Sample File:

	MD5 hash:
		07cd559a06fa9d014a31131cb225a7f4

	SHA1 hash:
		9350cc08be170087a79b21bebbf41c6dfa111690

	SHA256 hash:
		639bd88a73154bd38aa18eaea3e968b76f4431ade64d25936cc7e34509075f94

	SSDEEP hash:
		6144:P/GF7UKJQ4a26VPGk2TGFKq9MuolhzjE8YgxxSXHaLyF7KHDDXg/n/ddNNTp:P/w1+Psy9MuolZ5Ygx/uF74vg5r

	Filename(s):
		qPp5UU0Zt1HNYJXn.exe

	Filetype:
		Windows Exe (x86-32)


Mutex IOCs:

		1653680733


Registry Key IOCs:

		HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
		HKEY_CURRENT_USER\Software\Valve\Steam
		HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
		HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName


Domain IOCs:

		upaste.me
		u7320947p3.ha004.t.justns.ru


IP IOCs:

		51.75.250.6
		185.22.155.51


URL IOCs:

		upaste.me/r/4040523075fb98d9f
		u7320947p3.ha004.t.justns.ru/collect.php


File IOCs:

	Filenames:
		C:\\Users\All Users\AppData\Roaming\discord\Local Storage\leveldb\
		C:\\Users\Default\AppData\Roaming\.purple\accounts.xml
		C:\\Users\FD1HVy\AppData\Roaming\Authy Desktop\Local Storage\leveldb
		C:\\Users\Default User\AppData\Local
		C:\\Users\Default.migrated\AppData\Roaming\Psi\profiles
		C:\\Users\FD1HVy\AppData\Local\Microsoft\Windows\Temporary Internet Files
		C:\\Users\FD1HVy\AppData\Roaming\FileZilla\sitemanager.xml
		C:\\Users\FD1HVy\Documents\GTA San Andreas User Files\SAMP\chatlog.txt
		C:\\Users\Default User\AppData\Roaming
		C:\\Users\FD1HVy\AppData\Roaming\discord\Local Storage\leveldb\
		C:\\Users\All Users\AppData\Local\NordVPN
		C:\\Users\Default User\AppData\Local\NordVPN
		C:\\Users\Default\AppData\Local
		C:\\Users\Default\AppData\Roaming\Psi\profiles
		C:\\Users\Default.migrated\AppData\Roaming\Authy Desktop\Local Storage\leveldb
		C:\\Users\Default.migrated\AppData\Roaming\discord\Local Storage\leveldb\
		C:\\Users\Default.migrated\Documents\GTA San Andreas User Files\SAMP\USERDATA.DAT
		System Paging File
		C:\Users\FD1HVy\AppData\Local\Temp\ERCYSUBLVBUOHHNEFMPP\DNKQWP.EWOBKKWOTL
		C:\\Users\Public\Documents\GTA San Andreas User Files\SAMP\USERDATA.DAT
		C:\\Users\Public\AppData\Roaming\FileZilla\sitemanager.xml
		C:\\Users\FD1HVy\AppData\Local\Application Data
		C:\\Users\Default\Desktop
		C:\\Users\FD1HVy\AppData\Local
		C:\\Users
		C:\\Users\Default User\Desktop
		C:\\Users\All Users\AppData\Roaming\.purple\accounts.xml
		C:\\Users\All Users\AppData\Roaming\FileZilla\recentservers.xml
		C:\\Users\Default.migrated\AppData\Roaming\FileZilla\recentservers.xml
		C:\\Users\Default.migrated\AppData\Local
		C:\\Users\FD1HVy\Documents\GTA San Andreas User Files\SAMP\USERDATA.DAT
		C:\\Users\Public\AppData\Roaming
		C:\\Users\Default.migrated\AppData\Roaming\Psi+\profiles
		C:\\Users\Public\AppData\Roaming\Mozilla\Firefox\Profiles
		C:\\Users\All Users\AppData\Roaming\Psi\profiles
		C:\\Users\Default User\AppData\Roaming\Authy Desktop\Local Storage\leveldb
		C:\\Users\All Users\AppData\Roaming
		C:\\Users\All Users\Documents\GTA San Andreas User Files\SAMP\USERDATA.DAT
		C:\\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files
		C:\\Users\Public\AppData\Local\NordVPN
		C:\\Users\Default\AppData\Local\Temporary Internet Files
		C:\\Users\FD1HVy\AppData\Roaming
		C:\\Users\FD1HVy\AppData\Roaming\Psi\profiles
		C:\Users\FD1HVy\AppData\Local\Temp\ERCYSUBLVBUOHHNEFMPP\JLIBUEONUL.COYQJDGQP
		C:\Users\FD1HVy\Desktop\qPp5UU0Zt1HNYJXn.exe
		C:\\Users\Public\AppData\Roaming\discord\Local Storage\leveldb\
		C:\\Users\All Users\AppData\Local
		C:\Users\FD1HVy\AppData\Local\Temp\ERCYSUBLVBUOHHNEFMPP\EYOMIEVEUVPBHSRHJOV.KCFEUCGNKIVHGOLQ
		C:\Users\FD1HVy\AppData\Local\Temp\ERCYSUBLVBUOHHNEFMPP\IFMNPTSMFC.XYNWYSIBQ
		C:\\Users\FD1HVy\AppData\Roaming\Psi+\profiles
		C:\\Users\FD1HVy\AppData\Roaming\.purple\accounts.xml
