Compare this analysis to...

#### Analysis

Category | Started | Completed | Duration | Options | Log
--- | --- | --- | --- | --- | ---
FILE | 2019-05-16 16:36:32 | 2019-05-16 16:37:38 | 66 seconds | Show Options | Show Log

    vpn = disabled
    submit_all = yes

#### MalScore

## 10.0

##### Malicious

#### Machine

Name | Label | Manager | Started On | Shutdown On
--- | --- | --- | --- | ---
win7-x86-1-101 | 11101,default | Proxmox | 2019-05-16 16:36:32 | 2019-05-16 16:37:38

#### File Details

File Name | 848872cf5790bc67efdcfa4e379979a9eed1ca220856f76997e844b00c0debec
File Size | 175537 bytes
File Type | PE32 executable (GUI) Intel 80386, for MS Windows
MD5 | 2e288b0b1132e84e89e09b6806bc4e9d
SHA1 | a3f586723884acf44e24a8975c7a93d1d32030f1
SHA256 | 848872cf5790bc67efdcfa4e379979a9eed1ca220856f76997e844b00c0debec
SHA512 | f82cb2bae1b603999183ad38c27f512d46962288b154175e1886eeb50220fb790e7b54c55d8e981f075de05695826d339ad87653a514c75b2edac1db3f72f826
CRC32 | ECEB846B
Ssdeep | None
ClamAV | None matched
Yara | None matched
| Download

