Edit tour

Windows Analysis Report
malware.exe

Overview

General Information

Sample Name:	malware.exe
Analysis ID:	868123
MD5:	7eac8aef6533d6b87e1d0004005430e4
SHA1:	addf21b4bacf3c2e0eb001fb3e2be2d462da87bc
SHA256:	ccc63f897d97e61dcb616f0e28ab43a995b466506e6de3c9c153386f492259ab
Infos:

Detection

Conti, Royal

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Conti ransomware

Multi AV Scanner detection for submitted file

Yara detected Royal Ransomware

Found ransom note / readme

Writes many files with high entropy

Connects to many different private IPs (likely to spread or exploit)

Writes a notice file (html or txt) to demand a ransom

Connects to many different private IPs via SMB (likely to spread or exploit)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Stores files to the Windows start menu directory

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64_ra

cmd.exe (PID: 6160 cmdline: "C:\Windows\system32\cmd.exe" MD5: 9D59442313565C2E0860B88BF32B2277)

conhost.exe (PID: 6620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: C5E9B1D1103EDCEA2E408E9497A5A88F)

malware.exe (PID: 3896 cmdline: malware.exe -id 12345678901234567890123456789012 MD5: 7EAC8AEF6533D6B87E1D0004005430E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Conti, Conti Lock	Conti is an extremely damaging ransomware due to the speed with which it encrypts data and spreads to other systems. It was first observed in 2020 and it is thought to be led by a Russia-based cybercrime group that goes under the Wizard Spider pseudonym. In early May 2022, the US government announced a reward of up to $10 million for information on the Conti ransomware gang.	No Attribution	http://chuongdong.com/reverse%20engineering/2020/12/15/ContiRansomware/ https://0xthreatintel.medium.com/reversing-conti-ransomware-bfce15019e74 https://analyst1.com/blog/ransom-mafia-analysis-of-the-worlds-first-ransomware-cartel https://analyst1.com/file-assets/RANSOM-MAFIA-ANALYSIS-OF-THE-WORLD%E2%80%99S-FIRST-RANSOMWARE-CARTEL.pdf https://arcticwolf.com/resources/blog/conti-ransomware-leak-analyzed	https://malpedia.caad.fkie.fraunhofer.de/details/win.conti

Name	Description	Attribution	Blogpost URLs	Link
8.t Dropper, Royal_unix, RoyalRoyalRoad	8T_Dropper has been used by Chinese threat actor TA428 in order to install Cotx RAT onto victim's machines during Operation LagTime IT. According to Proofpoint the attack was developed against a number of government agencies in East Asia overseeing government information technology, domestic affairs, foreign affairs, economic development, and political processes. The dropper was delivered through an RTF document exploiting CVE-2018-0798.	Hellsing Ice Fog Pirate Panda RANCOR TA428 Tick Tonto Team Karma Panda	https://blog.malwarelab.pl/posts/on_the_royal_road/ https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf https://community.riskiq.com/article/56fa1b2f https://community.riskiq.com/article/5fe2da7f https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.8t_dropper

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
malware.exe	MAL_EXE_RoyalRansomware	Detection for Royal Ransomware seen Dec 2022	Silas Cutler, modfied by Florian Roth	0x20a1b8:$x_ext: .royal_ 0x209156:$s_readme: README.TXT 0x20a1cc:$s_readme: README.TXT 0x208ba3:$x_ransom_msg01: If you are reading this, it means that your system were hit by Royal ransomware. 0x2090d9:$x_ransom_msg02: Try Royal today and enter the new era of data security! 0x208c10:$x_onion_site: http://royal2xthig3ou5hd7zsliqagy6yygk2cdelaxtni2fyad6dpmpxedid.onion/
malware.exe	JoeSecurity_Conti_ransomware	Yara detected Conti ransomware	Joe Security
malware.exe	JoeSecurity_RoyalRansomware	Yara detected Royal Ransomware	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000F.00000000.1780567176.0000000000951000.00000002.00000001.01000000.00000005.sdmp	JoeSecurity_Conti_ransomware	Yara detected Conti ransomware	Joe Security
0000000F.00000000.1780567176.0000000000951000.00000002.00000001.01000000.00000005.sdmp	JoeSecurity_RoyalRansomware	Yara detected Royal Ransomware	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: malware.exe	ReversingLabs: Detection: 62%
Source: malware.exe	Virustotal: Detection: 72%			Perma Link