		C:\Users\FD1HVy\AppData\Local\Temp\ERCYSUBLVBUOHHNEFMPP\PNCWEC.JUGYDYGNFY
		C:\\Users\Default User\Documents\GTA San Andreas User Files\SAMP\chatlog.txt
		C:\\Users\Public\AppData\Local
		C:\\Users\All Users\Desktop
		C:\\Users\Default User\AppData\Roaming\FileZilla\recentservers.xml
		C:\\Users\Default.migrated\AppData\Roaming
		C:\\Users\Default\AppData\Local\History
		C:\\Users\FD1HVy\Desktop
		C:\\Users\Default User
		C:\\Users\Default\AppData\Local\NordVPN
		C:\\Users\FD1HVy\AppData\Local\Microsoft\Windows\INetCache\Content.IE5
		C:\\Users\Default\AppData\Roaming\discord\Local Storage\leveldb\
		C:\\Users\Public\AppData\Roaming\Psi+\profiles
		C:\\Users\Default\AppData\Roaming\Mozilla\Firefox\Profiles
		C:\Users\FD1HVy\AppData\Local\Temp\ERCYSUBLVBUOHHNEFMPP
		C:\\Users\Default User\AppData\Local\History
		C:\\Users\All Users\AppData\Roaming\Psi+\profiles
		C:\\Users\Default User\AppData\Roaming\Mozilla\Firefox\Profiles
		C:\\Users\Default\Documents\GTA San Andreas User Files\SAMP\USERDATA.DAT
		C:\\Users\Default.migrated\AppData\Local\Microsoft\Windows\Temporary Internet Files
		C:\\Users\Default\AppData\Roaming
		C:\\Users\FD1HVy\AppData\Local\Adobe
		C:\\Users\Public\AppData\Roaming\Psi\profiles
		C:\\Users\All Users
		C:\\Users\Default\AppData\Roaming\FileZilla\recentservers.xml
		C:\\Users\Default User\AppData\Roaming\Psi+\profiles
		C:\\Users\Public\Documents\GTA San Andreas User Files\SAMP\chatlog.txt
		C:\Windows\System32\VBoxService.exe
		C:\\Users\FD1HVy\AppData\Roaming\Mozilla
		C:\\Users\Default.migrated\AppData\Roaming\.purple\accounts.xml
		C:\\Users\Default User\AppData\Roaming\discord\Local Storage\leveldb\
		C:\\Users\Default User\Documents\GTA San Andreas User Files\SAMP\USERDATA.DAT
		C:\\Users\FD1HVy\AppData\Roaming\FileZilla\recentservers.xml
		C:\\Users\FD1HVy\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5
		C:\\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles
		C:\Users\FD1HVy\AppData\Local\Temp\ERCYSUBLVBUOHHNEFMPP\KDYYPOLFJWSDSNEGVSIX.TQKT
		C:\\Users\Default.migrated\AppData\Roaming\Mozilla\Firefox\Profiles
		C:\\Users\Default\Documents\GTA San Andreas User Files\SAMP\chatlog.txt
		C:\\Users\All Users\AppData\Roaming\FileZilla\sitemanager.xml
		C:\\Users\FD1HVy\AppData\Local\History
		C:\\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files
		C:\\Users\Default.migrated\AppData\Roaming\FileZilla\sitemanager.xml
		C:\\Users\FD1HVy\AppData\Local\Google\Chrome\User Data\Local State
		C:\\Users\Public\AppData\Roaming\FileZilla\recentservers.xml
		C:\\Users\Default.migrated\Documents\GTA San Andreas User Files\SAMP\chatlog.txt
		C:\\Users\Default\AppData\Roaming\Psi+\profiles
		C:\\Users\FD1HVy\AppData\Local\Google
		C:\\Users\Default User\AppData\Roaming\.purple\accounts.xml
		C:\\Users\Default User\AppData\Roaming\Psi\profiles
		C:\\Users\Default User\AppData\Local\Application Data
		C:\\Users\Public\AppData\Roaming\.purple\accounts.xml
		C:\\Users\Default\AppData\Roaming\Authy Desktop\Local Storage\leveldb
		C:\\Users\Default.migrated\Desktop
		C:\\Users\Public\AppData\Roaming\Authy Desktop\Local Storage\leveldb
		C:\\Users\Default User\AppData\Roaming\FileZilla\sitemanager.xml
		C:\\Users\All Users\AppData\Roaming\Mozilla\Firefox\Profiles
		C:\\Users\Default User\AppData\Local\Temporary Internet Files
		C:\\Users\All Users\Documents\GTA San Andreas User Files\SAMP\chatlog.txt
		C:\\Users\Default\AppData\Local\Application Data
		C:\\Users\FD1HVy\AppData\Local\NordVPN
		C:\\Users\All Users\AppData\Roaming\Authy Desktop\Local Storage\leveldb
		C:\\Users\Default.migrated\AppData\Local\NordVPN
		C:\\Users\Default\AppData\Roaming\FileZilla\sitemanager.xml
		C:\\Users\Public\Desktop