#### Signatures

Uses Microsoft Crypto API keys or hashes

Process: JyjxepxjTCgv.exe (1364)
Asymmetric key 0x005ceca8-0 | Handle: 0x005ceca8 Key origin: CryptImportPublicKeyInfo of unrecognized public key, Exponent: 0x10001, Modulus: 0xc3c6d4808db6e8d90d07ead81b1cb1b8db9de34954bcf74aa62200b56fa1aac1d84c505d0d3dadbb732c60720340fc20d686bb1016043a33e9c9d9c87d7c29c873592efa84156253ff35478e9094889990c3a3d8ee75c1c7bf4c1b07867a9e1ef7dbc725316e67749e30e02ad1b4ed8f1ec4aa57332eb8588739afe4d573fc51, Key hash: 964ddc83e5b35f853cbefe3fa1097b02dd37d997a50d9a2e2347c0c3b1c46b8a Algorithm: RSA Public Key Exchange (1024 bit) Encrypted data 1: (Exported AES-256 (256 bit) key 0x005cede8-0 exported as PLAINTEXTKEYBLOB, used 1 times, from CryptGenKey) \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\xe9P!\x8d\x06\xd23\x8e\xa0\xf0\xa1Z\xc4\xb0\x1e\xee\xcd\xbf\xda\xee\xc2J[\xad'\x01\xa6\xc0\xed\x97\x86\xe9
Asymmetric key 0x005ceda8-0 | Handle: 0x005ceda8 Key origin: CryptGenKey Algorithm: RSA Public Key Exchange (1024 bit) Export 1 as PRIVATEKEYBLOB: \x07\x02\x00\x00\x00\xa4\x00\x00RSA2\x00\x04\x00\x00\x01\x00\x01\x00g\x8c\x0f~\xfd\xa15\x19\xd3\xa0\xca\xb5\xbe\xc3\x82\x8b\xcb\x0a\xd2l\xd5jC\xba\x9f\xdb\xa8\x95\xe9\x1a\xc6\xf0\xfe\xe3@\x9a!1%\xfdo\xac\xa0\x8a\xa3l0+7\xc1\xfb\x04\xd1G\x10R\xed=\x93\xbb\xde\x0f\x8f\xea\xc0\x7fjF\x0eRh*\xea\xa5\x09\xbc\xd6jg\xa83@\xf2\xd5\xc4^\xcet\x10\xfeU\xb0\x09E\xeb\x97\x1a\xf5\x87I4T\xe3\xd0\x88L\xf6Z\x93\xe5\xa9\xb65p\x95\x0d\xae7\x06\xf4\x09\xcb}`\xd2B\xdd\xdci\x9cl)i\x9f*T~SFH'\xe2O\x88\x9b\\xa2Xjh\xeaxH\x11R\xfb.]\ (1239 more characters) Export 2 as PUBLICKEYBLOB: \x06\x02\x00\x00\x00\xa4\x00\x00RSA1\x00\x04\x00\x00\x01\x00\x01\x00g\x8c\x0f~\xfd\xa15\x19\xd3\xa0\xca\xb5\xbe\xc3\x82\x8b\xcb\x0a\xd2l\xd5jC\xba\x9f\xdb\xa8\x95\xe9\x1a\xc6\xf0\xfe\xe3@\x9a!1%\xfdo\xac\xa0\x8a\xa3l0+7\xc1\xfb\x04\xd1G\x10R\xed=\x93\xbb\xde\x0f\x8f\xea\xc0\x7fjF\x0eRh*\xea\xa5\x09\xbc\xd6jg\xa83@\xf2\xd5\xc4^\xcet\x10\xfeU\xb0\x09E\xeb\x97\x1a\xf5\x87I4T\xe3\xd0\x88L\xf6Z\x93\xe5\xa9\xb65p\x95\x0d\xae7\x06\xf4\x09\xcb}`\xd2B\xdd\xdc
Asymmetric key 0x005cece8-0 | Handle: 0x005cece8 Key origin: CryptImportKey of previous export of key 0x005ceda8-0 (RSA Public Key Exchange (1024 bit) CryptGenKey) as PUBLICKEYBLOB Algorithm: RSA Public Key Exchange (1024 bit) Encrypted data 1: (Exported AES-256 (256 bit) key 0x005cee28-0 exported as PLAINTEXTKEYBLOB, used 1 times, from CryptGenKey) \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\x98\x1f\xa5;\x05\xa4\x1b\xd8\xc3Bv\xa5\xf9}\xab.\xef\xff\xbd0%;\xccH\xea\x0dz?f\xefT6 Encrypted data 2: (Exported AES-256 (256 bit) key 0x005ceee8-0 exported as PLAINTEXTKEYBLOB, used 1 times, from CryptGenKey) \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00l\x97g#\x10\x0c\x83\xe4\x97'\x86|G-\xc9\x1c\x8a\x90\xff&')\xc4HI\xba\xa9\x0f\xe7\xed7y Encrypted data 3: (Exported AES-256 (256 bit) key 0x005ceee8-1 exported as PLAINTEXTKEYBLOB, used 1 times, from CryptGenKey) \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\xfe`M2\x85S\x86\x0e\x0e\x85\xea\xf5\x93\x9b\xd7\x88]\xec;y\x84\xaae\x9c\x0c9\xb6\xc4l\xe7\x9f\x89 Encrypted data 4: (Exported AES-256 (256 bit) key 0x005ceee8-2 exported as PLAINTEXTKEYBLOB, used 1 times, from CryptGenKey) \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\xf0\xf8\xf2\xe2\x12\xa2\xceX\x9cO\xde\xc8\x03\xeb\xd7\xe1[\x11\xc0\xe7l\x82\xce\x9c\x9a\x17\x91\xdb\xa7)Q\x9a Encrypted data 5: (Exported AES-256 (256 bit) key 0x005ceee8-3 exported as PLAINTEXTKEYBLOB, used 1 times, from CryptGenKey) \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\xff8\xae\x03\xf9\x7f>\xc9pl\x84Vs\x13\xf9\xcb\x80\x9a-:\x7f/p\xe8\xa4c\xbe\#\xc6i\xa5 Encrypted data 6: (Exported AES-256 (256 bit) key 0x005ceee8-4 exported as PLAINTEXTKEYBLOB, used 1 times, from CryptGenKey) \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\x84\x87\x8a\x98\xd5@\x1b\x06\x88.\xe7\xfe=\xf8\x1f%\x1d\xab\x82\xae\x87\xaf\xbf2q`M\x0f\x09\xbd\xaf\xc9 Encrypted data 7: (Exported AES-256 (256 bit) key 0x005ceee8-5 exported as PLAINTEXTKEYBLOB, used 1 times, from CryptGenKey) \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\xebU5!\xea\xc4\x9f\xfc\x802\x05lN\x08;j\xc7JBf\xf4&`D%\x1e(u\x17\x94\xcfm Encrypted data 8: (Exported AES-256 (256 bit) key 0x005ceee8-6 exported as PLAINTEXTKEYBLOB, used 1 times, from CryptGenKey) \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\x06\xf4<\x03\x0ac*\xf4\x09#\x0fH\xde\xdc)\x84\xb3\xa7\xa7\x84\xcb\x95\xc25\xb7P\xb7\x0a\xb3t\xd4\x18 Encrypted data 9: (Exported AES-256 (256 bit) key 0x005ceee8-7 exported as PLAINTEXTKEYBLOB, used 1 times, from CryptGenKey) \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\x9bX\xdf\xf2\x1a\xc7+\xce`\x84k\x83e.!\xc6\xeb<\xe3\x8a\x12\xcc\x80\x83\x1e\xf4-\xe2\x80J\xb4\x7f Encrypted data 10: (Exported AES-256 (256 bit) key 0x005ceee8-8 exported as PLAINTEXTKEYBLOB, used 1 times, from CryptGenKey) \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\xd2\xd6\x84`XH\xf6bd\x0fV\x05|\x91R\x86V"\xbf\x16U<\xcd6\xd9>\xb2A\xf3\x05\x92\x7f Encrypted data 11: (Exported AES-256 (256 bit) key 0x005ceee8-9 exported as PLAINTEXTKEYBLOB, used 1 times, from CryptGenKey) \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00=\xe1\x9d!\xb2\xae0\xe8w\xc6\x9b\x00\xa3\x10a\x1aP\x84p\x1a0K\xd19\xcc0\xe2`\xda\xb2\x8b\xe3 Encrypted data 12: (Exported AES-256 (256 bit) key 0x005ceee8-10 exported as PLAINTEXTKEYBLOB, used 1 times, from CryptGenKey) \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00?*\x8e&\xaf\x19O!4\xda\x03\xc8\xa8\xdd\x0e\xf0\xc0w\x11JGw\x91\x05BV\xff\x8c\xf8p\xd9\xb9 Encrypted data 13: (Exported AES-256 (256 bit) key 0x005ceee8-11 exported as PLAINTEXTKEYBLOB, used 1 times, from CryptGenKey) \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00c\\xf4\xb4{\xc5\xc2z\xf3\x85\x93\xe8w6\x8bb?4\x10\xea\x19U\xb8\xce\xba\xe1\x14L(\xa2\x905 Encrypted data 14: (Exported AES-256 (256 bit) key 0x005ceee8-12 exported as PLAINTEXTKEYBLOB, used 1 times, from CryptGenKey) \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\xe7\xe0q\xe7\xfbT\xeb&\xc6"}\xe0\xf1e/]\xe64k\xce>\x8f\x0d\x81\xfc"\xa7\xcdM%\xaa\xd2 Encrypted data 15: (Exported AES-256 (256 bit) key 0x005ceee8-13 exported as PLAINTEXTKEYBLOB, used 1 times, from CryptGenKey) \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00d\x86[%\xc9\xca[\x14\xeebz\xedk2\xf5\x01\xc7\xd1\xa6\x82\x87\xcc\x850\xc9/\x12\x98\xb7w\x16q Encrypted data 16: (Exported AES-256 (256 bit) key 0x005ceee8-14 exported as PLAINTEXTKEYBLOB, used 1 times, from CryptGenKey) \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00Sl\xa33vH\x16\xf3\xc3Z\x84VG\xf8\xdew\x13\x8c\x8b\xa4J\xbax^D\xa4\x861\x05\x80\xda\xac Encrypted data 17: (Exported AES-256 (256 bit) key 0x005ceee8-15 exported as PLAINTEXTKEYBLOB, used 1 times, from CryptGenKey) \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00vv\xa8\xe8(\x0b\xaf\x10;\x9c\xb0yMi\xe0w\x00\xec\x02!\xd3m?{\x13\xf4\x80\xd1\xe0&\xef\xb3 Encrypted data 18: (Exported AES-256 (256 bit) key 0x005ceee8-16 exported as PLAINTEXTKEYBLOB, used 1 times, from CryptGenKey) \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\xec\x08h\x9fG\xf5\x1f\xa7\xfeD\xe9\x0c\xc0\x88\xa4\x96f]\xb5q\xc8\xaf\\x09j\xe6\xc8a\xfe:zm Encrypted data 19: (Exported AES-256 (256 bit) key 0x005ceee8-17 exported as PLAINTEXTKEYBLOB, used 1 times, from CryptGenKey) \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00Z9G[\xd3\xf7\xaax\xacv\x1df\x145\xdbf\xef-\xd3\xa8\xbf\xaa\x92\xed^\xa7[\x9a9\xe0\xfe\xbb Encrypted data 20: (Exported AES-256 (256 bit) key 0x005ceee8-18 exported as PLAINTEXTKEYBLOB, used 1 times, from CryptGenKey) \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\xee/\x80A\xaf*\xdd\x09Z\xe9-\xba\xd0X\xbb\x07V\xe1D\x8f\xc4\x15g\xf7\xe2\x8d\x85OWo\xdc\x1a Encrypted data 21: (Exported AES-256 (256 bit) key 0x005ceee8-19 exported as PLAINTEXTKEYBLOB, used 1 times, from CryptGenKey) \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\xb1\xba\x14\x81L\xae\xe5/s{c5\xd1\x04V3\x18\x81\x8d(\xe8\x12\xa5\x0df\x0e\x97;\x89\xda\xec\x0e Encrypted data 22: (Exported AES-256 (256 bit) key 0x005ceee8-20 exported as PLAINTEXTKEYBLOB, used 1 times, from CryptGenKey) \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00{#\xcbB\xd3\xcd\xce\x0a'\xb7i\x93k\xa7-\xca\xcc\xc0\xdb\xfe4\xc1\xea\x0c\xaa"\xd9\x16\xd4C\x87\x1f Encrypted data 23: (Exported AES-256 (256 bit) key 0x005ceee8-21 exported as PLAINTEXTKEYBLOB, used 1 times, from CryptGenKey) \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x007\xd1\xba[\xce\xff\xfa\x84\xe4\xe9\x11N\xec\xec\xbbFM`\x17-\xb0\x16\xfed\x9b\x18\x13,I\x8f\xa0o Encrypted data 24: (Exported AES-256 (256 bit) key 0x005ceee8-22 exported as PLAINTEXTKEYBLOB, used 1 times, from CryptGenKey) \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00(\xaf\x00\x91j\xa3\xf6\xa2#Y#b\xe9\x89Tt\xe2\x11a\xff;\x0dB#\xc4\xd6\xf2\x18\xe5\xca\xb7\xcb Encrypted data 25: (Exported AES-256 (256 bit) key 0x005ceee8-23 exported as PLAINTEXTKEYBLOB, used 1 times, from CryptGenKey) \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\xf6\\x90{i\xcd/p<\xcd\xe8j\x06\x07#\xe9\x84\xcf.\x16\xc7\xfe\x89]\x8d\x91\xa3\xdc]\x0d\xf2\x9a Encrypted data 26: (Exported AES-256 (256 bit) key 0x005ceee8-24 exported as PLAINTEXTKEYBLOB, used 1 times, from CryptGenKey) \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\xa4Nu\xc6\xba\xb5\xe6qmM\x9a\xd4\x9b@\xd4\xa9\x07g\x922\xe4O\xfb\xea\x1e\x07\xe0%\x9dKDh Encrypted data 27: (Exported AES-256 (256 bit) key 0x005ceee8-25 exported as PLAINTEXTKEYBLOB, used 1 times, from CryptGenKey) \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00[\x83\xf0\x80%5`[\xcf\x1d\xb6G\x08H\xbf\x05\xb7\xf1\xd1\xa6\xb5Q\xac\xf9\xd2@}\xd9\x06"\x9ao Encrypted data 28: (Exported AES-256 (256 bit) key 0x005ceee8-26 exported as PLAINTEXTKEYBLOB, used 1 times, from CryptGenKey) \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\x84N42\xc5\x04\xa88\xf6\xd9\xb7,\x98\x9e\xef\x12\xa7\xa1\\x15\x9c\xbdZ\xf4\xb0\x87.g\xf3wqU Encrypted data 29: (Exported AES-256 (256 bit) key 0x005ceee8-27 exported as PLAINTEXTKEYBLOB, used 1 times, from CryptGenKey) \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00"\xddHi\xf55j\x1e\x80\x00cw\x84\xa7W\x18\x1a#\x18\xeaDd\x92\xc4R\x18a\xf4\xcb\x1e\xc6\x9a Encrypted data 30: (Exported AES-256 (256 bit) key 0x005ceee8-28 exported as PLAINTEXTKEYBLOB, used 1 times, from CryptGenKey) \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\xa0J\xe9\xed\xb1D<\x87Q\x8b#\x86\x8aEm\xce\x99\xdf\xdf\xb7A\x0bAT\xa8mv\x20\x8c\x0f\xbb\xc8 Other encryptions: 2 additional encrypted buffers