Exploits

Connects to many different private IPs (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.2.148:445
Source: global traffic	TCP traffic: 192.168.2.149:445
Source: global traffic	TCP traffic: 192.168.2.146:445
Source: global traffic	TCP traffic: 192.168.2.147:445
Source: global traffic	TCP traffic: 192.168.2.140:445
Source: global traffic	TCP traffic: 192.168.2.141:445
Source: global traffic	TCP traffic: 192.168.2.144:445
Source: global traffic	TCP traffic: 192.168.2.145:445
Source: global traffic	TCP traffic: 192.168.2.142:445
Source: global traffic	TCP traffic: 192.168.2.143:445
Source: global traffic	TCP traffic: 192.168.2.159:445
Source: global traffic	TCP traffic: 192.168.2.157:445
Source: global traffic	TCP traffic: 192.168.2.158:445
Source: global traffic	TCP traffic: 192.168.2.151:445
Source: global traffic	TCP traffic: 192.168.2.152:445
Source: global traffic	TCP traffic: 192.168.2.150:445
Source: global traffic	TCP traffic: 192.168.2.155:445
Source: global traffic	TCP traffic: 192.168.2.156:445
Source: global traffic	TCP traffic: 192.168.2.153:445
Source: global traffic	TCP traffic: 192.168.2.154:445
Source: global traffic	TCP traffic: 192.168.2.126:445
Source: global traffic	TCP traffic: 192.168.2.247:445
Source: global traffic	TCP traffic: 192.168.2.127:445
Source: global traffic	TCP traffic: 192.168.2.248:445
Source: global traffic	TCP traffic: 192.168.2.124:445
Source: global traffic	TCP traffic: 192.168.2.245:445
Source: global traffic	TCP traffic: 192.168.2.125:445
Source: global traffic	TCP traffic: 192.168.2.246:445
Source: global traffic	TCP traffic: 192.168.2.128:445
Source: global traffic	TCP traffic: 192.168.2.249:445
Source: global traffic	TCP traffic: 192.168.2.129:445
Source: global traffic	TCP traffic: 192.168.2.240:445
Source: global traffic	TCP traffic: 192.168.2.122:445
Source: global traffic	TCP traffic: 192.168.2.243:445
Source: global traffic	TCP traffic: 192.168.2.123:445
Source: global traffic	TCP traffic: 192.168.2.244:445
Source: global traffic	TCP traffic: 192.168.2.120:445
Source: global traffic	TCP traffic: 192.168.2.241:445
Source: global traffic	TCP traffic: 192.168.2.121:445
Source: global traffic	TCP traffic: 192.168.2.242:445
Source: global traffic	TCP traffic: 192.168.2.97:445
Source: global traffic	TCP traffic: 192.168.2.137:445
Source: global traffic	TCP traffic: 192.168.2.96:445
Source: global traffic	TCP traffic: 192.168.2.138:445
Source: global traffic	TCP traffic: 192.168.2.99:445
Source: global traffic	TCP traffic: 192.168.2.135:445
Source: global traffic	TCP traffic: 192.168.2.98:445
Source: global traffic	TCP traffic: 192.168.2.136:445
Source: global traffic	TCP traffic: 192.168.2.139:445
Source: global traffic	TCP traffic: 192.168.2.250:445
Source: global traffic	TCP traffic: 192.168.2.130:445
Source: global traffic	TCP traffic: 192.168.2.251:445
Source: global traffic	TCP traffic: 192.168.2.91:445
Source: global traffic	TCP traffic: 192.168.2.90:445
Source: global traffic	TCP traffic: 192.168.2.93:445
Source: global traffic	TCP traffic: 192.168.2.133:445
Source: global traffic	TCP traffic: 192.168.2.254:445
Source: global traffic	TCP traffic: 192.168.2.92:445
Source: global traffic	TCP traffic: 192.168.2.134:445
Source: global traffic	TCP traffic: 192.168.2.255:445
Source: global traffic	TCP traffic: 192.168.2.95:445
Source: global traffic	TCP traffic: 192.168.2.131:445
Source: global traffic	TCP traffic: 192.168.2.252:445
Source: global traffic	TCP traffic: 192.168.2.94:445
Source: global traffic	TCP traffic: 192.168.2.132:445
Source: global traffic	TCP traffic: 192.168.2.253:445
Source: global traffic	TCP traffic: 192.168.2.104:445
Source: global traffic	TCP traffic: 192.168.2.225:445
Source: global traffic	TCP traffic: 192.168.2.105:445
Source: global traffic	TCP traffic: 192.168.2.226:445
Source: global traffic	TCP traffic: 192.168.2.102:445
Source: global traffic	TCP traffic: 192.168.2.223:445
Source: global traffic	TCP traffic: 192.168.2.103:445
Source: global traffic	TCP traffic: 192.168.2.224:445
Source: global traffic	TCP traffic: 192.168.2.108:445
Source: global traffic	TCP traffic: 192.168.2.229:445
Source: global traffic	TCP traffic: 192.168.2.109:445
Source: global traffic	TCP traffic: 192.168.2.106:445
Source: global traffic	TCP traffic: 192.168.2.227:445
Source: global traffic	TCP traffic: 192.168.2.107:445
Source: global traffic	TCP traffic: 192.168.2.228:445
Source: global traffic	TCP traffic: 192.168.2.100:445
Source: global traffic	TCP traffic: 192.168.2.221:445
Source: global traffic	TCP traffic: 192.168.2.101:445
Source: global traffic	TCP traffic: 192.168.2.222:445
Source: global traffic	TCP traffic: 192.168.2.220:445
Source: global traffic	TCP traffic: 192.168.2.115:445
Source: global traffic	TCP traffic: 192.168.2.236:445
Source: global traffic	TCP traffic: 192.168.2.116:445
Source: global traffic	TCP traffic: 192.168.2.237:445
Source: global traffic	TCP traffic: 192.168.2.113:445
Source: global traffic	TCP traffic: 192.168.2.234:445
Source: global traffic	TCP traffic: 192.168.2.114:445
Source: global traffic	TCP traffic: 192.168.2.235:445
Source: global traffic	TCP traffic: 192.168.2.119:445
Source: global traffic	TCP traffic: 192.168.2.117:445
Source: global traffic	TCP traffic: 192.168.2.238:445
Source: global traffic	TCP traffic: 192.168.2.118:445
Source: global traffic	TCP traffic: 192.168.2.239:445
Source: global traffic	TCP traffic: 192.168.2.111:445
Source: global traffic	TCP traffic: 192.168.2.232:445
Source: global traffic	TCP traffic: 192.168.2.112:445
Source: global traffic	TCP traffic: 192.168.2.233:445
Source: global traffic	TCP traffic: 192.168.2.230:445
Source: global traffic	TCP traffic: 192.168.2.110:445
Source: global traffic	TCP traffic: 192.168.2.231:445
Source: global traffic	TCP traffic: 192.168.2.203:445
Source: global traffic	TCP traffic: 192.168.2.204:445
Source: global traffic	TCP traffic: 192.168.2.201:445
Source: global traffic	TCP traffic: 192.168.2.202:445
Source: global traffic	TCP traffic: 192.168.2.207:445
Source: global traffic	TCP traffic: 192.168.2.208:445
Source: global traffic	TCP traffic: 192.168.2.205:445
Source: global traffic	TCP traffic: 192.168.2.206:445
Source: global traffic	TCP traffic: 192.168.2.200:445
Source: global traffic	TCP traffic: 192.168.2.209:445
Source: global traffic	TCP traffic: 192.168.2.214:445
Source: global traffic	TCP traffic: 192.168.2.215:445
Source: global traffic	TCP traffic: 192.168.2.212:445
Source: global traffic	TCP traffic: 192.168.2.213:445
Source: global traffic	TCP traffic: 192.168.2.218:445
Source: global traffic	TCP traffic: 192.168.2.219:445
Source: global traffic	TCP traffic: 192.168.2.216:445
Source: global traffic	TCP traffic: 192.168.2.217:445
Source: global traffic	TCP traffic: 192.168.2.210:445
Source: global traffic	TCP traffic: 192.168.2.211:445