	MD5 hashes:
		c2ab6992976dabee5c3da36cb11ce933
		164f4ab18544aae9d15a13d4515bd3dc
		3bede0d18bc45f433e846b52a7337f98
		5437864c133f53e6a43fc8678fee8ca9
		8e7107bddd95522257907508a7f913a4
		5c2161fc7b16d12b45b3e53d56fad16a
		e8af740fbd1c52f0eb5d39deceb363b4
		07cd559a06fa9d014a31131cb225a7f4
		70e12cac31a061c18c2330867a11905a
		9699e3ac11d9342ff1ef469cf1617601
		9c9fcc347903654575f953a312a552bb
		e3a002935a782f75c8ac7f3f0505d7f2
		3fc640a45710bd566ae2803c6a23d25a
		577e5cf6c9eaa3e8b7a7181e9eeda7b8

	SHA1 hashes:
		933cf6fd1466505acd481220a56daed3587f769a
		7961666e47d9db34ecd64b41212b18b9c68f41f8
		490060d53743d4a0c5018c6ce1ccd4a32e9540e9
		5f1629753f79dba76210a669affa6996b25efa90
		9350cc08be170087a79b21bebbf41c6dfa111690
		716c603f5ce48315a81254eecd440db928aa5b0a
		383ed41171772885ecedac3639de19c6d4024b57
		08601effeb5c842d9151d3559cbaaf41c1c101ee
		06a317f3d6519cf226db3ab029a212293d318a1b
		929d13577d3e4580b2ad0dfa8630b4ee1c2652ce
		78c8d3bdd34ba554fd077b0a126f01c6e877b1ae
		5ec603207a726efa249b6ef575b2d03c64e928fd
		16af12f4485b1db7c04fd9a70d3226f8aad22374
		4b36bb3248c5286f4378d6c36f85c300cfcc9c0a