Symmetric key 0x005cede8-0 | Handle: 0x005cede8 Key origin: CryptGenKey Algorithm: AES-256 (256 bit) CBC mode Encrypted data 1: (Unrecognized data) BwIAAACkAABSU0EyAAQAAAEAAQBnjA9+/aE1GdOgyrW+w4KLywrSbNVqQ7qf26iV6RrG8P7jQJohMSX9b6ygiqNsMCs3wfsE0UcQUu09k7veD4/qwH9qRg5SaCrqpQm81mpnqDNA8tXEXs50EP5VsAlF65ca9YdJNFTj0IhM9lqT5am2NXCVDa43BvQJy31g0kLd3GmcbClpnypUflNGSCfiT4ibXKJYamjqeEgRUvsuXR8Dw+9FpwscXjW5PsTznMRosJUCjH4U+Zo8GEVMZqOZ8PpPCGjWhwWd3HGJkQ1exXwHPMbC12fHJh8pzomZ2NslSRVs7/Vd/hb5/tGazD3wrKCxnZuY41NRLjc4u/G1Z1HhsRWhqrLSopqyHW9lrRqD4zZg1hVUpBuA43ItSWyJlSC6W7xEiK1rucEM9ugWVlgAXSHUxn0WjU9SfCfm9VQBNIm7vX2cp1NbCjLJC5qIJUwhGnmBsIgePP+1rxIX+MkuwYChm1ivS1CDa2hW (338 more characters) Export 1 as PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\xe9P!\x8d\x06\xd23\x8e\xa0\xf0\xa1Z\xc4\xb0\x1e\xee\xcd\xbf\xda\xee\xc2J[\xad'\x01\xa6\xc0\xed\x97\x86\xe9
Symmetric key 0x005cee28-0 | Handle: 0x005cee28 Key origin: CryptGenKey Algorithm: AES-256 (256 bit) CBC mode Encrypted data 1: (Likely JPEG file) \xff\xd8\xff\xe0\x00\x10JFIF\x00\x01\x02\x01\x00H\x00H\x00\x00\xff\xed\x0e\x0cPhotoshop\x203.0\x008BIM\x04\x04\x07Caption\x00\x00\x00\x10\x1c\x02\x00\x00\x02\x00\x02\x1c\x02x\x00\x04\x00\x00\x00\x008BIM\x03\xe9\x0aPrint\x20Info\x00\x00\x00\x00x\x00\x03\x00\x00\x00H\x00H\x00\x00\x00\x00\x02\xd8\x02(\xff\xe1\xff\xe2\x02\xf9\x02F\x03G\x05(\x03\xfc\x00\x02\x00\x00\x00H\x00H\x00\x00\x00\x00\x02\xd8\x02(\x00\x01\x00\x00\x00d\x00\x00\x00\x01\x00\x03\x03\x03\x00\x00\x00\x01'\x0f\x00\x01\x00\x01\x00\x00\x00\x00\x00\ (5724 more characters) Export 1 as PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\x98\x1f\xa5;\x05\xa4\x1b\xd8\xc3Bv\xa5\xf9}\xab.\xef\xff\xbd0%;\xccH\xea\x0dz?f\xefT6
Symmetric key 0x005ceee8-0 | Handle: 0x005ceee8 Key origin: CryptGenKey Algorithm: AES-256 (256 bit) CBC mode Encrypted data 1: (Likely JPEG file) \xff\xd8\xff\xe0\x00\x10JFIF\x00\x01\x02\x01\x00H\x00H\x00\x00\xff\xed\x0e\x0cPhotoshop\x203.0\x008BIM\x04\x04\x07Caption\x00\x00\x00\x10\x1c\x02\x00\x00\x02\x00\x02\x1c\x02x\x00\x04\x00\x00\x00\x008BIM\x03\xe9\x0aPrint\x20Info\x00\x00\x00\x00x\x00\x03\x00\x00\x00H\x00H\x00\x00\x00\x00\x02\xd8\x02(\xff\xe1\xff\xe2\x02\xf9\x02F\x03G\x05(\x03\xfc\x00\x02\x00\x00\x00H\x00H\x00\x00\x00\x00\x02\xd8\x02(\x00\x01\x00\x00\x00d\x00\x00\x00\x01\x00\x03\x03\x03\x00\x00\x00\x01'\x0f\x00\x01\x00\x01\x00\x00\x00\x00\x00\ (5724 more characters) Export 1 as PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00l\x97g#\x10\x0c\x83\xe4\x97'\x86|G-\xc9\x1c\x8a\x90\xff&')\xc4HI\xba\xa9\x0f\xe7\xed7y
Symmetric key 0x005ceee8-1 | Handle: 0x005ceee8 Key origin: CryptGenKey Algorithm: AES-256 (256 bit) CBC mode Encrypted data 1: (Likely ZIP archive) PK\x03\x04\x0a\x00\x00\x00\x00\x00\xa4\x04:E\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x00\x00\x00fp_15.0.0.152_archive/PK\x03\x04\x0a\x00\x00\x00\x00\x00\x1b\x08=E\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"\x00\x00\x00fp_15.0.0.152_archive/15_0_r0_152/PK\x03\x04\x14\x00\x00\x00\x08\x00\x06\x10\x1cE\xad\xf4\x14\x1d\x17\x02\xee\x00l\x1a\xee\x00?\x00\x00\x00fp_15.0.0.152_archive/15_0_r0_152/flashplayer15_0r0_152_mac.dmg\x84\xb7S\x94.<\xd8$\xfa\xb6m\xdb\xb6{\xb7\xbd\xdb\xb6m\xdb\xb6m\xdb\xb6m\x (5130 more characters) Export 1 as PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\xfe`M2\x85S\x86\x0e\x0e\x85\xea\xf5\x93\x9b\xd7\x88]\xec;y\x84\xaae\x9c\x0c9\xb6\xc4l\xe7\x9f\x89
Symmetric key 0x005ceee8-2 | Handle: 0x005ceee8 Key origin: CryptGenKey Algorithm: AES-256 (256 bit) CBC mode Encrypted data 1: (Likely ZIP archive) PK\x03\x04\x0a\x00\x00\x00\x00\x00.\x07=E\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x00\x00\x00fp_15.0.0.167_archive/PK\x03\x04\x0a\x00\x00\x00\x00\x00.\x07=E\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"\x00\x00\x00fp_15.0.0.167_archive/15_0_r0_167/PK\x03\x04\x14\x00\x00\x00\x08\x00\xc0\x05:E;"\xce\xfdq@\x06\x01\xb0V\x08\x01A\x00\x00\x00fp_15.0.0.167_archive/15_0_r0_167/flashplayer15_0r0_167_winax.exe\xec\xfd\x7f|SE\xf60\x8e\xdf4i\x1bJ\x20\x01R\xacR\xb5jT\xb4\xa8HP[\x83Z~$T\xa5\x98R\x9a\xb4B[\ (5106 more characters) Export 1 as PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\xf0\xf8\xf2\xe2\x12\xa2\xceX\x9cO\xde\xc8\x03\xeb\xd7\xe1[\x11\xc0\xe7l\x82\xce\x9c\x9a\x17\x91\xdb\xa7)Q\x9a
Symmetric key 0x005ceee8-3 | Handle: 0x005ceee8 Key origin: CryptGenKey Algorithm: AES-256 (256 bit) CBC mode Encrypted data 1: (Unrecognized data) \xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00\x03\x00\xfe\xff\x09\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x005\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x007\x00\x00\x00\x01\x00\x00\x00\xfe\xff\xff\xff\x00\x00\x00\x004\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff (6372 more characters) Export 1 as PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\xff8\xae\x03\xf9\x7f>\xc9pl\x84Vs\x13\xf9\xcb\x80\x9a-:\x7f/p\xe8\xa4c\xbe\#\xc6i\xa5
Symmetric key 0x005ceee8-4 | Handle: 0x005ceee8 Key origin: CryptGenKey Algorithm: AES-256 (256 bit) CBC mode Encrypted data 1: (Unrecognized data) \xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00\x03\x00\xfe\xff\x09\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x005\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x007\x00\x00\x00\x01\x00\x00\x00\xfe\xff\xff\xff\x00\x00\x00\x004\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff (6372 more characters) Export 1 as PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\x84\x87\x8a\x98\xd5@\x1b\x06\x88.\xe7\xfe=\xf8\x1f%\x1d\xab\x82\xae\x87\xaf\xbf2q`M\x0f\x09\xbd\xaf\xc9
Symmetric key 0x005ceee8-5 | Handle: 0x005ceee8 Key origin: CryptGenKey Algorithm: AES-256 (256 bit) CBC mode Encrypted data 1: (Unrecognized data) \xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00\x03\x00\xfe\xff\x09\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x005\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x007\x00\x00\x00\x01\x00\x00\x00\xfe\xff\xff\xff\x00\x00\x00\x004\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff (6372 more characters) Export 1 as PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\xebU5!\xea\xc4\x9f\xfc\x802\x05lN\x08;j\xc7JBf\xf4&`D%\x1e(u\x17\x94\xcfm
Symmetric key 0x005ceee8-6 | Handle: 0x005ceee8 Key origin: CryptGenKey Algorithm: AES-256 (256 bit) CBC mode Encrypted data 1: (Unrecognized data) \xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00\x03\x00\xfe\xff\x09\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x005\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x007\x00\x00\x00\x01\x00\x00\x00\xfe\xff\xff\xff\x00\x00\x00\x004\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff (6372 more characters) Export 1 as PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\x06\xf4<\x03\x0ac*\xf4\x09#\x0fH\xde\xdc)\x84\xb3\xa7\xa7\x84\xcb\x95\xc25\xb7P\xb7\x0a\xb3t\xd4\x18
Symmetric key 0x005ceee8-7 | Handle: 0x005ceee8 Key origin: CryptGenKey Algorithm: AES-256 (256 bit) CBC mode Encrypted data 1: (Unrecognized data) \xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00\x03\x00\xfe\xff\x09\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x005\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x007\x00\x00\x00\x01\x00\x00\x00\xfe\xff\xff\xff\x00\x00\x00\x004\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff (6372 more characters) Export 1 as PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\x9bX\xdf\xf2\x1a\xc7+\xce`\x84k\x83e.!\xc6\xeb<\xe3\x8a\x12\xcc\x80\x83\x1e\xf4-\xe2\x80J\xb4\x7f
Symmetric key 0x005ceee8-8 | Handle: 0x005ceee8 Key origin: CryptGenKey Algorithm: AES-256 (256 bit) CBC mode Encrypted data 1: (Unrecognized data) \xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00\x03\x00\xfe\xff\x09\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x005\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x007\x00\x00\x00\x01\x00\x00\x00\xfe\xff\xff\xff\x00\x00\x00\x004\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff (6372 more characters) Export 1 as PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\xd2\xd6\x84`XH\xf6bd\x0fV\x05|\x91R\x86V"\xbf\x16U<\xcd6\xd9>\xb2A\xf3\x05\x92\x7f
Symmetric key 0x005ceee8-9 | Handle: 0x005ceee8 Key origin: CryptGenKey Algorithm: AES-256 (256 bit) CBC mode Encrypted data 1: (Unrecognized data) \xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00\x03\x00\xfe\xff\x09\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x005\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x007\x00\x00\x00\x01\x00\x00\x00\xfe\xff\xff\xff\x00\x00\x00\x004\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff (6372 more characters) Export 1 as PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00=\xe1\x9d!\xb2\xae0\xe8w\xc6\x9b\x00\xa3\x10a\x1aP\x84p\x1a0K\xd19\xcc0\xe2`\xda\xb2\x8b\xe3
Symmetric key 0x005ceee8-10 | Handle: 0x005ceee8 Key origin: CryptGenKey Algorithm: AES-256 (256 bit) CBC mode Encrypted data 1: (Unrecognized data) \xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00\x03\x00\xfe\xff\x09\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x005\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x007\x00\x00\x00\x01\x00\x00\x00\xfe\xff\xff\xff\x00\x00\x00\x004\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff (6372 more characters) Export 1 as PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00?*\x8e&\xaf\x19O!4\xda\x03\xc8\xa8\xdd\x0e\xf0\xc0w\x11JGw\x91\x05BV\xff\x8c\xf8p\xd9\xb9
Symmetric key 0x005ceee8-11 | Handle: 0x005ceee8 Key origin: CryptGenKey Algorithm: AES-256 (256 bit) CBC mode Encrypted data 1: (Unrecognized data) \xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00\x03\x00\xfe\xff\x09\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x005\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x007\x00\x00\x00\x01\x00\x00\x00\xfe\xff\xff\xff\x00\x00\x00\x004\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff (6372 more characters) Export 1 as PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00c\\xf4\xb4{\xc5\xc2z\xf3\x85\x93\xe8w6\x8bb?4\x10\xea\x19U\xb8\xce\xba\xe1\x14L(\xa2\x905
