Joe Sandbox Cloud Basic

Want to search on specific fields?


Try our:

Advanced Search

Want to search in depth on all Cloud Basic reports?

Try: Joe Sandbox View

Register Login
sloganpng
top title background image
flash

912534A5380738D96E8DDB7873ECB004667D72D5DF783.exe

Status: finished
Submission Time: 2021-12-04 23:27:06 +01:00
Malicious
Trojan
Spyware
Evader
RedLine Socelars Vidar

Comments

Tags

  • exe
  • GCleaner

Details

  • Analysis ID:
    534003
  • API (Web) ID:
    901525
  • Analysis Started:
    2021-12-04 23:27:07 +01:00
  • Analysis Finished:
    2021-12-04 23:45:28 +01:00
  • MD5:
    8b7b82eb83d4a6760ecf8e9398ffda64
  • SHA1:
    e827272cd42a9030741f4acb6004a97f6e13ba40
  • SHA256:
    912534a5380738d96e8ddb7873ecb004667d72d5df783cabce2e398c11b14912
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Full Report Management Report IOC Report
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

Open Full Report
malicious
Score: 42/68
Open Full Report
malicious
Score: 17/35
malicious
Score: 25/26
malicious
malicious

IPs

IP Country Detection
172.67.189.190
 United States
47.251.42.216
 United States
5.9.162.45
 Germany
Click to see the 29 hidden entries
185.46.11.66
 Russian Federation
52.218.101.152
 United States
185.215.113.208
 Portugal
37.0.10.244
 Netherlands
103.155.93.165
 unknown
5.188.38.39
 Russian Federation
208.95.112.1
 United States
163.181.57.228
 United States
162.159.133.233
 United States
20.189.173.20
 United States
74.114.154.18
 Canada
107.148.201.36
 United States
34.117.59.81
 United States
85.209.157.230
 Netherlands
145.131.16.92
 Netherlands
2.56.59.42
 Netherlands
104.23.98.190
 United States
37.0.10.199
 Netherlands
162.159.129.233
 United States
85.208.48.152
 Germany
104.192.141.1
 United States
65.108.20.195
 United States
52.95.149.18
 United States
104.208.16.94
 United States
8.8.8.8
 United States
149.28.253.196
 United States
212.193.30.29
 Russian Federation
52.217.96.20
 United States
193.56.146.76
 unknown

