34.0.dr, README-FILE-562258-1639906857.hta14.0.dr, README-FILE-562258-1639906857.hta18.0.dr, README-FILE-562258-1639906857.hta19.0.dr, README-FILE-562258-1639906857.hta20.0.dr, README-FILE-562258-1639906857.hta26.0.dr, README-FILE-562258-1639906857.hta23.0.dr, README-FILE-562258-1639906857.hta30.0.dr, README-FILE-562258-1639906857.hta12.0.dr, README-FILE-562258-1639906857.hta22.0.dr, README-FILE-562258-1639906857.hta11.0.dr, README-FILE-562258-1639906857.hta.0.dr, README-FILE-562258-1639906857.hta35.0.dr, README-FILE-562258-1639906857.hta13.0.dr, README-FILE-562258-1639906857.hta5.0.dr, README-FILE-562258-1639906857.hta21.0.dr, index.html.0.dr, README-FILE-562258-1639906857.hta29.0.dr, README-FILE-562258-1639906857.hta32.0.dr, README-FILE-562258-1639906857.hta3.0.dr, README-FILE-562258-1639906857.hta8.0.dr, README-FILE-562258-1639906857.hta27.0.dr, README-FILE-562258-1639906857.hta31.0.dr, README-FILE-562258-1639906857.hta1.0.dr, README-FILE-562258-1639906857.hta10.0.dr, README-FILE-562258-1639906857.hta16.0.dr, README-FILE-562258-1639906857.hta17.0.dr, README-FILE-562258-1639906857.hta4.0.dr, README-FILE-562258-1639906857.hta9.0.dr	false		high
http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion	README-FILE-562258-1639906857.hta9.0.dr	true	Avira URL Cloud: safe	unknown
http://139.180.184.147:45532/fake.php	kCcJdlYm9t.exe, 00000000.00000002.550851837.00007FF763EF7000.00000002.00020000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://139.180.184.147:45532/fake.phpwinsta0	kCcJdlYm9t.exe, 00000000.00000002.550851837.00007FF763EF7000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.youtube.com	kCcJdlYm9t.exe, 00000000.00000002.551127517.00007FF763F36000.00000004.00020000.sdmp, kCcJdlYm9t.exe, 00000000.00000002.548149705.00000287BFDCB000.00000004.00000020.sdmp, README-FILE-562258-1639906857.hta15.0.dr, README-FILE-562258-1639906857.hta6.0.dr, README-FILE-562258-1639906857.hta25.0.dr, README-FILE-562258-1639906857.hta24.0.dr, README-FILE-562258-1639906857.hta7.0.dr, README-FILE-562258-1639906857.hta28.0.dr, README-FILE-562258-1639906857.hta0.0.dr, README-FILE-562258-1639906857.hta2.0.dr, README-FILE-562258-1639906857.hta33.0.dr, README-FILE-562258-1639906857.hta34.0.dr, README-FILE-562258-1639906857.hta14.0.dr, README-FILE-562258-1639906857.hta18.0.dr, README-FILE-562258-1639906857.hta19.0.dr, README-FILE-562258-1639906857.hta20.0.dr, README-FILE-562258-1639906857.hta26.0.dr, README-FILE-562258-1639906857.hta23.0.dr, README-FILE-562258-1639906857.hta30.0.dr, README-FILE-562258-1639906857.hta12.0.dr, README-FILE-562258-1639906857.hta22.0.dr, README-FILE-562258-1639906857.hta11.0.dr, README-FILE-562258-1639906857.hta.0.dr, README-FILE-562258-1639906857.hta35.0.dr, README-FILE-562258-1639906857.hta13.0.dr, README-FILE-562258-1639906857.hta5.0.dr, README-FILE-562258-1639906857.hta21.0.dr, index.html.0.dr, README-FILE-562258-1639906857.hta29.0.dr, README-FILE-562258-1639906857.hta32.0.dr, README-FILE-562258-1639906857.hta3.0.dr, README-FILE-562258-1639906857.hta8.0.dr, README-FILE-562258-1639906857.hta27.0.dr, README-FILE-562258-1639906857.hta31.0.dr, README-FILE-562258-1639906857.hta1.0.dr, README-FILE-562258-1639906857.hta10.0.dr, README-FILE-562258-1639906857.hta16.0.dr, README-FILE-562258-1639906857.hta17.0.dr, README-FILE-562258-1639906857.hta4.0.dr, README-FILE-562258-1639906857.hta9.0.dr	false		high
https://www.torproject.org/download/download-easy.html.en	README-FILE-562258-1639906857.hta9.0.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
139.180.184.147	unknown	United States		20473	AS-CHOOPAUS	false