Symmetric key 0x005ceee8-12 | Handle: 0x005ceee8 Key origin: CryptGenKey Algorithm: AES-256 (256 bit) CBC mode Encrypted data 1: (Unrecognized data) \xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00\x03\x00\xfe\xff\x09\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x005\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x007\x00\x00\x00\x01\x00\x00\x00\xfe\xff\xff\xff\x00\x00\x00\x004\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff (6372 more characters) Export 1 as PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\xe7\xe0q\xe7\xfbT\xeb&\xc6"}\xe0\xf1e/]\xe64k\xce>\x8f\x0d\x81\xfc"\xa7\xcdM%\xaa\xd2
Symmetric key 0x005ceee8-13 | Handle: 0x005ceee8 Key origin: CryptGenKey Algorithm: AES-256 (256 bit) CBC mode Encrypted data 1: (Unrecognized data) \xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00\x03\x00\xfe\xff\x09\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00e\x00\x00\x00\x01\x00\x00\x00\xfe\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x (7026 more characters) Export 1 as PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00d\x86[%\xc9\xca[\x14\xeebz\xedk2\xf5\x01\xc7\xd1\xa6\x82\x87\xcc\x850\xc9/\x12\x98\xb7w\x16q
Symmetric key 0x005ceee8-14 | Handle: 0x005ceee8 Key origin: CryptGenKey Algorithm: AES-256 (256 bit) CBC mode Encrypted data 1: (Unrecognized data) \xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00\x03\x00\xfe\xff\x09\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00e\x00\x00\x00\x01\x00\x00\x00\xfe\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x (7020 more characters) Export 1 as PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00Sl\xa33vH\x16\xf3\xc3Z\x84VG\xf8\xdew\x13\x8c\x8b\xa4J\xbax^D\xa4\x861\x05\x80\xda\xac
Symmetric key 0x005ceee8-15 | Handle: 0x005ceee8 Key origin: CryptGenKey Algorithm: AES-256 (256 bit) CBC mode Encrypted data 1: (Unrecognized data) \xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00\x03\x00\xfe\xff\x09\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00e\x00\x00\x00\x01\x00\x00\x00\xfe\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x (7023 more characters) Export 1 as PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00vv\xa8\xe8(\x0b\xaf\x10;\x9c\xb0yMi\xe0w\x00\xec\x02!\xd3m?{\x13\xf4\x80\xd1\xe0&\xef\xb3
Symmetric key 0x005ceee8-16 | Handle: 0x005ceee8 Key origin: CryptGenKey Algorithm: AES-256 (256 bit) CBC mode Encrypted data 1: (Unrecognized data) \xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00\x03\x00\xfe\xff\x09\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00e\x00\x00\x00\x01\x00\x00\x00\xfe\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x (7026 more characters) Export 1 as PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\xec\x08h\x9fG\xf5\x1f\xa7\xfeD\xe9\x0c\xc0\x88\xa4\x96f]\xb5q\xc8\xaf\\x09j\xe6\xc8a\xfe:zm
Symmetric key 0x005ceee8-17 | Handle: 0x005ceee8 Key origin: CryptGenKey Algorithm: AES-256 (256 bit) CBC mode Encrypted data 1: (Unrecognized data) \xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00\x03\x00\xfe\xff\x09\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00e\x00\x00\x00\x01\x00\x00\x00\xfe\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x (7020 more characters) Export 1 as PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00Z9G[\xd3\xf7\xaax\xacv\x1df\x145\xdbf\xef-\xd3\xa8\xbf\xaa\x92\xed^\xa7[\x9a9\xe0\xfe\xbb
Symmetric key 0x005ceee8-18 | Handle: 0x005ceee8 Key origin: CryptGenKey Algorithm: AES-256 (256 bit) CBC mode Encrypted data 1: (Unrecognized data) \xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00\x03\x00\xfe\xff\x09\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00e\x00\x00\x00\x01\x00\x00\x00\xfe\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x (7026 more characters) Export 1 as PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\xee/\x80A\xaf*\xdd\x09Z\xe9-\xba\xd0X\xbb\x07V\xe1D\x8f\xc4\x15g\xf7\xe2\x8d\x85OWo\xdc\x1a
Symmetric key 0x005ceee8-19 | Handle: 0x005ceee8 Key origin: CryptGenKey Algorithm: AES-256 (256 bit) CBC mode Encrypted data 1: (Unrecognized data) \xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00\x03\x00\xfe\xff\x09\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00e\x00\x00\x00\x01\x00\x00\x00\xfe\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x (7026 more characters) Export 1 as PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\xb1\xba\x14\x81L\xae\xe5/s{c5\xd1\x04V3\x18\x81\x8d(\xe8\x12\xa5\x0df\x0e\x97;\x89\xda\xec\x0e
Symmetric key 0x005ceee8-20 | Handle: 0x005ceee8 Key origin: CryptGenKey Algorithm: AES-256 (256 bit) CBC mode Encrypted data 1: (Unrecognized data) \xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00\x03\x00\xfe\xff\x09\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00e\x00\x00\x00\x01\x00\x00\x00\xfe\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x (7020 more characters) Export 1 as PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00{#\xcbB\xd3\xcd\xce\x0a'\xb7i\x93k\xa7-\xca\xcc\xc0\xdb\xfe4\xc1\xea\x0c\xaa"\xd9\x16\xd4C\x87\x1f
Symmetric key 0x005ceee8-21 | Handle: 0x005ceee8 Key origin: CryptGenKey Algorithm: AES-256 (256 bit) CBC mode Encrypted data 1: (Unrecognized data) \xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00\x03\x00\xfe\xff\x09\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00e\x00\x00\x00\x01\x00\x00\x00\xfe\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x (7026 more characters) Export 1 as PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x007\xd1\xba[\xce\xff\xfa\x84\xe4\xe9\x11N\xec\xec\xbbFM`\x17-\xb0\x16\xfed\x9b\x18\x13,I\x8f\xa0o
Symmetric key 0x005ceee8-22 | Handle: 0x005ceee8 Key origin: CryptGenKey Algorithm: AES-256 (256 bit) CBC mode Encrypted data 1: (Unrecognized data) \xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00\x03\x00\xfe\xff\x09\x00\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00e\x00\x00\x00\x01\x00\x00\x00\xfe\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x (7023 more characters) Export 1 as PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00(\xaf\x00\x91j\xa3\xf6\xa2#Y#b\xe9\x89Tt\xe2\x11a\xff;\x0dB#\xc4\xd6\xf2\x18\xe5\xca\xb7\xcb
Symmetric key 0x005ceee8-23 | Handle: 0x005ceee8 Key origin: CryptGenKey Algorithm: AES-256 (256 bit) CBC mode Encrypted data 1: (Likely JPEG file) \xff\xd8\xff\xe0\x00\x10JFIF\x00\x01\x02\x01\x00`\x00`\x00\x00\xff\xee\x00\x0eAdobe\x00d\x00\x00\x00\x00\x01\xff\xe1\x13]Exif\x00\x00MM\x00*\x00\x00\x00\x08\x00\x07\x012\x00\x02\x00\x00\x00\x14\x00\x00\x00b\x01;\x00\x02\x00\x00\x00\x07\x00\x00\x00vGF\x00\x03\x00\x00\x00\x01\x00\x04\x00\x00GI\x00\x03\x00\x00\x00\x01\x00?\x00\x00\x9c\x9d\x00\x01\x00\x00\x00\x0e\x00\x00\x00\x00\xea\x1c\x00\x07\x00\x00\x08\x0c\x00\x00\x00\x00\x87i\x00\x04\x00\x00\x00\x01\x00\x00\x00}\x00\x00\x00\xe72009:03:12\x2013:46:42\x00Cor (5514 more characters) Export 1 as PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\xf6\\x90{i\xcd/p<\xcd\xe8j\x06\x07#\xe9\x84\xcf.\x16\xc7\xfe\x89]\x8d\x91\xa3\xdc]\x0d\xf2\x9a
Symmetric key 0x005ceee8-24 | Handle: 0x005ceee8 Key origin: CryptGenKey Algorithm: AES-256 (256 bit) CBC mode Encrypted data 1: (Likely JPEG file) \xff\xd8\xff\xe0\x00\x10JFIF\x00\x01\x02\x01\x00`\x00`\x00\x00\xff\xe1\x0f\x07Exif\x00\x00MM\x00*\x00\x00\x00\x08\x00\x06\x012\x00\x02\x00\x00\x00\x14\x00\x00\x00VGF\x00\x03\x00\x00\x00\x01\x00\x03\x00\x00GI\x00\x03\x00\x00\x00\x01\x002\x00\x00\x9c\x9d\x00\x01\x00\x00\x00\x0e\x00\x00\x00\x00\xea\x1c\x00\x07\x00\x00\x07\xf4\x00\x00\x00\x00\x87i\x00\x04\x00\x00\x00\x01\x00\x00\x00j\x00\x00\x00\xd42009:03:12\x2013:47:43\x00\x00\x05\x90\x03\x00\x02\x00\x00\x00\x14\x00\x00\x00\xac\x90\x04\x00\x02\x00\x00\x00\x14 (5520 more characters) Export 1 as PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\xa4Nu\xc6\xba\xb5\xe6qmM\x9a\xd4\x9b@\xd4\xa9\x07g\x922\xe4O\xfb\xea\x1e\x07\xe0%\x9dKDh
Symmetric key 0x005ceee8-25 | Handle: 0x005ceee8 Key origin: CryptGenKey Algorithm: AES-256 (256 bit) CBC mode Encrypted data 1: (Likely JPEG file) \xff\xd8\xff\xe0\x00\x10JFIF\x00\x01\x02\x01\x00`\x00`\x00\x00\xff\xe1\x106Exif\x00\x00MM\x00*\x00\x00\x00\x08\x00\x07\x012\x00\x02\x00\x00\x00\x14\x00\x00\x00bGF\x00\x03\x00\x00\x00\x01\x00\x03\x00\x00GI\x00\x03\x00\x00\x00\x01\x00&\x00\x00\x82\x98\x00\x02\x00\x00\x00\x16\x00\x00\x00v\x9c\x9d\x00\x01\x00\x00\x00\x18\x00\x00\x00\x00\xea\x1c\x00\x07\x00\x00\x07\xd2\x00\x00\x00\x00\x87i\x00\x04\x00\x00\x00\x01\x00\x00\x00\x8c\x00\x00\x00\xf62009:03:12\x2013:48:18\x00Microsoft\x20Corporation\x00\x00\x05\x90\x0 (5517 more characters) Export 1 as PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00[\x83\xf0\x80%5`[\xcf\x1d\xb6G\x08H\xbf\x05\xb7\xf1\xd1\xa6\xb5Q\xac\xf9\xd2@}\xd9\x06"\x9ao
Symmetric key 0x005ceee8-26 | Handle: 0x005ceee8 Key origin: CryptGenKey Algorithm: AES-256 (256 bit) CBC mode Encrypted data 1: (Likely JPEG file) \xff\xd8\xff\xe0\x00\x10JFIF\x00\x01\x02\x01\x00`\x00`\x00\x00\xff\xe1\x0c-Exif\x00\x00MM\x00*\x00\x00\x00\x08\x00\x07\x012\x00\x02\x00\x00\x00\x14\x00\x00\x00bGF\x00\x03\x00\x00\x00\x01\x00\x05\x00\x00GI\x00\x03\x00\x00\x00\x01\x00X\x00\x00\x82\x98\x00\x02\x00\x00\x00\x16\x00\x00\x00v\x9c\x9d\x00\x01\x00\x00\x00\x14\x00\x00\x00\x00\xea\x1c\x00\x07\x00\x00\x07\xd2\x00\x00\x00\x00\x87i\x00\x04\x00\x00\x00\x01\x00\x00\x00\x8c\x00\x00\x00\xf62009:03:12\x2013:48:23\x00Microsoft\x20Corporation\x00\x00\x05\x90\x0 (5463 more characters) Export 1 as PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\x84N42\xc5\x04\xa88\xf6\xd9\xb7,\x98\x9e\xef\x12\xa7\xa1\\x15\x9c\xbdZ\xf4\xb0\x87.g\xf3wqU
Symmetric key 0x005ceee8-27 | Handle: 0x005ceee8 Key origin: CryptGenKey Algorithm: AES-256 (256 bit) CBC mode Encrypted data 1: (Likely JPEG file) \xff\xd8\xff\xe0\x00\x10JFIF\x00\x01\x02\x01\x00`\x00`\x00\x00\xff\xee\x00\x0eAdobe\x00d\x00\x00\x00\x00\x01\xff\xe1\x14#Exif\x00\x00MM\x00*\x00\x00\x00\x08\x00\x07\x012\x00\x02\x00\x00\x00\x14\x00\x00\x00b\x01;\x00\x02\x00\x00\x00\x07\x00\x00\x00vGF\x00\x03\x00\x00\x00\x01\x00\x04\x00\x00GI\x00\x03\x00\x00\x00\x01\x00?\x00\x00\x9c\x9d\x00\x01\x00\x00\x00\x0e\x00\x00\x00\x00\xea\x1c\x00\x07\x00\x00\x07\xf4\x00\x00\x00\x00\x87i\x00\x04\x00\x00\x00\x01\x00\x00\x00}\x00\x00\x00\xe72009:03:12\x2013:48:28\x00Cor (5436 more characters) Export 1 as PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00"\xddHi\xf55j\x1e\x80\x00cw\x84\xa7W\x18\x1a#\x18\xeaDd\x92\xc4R\x18a\xf4\xcb\x1e\xc6\x9a
Additional symmetric keys | 3 additional symmetric keys used