URLs

Name Detection
http://www.bqmqx.com/askhelp59/askinstall59.exeC:
http://194.145.227.161/dlc/sharing.php?pub=mixonerogramDataAPPDATA=C:
http://hsiens.xyz/
Click to see the 97 hidden entries
http://hsiens.xyz/addInstallImpression.php?key=125478824515ADNxu2ccbwe&ip=&oid=149
http://hsiens.xyz/addInstall.php?key=125478824515ADNxu2ccbwe&ip=&oid=149&oname
http://194.145.227.161/dlc/sharing.php?pub=mixoneTIFIER=Intel64
http://amzrouting.com/amz.exe/$
http://194.145.227.161/dlc/sharing.php?pub=mixone
http://194.145.227.161/dlc/sharing.php?pub=mixonene
http://www.bqmqx.com/askhelp59/askinstall59.exe
https://dependstar.bar/?username=p11_4
https://dependstar.bar/?username=p11_5
https://cdn.discordapp.com:80/attachments/910842184708792331/916341616422322236/HwL0301.bmpZ1
https://iplogger.org/169Bx7
https://iplogger.org/1H3Fa7
https://dependstar.bar/?username=p11_7
http://212.193.30.29/WW/file4.exe
https://cdn.discordapp.com/attachments/910842184708792331/916790043174125589/real0403.bmp;
https://cdn.discordapp.com:80/attachments/910842184708792331/916699585185984542/7e248_0401.bmp-0
https://cdn.discordapp.com:80/attachments/915539163787460658/915542724923502643/Uponrun.exe
https://sf7584565426374orjhgt.s3.eu-west-2.amazonaws.com/
https://iplogger.org/1T79i7
https://iplogger.org/1DE477
https://cdn.discordapp.com/attachments/905701898806493199/915522670873944114/Setup12.exeh
https://iplogger.org/1XJq97
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
https://cdn.discordapp.com/attachments/905701898806493199/915522670873944114/Setup12.exep
https://curl.se/V
https://cdn.discordapp.com:80/attachments/910842184708792331/916681821687775312/under0401.bmp
https://cdn.discordapp.com:80/attachments/910842184708792331/916356408235159641/lance.bmpx
http://artguide.top/foradvertisingwwb.exeLj
https://dependstar.bar/?username=p11_1
http://amzrouting.com/amz.exeB
https://c.goatgameh.co/dlc/sharing.php?pub=mixone
https://www.aol.com
https://dependstar.bar
http://www.iyiqian.com/
http://212.193.30.29/WW/file4.exez
http://www.jiyu-kobo.co.jp/va
https://cdn.discordapp.com/attachments/905701898806493199/915522670873944114/Setup12.exeP
http://212.193.30.29/WW/file4.exet
https://dependstar.bar/?username=p11_6
https://cdn.discordapp.com/attachments/905701898806493199/915522670873944114/Setup12.exe(
https://iplogger.org/1q6Jt7
https://cdn.discordapp.com/attachments/910842184708792331/916790043174125589/real0403.bmpH
https://iplogger.org/1rDMq7
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
http://amzrouting.com/amz.exew
https://iplogger.org/1wnqn7
https://iplogger.org/1CDGu7
https://cdn.discordapp.com:80/attachments/910842184708792331/916341616422322236/HwL0301.bmp
https://sf7584565426374orjhgt.s3.eu-west-2.amazonaws.com:80/BF1.exe
https://cdn.discordapp.com/attachments/910842184708792331/916580866153664522/mill.bmp
https://github.com/ModuleArt/
https://cdn.discordapp.com/attachments/910842184708792331/915859306728026132/PL_Client.bmp
https://iplogger.org/1XSq97
http://tg8.cllgxx.com/sr21/rtst1047.exeC:
http://www.bqmqx.com/askinstall59.exeh
https://software-services.bar8
https://www.listincode.com/
https://cdn.discordapp.com:80/attachments/915539163787460658/915542724923502643/Uponrun.exeK
https://cdn.discordapp.com/attachments/910842184708792331/916756102165704704/install_new0402.bmp:3
https://software-services.bar/
https://ipinfo.io/Content-Type:
https://cdn.discordapp.com:80/attachments/910842184708792331/916681000476626984/SoftPInstaller0401.b
http://ngdatas.pw/https://www.listincode.com/0.0.0.0%d.%d.%d.%dhttp-1ZIP
https://cdn.discordapp.com/attachments/910842184708792331/916341616422322236/HwL0301.bmpC:
http://www.fontbureau.com/designers
http://tg8.cllgxx.com/sr21/rtst1047.exe1
http://212.193.30.29/WW/file5.exe
http://212.193.30.29/WW/file3.exe8
http://212.193.30.29/WW/file1.exeC:
https://sm.ms/api/v2/upload?inajax=1https://sm.ms/api/v2/upload?inajax=1
http://194.145.227.161/45.227.161/dlc/sharing.php?pub=mixone
https://iplogger.org/14Qju7
https://software-services.bar
https://cdn.discordapp.com:80/attachments/910842184708792331/916387844342284388/ruzki.bmp
http://2.56.59.42/base/api/getData.php
https://iplogger.org/1KyTy7
https://cdn.discordapp.com/attachments/910842184708792331/916790682084057128/1234_0402.bmp
http://212.193.30.29/WW/file3.exem
https://cdn.discordapp.com/attachments/910842184708792331/916754844734337064/design0401.bmpC:
https://cdn.discordapp.com/attachments/910842184708792331/916341616422322236/HwL0301.bmpntSourcf
http://tg8.cllgxx.com/sr21/siww1047.exe
https://www.google.com/search?q=admob&oq=admob
http://193.56.146.76/Udp.exev%
https://sm.ms/api/v2/upload?inajax=1
https://www.cloudflare.com/5xx-error-landing
https://cdn.discordapp.com:80/attachments/915539163787460658/915542724923502643/Uponrun.exe#
https://iplogger.org/1OXFG
http://piratenhits.fm/luna1.exew
https://cdn.discordapp.com:80/attachments/910842184708792331/915310820416716862/sfx_123_310.bmp
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline
https://bitbucket.org/Yz
https://api.ip.sb/geoip%USERPEnvironmentROFILE%
https://github.com/ModuleArt/ehttps://github.com/ModuleArt/quick-picture-viewer/
https://sf7584565426374orjhgt.s3.eu-west-2.amazonaws.com:80/BF1.exe(
https://iplogger.org/16xjh7
https://iplogger.org/1s4qp7
https://iplogger.org/1T89i7