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	542163
Start date:	19.12.2021
Start time:	00:21:14
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	kCcJdlYm9t.bin (renamed file extension from bin to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal68.rans.evad.winEXE@2/38@0/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 100% (good quality ratio 50%) Quality average: 17.5% Quality standard deviation: 17.5%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WMIADAP.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.54.113.53, 23.54.113.104 Excluded domains from analysis (whitelisted): fs.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, store-images.s-microsoft.com-c.edgekey.net, e1723.g.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, store-images.s-microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, cdn.onenote.net, prod.fs.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
139.180.184.147	klHnJP9KUp.exe	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AS-CHOOPAUS	java	Get hash	malicious	Browse	139.180.189.50
	setup_x86_x64_install.exe	Get hash	malicious	Browse	149.28.78.238
	CfAG7RLYwP.exe	Get hash	malicious	Browse	149.28.253.196
	ransomware.exe	Get hash	malicious	Browse	45.76.99.222
	lhFZ5lgVZe.exe	Get hash	malicious	Browse	149.28.253.196
	PLsr36JHqc.exe	Get hash	malicious	Browse	149.28.78.238
	QPoUOIhwkO.exe	Get hash	malicious	Browse	149.28.78.238
	hT8opTEkOj.exe	Get hash	malicious	Browse	149.28.253.196
	RIxTQg4Dl6.exe	Get hash	malicious	Browse	149.28.78.238
	tyGGXi7QXW.js	Get hash	malicious	Browse	45.76.154.237
	sohyEVpQMp.js	Get hash	malicious	Browse	45.76.154.237
	DBC1tg2tq1.js	Get hash	malicious	Browse	45.76.154.237
	tyGGXi7QXW.js	Get hash	malicious	Browse	45.76.154.237
	sohyEVpQMp.js	Get hash	malicious	Browse	45.76.154.237
	DBC1tg2tq1.js	Get hash	malicious	Browse	45.76.154.237
	ZvMcD3kgsF.exe	Get hash	malicious	Browse	149.28.253.196
	ZvMcD3kgsF.exe	Get hash	malicious	Browse	149.28.253.196
	q9VO0ItTRSrphpi.exe	Get hash	malicious	Browse	149.28.69.224
	cMGS14q1Sz.exe	Get hash	malicious	Browse	149.28.253.196
	xXVJKyzkPV.exe	Get hash	malicious	Browse	149.28.253.196

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\AppData\Local\Microsoft\InputPersonalization\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\AppData\Local\Microsoft\InputPersonalization\TrainedDataStore\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\AppData\Local\Microsoft\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\Gadgets\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\AppData\Local\Microsoft\Windows\History\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\AppData\Local\Microsoft\Windows\INetCache\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\AppData\Local\Microsoft\Windows\INetCookies\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\AppData\Local\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\AppData\Local\Temp\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\AppData\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\AppData\Roaming\Microsoft\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\AppData\Roaming\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\Desktop\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\Documents\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\Downloads\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\Favorites\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\Links\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\Music\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\Pictures\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\Saved Games\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Default\Videos\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	modified
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\Public\index.html Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	true
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