Runs mshta.exe what is sometimes used to display ransom demand
cmd: "C:\Windows\System32\mshta.exe" "C:\Users\John\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\README_eGUiKSAmJi.hta"
Encrypts exported Crypto API key
Key handle-index 0x005ceca8-0: 1 previously exported keys encrypted
Key handle-index 0x005cece8-0: 32 previously exported keys encrypted
Performs Crypto API operations with keys or hashes

A process created a hidden window
Process: JyjxepxjTCgv.exe -> wmic.exe
The binary likely contains encrypted or compressed data.
section: name: .rsrc, entropy: 6.99, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x00020c00, virtual_size: 0x00020b8a
Executed a process and injected code into it, probably while unpacking
Injection: JyjxepxjTCgv.exe(800) -> JyjxepxjTCgv.exe(1364)
Attempts to remove evidence of file being downloaded from the Internet
file: C:\Users\John\AppData\Local\Temp\JyjxepxjTCgv.exe:Zone.Identifier
Attempts to delete volume shadow copies

Attempts to execute a binary from a dead or sinkholed URL
dead_binary: c:\users\john\appdata\roaming\microsoft\windows\start menu\programs\startup\readme_eguiksamji.hta
Installs itself for autorun at Windows startup
file: C:\Users\John\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\README_eGUiKSAmJi.hta
file: C:\Users\John\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\README_eGUiKSAmJi.hta
Harvests information related to installed mail clients
key: HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Microsoft Outlook\Capabilities\Hidden
key: HKEY_LOCAL_MACHINE\Software\Clients\Mail\Microsoft Outlook\Capabilities
key: HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Microsoft Outlook\Capabilities\FileAssociations
Anomalous binary characteristics
anomaly: Actual checksum does not match that reported in PE header

#### Screenshots

#### Hosts

Direct | IP | Country Name
--- | --- | ---
Y | 89.248.161.15 [VT] | Netherlands
Y | 8.8.8.8 [VT] | United States
N | 51.140.127.197 [VT] | United Kingdom

#### DNS

Name | Response | Post-Analysis Lookup
--- | --- | ---
time.windows.com [VT] | A 51.140.127.197 [VT] CNAME time.microsoft.akadns.net [VT] |

#### PE Information

Image Base | 0x03000000
Entry Point | 0x03001609
Reported Checksum | 0x00038e48
Actual Checksum | 0x0002f924
Minimum OS Version | 5.0
Compile Time | 2017-08-02 15:51:44
Import Hash | 824fcfdfa1f8371a52bb4e5d2a9a3d30
Icon |
Icon Exact Hash | 0b4018a1916e4b943bf5850d6c683bf4
Icon Similarity Hash | 609f7913e94ac8c729c9e236d52771c5

#### Sections

Name | Virtual Address | Virtual Size | Size of Raw Data | Characteristics | Entropy
--- | --- | --- | --- | --- | ---
.text | 0x00001000 | 0x00006740 | 0x00006800 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ | 6.58
.rdata | 0x00008000 | 0x00002474 | 0x00002600 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 5.48
.data | 0x0000b000 | 0x0000447c | 0x00000e00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 2.33
.rsrc | 0x00010000 | 0x00020b8a | 0x00020c00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 6.99

#### Overlay

Offset | 0x0002ac00
Size | 0x000001b1

#### Resources

Name | Offset | Size | Language | Sub-language | Entropy | File type
--- | --- | --- | --- | --- | --- | ---
RT_BITMAP | 0x00025a70 | 0x00005dd0 | LANG_NEUTRAL | SUBLANG_NEUTRAL | 3.45 | data
RT_BITMAP | 0x00025a70 | 0x00005dd0 | LANG_NEUTRAL | SUBLANG_NEUTRAL | 3.45 | data
RT_BITMAP | 0x00025a70 | 0x00005dd0 | LANG_NEUTRAL | SUBLANG_NEUTRAL | 3.45 | data
RT_ICON | 0x0002c8e8 | 0x00004228 | LANG_NEUTRAL | SUBLANG_NEUTRAL | 7.00 | data
RT_ICON | 0x0002c8e8 | 0x00004228 | LANG_NEUTRAL | SUBLANG_NEUTRAL | 7.00 | data
RT_ACCELERATOR | 0x00030b10 | 0x00000058 | LANG_NEUTRAL | SUBLANG_NEUTRAL | 2.78 | data
RT_GROUP_ICON | 0x00030b68 | 0x00000022 | LANG_NEUTRAL | SUBLANG_NEUTRAL | 2.29 | data

#### Imports

Library KERNEL32.dll:
• 0x3008000 FindAtomA
• 0x3008004 lstrlenA
• 0x3008008 ExitThread
• 0x300800c GlobalAlloc
• 0x3008010 GetProcAddress
• 0x3008014 LoadLibraryW
• 0x3008018 GetCPInfo
• 0x300801c GetSystemTimeAdjustment
• 0x3008020 LCMapStringW
• 0x3008024 LCMapStringA
• 0x3008028 RtlUnwind
• 0x300802c GetCommandLineA
• 0x3008030 GetStartupInfoA
• 0x3008034 HeapAlloc
• 0x3008038 GetLastError
• 0x300803c HeapFree
• 0x3008040 TerminateProcess
• 0x3008044 GetCurrentProcess
• 0x3008048 UnhandledExceptionFilter
• 0x300804c SetUnhandledExceptionFilter
• 0x3008050 IsDebuggerPresent
• 0x3008054 GetModuleHandleW
• 0x3008058 TlsGetValue
• 0x300805c TlsAlloc
• 0x3008060 TlsSetValue
• 0x3008064 TlsFree
• 0x3008068 InterlockedIncrement
• 0x300806c SetLastError
• 0x3008070 GetCurrentThreadId
• 0x3008074 InterlockedDecrement
• 0x3008078 Sleep
• 0x300807c ExitProcess
• 0x3008080 WriteFile
• 0x3008084 GetStdHandle
• 0x3008088 GetModuleFileNameA
• 0x300808c FreeEnvironmentStringsA
• 0x3008090 GetEnvironmentStrings
• 0x3008094 FreeEnvironmentStringsW
• 0x3008098 WideCharToMultiByte
• 0x300809c GetEnvironmentStringsW
• 0x30080a0 SetHandleCount
• 0x30080a4 GetFileType
• 0x30080a8 DeleteCriticalSection
• 0x30080ac HeapCreate
• 0x30080b0 VirtualFree
• 0x30080b4 QueryPerformanceCounter
• 0x30080b8 GetTickCount
• 0x30080bc GetCurrentProcessId
• 0x30080c0 GetSystemTimeAsFileTime
• 0x30080c4 LeaveCriticalSection
• 0x30080c8 EnterCriticalSection
• 0x30080cc VirtualAlloc
• 0x30080d0 HeapReAlloc
• 0x30080d4 HeapSize
• 0x30080d8 GetACP
• 0x30080dc GetOEMCP
• 0x30080e0 IsValidCodePage
• 0x30080e4 LoadLibraryA
• 0x30080e8 InitializeCriticalSectionAndSpinCount
• 0x30080ec GetLocaleInfoA
• 0x30080f0 GetStringTypeA
• 0x30080f4 MultiByteToWideChar
• 0x30080f8 GetStringTypeW
Library USER32.dll:
• 0x3008100 GetMonitorInfoA
• 0x3008104 ShowWindow
• 0x3008108 UpdateWindow
• 0x300810c FindWindowW
• 0x3008110 GetMessageExtraInfo

.text
`.rdata
@.data
.rsrc
PQRh90
YQPVh
uBh|8
URPQQh\I
SVWUj
bad allocation
BBBBBBBBBB@BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB>BBB?456789:;<=BBBABBB
!"#$%&'()*+,-./0123BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBk
VirtualProtect
bad allocation
EncodePointer
DecodePointer
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
CorExitProcess
runtime error
Microsoft Visual C++ Runtime Library
<program name unknown>
Program:
Complete Object Locator'
Class Hierarchy Descriptor'
Base Class Array'
Base Class Descriptor at (
Type Descriptor'
`local static thread guard'
`managed vector copy constructor iterator'
`vector vbase copy constructor iterator'
`vector copy constructor iterator'
`dynamic atexit destructor for '
`dynamic initializer for '
`eh vector vbase copy constructor iterator'
`eh vector copy constructor iterator'
`managed vector destructor iterator'
`managed vector constructor iterator'
`placement delete[] closure'
`placement delete closure'
`omni callsig'
delete[]
new[]
`local vftable constructor closure'
`local vftable'
`RTTI
`udt returning'
`copy constructor closure'
`eh vector vbase constructor iterator'
`eh vector destructor iterator'
`eh vector constructor iterator'
`virtual displacement map'
`vector vbase constructor iterator'
`vector destructor iterator'
`vector constructor iterator'
`scalar deleting destructor'
`default constructor closure'
`vector deleting destructor'
`vbase destructor'
`string'
`local static guard'
`typeof'
`vcall'
`vbtable'
`vftable'
operator
delete
__unaligned
__restrict
__ptr64
__clrcall
__fastcall
__thiscall
__stdcall
__pascal
__cdecl
__based(
GetProcessWindowStation
GetUserObjectInformationA
GetLastActivePopup
GetActiveWindow
MessageBoxA
USER32.DLL
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
April
March
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
FindAtomA
lstrlenA
ExitThread
GlobalAlloc
GetProcAddress
LoadLibraryW
GetCPInfo
GetSystemTimeAdjustment
KERNEL32.dll
FindWindowW
UpdateWindow
ShowWindow
GetMonitorInfoA
GetMessageExtraInfo
USER32.dll
RtlUnwind
GetCommandLineA
GetStartupInfoA
HeapAlloc
GetLastError
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
HeapSize
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
~"PV"PV
kx"PV
kx"PV
kernel32.dll
KERNEL32.DLL
mscoree.dll