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\askinstall59[1].exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\Setup12[1].exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\7zS883210E8\Mon067f2fcee827.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
Click to see the 97 hidden entries
C:\Users\user\Pictures\Adobe Films\So_nQ0f6036W5A_oTVjjj7ec.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\7zS883210E8\Mon067df200a8fd43b.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\7zS883210E8\Mon066b4a7578e0123e.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\Service[1].bmp
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\Udp[1].exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\askinstall42[1].exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\7zS883210E8\Mon06885bbdb13fec3.exe
 PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\ferrari[1].exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\file1[1].exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\7zS883210E8\Mon06434adde6c2.exe
 PE32 executable (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\7zS883210E8\Mon0630c6f1115ad5.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\siww1047[1].exe
 PE32+ executable (GUI) x86-64, for MS Windows
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\BF1[1].exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\amz[1].exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\comprehensive1[1].exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\7zS883210E8\Mon0699e256d5dc14.exe
 PE32+ executable (GUI) x86-64, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\7zS883210E8\setup_install.exe
 PE32 executable (console) Intel 80386, for MS Windows
 #
C:\Users\user\Pictures\Adobe Films\i4HzLCX9ix_xgRHB3fQN7Sf0.exe
 PE32+ executable (GUI) x86-64, for MS Windows
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\NiceProcessX64[1].bmp
 PE32+ executable (GUI) x86-64, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\7zS883210E8\Mon060579dda3b.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\xxxx[1].exe
 MS-DOS executable
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Uponrun[1].exe
 PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\toolspab2[1].exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\install4[1].exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\7zS883210E8\Mon06f9c53ffae25af61.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\7zS883210E8\Mon06dc62fb7183b9e.exe
 PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\7zS883210E8\Mon06d47d8fde50.exe
 PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\file3[1].exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\7zS883210E8\Mon06be060a7cb426cf.exe
 PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Users\user\Pictures\Adobe Films\EH2UqXkmGsdM7d8RuuDQ7km6.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Pictures\Adobe Films\G2_EIY9DOQs4sNlH3UBGIHNs.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Documents\20211204\PowerShell_transcript.494126.SvgNFG3o.20211204232806.txt
 UTF-8 Unicode (with BOM) text, with CRLF line terminators
 #
C:\Users\user\Pictures\Adobe Films\BFuUkLJxjHnJ56WPRhHz3ign.exe
 HTML document, ASCII text
 #
C:\Users\user\Pictures\Adobe Films\B9sunPpJzOhhqi2LNmnFA1Vf.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Pictures\Adobe Films\8L6ugJuHG9eDlcL37667vJc9.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Pictures\Adobe Films\7ciFxtIpptvH3EmimVuzKQBx.exe
 HTML document, ASCII text
 #
C:\Users\user\Pictures\Adobe Films\70gT3_jLhoTN69YJz2eMYaZ8.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Documents\Ei8DrAmaYu9K8ghN89CsjOW1.dll
 data
 #
C:\Users\user\Pictures\Adobe Films\i_OjgwShp6vSNPTHoCRKJq5M.exe
 PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Users\user\Pictures\Adobe Films\XgI7PQbAfdnaXrmuKlSbD1tN.exe
 HTML document, ASCII text
 #
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Mon06d47d8fde50.exe.log
 ASCII text, with CRLF line terminators
 #
C:\Users\user\Pictures\Adobe Films\i9v9KeSPU8TebYFmPJaLjDAO.exe
 HTML document, ASCII text, with CRLF line terminators
 #
C:\Users\user\Pictures\Adobe Films\hl_J5ttTbMmf2AhgPYwvzG__.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Pictures\Adobe Films\g_MknxqsfTsoo1ZWGLulW9rc.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Pictures\Adobe Films\eyCAN_PVePYm1Gl5JhE7GSOh.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Pictures\Adobe Films\ekfeDHeefrpVeOLF_zEospRe.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Pictures\Adobe Films\biQtzmlvUuePquCyc26WOk81.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Pictures\Adobe Films\bClhmhZlpCeoCXI8ug2wg8mi.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Pictures\Adobe Films\_I840nW0W0BkPi0VRC8fXhgb.exe