Source: global traffic	TCP traffic: 192.168.2.39:445
Source: global traffic	TCP traffic: 192.168.2.38:445
Source: global traffic	TCP traffic: 192.168.2.42:445
Source: global traffic	TCP traffic: 192.168.2.41:445
Source: global traffic	TCP traffic: 192.168.2.44:445
Source: global traffic	TCP traffic: 192.168.2.43:445
Source: global traffic	TCP traffic: 192.168.2.46:445
Source: global traffic	TCP traffic: 192.168.2.45:445
Source: global traffic	TCP traffic: 192.168.2.48:445
Source: global traffic	TCP traffic: 192.168.2.47:445
Source: global traffic	TCP traffic: 192.168.2.40:445
Source: global traffic	TCP traffic: 192.168.2.28:445
Source: global traffic	TCP traffic: 192.168.2.27:445
Source: global traffic	TCP traffic: 192.168.2.29:445
Source: global traffic	TCP traffic: 192.168.2.31:445
Source: global traffic	TCP traffic: 192.168.2.30:445
Source: global traffic	TCP traffic: 192.168.2.33:445
Source: global traffic	TCP traffic: 192.168.2.32:445
Source: global traffic	TCP traffic: 192.168.2.35:445
Source: global traffic	TCP traffic: 192.168.2.34:445
Source: global traffic	TCP traffic: 192.168.2.37:445
Source: global traffic	TCP traffic: 192.168.2.36:445
Source: global traffic	TCP traffic: 192.168.2.17:445
Source: global traffic	TCP traffic: 192.168.2.16:445
Source: global traffic	TCP traffic: 192.168.2.19:445
Source: global traffic	TCP traffic: 192.168.2.18:445
Source: global traffic	TCP traffic: 192.168.2.20:445
Source: global traffic	TCP traffic: 192.168.2.22:445
Source: global traffic	TCP traffic: 192.168.2.21:445
Source: global traffic	TCP traffic: 192.168.2.24:445
Source: global traffic	TCP traffic: 192.168.2.23:445
Source: global traffic	TCP traffic: 192.168.2.26:445
Source: global traffic	TCP traffic: 192.168.2.25:445
Source: global traffic	TCP traffic: 192.168.2.11:445
Source: global traffic	TCP traffic: 192.168.2.10:445
Source: global traffic	TCP traffic: 192.168.2.13:445
Source: global traffic	TCP traffic: 192.168.2.12:445
Source: global traffic	TCP traffic: 192.168.2.15:445
Source: global traffic	TCP traffic: 192.168.2.14:445
Source: global traffic	TCP traffic: 192.168.2.0:445
Source: global traffic	TCP traffic: 192.168.2.2:445
Source: global traffic	TCP traffic: 192.168.2.1:445
Source: global traffic	TCP traffic: 192.168.2.180:445
Source: global traffic	TCP traffic: 192.168.2.181:445
Source: global traffic	TCP traffic: 192.168.2.8:445
Source: global traffic	TCP traffic: 192.168.2.7:445
Source: global traffic	TCP traffic: 192.168.2.9:445
Source: global traffic	TCP traffic: 192.168.2.4:445
Source: global traffic	TCP traffic: 192.168.2.6:445
Source: global traffic	TCP traffic: 192.168.2.5:445
Source: global traffic	TCP traffic: 192.168.2.86:445
Source: global traffic	TCP traffic: 192.168.2.85:445
Source: global traffic	TCP traffic: 192.168.2.88:445
Source: global traffic	TCP traffic: 192.168.2.87:445
Source: global traffic	TCP traffic: 192.168.2.89:445
Source: global traffic	TCP traffic: 192.168.2.184:445
Source: global traffic	TCP traffic: 192.168.2.185:445
Source: global traffic	TCP traffic: 192.168.2.80:445
Source: global traffic	TCP traffic: 192.168.2.182:445
Source: global traffic	TCP traffic: 192.168.2.183:445
Source: global traffic	TCP traffic: 192.168.2.82:445
Source: global traffic	TCP traffic: 192.168.2.188:445
Source: global traffic	TCP traffic: 192.168.2.81:445
Source: global traffic	TCP traffic: 192.168.2.189:445
Source: global traffic	TCP traffic: 192.168.2.84:445
Source: global traffic	TCP traffic: 192.168.2.186:445
Source: global traffic	TCP traffic: 192.168.2.83:445
Source: global traffic	TCP traffic: 192.168.2.187:445
Source: global traffic	TCP traffic: 192.168.2.191:445
Source: global traffic	TCP traffic: 192.168.2.192:445
Source: global traffic	TCP traffic: 192.168.2.190:445
Source: global traffic	TCP traffic: 192.168.2.75:445
Source: global traffic	TCP traffic: 192.168.2.74:445
Source: global traffic	TCP traffic: 192.168.2.77:445
Source: global traffic	TCP traffic: 192.168.2.76:445
Source: global traffic	TCP traffic: 192.168.2.79:445
Source: global traffic	TCP traffic: 192.168.2.78:445
Source: global traffic	TCP traffic: 192.168.2.195:445
Source: global traffic	TCP traffic: 192.168.2.196:445
Source: global traffic	TCP traffic: 192.168.2.193:445
Source: global traffic	TCP traffic: 192.168.2.194:445
Source: global traffic	TCP traffic: 192.168.2.71:445
Source: global traffic	TCP traffic: 192.168.2.199:445
Source: global traffic	TCP traffic: 192.168.2.70:445
Source: global traffic	TCP traffic: 192.168.2.73:445
Source: global traffic	TCP traffic: 192.168.2.197:445
Source: global traffic	TCP traffic: 192.168.2.72:445
Source: global traffic	TCP traffic: 192.168.2.198:445
Source: global traffic	TCP traffic: 192.168.2.64:445
Source: global traffic	TCP traffic: 192.168.2.63:445
Source: global traffic	TCP traffic: 192.168.2.66:445
Source: global traffic	TCP traffic: 192.168.2.168:445
Source: global traffic	TCP traffic: 192.168.2.65:445
Source: global traffic	TCP traffic: 192.168.2.169:445
Source: global traffic	TCP traffic: 192.168.2.68:445
Source: global traffic	TCP traffic: 192.168.2.67:445
Source: global traffic	TCP traffic: 192.168.2.69:445
Source: global traffic	TCP traffic: 192.168.2.162:445
Source: global traffic	TCP traffic: 192.168.2.163:445
Source: global traffic	TCP traffic: 192.168.2.160:445
Source: global traffic	TCP traffic: 192.168.2.161:445
Source: global traffic	TCP traffic: 192.168.2.60:445
Source: global traffic	TCP traffic: 192.168.2.166:445
Source: global traffic	TCP traffic: 192.168.2.167:445
Source: global traffic	TCP traffic: 192.168.2.62:445
Source: global traffic	TCP traffic: 192.168.2.164:445
Source: global traffic	TCP traffic: 192.168.2.61:445
Source: global traffic	TCP traffic: 192.168.2.165:445
Source: global traffic	TCP traffic: 192.168.2.170:445
Source: global traffic	TCP traffic: 192.168.2.49:445
Source: global traffic	TCP traffic: 192.168.2.53:445
Source: global traffic	TCP traffic: 192.168.2.52:445
Source: global traffic	TCP traffic: 192.168.2.55:445
Source: global traffic	TCP traffic: 192.168.2.179:445
Source: global traffic	TCP traffic: 192.168.2.54:445
Source: global traffic	TCP traffic: 192.168.2.57:445
Source: global traffic	TCP traffic: 192.168.2.56:445
Source: global traffic	TCP traffic: 192.168.2.59:445
Source: global traffic	TCP traffic: 192.168.2.58:445
Source: global traffic	TCP traffic: 192.168.2.173:445
Source: global traffic	TCP traffic: 192.168.2.174:445
Source: global traffic	TCP traffic: 192.168.2.171:445
Source: global traffic	TCP traffic: 192.168.2.172:445
Source: global traffic	TCP traffic: 192.168.2.177:445
Source: global traffic	TCP traffic: 192.168.2.178:445
Source: global traffic	TCP traffic: 192.168.2.51:445
Source: global traffic	TCP traffic: 192.168.2.175:445
Source: global traffic	TCP traffic: 192.168.2.50:445
Source: global traffic	TCP traffic: 192.168.2.176:445