	SHA256 hashes:
		fcbf28e532103aee92e2e1d0ca8e96e7c1387fb6654566078362623a0c893129
		cd184b370c98dc7906d4bfd958ac0a22b64e0b70d0e096f0c655d6428d264932
		f542d91096288d712dbdb38a061f9afd3784a2708377533955d45aaff69e71cd
		037369299fe8f3e3755fd3d7b421ae7676b1d713d948a4bf02ac138aaea55748
		ca40f2a639b66af31ffc79af7d58fac0b6e5942107b9396372961686a30c107f
		d7f1e913d2c0c2636321dafc1577cb3be3ca9367506f8839caaba9fd880ca6c2
		acfddbb4413be0827d8a073126ddff86f67607672384d2f7aa08f4ccfa65003b
		c8944acce930591044bae29b93f05a9dc7efa86485c22d9cc8ee2f7e0b062192
		639bd88a73154bd38aa18eaea3e968b76f4431ade64d25936cc7e34509075f94
		87e70ca6d3c456d9be944716af6c5be3e30ec066e1834a74ad04e4b0d3acfa6e
		cdad85eefaeee766286a12d8c4039c819a3515170da3070967a7f5198119b35a
		3572cde06e5415a27803b68d3978291db97ac8308bdc51076fbacf02af659beb
		912c041f1f45b8b817f94c84c15433a40463a8a56d6978cf08b7ed28996050a7
		62e2a4e55f4a335fadaa542ff834be3e3d938c7a4c6ed5334b408966737ed887

	SSDEEP hashes:
		24:LLUH0KL7G0TMJHUyyJtmCm0XKY6lOKQAE9V8MffD4fOzeCmly6Uwc6FZW:Uz+JH3yJUheCVE9V8MX0PFlNU12ZW
		96:Ze3Zht6YnMvqI738Hsa/NTIdEFaEdUDSuKn8Y/qBOnxjyWTJereWb3Ds4Blr:ZkZLHMEhTJMb3D
		6:q39NqxtL8MDIQ+QcpSHeIIQTUrmSziXDVUk5GUnKtZKdE7xRPzL72RHNx3osT1q5:U+xGMfT+gRZUiBns0dcz2Hz3osBI5
		192:VD/ApAhREKxiHpWXC1elNknfedN2F8870P98aA2ymwCtQMABwC7p:VDopgREIcrelKfe3WRmsM0p
		24:rid5UcYQ2yZTPaFpEvg3obNmQMOypv6UoF:+decYFgPOpEveoJNCoUc
		96:YG98nNwSct0rt0Jt09BPHl8onelgN8IzzlIwPHqbqbdRiKbXbAZWYAa3GNtWzpJt:198888QNbeSWINDIaIzpJJRN3rBa2
		24:r+iw5Uc5Q2yZTPaFpEvg3obNmQMOypv6UoF:yrec5FgPOpEveoJNCoUc
		48:T1L/ecVTgPOpEveoJZFrU1cQBAxPsuNfRlc9:FHSNDJAAvfbc
		3:vGWJ3uopHrsJXOWXcVUcd7s3AEmtVNof4iCLHK0v:F+opYZOQcVFdm+f6QrLHKW
		24576:FgVx9avE5CMKX8utMty6Hgd4wkozZ6lf1:FYcE5CHZ8yVYozZC1
		192:lD/ApAhREKxiHpWXC1elNknfedN2F8870P98aA2ymwCtQMABwC7p:lDopgREIcrelKfe3WRmsM0p
		48:TS4aecVTgPOpEveoJZFrU1cQBAxPsuNfRlc9:mpSNDJAAvfbc
		6144:P/GF7UKJQ4a26VPGk2TGFKq9MuolhzjE8YgxxSXHaLyF7KHDDXg/n/ddNNTp:P/w1+Psy9MuolZ5Ygx/uF74vg5r
		24:oJZHUFVZ5Kk/aRFVZ5Kk8hoFVZ5KkPrBVS5vuK:oJZ0jZUkSRjZUkiojZUkPrXSluK