#### Process Tree

- JyjxepxjTCgv.exe 800

- JyjxepxjTCgv.exe 1364

- WMIC.exe 2360 process call create "cmd.exe /c vssadmin.exe delete shadows /quiet /all"
- mshta.exe 2448 "C:\Users\John\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\README_eGUiKSAmJi.hta"

- services.exe 460

- svchost.exe 592 -k DcomLaunch

- WmiPrvSE.exe 3244 -secured -Embedding

- cmd.exe 3564 cmd.exe /c vssadmin.exe delete shadows /quiet /all

- vssadmin.exe 3664 vssadmin.exe delete shadows /quiet /all

- svchost.exe 2844 -k netsvcs
- VSSVC.exe 3844
- svchost.exe 3980 -k swprv

Search term
JyjxepxjTCgv.exe, PID: 800, Parent PID: 2008
Full Path: C:\Users\John\AppData\Local\Temp\JyjxepxjTCgv.exe
Command Line: "C:\Users\John\AppData\Local\Temp\JyjxepxjTCgv.exe"
default registry filesystem network process threading services device synchronization crypto browser all
API Filter

- 1

Error loading data. Please reload the page and if the error persists contact us.

- 1

JyjxepxjTCgv.exe, PID: 1364, Parent PID: 800
Full Path: C:\Users\John\AppData\Local\Temp\JyjxepxjTCgv.exe
Command Line: "C:\Users\John\AppData\Local\Temp\JyjxepxjTCgv.exe"
default registry filesystem network process threading services device synchronization crypto browser all
API Filter

- 1
- 2
- 3
- 4
- 5
- 6
- ...
- 100

Error loading data. Please reload the page and if the error persists contact us.

- 1
- 2
- 3
- 4
- 5
- 6
- ...
- 100

WMIC.exe, PID: 2360, Parent PID: 1364
Full Path: C:\Windows\System32\wbem\WMIC.exe
Command Line: "C:\Windows\System32\wbem\WMIC.exe" process call create "cmd.exe /c vssadmin.exe delete shadows /quiet /all"
default registry filesystem network process threading services device synchronization crypto browser all
API Filter

- 1
- 2
- 3
- 4
- 5
- 6

Error loading data. Please reload the page and if the error persists contact us.

- 1
- 2
- 3
- 4
- 5
- 6

mshta.exe, PID: 2448, Parent PID: 1364
Full Path: C:\Windows\System32\mshta.exe
Command Line: "C:\Windows\System32\mshta.exe" "C:\Users\John\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\README_eGUiKSAmJi.hta"
default registry filesystem network process threading services device synchronization crypto browser all
API Filter

- 1
- 2
- 3
- 4
- 5
- 6
- ...
- 18

Error loading data. Please reload the page and if the error persists contact us.

- 1
- 2
- 3
- 4
- 5
- 6
- ...
- 18

svchost.exe, PID: 592, Parent PID: 460
Full Path: C:\Windows\System32\svchost.exe
Command Line: C:\Windows\system32\svchost.exe -k DcomLaunch
default registry filesystem network process threading services device synchronization crypto browser all
API Filter

- 1
- 2
- 3
- 4
- 5
- 6

Error loading data. Please reload the page and if the error persists contact us.

- 1
- 2
- 3
- 4
- 5
- 6

svchost.exe, PID: 2844, Parent PID: 460
Full Path: C:\Windows\System32\svchost.exe
Command Line: C:\Windows\system32\svchost.exe -k netsvcs
default registry filesystem network process threading services device synchronization crypto browser all
API Filter

- 1
- 2
- 3
- 4
- 5
- 6
- ...
- 36

Error loading data. Please reload the page and if the error persists contact us.

- 1
- 2
- 3
- 4
- 5
- 6
- ...
- 36

WmiPrvSE.exe, PID: 3244, Parent PID: 592
Full Path: C:\Windows\System32\wbem\WmiPrvSE.exe
Command Line: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
default registry filesystem network process threading services device synchronization crypto browser all
API Filter

- 1
- 2
- 3
- 4
- 5
- 6
- ...
- 11

Error loading data. Please reload the page and if the error persists contact us.

- 1
- 2
- 3
- 4
- 5
- 6
- ...
- 11

cmd.exe, PID: 3564, Parent PID: 3244
Full Path: C:\Windows\System32\cmd.exe
Command Line: cmd.exe /c vssadmin.exe delete shadows /quiet /all
default registry filesystem network process threading services device synchronization crypto browser all
API Filter

- 1

Error loading data. Please reload the page and if the error persists contact us.

- 1

vssadmin.exe, PID: 3664, Parent PID: 3564
Full Path: C:\Windows\System32\vssadmin.exe
Command Line: vssadmin.exe delete shadows /quiet /all
default registry filesystem network process threading services device synchronization crypto browser all
API Filter

- 1
- 2

Error loading data. Please reload the page and if the error persists contact us.

- 1
- 2

services.exe, PID: 460, Parent PID: 368
Full Path: C:\Windows\System32\services.exe
Command Line: C:\Windows\system32\services.exe
default registry filesystem network process threading services device synchronization crypto browser all
API Filter

- 1
- 2
- 3
- 4

Error loading data. Please reload the page and if the error persists contact us.

- 1
- 2
- 3
- 4

VSSVC.exe, PID: 3844, Parent PID: 460
Full Path: C:\Windows\System32\VSSVC.exe
Command Line: C:\Windows\system32\vssvc.exe
default registry filesystem network process threading services device synchronization crypto browser all
API Filter

- 1
- 2
- 3
- 4
- 5
- 6
- ...
- 15

Error loading data. Please reload the page and if the error persists contact us.

- 1
- 2
- 3
- 4
- 5
- 6
- ...
- 15

svchost.exe, PID: 3980, Parent PID: 460
Full Path: C:\Windows\System32\svchost.exe
Command Line: C:\Windows\System32\svchost.exe -k swprv
default registry filesystem network process threading services device synchronization crypto browser all
API Filter

- 1
- 2
- 3
- 4
- 5
- 6
- ...
- 54

Error loading data. Please reload the page and if the error persists contact us.

- 1
- 2
- 3
- 4
- 5
- 6
- ...
- 54

Download PCAP

#### Hosts

Direct | IP | Country Name
--- | --- | ---
Y | 89.248.161.15 [VT] | Netherlands
Y | 8.8.8.8 [VT] | United States
N | 51.140.127.197 [VT] | United Kingdom

#### TCP

No TCP connections recorded.

#### UDP

Source | Source Port | Destination | Destination Port
--- | --- | --- | ---
192.168.1.101 | 137 | 192.168.1.255 | 137
192.168.1.101 | 123 | 51.140.127.197 time.windows.com | 123
192.168.1.101 | 61816 | 8.8.8.8 | 53

- 192.168.1.101:137 → 192.168.1.255:137

      00000000: cb28 2910 0001 0000 0000 0001 2045 4b45  .()..........EKE
      00000010: 5045 4945 4f43 4e46 4145 4443 4143 4143  PEIEOCNFAEDCACAC
      00000020: 4143 4143 4143 4143 4143 4141 4100 0020  ACACACACACAAA...
      00000030: 0001 c00c 0020 0001 0004 93e0 0006 0000  ................
      00000040: c0a8 0165                                ...e

#### DNS

Name | Response | Post-Analysis Lookup
--- | --- | ---
time.windows.com [VT] | A 51.140.127.197 [VT] CNAME time.microsoft.akadns.net [VT] |

#### HTTP Requests

No HTTP requests performed.

#### SMTP traffic

No SMTP traffic performed.

#### IRC traffic

No IRC requests performed.

#### ICMP traffic

No ICMP traffic performed.

#### CIF Results

No CIF Results

#### Suricata Alerts

No Suricata Alerts

#### Suricata TLS

No Suricata TLS

#### Suricata HTTP

No Suricata HTTP

Sorry! No dropped Suricata Extracted files.