Connects to many different private IPs via SMB (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.2.148:445
Source: global traffic	TCP traffic: 192.168.2.149:445
Source: global traffic	TCP traffic: 192.168.2.146:445
Source: global traffic	TCP traffic: 192.168.2.147:445
Source: global traffic	TCP traffic: 192.168.2.140:445
Source: global traffic	TCP traffic: 192.168.2.141:445
Source: global traffic	TCP traffic: 192.168.2.144:445
Source: global traffic	TCP traffic: 192.168.2.145:445
Source: global traffic	TCP traffic: 192.168.2.142:445
Source: global traffic	TCP traffic: 192.168.2.143:445
Source: global traffic	TCP traffic: 192.168.2.159:445
Source: global traffic	TCP traffic: 192.168.2.157:445
Source: global traffic	TCP traffic: 192.168.2.158:445
Source: global traffic	TCP traffic: 192.168.2.151:445
Source: global traffic	TCP traffic: 192.168.2.152:445
Source: global traffic	TCP traffic: 192.168.2.150:445
Source: global traffic	TCP traffic: 192.168.2.155:445
Source: global traffic	TCP traffic: 192.168.2.156:445
Source: global traffic	TCP traffic: 192.168.2.153:445
Source: global traffic	TCP traffic: 192.168.2.154:445
Source: global traffic	TCP traffic: 192.168.2.126:445
Source: global traffic	TCP traffic: 192.168.2.247:445
Source: global traffic	TCP traffic: 192.168.2.127:445
Source: global traffic	TCP traffic: 192.168.2.248:445
Source: global traffic	TCP traffic: 192.168.2.124:445
Source: global traffic	TCP traffic: 192.168.2.245:445
Source: global traffic	TCP traffic: 192.168.2.125:445
Source: global traffic	TCP traffic: 192.168.2.246:445
Source: global traffic	TCP traffic: 192.168.2.128:445
Source: global traffic	TCP traffic: 192.168.2.249:445
Source: global traffic	TCP traffic: 192.168.2.129:445
Source: global traffic	TCP traffic: 192.168.2.240:445
Source: global traffic	TCP traffic: 192.168.2.122:445
Source: global traffic	TCP traffic: 192.168.2.243:445
Source: global traffic	TCP traffic: 192.168.2.123:445
Source: global traffic	TCP traffic: 192.168.2.244:445
Source: global traffic	TCP traffic: 192.168.2.120:445
Source: global traffic	TCP traffic: 192.168.2.241:445
Source: global traffic	TCP traffic: 192.168.2.121:445
Source: global traffic	TCP traffic: 192.168.2.242:445
Source: global traffic	TCP traffic: 192.168.2.97:445
Source: global traffic	TCP traffic: 192.168.2.137:445
Source: global traffic	TCP traffic: 192.168.2.96:445
Source: global traffic	TCP traffic: 192.168.2.138:445
Source: global traffic	TCP traffic: 192.168.2.99:445
Source: global traffic	TCP traffic: 192.168.2.135:445
Source: global traffic	TCP traffic: 192.168.2.98:445
Source: global traffic	TCP traffic: 192.168.2.136:445
Source: global traffic	TCP traffic: 192.168.2.139:445
Source: global traffic	TCP traffic: 192.168.2.250:445
Source: global traffic	TCP traffic: 192.168.2.130:445
Source: global traffic	TCP traffic: 192.168.2.251:445
Source: global traffic	TCP traffic: 192.168.2.91:445
Source: global traffic	TCP traffic: 192.168.2.90:445
Source: global traffic	TCP traffic: 192.168.2.93:445
Source: global traffic	TCP traffic: 192.168.2.133:445
Source: global traffic	TCP traffic: 192.168.2.254:445
Source: global traffic	TCP traffic: 192.168.2.92:445
Source: global traffic	TCP traffic: 192.168.2.134:445
Source: global traffic	TCP traffic: 192.168.2.255:445
Source: global traffic	TCP traffic: 192.168.2.95:445
Source: global traffic	TCP traffic: 192.168.2.131:445
Source: global traffic	TCP traffic: 192.168.2.252:445
Source: global traffic	TCP traffic: 192.168.2.94:445
Source: global traffic	TCP traffic: 192.168.2.132:445
Source: global traffic	TCP traffic: 192.168.2.253:445
Source: global traffic	TCP traffic: 192.168.2.104:445
Source: global traffic	TCP traffic: 192.168.2.225:445
Source: global traffic	TCP traffic: 192.168.2.105:445
Source: global traffic	TCP traffic: 192.168.2.226:445
Source: global traffic	TCP traffic: 192.168.2.102:445
Source: global traffic	TCP traffic: 192.168.2.223:445
Source: global traffic	TCP traffic: 192.168.2.103:445
Source: global traffic	TCP traffic: 192.168.2.224:445
Source: global traffic	TCP traffic: 192.168.2.108:445
Source: global traffic	TCP traffic: 192.168.2.229:445
Source: global traffic	TCP traffic: 192.168.2.109:445
Source: global traffic	TCP traffic: 192.168.2.106:445
Source: global traffic	TCP traffic: 192.168.2.227:445
Source: global traffic	TCP traffic: 192.168.2.107:445
Source: global traffic	TCP traffic: 192.168.2.228:445
Source: global traffic	TCP traffic: 192.168.2.100:445
Source: global traffic	TCP traffic: 192.168.2.221:445
Source: global traffic	TCP traffic: 192.168.2.101:445
Source: global traffic	TCP traffic: 192.168.2.222:445
Source: global traffic	TCP traffic: 192.168.2.220:445
Source: global traffic	TCP traffic: 192.168.2.115:445
Source: global traffic	TCP traffic: 192.168.2.236:445
Source: global traffic	TCP traffic: 192.168.2.116:445
Source: global traffic	TCP traffic: 192.168.2.237:445
Source: global traffic	TCP traffic: 192.168.2.113:445
Source: global traffic	TCP traffic: 192.168.2.234:445
Source: global traffic	TCP traffic: 192.168.2.114:445
Source: global traffic	TCP traffic: 192.168.2.235:445
Source: global traffic	TCP traffic: 192.168.2.119:445
Source: global traffic	TCP traffic: 192.168.2.117:445
Source: global traffic	TCP traffic: 192.168.2.238:445
Source: global traffic	TCP traffic: 192.168.2.118:445
Source: global traffic	TCP traffic: 192.168.2.239:445
Source: global traffic	TCP traffic: 192.168.2.111:445
Source: global traffic	TCP traffic: 192.168.2.232:445
Source: global traffic	TCP traffic: 192.168.2.112:445
Source: global traffic	TCP traffic: 192.168.2.233:445
Source: global traffic	TCP traffic: 192.168.2.230:445
Source: global traffic	TCP traffic: 192.168.2.110:445
Source: global traffic	TCP traffic: 192.168.2.231:445
Source: global traffic	TCP traffic: 192.168.2.203:445
Source: global traffic	TCP traffic: 192.168.2.204:445
Source: global traffic	TCP traffic: 192.168.2.201:445
Source: global traffic	TCP traffic: 192.168.2.202:445
Source: global traffic	TCP traffic: 192.168.2.207:445
Source: global traffic	TCP traffic: 192.168.2.208:445
Source: global traffic	TCP traffic: 192.168.2.205:445
Source: global traffic	TCP traffic: 192.168.2.206:445
Source: global traffic	TCP traffic: 192.168.2.200:445
Source: global traffic	TCP traffic: 192.168.2.209:445
Source: global traffic	TCP traffic: 192.168.2.214:445
Source: global traffic	TCP traffic: 192.168.2.215:445
Source: global traffic	TCP traffic: 192.168.2.212:445
Source: global traffic	TCP traffic: 192.168.2.213:445
Source: global traffic	TCP traffic: 192.168.2.218:445
Source: global traffic	TCP traffic: 192.168.2.219:445
Source: global traffic	TCP traffic: 192.168.2.216:445
Source: global traffic	TCP traffic: 192.168.2.217:445
Source: global traffic	TCP traffic: 192.168.2.210:445
Source: global traffic	TCP traffic: 192.168.2.211:445
Source: global traffic	TCP traffic: 192.168.2.39:445
Source: global traffic	TCP traffic: 192.168.2.38:445
Source: global traffic	TCP traffic: 192.168.2.42:445
Source: global traffic	TCP traffic: 192.168.2.41:445
Source: global traffic	TCP traffic: 192.168.2.44:445
Source: global traffic	TCP traffic: 192.168.2.43:445
Source: global traffic	TCP traffic: 192.168.2.46:445
Source: global traffic	TCP traffic: 192.168.2.45:445
Source: global traffic	TCP traffic: 192.168.2.48:445
Source: global traffic	TCP traffic: 192.168.2.47:445
Source: global traffic	TCP traffic: 192.168.2.40:445
Source: global traffic	TCP traffic: 192.168.2.28:445
Source: global traffic	TCP traffic: 192.168.2.27:445
Source: global traffic	TCP traffic: 192.168.2.29:445
Source: global traffic	TCP traffic: 192.168.2.31:445
Source: global traffic	TCP traffic: 192.168.2.30:445
Source: global traffic	TCP traffic: 192.168.2.33:445
Source: global traffic	TCP traffic: 192.168.2.32:445
Source: global traffic	TCP traffic: 192.168.2.35:445
Source: global traffic	TCP traffic: 192.168.2.34:445
Source: global traffic	TCP traffic: 192.168.2.37:445
Source: global traffic	TCP traffic: 192.168.2.36:445
Source: global traffic	TCP traffic: 192.168.2.17:445
Source: global traffic	TCP traffic: 192.168.2.16:445
Source: global traffic	TCP traffic: 192.168.2.19:445
Source: global traffic	TCP traffic: 192.168.2.18:445
Source: global traffic	TCP traffic: 192.168.2.20:445
Source: global traffic	TCP traffic: 192.168.2.22:445
Source: global traffic	TCP traffic: 192.168.2.21:445
Source: global traffic	TCP traffic: 192.168.2.24:445
Source: global traffic	TCP traffic: 192.168.2.23:445
Source: global traffic	TCP traffic: 192.168.2.26:445
Source: global traffic	TCP traffic: 192.168.2.25:445
Source: global traffic	TCP traffic: 192.168.2.11:445
Source: global traffic	TCP traffic: 192.168.2.10:445
Source: global traffic	TCP traffic: 192.168.2.13:445
Source: global traffic	TCP traffic: 192.168.2.12:445
Source: global traffic	TCP traffic: 192.168.2.15:445
Source: global traffic	TCP traffic: 192.168.2.14:445
Source: global traffic	TCP traffic: 192.168.2.0:445
Source: global traffic	TCP traffic: 192.168.2.2:445
Source: global traffic	TCP traffic: 192.168.2.1:445
Source: global traffic	TCP traffic: 192.168.2.180:445
Source: global traffic	TCP traffic: 192.168.2.181:445
Source: global traffic	TCP traffic: 192.168.2.8:445
Source: global traffic	TCP traffic: 192.168.2.7:445
Source: global traffic	TCP traffic: 192.168.2.9:445
Source: global traffic	TCP traffic: 192.168.2.4:445
Source: global traffic	TCP traffic: 192.168.2.6:445
Source: global traffic	TCP traffic: 192.168.2.5:445
Source: global traffic	TCP traffic: 192.168.2.86:445
Source: global traffic	TCP traffic: 192.168.2.85:445
Source: global traffic	TCP traffic: 192.168.2.88:445
Source: global traffic	TCP traffic: 192.168.2.87:445
Source: global traffic	TCP traffic: 192.168.2.89:445
Source: global traffic	TCP traffic: 192.168.2.184:445
Source: global traffic	TCP traffic: 192.168.2.185:445
Source: global traffic	TCP traffic: 192.168.2.80:445
Source: global traffic	TCP traffic: 192.168.2.182:445
Source: global traffic	TCP traffic: 192.168.2.183:445
Source: global traffic	TCP traffic: 192.168.2.82:445
Source: global traffic	TCP traffic: 192.168.2.188:445
Source: global traffic	TCP traffic: 192.168.2.81:445
Source: global traffic	TCP traffic: 192.168.2.189:445
Source: global traffic	TCP traffic: 192.168.2.84:445
Source: global traffic	TCP traffic: 192.168.2.186:445
Source: global traffic	TCP traffic: 192.168.2.83:445
Source: global traffic	TCP traffic: 192.168.2.187:445
Source: global traffic	TCP traffic: 192.168.2.191:445
Source: global traffic	TCP traffic: 192.168.2.192:445
Source: global traffic	TCP traffic: 192.168.2.190:445
Source: global traffic	TCP traffic: 192.168.2.75:445
Source: global traffic	TCP traffic: 192.168.2.74:445
Source: global traffic	TCP traffic: 192.168.2.77:445
Source: global traffic	TCP traffic: 192.168.2.76:445
Source: global traffic	TCP traffic: 192.168.2.79:445
Source: global traffic	TCP traffic: 192.168.2.78:445
Source: global traffic	TCP traffic: 192.168.2.195:445
Source: global traffic	TCP traffic: 192.168.2.196:445
Source: global traffic	TCP traffic: 192.168.2.193:445
Source: global traffic	TCP traffic: 192.168.2.194:445
Source: global traffic	TCP traffic: 192.168.2.71:445
Source: global traffic	TCP traffic: 192.168.2.199:445
Source: global traffic	TCP traffic: 192.168.2.70:445
Source: global traffic	TCP traffic: 192.168.2.73:445
Source: global traffic	TCP traffic: 192.168.2.197:445
Source: global traffic	TCP traffic: 192.168.2.72:445
Source: global traffic	TCP traffic: 192.168.2.198:445
Source: global traffic	TCP traffic: 192.168.2.64:445
Source: global traffic	TCP traffic: 192.168.2.63:445
Source: global traffic	TCP traffic: 192.168.2.66:445
Source: global traffic	TCP traffic: 192.168.2.168:445
Source: global traffic	TCP traffic: 192.168.2.65:445
Source: global traffic	TCP traffic: 192.168.2.169:445
Source: global traffic	TCP traffic: 192.168.2.68:445
Source: global traffic	TCP traffic: 192.168.2.67:445
Source: global traffic	TCP traffic: 192.168.2.69:445
Source: global traffic	TCP traffic: 192.168.2.162:445
Source: global traffic	TCP traffic: 192.168.2.163:445
Source: global traffic	TCP traffic: 192.168.2.160:445
Source: global traffic	TCP traffic: 192.168.2.161:445
Source: global traffic	TCP traffic: 192.168.2.60:445
Source: global traffic	TCP traffic: 192.168.2.166:445
Source: global traffic	TCP traffic: 192.168.2.167:445
Source: global traffic	TCP traffic: 192.168.2.62:445
Source: global traffic	TCP traffic: 192.168.2.164:445
Source: global traffic	TCP traffic: 192.168.2.61:445
Source: global traffic	TCP traffic: 192.168.2.165:445
Source: global traffic	TCP traffic: 192.168.2.170:445
Source: global traffic	TCP traffic: 192.168.2.49:445
Source: global traffic	TCP traffic: 192.168.2.53:445
Source: global traffic	TCP traffic: 192.168.2.52:445
Source: global traffic	TCP traffic: 192.168.2.55:445
Source: global traffic	TCP traffic: 192.168.2.179:445
Source: global traffic	TCP traffic: 192.168.2.54:445
Source: global traffic	TCP traffic: 192.168.2.57:445
Source: global traffic	TCP traffic: 192.168.2.56:445
Source: global traffic	TCP traffic: 192.168.2.59:445
Source: global traffic	TCP traffic: 192.168.2.58:445
Source: global traffic	TCP traffic: 192.168.2.173:445
Source: global traffic	TCP traffic: 192.168.2.174:445
Source: global traffic	TCP traffic: 192.168.2.171:445
Source: global traffic	TCP traffic: 192.168.2.172:445
Source: global traffic	TCP traffic: 192.168.2.177:445
Source: global traffic	TCP traffic: 192.168.2.178:445
Source: global traffic	TCP traffic: 192.168.2.51:445
Source: global traffic	TCP traffic: 192.168.2.175:445
Source: global traffic	TCP traffic: 192.168.2.50:445
Source: global traffic	TCP traffic: 192.168.2.176:445