C:\Users\README-FILE-562258-1639906857.hta Download File
Process:	C:\Users\user\Desktop\kCcJdlYm9t.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	11432
Entropy (8bit):	6.021959836976645
Encrypted:	false
SSDEEP:	192:nxDqEN2eSBJQbyBcfpWj4RYFhkAe1kvKQh+089L7drMckM1t:QucQbyBcBWjrhk/ySx0SnVZD
MD5:	3F4C0308565DC6AD1FA5D9BEF42FD3CF
SHA1:	5C1FAB71AF6E14779F133EAAAB81522DBE884607
SHA-256:	5D62460D3EE9AF9244680B480C017861216B05C34B804FCE37E8665CA3BDE9E2
SHA-512:	43968C53FE691C9E1012D0EEC79ED3B1CF54128B3B585880E44C33EA9BCC8C193867F2FDD1A5801ADA57C42908F5A4D8726008EC71DE6D3C3665005FF65401A6
Malicious:	false
Preview:	<!DOCTYPE html>..<html lang="en">..<head>...<meta charset="utf-8">...<title>Atom Slio: Instructions</title>...<HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">......<style type="text/css">....text{....text-align:center;...}...a {....color: #04a;....text-decoration: none;...}...a:hover {....text-decoration: underline;...}...body {....background-color: #e7e7e7;....color: #222;....font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;....font-size: 13pt;....line-height: 19pt;...}...body, h1 {....margin: 0;....padding: 0;...}...hr {....color: #bda;....height: 2pt;....margin: 1.5%;...}...h1 {....color: #555;....font-size: 14pt;...}...ol {....padding-left: 2.5%;...}...ol li {....padding-bottom: 13pt;...}...small {....color: #555;....font-size: 11pt;...}....button:hover {....text-decoration: underline;...}....container {....background-color: #fff;....border: 2pt solid #c7c7c7;....margin: 5%;....min-width: 850px;....padding: 2.5%;.

Static File Info

General
File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	7.921607431888335
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	kCcJdlYm9t.exe
File size:	6242816
MD5:	5559e9f5e1645f8554ea020a29a5a3ee
SHA1:	d74bd70862707cd2c7ab946903f6fa0aab066151
SHA256:	5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4
SHA512:	56835d08f64887c4bd7b0fecd111f4b89411c45398618d815ed9652a0addbf25939fee9f40c4a0315e5e1539c0e87fcd5a9bd73cd7ad43d97d1484763abc5540
SSDEEP:	98304:YqqGLqEfydHgelcdpKCEAlFcyXSbSOK8AvpDggzc8LeAf5pNR0N75E6:dpLqEWJcd0CEzyibGpDpRRpYtO
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......a.........."......Z..........z..........@..........................................`................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x14085fc7a
Entrypoint Section:	.zuF2
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Time Stamp:	0x61B20ADE [Thu Dec 9 13:55:42 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	4fb24a31e05bcb3f1ec23d88b5dc5e10

Entrypoint Preview

Instruction
push 6CCBEBE0h
call 00007FAD24DEBEDEh
xchg eax, esi
shr byte ptr [ecx], FFFFFFFBh
inc edx
sub al, DFh
jbe 00007FAD24D43FA7h
cmp al, E9h
push edi
sub dword ptr [ebp+esi+346B86D9h], ebp
jle 00007FAD24D43F9Bh
jne 00007FAD24D43F76h
fist dword ptr [ebx+51146A47h]
cmp esp, dword ptr [edi+ebx*4]
imul ebp, ebx, 1Ah
setb bl
pushfd
dec ecx
jbe 00007FAD24D43EFDh
imul esp, dword ptr [eax-19h], E3h
arpl word ptr [edi+ebx*4+146806DBh], dx
int3
mov cx, ds
xchg eax, esp
xor dword ptr [edx+6CEB95E2h], 53h
movsb
lahf
imul ecx, dword ptr [ebx+146786F4h], CEh
xchg eax, esp
and dword ptr [ebx+14h], ebp
int1
cmp dword ptr [edi+74h], ebx
adc al, 74h
add dword ptr [ecx+eax*4], edi
imul edi, dword ptr [esi-1473E810h], 41h
pop ebx
outsb
test dword ptr [ebx+75h], ebp
sbb eax, 7A947DFBh
add dword ptr [esi], ebx
jbe 00007FAD24D43F76h
dec esi
sar dword ptr [ecx-6Ch], FFFFFF86h
dec edx
xchg eax, esp
sbb cl, byte ptr [eax-41h]
jecxz 00007FAD24D43F01h
call far BB88h : CAC2C290h
in al, 78h
adc al, 81h
mov eax, dword ptr [1A9A9CD9h]
inc esi
popfd
jp 00007FAD24D43F06h
jo 00007FAD24D43F60h
jmp far 8FE5h : 7794EBB7h
pop ds
imul dword ptr [eax+ebp-709461D4h]
mov cl, D4h
cmc
and byte ptr [ecx+705BC5F9h], bl
or ecx, dword ptr [ebp-66A8994Eh]
lahf
cmp byte ptr [ecx], al
test al, E4h
jno 00007FAD24D43F6Dh
lea esi, dword ptr [edx+31989DEBh]
cdq