File name | letterlegal5.doc
Associated Filenames | C:\Users\John\Downloads\letterlegal5.doc
File Size | 30786 bytes
File Type | data
MD5 | 6c57d327870b905288d40b6f87ba7ece
SHA1 | 554bd903ef71c65c39c3b6cbb377bd423de75854
SHA256 | 742f58dfa808cd0a2be7d072db6da0d8db67b8a6f97bed070b874491163c028e
CRC32 | 0C6E5D3C
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | Tulips.jpg
Associated Filenames | C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg
File Size | 621978 bytes
File Type | data
MD5 | 4e0e188dd5b7d37e5a56eb2ca9a90174
SHA1 | 9d534f69f6e412a71ca521120fe04053706c194e
SHA256 | a73377564c5967c7e47120599a1cb9438710434ce3d6277d6b7e67208aa42337
CRC32 | 9113848C
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | QTL_Sample_data.xls
Associated Filenames | C:\Users\John\Downloads\QTL_Sample_data.xls
File Size | 55362 bytes
File Type | data
MD5 | 84912a76433850f89914e96a680854af
SHA1 | ecb6d41583086bdf97b01fc41fc3a8e042337dce
SHA256 | 1ddd20698cbae5215cebb01810f7be3aea68218ac5b70abfe2a297be555077bd
CRC32 | 32F2FEF6
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | icon_4.png
Associated Filenames | C:\Users\John\AppData\Local\Temp\icon_4.png
File Size | 1590 bytes
File Type | PNG image data, 48 x 48, 8-bit colormap, non-interlaced
MD5 | 84e2e535c9c48e24112c777ce78d25b8
SHA1 | 9741404c6715b46795cf675ac5c837670e8924c3
SHA256 | 29747e39377d2bc73ecf262545b9339703e36e60e31404f72e94e9e1d27cfe70
CRC32 | 1EE911F0
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | README_eGUiKSAmJi.hta
Associated Filenames | C:\a\README_eGUiKSAmJi.hta C:\Users\John\Desktop\README_eGUiKSAmJi.hta C:\Users\John\Downloads\README_eGUiKSAmJi.hta C:\Users\Public\Pictures\Sample Pictures\README_eGUiKSAmJi.hta C:\Users\John\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\README_eGUiKSAmJi.hta
File Size | 11028 bytes
File Type | HTML document, ISO-8859 text, with very long lines, with no line terminators
MD5 | 1ae2dc01ba5bb6567e0e81779155c003
SHA1 | 3cabb865af5b4aeed6090003ea7416cc52f4c945
SHA256 | f3093803de874392a34b5fd9c218a5b1597cc19630bf56ec26c8d781e28b5e0b
CRC32 | C63AF820
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | QTL_Sample_data - Copy (6).xls
Associated Filenames | C:\Users\John\Downloads\QTL_Sample_data - Copy (6).xls
File Size | 55362 bytes
File Type | data
MD5 | c036710c606cf37aa4d66cf8947af7f8
SHA1 | 8d87b7967f775a05ce3f9030ff3eb92848408adc
SHA256 | 9573d80ccba13954912e08e4fa2d9b6ab5c3afd89611636f2b31f17a5adb5f96
CRC32 | B70D1635
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | foobar.jpg
Associated Filenames | C:\Users\John\Desktop\foobar.jpg
File Size | 43818 bytes
File Type | data
MD5 | fd653953a102daa5983e0ae465d9188e
SHA1 | a0d2c5fbed2ef9d4ea0dfc3ec6796c6c5360d61b
SHA256 | 40f9c484a8d0f2e80884ee40abce6c17aa49edc22116a6fb8fc898d1be129f9f
CRC32 | AEF991FB
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | letterlegal5 - Copy (3).doc
Associated Filenames | C:\Users\John\Downloads\letterlegal5 - Copy (3).doc
File Size | 30786 bytes
File Type | data
MD5 | e704bc1fd5aad7afe8b5540b48ee6d0c
SHA1 | 54d97215b67bd0e517c5d5d00da8e45b1c98d90a
SHA256 | 799de7f2e255fb348b20f84a9fb04b52c222fe2da0cde5c3a256a8192e8ce0a4
CRC32 | 324F9CAC
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | foobar.jpg
Associated Filenames | C:\a\foobar.jpg
File Size | 43818 bytes
File Type | data
MD5 | dbc3af7d54b7153d2e8b60d66e767929
SHA1 | a1ee39b9e166d8ae253edaec0b6af8df8a881dfe
SHA256 | 05e3407f43d7616a5afe26186c1e5ea1e2eb2887c552539de5467fc0dbc45b55
CRC32 | 6E5D0DFE
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | QTL_Sample_data - Copy (4).xls
Associated Filenames | C:\Users\John\Downloads\QTL_Sample_data - Copy (4).xls
File Size | 55362 bytes
File Type | data
MD5 | f345a1457e6cc483c9c7eca964886d5e
SHA1 | b18030d42316b0c8c8af7809d21baf7962a9f1d5
SHA256 | 85a3b9c1066b5c345e0397e1f0fc7a347a873a32ef716842da39144093a6f8c6
CRC32 | 6006A437
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | Desert.jpg
Associated Filenames | C:\Users\Public\Pictures\Sample Pictures\Desert.jpg
File Size | 847031 bytes
File Type | data
MD5 | 3e67a44152fb377463c5c4b728563bff
SHA1 | 8abb7e4a777c6e6ebfebc402cc916d5944d88483
SHA256 | 5a34c2336c330b2ef67452d742075406ddb34f67ef2742b9279c7382db6ad191
CRC32 | E9B4D093
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | fp_15.0.0.152_archive.zip
Associated Filenames | C:\Users\John\Downloads\fp_15.0.0.152_archive.zip
File Size | 104857615 bytes
File Type | data
MD5 | 89dfd794a5f8c7bde5d7666c1b7c6618
SHA1 | b8eb999cdddd644a5d1c3dc4b137373e4e2f392f
SHA256 | cd98d0b290f3375c4614ff8789df8c962a3953c369b526ad5951b012ef4374cd
CRC32 | 7B8D5E79
Ssdeep | None
ClamAV | None
Yara | shellcode - Matched shellcode byte patterns
| None matched
VirusTotal | Search for Analysis
| Download

File name | letterlegal5 - Copy.doc
Associated Filenames | C:\Users\John\Downloads\letterlegal5 - Copy.doc
File Size | 30786 bytes
File Type | data
MD5 | 1d4d5498bf5af37a38c2f2de09979b05
SHA1 | 93040bbbd352575d6e71b87c826f80db213ca51e
SHA256 | 0d875db335b795f95a2f63b7a939031ae2e133db071c7ec43aedbaa9284b3fd9
CRC32 | 1C08CF65
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | letterlegal5 - Copy (2).doc
Associated Filenames | C:\Users\John\Downloads\letterlegal5 - Copy (2).doc
File Size | 30786 bytes
File Type | data
MD5 | 9daa6765a4355e008326f963384deac5
SHA1 | cf7788b1e8b6377ab05fc89b16839f626ace7c89
SHA256 | 3260f79bb2e23fa5a1a1e7c29943318a9feeec2d8dfcf0626d404079cbbb010c
CRC32 | A34D3050
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | Jellyfish.jpg
Associated Filenames | C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
File Size | 776792 bytes
File Type | data
MD5 | b5164e6047ef8f9b80e46020f5244912
SHA1 | 6ed8fd6cbdd5615a586f97c998e230b72a13c609
SHA256 | 0c76bdd15ee711a47fde9e42ff4ec157cb170c62e115381d9e800bf5f18f1ce7
CRC32 | DFA940C8
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | icon_3.png
Associated Filenames | C:\Users\John\AppData\Local\Temp\icon_3.png
File Size | 1715 bytes
File Type | PNG image data, 48 x 48, 8-bit colormap, non-interlaced
MD5 | 0507522b4e8184ce7bf12c47886acac5
SHA1 | e7306b67cbfb2e9967eaeee8dd4d986ada494229
SHA256 | c6c78898486e6ddc1cd198cf48c5f608e70d1f21df68a00eefa6af56dae763bb
CRC32 | F30C3AE2
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | icon_2.png
Associated Filenames | C:\Users\John\AppData\Local\Temp\icon_2.png
File Size | 952 bytes
File Type | PNG image data, 24 x 24, 8-bit colormap, non-interlaced
MD5 | c4d0c029a3df51ba935ccf6b3f79e3ec
SHA1 | 5671536e748150e57dbafbdbed0a567a080ec231
SHA256 | cde78257bff838256d0743255b5ad3aac6f5f7eab70dffbcd1c4a3bf8c80532a
CRC32 | 33DEF1F6
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | letterlegal5 - Copy (9).doc
Associated Filenames | C:\Users\John\Downloads\letterlegal5 - Copy (9).doc
File Size | 30786 bytes
File Type | data
MD5 | b8f4750b454c67468ace1d7f97adccb2
SHA1 | b2d4eb77ae77f2ee87b74d112a4ba074112f15da
SHA256 | 029cd4ceafa63f7bd8d92c60d5b0b960f6ed7056684943856a6a8f420ec0e86a
CRC32 | 7FE7BCF2
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | icon_5.png
Associated Filenames | C:\Users\John\AppData\Local\Temp\icon_5.png
File Size | 1611 bytes
File Type | PNG image data, 31 x 48, 8-bit colormap, non-interlaced
MD5 | a7401a3f7b5d0e7fc87c4de5d847b7fd
SHA1 | b618e29789bd2be97305548c7a840b6298f60d06
SHA256 | 9b3a536d2ae603631c2a141b1d02e33c81725a5f73f36890a7d4716a210cea9d
CRC32 | 324975D4
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | Hydrangeas.jpg
Associated Filenames | C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
File Size | 596374 bytes
File Type | data
MD5 | 082a0a2c9e7e5301c2b69d7ea1ddd256
SHA1 | c250b87b93a5289fa6c06556e4afdfc466f3a5ed
SHA256 | e2af3b2fdb9fef9ecb5a25a35d48de3a07089c7f8c780e2bb09073f2ae2050da
CRC32 | DF21FBB8
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | Chrysanthemum.jpg
Associated Filenames | C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
File Size | 880484 bytes
File Type | data
MD5 | c1a998835ab9cdfa5f1ba95b21d4a284
SHA1 | 42cc6de04c1de0ac6304eb2d23a39948870c5aac
SHA256 | 4e4a2eaa44d1ff850199cb97ce88a2f37af288a8da67d9656e44e506c029d2c5
CRC32 | 7B1F7E5C
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | Penguins.jpg
Associated Filenames | C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg
File Size | 778925 bytes
File Type | data
MD5 | cd79d5248fceaa141c90b1ca626b8987
SHA1 | 71893d5babdcd1e3471e299ff8aa9df16d102267
SHA256 | a95fc89a1c0630497ab4927089e409ac73cf75b39e2ee62d607ab8b85b890fc0
CRC32 | C423687C
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | QTL_Sample_data - Copy (9).xls
Associated Filenames | C:\Users\John\Downloads\QTL_Sample_data - Copy (9).xls
File Size | 55362 bytes
File Type | data
MD5 | 1b6cf64ce9f84cf24082d315199961a7
SHA1 | 6631d61b6505e3d6101f0beaad045004b4418754
SHA256 | 32fd35d9ff03200da84e8e8424ab472475f3b09d513684740f170178924b4b04
CRC32 | 6006C1E2
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | fp_15.0.0.167_archive.zip
Associated Filenames | C:\Users\John\Downloads\fp_15.0.0.167_archive.zip
File Size | 52995294 bytes
File Type | data
MD5 | 2dab6e504e9934873b0fae9945f3ded3
SHA1 | 5791f5bea2659dcb0508003f7f7186c8b6152014
SHA256 | 6407e8c5c1b6bc7b5ba59d656b06ff1379a5ce4873c8a7233f946a94b8b314c7
CRC32 | 26600D02
Ssdeep | None
ClamAV | None
Yara | shellcode - Matched shellcode byte patterns
| None matched
VirusTotal | Search for Analysis
| Download