Source: malware.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\OneDriveTemp\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\ProgramData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\ProgramData\Adobe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\ProgramData\dbg\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\ProgramData\Documents\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\ProgramData\Microsoft OneDrive\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\ProgramData\Oracle\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\ProgramData\TightVNC\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\ProgramData\USOShared\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\Public\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\ProgramData\Adobe\ARM\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\ProgramData\Adobe\Temp\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\ProgramData\Microsoft\DeviceSync\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\ProgramData\Microsoft\User Account Pictures\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\ProgramData\Microsoft OneDrive\setup\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\ProgramData\Oracle\Java\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\ProgramData\USOShared\Logs\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\3D Objects\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Application Data\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Contacts\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Cookies\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Desktop\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Documents\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Downloads\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Favorites\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Links\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Local Settings\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Music\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\NetHood\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\OneDrive\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Pictures\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\PrintHood\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Recent\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Saved Games\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Searches\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\SendTo\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Start Menu\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Templates\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Videos\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\Public\AccountPictures\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\Public\Downloads\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\Public\Libraries\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\Public\Music\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\Public\Pictures\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\Public\Videos\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\ProgramData\Adobe\ARM\Reader_21.001.20155\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\ProgramData\USOShared\Logs\User\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\LocalLow\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Desktop\AQRFEVRTGL\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Desktop\DQOFHVHTMG\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Desktop\EIVQSAOTAQ\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Desktop\GIGIYTFFYT\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Desktop\HQJBRDYKDE\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Desktop\KLIZUSIQEN\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Desktop\LIJDSFKJZG\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Desktop\NYMMPCEIMA\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Desktop\QCOILOQIKC\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Documents\AQRFEVRTGL\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Documents\DQOFHVHTMG\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Documents\EIVQSAOTAQ\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Documents\GIGIYTFFYT\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Documents\HQJBRDYKDE\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Documents\KLIZUSIQEN\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Documents\LIJDSFKJZG\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Documents\NYMMPCEIMA\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Documents\Outlook Files\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Documents\QCOILOQIKC\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Downloads\FxyxmdOyQe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Favorites\Links\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\Pictures\Camera Roll\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\ProgramData\Microsoft\Crypto\DSS\MachineKeys\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Adobe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Comms\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\D3DSCache\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\History\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\MicrosoftEdge\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\OneDrive\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\PeerDistRepub\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Publishers\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Temp\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Temporary Internet Files\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\VirtualStore\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Roaming\Adobe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Adobe\ARM\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Adobe\Color\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Comms\Unistore\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Comms\UnistoreDB\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\D3DSCache\e8010882af4f153f\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Credentials\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Event Viewer\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Feeds\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Feeds Cache\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\FORMS\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\GameDVR\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\InputPersonalization\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Media Player\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Outlook\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\PenWorkspace\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\PlayReady\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\TokenBroker\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Vault\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\MicrosoftEdge\SharedCacheContainers\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\OneDrive\cache\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\ActiveSync\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\adobe.acrobatreaderdc.protectedmode\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\InputApp_cw5n1h2txyewy\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Advertising.Xaml_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.HEIFImageExtension_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Messaging_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Framework.1.7_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Framework.2.2_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Runtime.1.7_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Runtime.2.2_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.PPIProjection_cw5n1h2txyewy\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Print3D_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.UI.Xaml.2.0_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.VCLibs.140.00.UWPDesktop_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Wallet_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WebMediaExtensions_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.WebpImageExtension_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Win32WebViewHost_cw5n1h2txyewy\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Temp\acrocef_low\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Temp\acrord32_sbx\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Temp\Diagnostics\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Temp\Low\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Temp\msdt\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Temp\VBE\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Temp\{0526F170-B257-4B5A-B638-A61006F3853A}\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\Linguistics\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Flash Player\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Headlights\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Linguistics\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Roaming\Adobe\LogTransport2\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\AddIns\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Credentials\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Excel\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\MMC\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Network\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Office\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Outlook\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Proof\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Protect\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Speech\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Spelling\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Templates\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Vault\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Word\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Adobe\ARM\S\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Adobe\Color\Profiles\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Comms\Unistore\data\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Event Viewer\Views\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\af-ZA\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\ar-AE\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\ar-BH\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\ar-DZ\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\ar-EG\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\ar-IQ\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\ar-JO\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\ar-KW\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\ar-LB\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\ar-LY\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\ar-MA\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\ar-OM\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\ar-QA\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\ar-SA\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\ar-SY\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\ar-TN\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\ar-YE\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\az-Latn-AZ\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\bg-BG\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\bn-BD\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\ca-ES\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\cs-CZ\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\da-DK\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\de-AT\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\de-CH\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\de-DE\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\de-LI\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\de-LU\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\el-GR\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\en-029\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\en-AU\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\en-BZ\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\en-CA\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\en-GB\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\en-HK\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\en-ID\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\en-IE\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\en-IN\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\en-JM\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\en-MY\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\en-NZ\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\en-SG\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\en-TT\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\en-ZA\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\en-ZW\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\es-419\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\es-AR\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\es-BO\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\es-CL\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\es-CO\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\es-CR\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\es-DO\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\es-EC\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\es-ES\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\es-GT\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\es-HN\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\es-MX\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\es-NI\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\es-PA\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\es-PE\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\es-PR\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\es-PY\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\es-SV\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\es-US\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\es-UY\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\es-VE\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\et-EE\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\eu-ES\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\fa-IR\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\fi-FI\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\fr-029\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\fr-BE\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\fr-CA\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\fr-CD\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\fr-CH\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\fr-CI\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\fr-CM\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\fr-FR\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\fr-HT\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\fr-LU\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\fr-MA\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\fr-MC\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\fr-ML\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\fr-RE\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\fr-SN\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\gl-ES\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\ha-Latn-NG\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\he-IL\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\hi-IN\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\hr-BA\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\hr-HR\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\hu-HU\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\hy-AM\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\id-ID\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\it-CH\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\it-IT\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\ka-GE\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\kk-KZ\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\lt-LT\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\lv-LV\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\mk-MK\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\ms-BN\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\ms-MY\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\nb-NO\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\nl-BE\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\nl-NL\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\pl-PL\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\pt-BR\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\pt-PT\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\ro-MD\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\ro-RO\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\ru-RU\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\sk-SK\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\sl-SI\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\sq-AL\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\sr-Cyrl-BA\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\sr-Cyrl-ME\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\sr-Cyrl-RS\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\sr-Latn-BA\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\sr-Latn-ME\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\sr-Latn-RS\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\sv-FI\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\sv-SE\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\tr-TR\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\uk-UA\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\uz-Latn-UZ\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\InputPersonalization\TrainedDataStore\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\EmieSiteList\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\EmieUserList\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\TabRoaming\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tracking Protection\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\UrlBlock\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\PlayReady\Internet Explorer\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Vault\UserProfileRoaming\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\MicrosoftEdge\SharedCacheContainers\MicrosoftEdge_DNTException\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\OneDrive\cache\qmlcache\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\AC\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\AppData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\LocalCache\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\LocalState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\RoamingState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\Settings\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\SystemAppData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\TempState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\adobe.acrobatreaderdc.protectedmode\AC\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\AC\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\AppData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\LocalCache\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\LocalState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\RoamingState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\Settings\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\SystemAppData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\TempState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\AC\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\AppData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\LocalCache\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\LocalState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\RoamingState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\SystemAppData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\TempState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\AC\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\AppData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\LocalCache\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\LocalState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\RoamingState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\Settings\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\SystemAppData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\TempState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\InputApp_cw5n1h2txyewy\AC\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\InputApp_cw5n1h2txyewy\AppData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\InputApp_cw5n1h2txyewy\LocalCache\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\InputApp_cw5n1h2txyewy\LocalState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\InputApp_cw5n1h2txyewy\RoamingState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\InputApp_cw5n1h2txyewy\Settings\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\InputApp_cw5n1h2txyewy\SystemAppData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\InputApp_cw5n1h2txyewy\TempState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AppData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\LocalCache\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\LocalState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\RoamingState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\SystemAppData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\TempState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\AC\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\AppData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\LocalCache\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\LocalState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\RoamingState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\SystemAppData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\TempState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Advertising.Xaml_8wekyb3d8bbwe\AC\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\AC\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\AppData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\LocalCache\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\LocalState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\RoamingState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\Settings\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\SystemAppData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\TempState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\AC\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\AppData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\LocalCache\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\LocalState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\RoamingState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\SystemAppData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\TempState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\AC\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\AppData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\LocalCache\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\LocalState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\RoamingState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\Settings\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\SystemAppData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\TempState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\AC\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\AppData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\LocalCache\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\LocalState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\RoamingState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\Settings\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\SystemAppData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\TempState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AppData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalCache\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\RoamingState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\SystemAppData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\TempState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\AC\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\AppData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\LocalCache\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\LocalState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\RoamingState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\Settings\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\SystemAppData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\TempState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AppData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\LocalCache\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\LocalState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\RoamingState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\SystemAppData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\TempState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\AC\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\AppData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\LocalCache\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\LocalState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\RoamingState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\Settings\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\SystemAppData\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\TempState\README.TXT
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.HEIFImageExtension_8wekyb3d8bbwe\AC\README.TXT