 HTML document, ASCII text
 #
C:\Users\user\Pictures\Adobe Films\Zq6kcg5lJKuuEaFuudf7gjaI.exe
 HTML document, ASCII text
 #
C:\Users\user\Pictures\Adobe Films\Z_vRblvz9Nut3_fUjgc3y2tG.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Pictures\Adobe Films\Kjf6fop4TDCFGr6Z3sfik8Kr.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Pictures\Adobe Films\VkFchiXGaREjCGp6k2Ktr5lS.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Pictures\Adobe Films\Tm0qqnTEi1cYOqiY563QdqH0.exe
 HTML document, ASCII text
 #
C:\Users\user\Pictures\Adobe Films\TITkxzS0gfvs2KvVCeBpa4X_.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Pictures\Adobe Films\SSceGixduBzhWNhNwAlLoQH9.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Pictures\Adobe Films\Rd4mWWpY8ZOYLzPUXbMr48g7.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Pictures\Adobe Films\OWtr97fJ3mDnO4VToTTzkR9p.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Pictures\Adobe Films\NikB4LocWiKFuKasNcrhRDqo.exe
 MS-DOS executable
 #
C:\Users\user\Pictures\Adobe Films\MVqkmKxpMmLZNmFpGwUpdGg4.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Pictures\Adobe Films\MMMy7Y8hjR6Y29cpH6i8H_U7.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Pictures\Adobe Films\Km91VWEL8QlQMf6PXBcS7CUg.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\help0301[1].bmp
 data
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\real0403[1].bmp
 data
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\design0401[1].bmp
 data
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\under0401[1].bmp
 data
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\sfx_123_310[1].bmp
 data
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\ruzki[1].bmp
 data
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\mill[1].bmp
 data
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\lance[1].bmp
 data
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\install_new0402[1].bmp
 data
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\AordVPNWZ3202111221117[1].exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\filinnn0301[1].bmp
 data
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\app0301[1].bmp
 data
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Topov0401[1].bmp
 data
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\SoftPInstaller0401[1].bmp
 data
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\HwL0301[1].bmp
 data
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\7e248_0401[1].bmp
 data
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\1234_0402[2].bmp
 data
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\1234_0402[1].bmp
 data
 #
C:\Users\user\AppData\Local\Module_Art\Mon06dc62fb7183b9e.exe_Url_plmwxjco1mh2rarhkmu4d43wt11ojz2e\1.2.1.0\user.config (copy)
 XML 1.0 document, ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0mu53gul.jvr.ps1
 very short file (no magic)
 #
C:\Users\user\AppData\Local\Temp\7zS883210E8\libwinpthread-1.dll
 PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
 #
C:\Users\user\AppData\Local\Temp\7zS883210E8\libstdc++-6.dll
 PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
 #
C:\Users\user\AppData\Local\Temp\7zS883210E8\libgcc_s_dw2-1.dll
 PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
 #
C:\Users\user\AppData\Local\Temp\7zS883210E8\libcurlpp.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\7zS883210E8\libcurl.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\7zS883210E8\Mon06cebe79e9a244.exe
 PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Users\user\AppData\Local\Module_Art\Mon06dc62fb7183b9e.exe_Url_plmwxjco1mh2rarhkmu4d43wt11ojz2e\1.2.1.0\user.configs_ (copy)
 XML 1.0 document, ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yp1iwvjd.lzv.psm1
 very short file (no magic)
 #
C:\Users\user\AppData\Local\Module_Art\Mon06dc62fb7183b9e.exe_Url_plmwxjco1mh2rarhkmu4d43wt11ojz2e\1.2.1.0\oqzi3r40.newcfg
 XML 1.0 document, ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Module_Art\Mon06dc62fb7183b9e.exe_Url_plmwxjco1mh2rarhkmu4d43wt11ojz2e\1.2.1.0\myvnba1h.newcfg
 XML 1.0 document, ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Module_Art\Mon06dc62fb7183b9e.exe_Url_plmwxjco1mh2rarhkmu4d43wt11ojz2e\1.2.1.0\fb0nnnxr.newcfg
 XML 1.0 document, ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
 data
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\setup_525403[1].exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\hiddis_setup_add[1].htm
 HTML document, ASCII text
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\PL_Client[1].bmp
 data
 #