File name | letterlegal5 - Copy (7).doc
Associated Filenames | C:\Users\John\Downloads\letterlegal5 - Copy (7).doc
File Size | 30786 bytes
File Type | data
MD5 | a107aa26ed7df7000ed55ef50e4ea690
SHA1 | 5059affbae2d1b8a7dd5b2d767c79054b2f948c9
SHA256 | 2533ad79750423dc081c9e3246a3a365cac7b705f35acdf7654728c1c35cf9b1
CRC32 | 99F365F6
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | QTL_Sample_data - Copy (8).xls
Associated Filenames | C:\Users\John\Downloads\QTL_Sample_data - Copy (8).xls
File Size | 55362 bytes
File Type | data
MD5 | b8feafcd4a2107f59ff660f072133ba8
SHA1 | 76745723b954423bcf39c91881179bc50d6650c6
SHA256 | 59beaf5ebaf2fe48c78675c0c30e8fd1bb05baf6137d5dc8ad1f5c499d3c9a33
CRC32 | 73A50F09
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | QTL_Sample_data - Copy (5).xls
Associated Filenames | C:\Users\John\Downloads\QTL_Sample_data - Copy (5).xls
File Size | 55362 bytes
File Type | data
MD5 | 69d66ce0b76ec5ecff14577a7b89a5b4
SHA1 | e51555b1e19b2c96faa075d2443870d97e4a410d
SHA256 | c1922b49733ecfac071f76aae26381219ffb299080b3a73df84e2176739852f9
CRC32 | 6D1CC8AB
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | letterlegal5 - Copy (6).doc
Associated Filenames | C:\Users\John\Downloads\letterlegal5 - Copy (6).doc
File Size | 30786 bytes
File Type | data
MD5 | 08d54594d62fc1ed80556fd287423669
SHA1 | a700ac1cc731099ef9fc8470f6bec06da01f0790
SHA256 | 2ea0e78800e19054ca66fed791a4cc927b51d8eadd06ddd4a1fd11d27bd72bc6
CRC32 | C0B51D46
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | QTL_Sample_data - Copy (2).xls
Associated Filenames | C:\Users\John\Downloads\QTL_Sample_data - Copy (2).xls
File Size | 55362 bytes
File Type | data
MD5 | c051d57aa5ea0df6d23c42b07d227bc3
SHA1 | ead2e6ab8e63c46f5d55bf4532b1984e7d7bda95
SHA256 | a5e744a912790f3f84bd732b3e2b31eae4ce7e272fcb81d51917d923495d0ef4
CRC32 | C0CD33B9
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | Lighthouse.jpg
Associated Filenames | C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
File Size | 562366 bytes
File Type | data
MD5 | a7515a9aa171b6b8ca8a2198b61aa6f3
SHA1 | ffb32611be65e32df9f949f038e6bce8a8662805
SHA256 | 928a435bd28c5c036427e58b8b036904153c9d3cc02ca5d59b7352c8982e799a
CRC32 | A4417EE9
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | letterlegal5 - Copy (8).doc
Associated Filenames | C:\Users\John\Downloads\letterlegal5 - Copy (8).doc
File Size | 30786 bytes
File Type | data
MD5 | 602014858e1fd5ff7bd8aa7d48fbf133
SHA1 | f19b6499758b456c406413add8d5ced3ac2b230d
SHA256 | 00a3c59e7e6576a3d9344ca922a22199e62e947b3f633dc966f6fd1d3e5ed9f7
CRC32 | E0A39D16
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | QTL_Sample_data - Copy (7).xls
Associated Filenames | C:\Users\John\Downloads\QTL_Sample_data - Copy (7).xls
File Size | 55362 bytes
File Type | data
MD5 | f44a71f0f4a58a37da353891090d0d95
SHA1 | 2875aa4605fc5196b234b167f1f915f899497a14
SHA256 | 7e55c95354fe334d70a502227458307872af188389d8e72fa566f0c3d991049a
CRC32 | C91BFF08
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | letterlegal5 - Copy (5).doc
Associated Filenames | C:\Users\John\Downloads\letterlegal5 - Copy (5).doc
File Size | 30786 bytes
File Type | data
MD5 | 1912566e122cf58f4c94233792518bfe
SHA1 | 85fd09ffcf598f7525afa91710db3f4d949e3263
SHA256 | 1f93c7b9403f40b9d977d5c801121267bc7a6850b28284e35de3d6b2b05c64ff
CRC32 | 0AA44010
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | QTL_Sample_data - Copy.xls
Associated Filenames | C:\Users\John\Downloads\QTL_Sample_data - Copy.xls
File Size | 55362 bytes
File Type | data
MD5 | 750e1e4f3df2fb10ab076f916f14500b
SHA1 | acb3c96f853ce5313b5a3534f3317d0328e3d2bc
SHA256 | 05284f476c77a9d290df4117e6758decac1a58e7c3eb81f8d57cc89db05cff02
CRC32 | 34A848FB
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | Koala.jpg
Associated Filenames | C:\Users\Public\Pictures\Sample Pictures\Koala.jpg
File Size | 781921 bytes
File Type | data
MD5 | e7fab4ae0ae8feb86fc34d53595efbf3
SHA1 | bc3888c506fb5a7029ab1b3b12642f78995ea352
SHA256 | 03c1e5548cdb34b45a0ffad53a3af92c1979f861a8cf1e5be2ab217b54051286
CRC32 | CE592993
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | letterlegal5 - Copy (4).doc
Associated Filenames | C:\Users\John\Downloads\letterlegal5 - Copy (4).doc
File Size | 30786 bytes
File Type | data
MD5 | 5916e60146d22989ed307ec79618f76c
SHA1 | 92fffe0f69bb88b6bb981d172cac5fafe60f4682
SHA256 | 89377b8852541418e8738c7a3f4ead388a09b0760e791a0bed806f513d659ac5
CRC32 | A588957D
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | QTL_Sample_data - Copy (3).xls
Associated Filenames | C:\Users\John\Downloads\QTL_Sample_data - Copy (3).xls
File Size | 55362 bytes
File Type | data
MD5 | dd9f9794ca2fe4647b74f34c92685098
SHA1 | 364aae82534ee31e9633ef1530570da257400cfb
SHA256 | 0afa92dc62d93eae3f9ae9074fa0096a6d721d785fab19377fbc74ea4b771605
CRC32 | 1F192CAE
Ssdeep | None
ClamAV | None
Yara | None matched
VirusTotal | Search for Analysis
| Download

JSON Report | Download
HTML Report | Download
Summary HTML Report | Download

#### Comments

No comments posted

#### Processing ( 8.131 seconds )

- 3.817 BehaviorAnalysis
- 3.278 Dropped
- 0.496 Static
- 0.339 peid
- 0.142 AnalysisInfo
- 0.024 MemoryWrite
- 0.015 NetworkAnalysis
- 0.006 TargetInfo
- 0.005 Debug
- 0.003 Memory
- 0.002 config_decoder
- 0.002 Strings
- 0.001 MemoryAlloc
- 0.001 MemoryProtect

#### Signatures ( 5.489 seconds )

- 1.698 antiav_detectreg
- 0.56 infostealer_ftp
- 0.339 antianalysis_detectreg
- 0.322 infostealer_im
- 0.185 stealth_timeout
- 0.181 antivm_vbox_keys
- 0.159 api_spamming
- 0.133 decoy_document
- 0.126 antivm_vmware_keys
- 0.115 virut
- 0.111 fakesys_similarity
- 0.099 infostealer_mail
- 0.093 antivm_generic_disk
- 0.09 antivm_xen_keys
- 0.088 antivm_parallels_keys
- 0.076 mimics_filetime
- 0.069 antivm_generic_scsi
- 0.063 bootkit
- 0.061 antivm_vpc_keys
- 0.058 antivm_generic_diskreg
- 0.057 virus
- 0.055 reads_self
- 0.055 stealth_file
- 0.049 antiav_detectfile
- 0.046 recon_programs
- 0.044 geodo_banking_trojan
- 0.032 hancitor_behavior
- 0.031 antivm_xen_keys
- 0.031 antivm_hyperv_keys
- 0.03 bypass_firewall
- 0.029 antivm_vbox_acpi
- 0.029 infostealer_bitcoin
- 0.024 antivm_generic_bios
- 0.023 antivm_generic_system
- 0.022 antivm_generic_services
- 0.02 antivm_vbox_files
- 0.018 recon_fingerprint
- 0.017 kibex_behavior
- 0.015 antianalysis_detectfile
- 0.014 betabot_behavior
- 0.013 darkcomet_regkeys
- 0.011 stack_pivot
- 0.01 antiemu_wine_func
- 0.01 infostealer_browser
- 0.01 crypto_analysis_signature
- 0.01 infostealer_browser_password
- 0.01 ransomware_files
- 0.009 kovter_behavior
- 0.009 antidbg_devices
- 0.009 ransomware_extensions
- 0.008 antisandbox_productid
- 0.007 antivm_vmware_files
- 0.006 network_tor
- 0.006 rat_luminosity
- 0.006 antivm_vbox_libs
- 0.005 injection_createremotethread
- 0.005 persistence_autorun
- 0.004 ipc_namedpipe
- 0.004 shifu_behavior
- 0.004 antivm_vbox_devices
- 0.004 office_code_page
- 0.004 packer_armadillo_regkey
- 0.003 hawkeye_behavior
- 0.003 kazybot_behavior
- 0.003 exec_crash
- 0.003 antidbg_windows
- 0.003 antivm_generic_cpu
- 0.003 codelux_behavior
- 0.003 rat_pcclient
- 0.002 antisandbox_sunbelt_libs
- 0.002 antisandbox_sboxie_libs
- 0.002 antiav_bitdefender_libs
- 0.002 antisandbox_ntdll_load
- 0.002 antisandbox_threattrack_files
- 0.002 banker_cridex
- 0.002 browser_security
- 0.002 sniffer_winpcap
- 0.001 tinba_behavior
- 0.001 antivm_vmware_libs
- 0.001 ransomware_message
- 0.001 sets_autoconfig_url
- 0.001 vawtrak_behavior
- 0.001 securityxploded_modules
- 0.001 antiemu_wine_reg
- 0.001 antisandbox_cuckoo_files
- 0.001 antisandbox_fortinet_files
- 0.001 antisandbox_joe_anubis_files
- 0.001 antisandbox_sunbelt_files
- 0.001 antivm_vpc_files
- 0.001 modify_proxy
- 0.001 disables_browser_warn
- 0.001 disables_open_file_security
- 0.001 network_tor_service
- 0.001 targeted_flame

#### Reporting ( 31.688 seconds )

- 5.254 JsonDump
- 4.961 ReportHTML
- 2.183 MemoryDump
- 0.901 ReportHTMLSummary

Task ID | 517
Mongo ID | 5cdd75ea9706b5a810420cb3
Cuckoo release | 1.3-NG
| Delete