Source: malware.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 52.109.8.44
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 52.109.124.153
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 52.109.8.44
Source: unknown	TCP traffic detected without corresponding DNS query: 52.109.124.153
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95

Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe

File created: C:\Users\user\AppData\Local\Temporary Internet Files\README.TXT

Spam, unwanted Advertisements and Ransom Demands

Yara detected Conti ransomware

Source: Yara match	File source: malware.exe, type: SAMPLE
Source: Yara match	File source: 0000000F.00000000.1780567176.0000000000951000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY

Yara detected Royal Ransomware

Source: Yara match	File source: malware.exe, type: SAMPLE
Source: Yara match	File source: 0000000F.00000000.1780567176.0000000000951000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY

Found ransom note / readme

Source: C:\ProgramData\Microsoft\DeviceSync\README.TXT

Dropped file: Hello!If you are reading this, it means that your system were hit by Royal ransomware.Please contact us via :http://royal2xthig3ou5hd7zsliqagy6yygk2cdelaxtni2fyad6dpmpxedid.onion/12345678901234567890123456789012In the meantime, let us explain this case.It may seem complicated, but it is not!Most likely what happened was that you decided to save some money on your security infrastructure.Alas, as a result your critical data was not only encrypted but also copied from your systems on a secure server.From there it can be published online.Then anyone on the internet from darknet criminals, ACLU journalists, Chinese government(different names for the same thing),and even your employees will be able to see your internal documentation: personal data, HR reviews, internal lawsuitsand complains, financial reports, accounting, intellectual property, and more!Fortunately we got you covered!Royal offers you a unique deal.For a modest royalty(got it; got it ? ) for our pentesting services we will not only provide you with an amazing risk mitigation service,covering you from reputational, legal, financial, regulatory, and insurance risks, but will also provide you with a security review for your systems.To put it simply, your files will be decrypted, your data restoredand kept confidential, and your systems will remain secure.Try Royal today and enter the new era of data security!We are looking to hearing from you soon!