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7b7380	0xc8	.zuF2
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa39000	0x1d5	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xa2ce30	0xafc8	.zuF2
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa38000	0xe0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x8670f8	0x28	.zuF2
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa2cd30	0x100	.zuF2
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x444000	0xe0	.zuF1
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x958e8	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x97000	0x3c27e	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xd4000	0x138e4	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.pdata	0xe8000	0x8334	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.zuF0	0xf1000	0x352a99	0x0	unknown	unknown	unknown	unknown	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.zuF1	0x444000	0xbe0	0xc00	False	0.0380859375	data	0.236345806672	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.zuF2	0x445000	0x5f2df8	0x5f2e00	unknown	unknown	unknown	unknown	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_READ
.reloc	0xa38000	0xe0	0x200	False	0.341796875	data	2.0306191961	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xa39000	0x1d5	0x200	False	0.53125	data	4.71767883295	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_MANIFEST	0xa39058	0x17d	XML 1.0 document text	English	United States

Imports

DLL	Import
KERNEL32.dll	GetVersionExW
USER32.dll	wsprintfA
ADVAPI32.dll	AdjustTokenPrivileges
USERENV.dll	CreateEnvironmentBlock
WTSAPI32.dll	WTSQueryUserToken
WININET.dll	HttpSendRequestA
KERNEL32.dll	GetSystemTimeAsFileTime
USER32.dll	CharUpperBuffW
KERNEL32.dll	LocalAlloc, LocalFree, GetModuleFileNameW, GetProcessAffinityMask, SetProcessAffinityMask, SetThreadAffinityMask, Sleep, ExitProcess, LoadLibraryA, GetModuleHandleA, GetProcAddress

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source IP	Dest IP
12/19/21-00:22:09.559855	ICMP	486	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited	139.180.184.147	192.168.2.3
12/19/21-00:22:12.568161	ICMP	486	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited	139.180.184.147	192.168.2.3
12/19/21-00:22:18.584472	ICMP	486	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited	139.180.184.147	192.168.2.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2021 00:22:09.213848114 CET	49747	45532	192.168.2.3	139.180.184.147
Dec 19, 2021 00:22:12.222275019 CET	49747	45532	192.168.2.3	139.180.184.147
Dec 19, 2021 00:22:18.238455057 CET	49747	45532	192.168.2.3	139.180.184.147

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 19, 2021 00:22:09.559854984 CET	139.180.184.147	192.168.2.3	410	(Unknown)	Destination Unreachable
Dec 19, 2021 00:22:12.568161011 CET	139.180.184.147	192.168.2.3	410	(Unknown)	Destination Unreachable
Dec 19, 2021 00:22:18.584471941 CET	139.180.184.147	192.168.2.3	410	(Unknown)	Destination Unreachable

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: kCcJdlYm9t.exe PID: 6536 Parent PID: 1664

General

Start time:	00:22:05
Start date:	19/12/2021
Path:	C:\Users\user\Desktop\kCcJdlYm9t.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\kCcJdlYm9t.exe"
Imagebase:	0x7ff763e60000
File size:	6242816 bytes
MD5 hash:	5559E9F5E1645F8554EA020A29A5A3EE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 6520 Parent PID: 6536

General

Start time:	00:22:06
Start date:	19/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.
Tactics:	Impact
Data Sources:	File monitoring, Kernel drivers, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report kCcJdlYm9t.bin

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

ICMP Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: kCcJdlYm9t.exe PID: 6536 Parent PID: 1664

General