Jump to dropped file

Writes many files with high entropy

Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\IconCache.db.royal_w entropy: 7.99379359762	Jump to dropped file
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs.royal_w entropy: 7.99969953107	Jump to dropped file
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs.royal_w entropy: 7.99966450456	Jump to dropped file
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbtmp.log.royal_w entropy: 7.99962259573	Jump to dropped file
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei.royal_w entropy: 7.99124646726	Jump to dropped file
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App_1684319521621248900_724DDF91-E372-411C-9B24-AB7293AE20C4.log.royal_w entropy: 7.99350628254	Jump to dropped file
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages.royal_w entropy: 7.99761496971	Jump to dropped file
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00001.jrs.royal_w entropy: 7.99994716651	Jump to dropped file
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Comms\UnistoreDB\USStmp.jtx.royal_w entropy: 7.99993983715	Jump to dropped file
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00002.jrs.royal_w entropy: 7.9999395173	Jump to dropped file
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx.royal_w entropy: 7.99740588117	Jump to dropped file
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\FORMS\FRMDATA64.DAT.royal_w entropy: 7.99935156105	Jump to dropped file
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\0BA6B95B-B5EC-4B9F-A2D3-51BD6D6FF521.royal_w entropy: 7.998957165	Jump to dropped file
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Reader\DesktopNotification\NotificationsDB\notificationsDB.royal_w entropy: 7.99373198087	Jump to dropped file
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\5732433C-DB76-4CEA-84F2-FDEFC3D2CDC0.royal_w entropy: 7.9987847434	Jump to dropped file
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edbres00002.jrs.royal_w entropy: 7.99966059332	Jump to dropped file
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edbres00001.jrs.royal_w entropy: 7.99962851849	Jump to dropped file
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edbtmp.log.royal_w entropy: 7.99964699465	Jump to dropped file
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\u2m79ck\imagestore.dat.royal_w entropy: 7.990876332	Jump to dropped file
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\{5C331E5A-C86C-11EB-87F5-000C29C35D9E}.dat.royal_w entropy: 7.99900481769	Jump to dropped file
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2021-06-08_151132_b90-13a8.log.royal_w entropy: 7.99151998409	Jump to dropped file
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Messaging_8wekyb3d8bbwe\LocalCache\MessagingBackgroundTaskLog.etl.royal_w entropy: 7.99332577353	Jump to dropped file
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Messaging_8wekyb3d8bbwe\LocalCache\MessagingBackgroundTaskLog.last.etl.royal_w entropy: 7.99220168165	Jump to dropped file
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\MMC\eventvwr.royal_w entropy: 7.99875017988	Jump to dropped file
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\MMC\services.royal_w entropy: 7.99824489006	Jump to dropped file
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Office\MSO1033.acl.royal_w entropy: 7.99497173784	Jump to dropped file
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache.bin.royal_w entropy: 7.99572800276	Jump to dropped file
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt21.lst.royal_w entropy: 7.99814415016	Jump to dropped file
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat.royal_w entropy: 7.99947672751	Jump to dropped file

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File dropped: C:\ProgramData\Microsoft\DeviceSync\README.TXT -> decrypted, your data restoredand kept confidential, and your systems will remain secure.try royal today and enter the new era of data security!we are looking to hearing from you soon!			Jump to dropped file
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	File dropped: C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\README.TXT -> decrypted, your data restoredand kept confidential, and your systems will remain secure.try royal today and enter the new era of data security!we are looking to hearing from you soon!			Jump to dropped file

Source: malware.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: malware.exe, type: SAMPLE

Matched rule: MAL_EXE_RoyalRansomware date = 2023-01-03, author = Silas Cutler, modfied by Florian Roth, description = Detection for Royal Ransomware seen Dec 2022, version = 1.0, DaysofYARA = 3/100, hash = a8384c9e3689eb72fa737b570dbb53b2c3d103c62d46747a96e1e1becf14dfea

Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe malware.exe -id 12345678901234567890123456789012
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe malware.exe -id 12345678901234567890123456789012

Source: malware.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: malware.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: malware.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: malware.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: malware.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: malware.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: malware.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: malware.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: malware.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: malware.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: malware.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\~DFB7E2EFEA5A45E5B4.TMP.royal_w VolumeInformation
Source: C:\Users\user\Downloads\FxyxmdOyQe\malware.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT.royal_w VolumeInformation

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Data Encrypted for Impact
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Software Packing	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Obfuscated Files or Information	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label	Link
malware.exe	62%	ReversingLabs	Win32.Ransomware.Royal
malware.exe	73%	Virustotal		Browse

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
52.109.124.153	unknown	United States		8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.109.8.44	unknown	United States		8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	868123
Start date and time:	2023-05-17 12:31:45 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 64 bit version 1909 (MS Office 2019, IE 11, Chrome 104, Firefox 88, Adobe Reader DC 21, Java 8 u291, 7-Zip)
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	1
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample file name:	malware.exe
Detection:	MAL
Classification:	mal88.rans.expl.winEXE@5/433@0/600
Cookbook Comments:	Found application associated with file extension: .exe

Process:	C:\Users\user\Downloads\FxyxmdOyQe\malware.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1473
Entropy (8bit):	4.676364699387907
Encrypted:	false
SSDEEP:
MD5:	27152879A897C13AE7E3365F45730DFA
SHA1:	8C875FD491382B2116E55617294E5F85FB55AB5E
SHA-256:	14C5232061C21C33754951E8345966589335C85DA750C30F7F435D064391D412
SHA-512:	342839F0353168D80FB52ED1B007AA752FBFA7608EF219D8E9761739B14E6845422CFAFB906356E2A98BB4EEC384AB667D6CD651F0DE93FB3294A786D54F8E88
Malicious:	true
Reputation:	low
Preview:	Hello!.....If you are reading this, it means that your system were hit by Royal ransomware....Please contact us via :...http://royal2xthig3ou5hd7zsliqagy6yygk2cdelaxtni2fyad6dpmpxedid.onion/12345678901234567890123456789012....In the meantime, let us explain this case.It may seem complicated, but it is not!..Most likely what happened was that you decided to save some money on your security infrastructure...Alas, as a result your critical data was not only encrypted but also copied from your systems on a secure server...From there it can be published online.Then anyone on the internet from darknet criminals, ACLU journalists, Chinese government(different names for the same thing),..and even your employees will be able to see your internal documentation: personal data, HR reviews, internal lawsuitsand complains, financial reports, accounting, intellectual property, and more!.....Fortunately we got you covered!....Royal offers you a unique deal.For a modest royalty(got it; got it ? ) for o

File Type:	data
Category:	dropped
Size (bytes):	576
Entropy (8bit):	5.051544237902749
Encrypted:	false
SSDEEP:
MD5:	6BD63A3846959F3C0CB44819E57D0DCA
SHA1:	AF7B8AFDA9946DA28E1095E70D72479FDE9E467B
SHA-256:	2CF08F8D294FEEE880AD49AE3CFC391FB6B3437F49E6221C17F85C8B9CE2199B
SHA-512:	16EA17B9FF89F50270C758F6B5756FBA7BE467FE12E1F5BB6C9B5207937EE37C8D1103C4578FD43FCA32D9889F8CCCA3F550FD2D58D9EDFC8F9101B4877EEB7D
Malicious:	false
Reputation:	low
Preview:	.6...AAAAAAA...AAAAA...A.A.A/ALAAAAAAAAAAAbA5AtA.!.AGA.A.bbA.A`A.].A%A.A...A AHA...AVA.A.n.AKA.A6d.A.A.A6.A~AEA...6.A.A..Ab.A...A...A...An.LA..bA...A..bA..#A..bA5..A...6#.qA.^tA..&A.5.6..A..bA..A...6`.~A.G.6N..A..bA2..A...A6#.A.-.A.#.A...A.#cA...6#.A.bA..A...An..A...A..A..bA..A. bA..A.tbA.SAA.AbA.S.A.6.AF..A.L.A`..A...AN.A...A..(A.}.A...A.1.A...A..A...A...AV..A..AQ.yA._.AE.MA...A\|.A...AU..A...6...A...6...A.?.6...A.H.A..A.9bAK.XA...A...A...A..DA..A...A.%bAZ.A.;b.q..A.#b...7A...Aw..A68.AAA.AtA.6..........................................................

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.828201669853982
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	malware.exe
File size:	2237952
MD5:	7eac8aef6533d6b87e1d0004005430e4
SHA1:	addf21b4bacf3c2e0eb001fb3e2be2d462da87bc
SHA256:	ccc63f897d97e61dcb616f0e28ab43a995b466506e6de3c9c153386f492259ab
SHA512:	35040ff6e30b07a564886f9ad7aa216153f7908b8faa57868f4e98d5cf05d3bf7066dfe1b8d8ecd023191add9a4643aaf016ef26fd98d842a18da40cd7357895
SSDEEP:	24576:P+KpPzIzkQoU6cvTJdCm6pMtGMt0p0LkeoqP5nV6BQ1s2Y/tJGnX+LuiehI6YL2o:Dq9FTZGkvtOqYwrUPJwzjzQsh6b
TLSH:	99A5AE02FF8294B2D9C3167921EB977F4E3959149738D9C3CB9129AEC8211D2963F3D8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Z..I;..I;..I;..]P..G;..]P...;..]P..[;..]P..^;..I;...;..+C..c;..+C..Z;..+C..Q;...G...9..I;..^;...B..L;...B).H;...B..H;..RichI;.

Entrypoint:	0x570b38
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x63F543B2 [Tue Feb 21 22:20:34 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	3a45ce41fbc6d362dd2f153d51234462

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x20d060	0xf0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x213000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x214000	0x138a0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x20bbb8	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x20baf8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x191000	0x308	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x18f54f	0x18f600	False	0.5368232834507042	data	6.851367351208121	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x191000	0x7d0ea	0x7d200	False	0.4288738605144855	data	5.823717570140382	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x20f000	0x3ed4	0x1e00	False	0.3111979166666667	Matlab v4 mat-file (little endian) \360iE, rows 8, columns 8, imaginary	3.486984481293121	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x213000	0x1e0	0x200	False	0.52734375	data	4.7113407225994175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x214000	0x138a0	0x13a00	False	0.5809240644904459	data	6.6096696172300256	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

DLL	Import
SHLWAPI.dll	StrStrIW
WS2_32.dll	WSAStartup, shutdown, setsockopt, connect, send, recv, WSASetLastError, getservbyname, getservbyport, gethostbyaddr, inet_ntoa, inet_addr, WSAGetLastError, WSACleanup, gethostbyname, select, ntohs, getsockopt, ioctlsocket, bind, WSAIoctl, closesocket, ntohl, WSASocketW, socket, WSAAddressToStringW, htonl, htons
CRYPT32.dll	CertEnumCertificatesInStore, CertOpenStore, CertFindCertificateInStore, CertGetCertificateContextProperty, CertFreeCertificateContext, CertDuplicateCertificateContext, CertCloseStore
ADVAPI32.dll	CryptGetUserKey, CryptReleaseContext, CryptDestroyKey, ReportEventW, RegisterEventSourceW, DeregisterEventSource, CryptEnumProvidersW, CryptSignHashW, CryptDestroyHash, CryptCreateHash, CryptDecrypt, CryptExportKey, CryptSetHashParam, CryptGetProvParam, CryptAcquireContextW
USER32.dll	MessageBoxW, GetUserObjectInformationW, GetProcessWindowStation, wsprintfW
SHELL32.dll	ShellExecuteW, CommandLineToArgvW
IPHLPAPI.DLL	GetIpAddrTable
NETAPI32.dll	NetShareEnum, NetApiBufferFree
RstrtMgr.DLL	RmStartSession, RmGetList, RmShutdown, RmEndSession, RmRegisterResources
bcrypt.dll	BCryptGenRandom
KERNEL32.dll	CompareStringW, HeapAlloc, HeapFree, GetModuleFileNameW, SetConsoleCtrlHandler, LCMapStringW, HeapReAlloc, GetConsoleOutputCP, SetStdHandle, GetCurrentDirectoryW, GetFullPathNameW, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, GetStringTypeW, GetProcessHeap, GetTimeZoneInformation, HeapSize, GetModuleHandleExW, FileTimeToSystemTime, SystemTimeToTzSpecificLocalTime, PeekNamedPipe, GetFileInformationByHandle, LoadLibraryExW, InitializeCriticalSectionAndSpinCount, EncodePointer, WriteConsoleW, WideCharToMultiByte, RaiseException, RtlUnwind, GetStartupInfoW, IsDebuggerPresent, InitializeSListHead, IsProcessorFeaturePresent, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetLogicalDrives, FindFirstFileW, EnterCriticalSection, FindNextFileW, WriteFile, LeaveCriticalSection, FindClose, CreateFileW, ExitThread, Sleep, CloseHandle, CreateThread, lstrcmpiW, GetDriveTypeW, GetCommandLineW, GetCurrentProcess, lstrlenW, WaitForMultipleObjects, InitializeCriticalSection, InitializeConditionVariable, CreateMutexW, lstrlenA, WaitForSingleObject, GetLastError, GetProcAddress, DeleteCriticalSection, ExitProcess, CreateProcessW, GetModuleHandleW, DecodePointer, lstrcmpW, CancelIo, GetQueuedCompletionStatus, CreateIoCompletionPort, SleepConditionVariableCS, ReadFile, GetFileSizeEx, WakeAllConditionVariable, GetProcessId, SetEndOfFile, CreateToolhelp32Snapshot, Process32NextW, Process32FirstW, GetNativeSystemInfo, SetFilePointerEx, MoveFileExW, FlushFileBuffers, SetLastError, InitializeSRWLock, ReleaseSRWLockExclusive, ReleaseSRWLockShared, AcquireSRWLockExclusive, AcquireSRWLockShared, GetCurrentThreadId, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetSystemDirectoryA, FreeLibrary, LoadLibraryA, FormatMessageA, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, VirtualFree, GetEnvironmentVariableW, MultiByteToWideChar, GetACP, GetStdHandle, GetFileType, GetConsoleMode, SetConsoleMode, ReadConsoleA, ReadConsoleW

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report malware.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\ProgramData\Microsoft\DeviceSync\README.TXT

C:\ProgramData\USOShared\Logs\User\NotificationUx.1d4f57f8-b43c-412d-8c8b-6f95b9fa276d.1.etl.royal_w

C:\ProgramData\USOShared\Logs\User\NotificationUx.444ea595-6a02-4e33-9d6c-209bb54fbc14.1.etl.royal_w

C:\ProgramData\USOShared\Logs\User\NotificationUx.47014d92-c4f5-4f11-8388-2e81c0490f5c.1.etl.royal_w

C:\ProgramData\USOShared\Logs\User\NotifyIcon.07671258-1986-4a94-bfdc-6e5e1a034c94.1.etl.royal_w

C:\ProgramData\USOShared\Logs\User\NotifyIcon.0afbfb91-e626-4ddc-951d-82a3f8d00877.1.etl.royal_w

C:\ProgramData\USOShared\Logs\User\NotifyIcon.2aa04435-f921-4d6d-b712-8f1a6b27d14e.1.etl.royal_w

C:\ProgramData\USOShared\Logs\User\NotifyIcon.2ca0e824-af43-42e4-8a67-ecf81d6ee52e.1.etl.royal_w

C:\ProgramData\USOShared\Logs\User\NotifyIcon.5db65f32-0610-4558-8633-97f78dd9ce23.1.etl.royal_w

C:\ProgramData\USOShared\Logs\User\NotifyIcon.5f195b2a-2bc8-45ed-bad9-a6b5ad3627ee.1.etl.royal_w

C:\ProgramData\USOShared\Logs\User\NotifyIcon.8e789948-e940-4082-9746-2d7a2066ab63.1.etl.royal_w

C:\ProgramData\USOShared\Logs\User\NotifyIcon.efa2710a-e0e5-422b-bece-7acbee31df21.1.etl.royal_w

C:\ProgramData\USOShared\Logs\User\NotifyIcon.f30561ce-d20f-44f0-98f0-0a2211dc7e26.1.etl.royal_w

C:\ProgramData\USOShared\Logs\User\NotifyIcon.f65bce6a-0c4c-4919-9083-c1fcd777e562.1.etl.royal_w

C:\ProgramData\USOShared\Logs\User\NotifyIcon.fbf1ceaf-d675-4142-90db-686d3ec7ad3d.1.etl.royal_w

C:\ProgramData\USOShared\Logs\User\NotifyIcon.ff950fa2-0d0a-4a64-acd9-0716f2fa9b9c.1.etl.royal_w

C:\Users\user\3D Objects\desktop.ini.royal_w

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\CURRENT.royal_w

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_0.royal_w

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_1.royal_w

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_2.royal_w

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_3.royal_w

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\index.royal_w

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0.royal_w

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0.royal_w

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0.royal_w

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0.royal_w

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0.royal_w

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0.royal_w

Windows Analysis Report
malware.exe

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.
Tactics:	Impact
Data Sources:	File monitoring, Kernel drivers, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre