Sample File:

	MD5 hash:
		fe9c95315eb59fbf16835e7f10476453

	SHA1 hash:
		c0b7fdd7176d82e499587abce3bd02da5dd77774

	SHA256 hash:
		c2b96838c24b59490a318b4165ae8231b9ed2f7e1b0cb61391c7816ff0f859f9

	SSDEEP hash:
		24576:+g82xK1QMAEYzfqRzq5x2ORBYHWNvxEx88u/SK04ozttKQV2cihnpk96hDI:+P2IlY7pDBLxt/SN4qKDPnpk9os

	Filename(s):
		vMjO4l2fj1uvRlHw.exe

	Filetype:
		Windows Exe (x86-32)


Mutex IOCs:

		1129332504


Registry Key IOCs:

		HKEY_CURRENT_USER\Software\Borland\Locales
		HKEY_LOCAL_MACHINE\Software\Borland\Locales
		HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
		HKEY_CURRENT_USER\SOFTWARE\EnigmaDevelopers
		HKEY_CURRENT_USER\Software\Enigma Protector\29AEB4A0365755F6-B862CAE984EA4D0E\02F01F553A112DCE-00C9DB38C18D5FD1
		HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
		HKEY_CURRENT_USER\Software\Valve\Steam
		HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
		HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName


Domain IOCs:

		upaste.me
		u7320947p3.ha004.t.justns.ru


IP IOCs:

		51.75.250.6
		185.22.155.51


URL IOCs:

		upaste.me/r/4040523075fb98d9f
		u7320947p3.ha004.t.justns.ru/collect.php


File IOCs:

	Filenames:
		C:\\Users\All Users\AppData\Roaming\.purple\accounts.xml
		C:\\Users\Default.migrated\AppData\Roaming
		C:\Users\FD1HVy\AppData\Local\Temp\WODWMSVHIINCVIWHDSKW\ISRBFKSGQBQFQJMDWUGJ.UYWH
		C:\\Users\FD1HVy\AppData\Roaming\FileZilla\recentservers.xml
		C:\\Users\FD1HVy\AppData\Local\Microsoft\Windows\Temporary Internet Files
		C:\Users\FD1HVy\AppData\Local\Temp\WODWMSVHIINCVIWHDSKW\FYSKIW.KQEMYWFFDB
		C:\\Users\All Users\AppData\Roaming\discord\Local Storage\leveldb\
		C:\\Users\Default\AppData\Local\Temporary Internet Files
		C:\\Users\All Users\AppData\Roaming\Mozilla\Firefox\Profiles
		C:\\Users\Default User\AppData\Roaming
		C:\\Users\FD1HVy\AppData\Local\NordVPN
		C:\\Users\FD1HVy\Desktop
		C:\\Users\FD1HVy\AppData\Local\Microsoft\Windows\INetCache\Content.IE5
		C:\\Users\Default User\Documents\GTA San Andreas User Files\SAMP\chatlog.txt
		C:\\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files
		C:\\Users\Default User\AppData\Local\History
		C:\\Users\Default\AppData\Local\History
		C:\\Users\FD1HVy\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5
		C:\\Users\Default\AppData\Roaming\.purple\accounts.xml
		C:\\Users\Default.migrated\AppData\Local\Microsoft\Windows\Temporary Internet Files
		C:\\Users\Public\AppData\Roaming\discord\Local Storage\leveldb\
		C:\\Users\Public\Documents\GTA San Andreas User Files\SAMP\chatlog.txt
		C:\\Users\Default User\AppData\Local\Temporary Internet Files
		C:\\Users\Default\AppData\Roaming\FileZilla\sitemanager.xml
		C:\\Users\Public\AppData\Local
		C:\\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles
		C:\\Users\All Users\AppData\Local\NordVPN
		C:\\Users\FD1HVy\AppData\Roaming\FileZilla\sitemanager.xml
		C:\\Users\Default.migrated\AppData\Local
		C:\\Users\Default User\AppData\Roaming\Psi\profiles
		C:\\Users\Public\Desktop
		C:\\Users\All Users\AppData\Roaming
		C:\\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files
		C:\\Users\Default.migrated\AppData\Roaming\Psi+\profiles
		C:\\Users\Public\AppData\Roaming\.purple\accounts.xml
		C:\Windows\System32\VBoxService.exe
		C:\\Users\Default\AppData\Roaming\FileZilla\recentservers.xml
		C:\\Users\All Users\Documents\GTA San Andreas User Files\SAMP\chatlog.txt
		C:\\Users\All Users\Documents\GTA San Andreas User Files\SAMP\USERDATA.DAT
		C:\\Users\Default User\AppData\Local
		C:\\Users\Default\Desktop
		C:\\Users\FD1HVy\AppData\Roaming\Psi+\profiles
		C:\\Users\Default User\AppData\Roaming\.purple\accounts.xml
		System Paging File
		C:\\Users\Default.migrated\AppData\Roaming\discord\Local Storage\leveldb\
		C:\\Users\Public\AppData\Roaming\Psi\profiles
		C:\\Users\Default User\AppData\Roaming\Authy Desktop\Local Storage\leveldb
		`Ȝw

		C:\\Users\All Users\AppData\Local
		C:\\Users\FD1HVy\AppData\Roaming\Authy Desktop\Local Storage\leveldb
		C:\\Users\Public\Documents\GTA San Andreas User Files\SAMP\USERDATA.DAT
		C:\\Users\Public\AppData\Roaming\Mozilla\Firefox\Profiles
		C:\\Users\All Users\AppData\Roaming\Psi+\profiles
		C:\\Users\Default.migrated\AppData\Local\NordVPN
		\??\c:\users\fd1hvy\desktop\vmjo4l2fj1uvrlhw.exe
		C:\\Users\Default\AppData\Roaming\Authy Desktop\Local Storage\leveldb
		C:\\Users\Default.migrated\AppData\Roaming\Psi\profiles
		C:\\Users\FD1HVy\Documents\GTA San Andreas User Files\SAMP\chatlog.txt
		C:\\Users\FD1HVy\AppData\Local\Adobe
		c:\users\fd1hvy\appdata\local\temp\80EB2F5C
		C:\\Users\Default\AppData\Local\Application Data
		C:\Users\FD1HVy\AppData\Local\Temp\WODWMSVHIINCVIWHDSKW\THDBSCEHFT.ODNSNUPVI
		C:\\Users\Default User\Documents\GTA San Andreas User Files\SAMP\USERDATA.DAT
		C:\\Users\Public\AppData\Roaming\FileZilla\sitemanager.xml
		C:\\Users\FD1HVy\AppData\Roaming\discord\Local Storage\leveldb\
		C:\\Users\FD1HVy\AppData\Local\Google\Chrome\User Data\Local State
		C:\\Users\FD1HVy\Documents\GTA San Andreas User Files\SAMP\USERDATA.DAT
		C:\\Users\Public\AppData\Roaming\Authy Desktop\Local Storage\leveldb
		C:\Users\FD1HVy\AppData\Local\Temp\WODWMSVHIINCVIWHDSKW\GQIELTYOKBFKMKMTBHK.WJSOJKKXHPXPOYMV
		C:\\Users\All Users
		C:\\Users\FD1HVy\AppData\Roaming
		C:\\Users\All Users\AppData\Roaming\FileZilla\sitemanager.xml
		C:\\Users\All Users\AppData\Roaming\Authy Desktop\Local Storage\leveldb
		C:\\Users\FD1HVy\AppData\Local\History
		C:\\Users\All Users\Desktop
		C:\\Users\Default.migrated\AppData\Roaming\FileZilla\sitemanager.xml
		C:\\Users\FD1HVy\AppData\Roaming\Psi\profiles
		C:\\Users\Default User\AppData\Roaming\Mozilla\Firefox\Profiles
		C:\\Users\Default\AppData\Roaming\discord\Local Storage\leveldb\
		C:\\Users\Default User\AppData\Local\Application Data
		C:\\Users\Default User
		C:\Users\FD1HVy\AppData\Local\Temp\WODWMSVHIINCVIWHDSKW\ESNKOR.COMWPKWYKT
		C:\\Users\Default\AppData\Local
		C:\\Users\Default User\AppData\Local\NordVPN
		C:\\Users\Default.migrated\Desktop
		C:\\Users\Public\AppData\Local\NordVPN
		C:\\Users\FD1HVy\AppData\Local
		C:\\Users\FD1HVy\AppData\Roaming\.purple\accounts.xml
		\\.\C:
		C:\\Users\All Users\AppData\Roaming\Psi\profiles
		C:\\Users\FD1HVy\AppData\Local\Temporary Internet Files
		C:\\Users\Default\Documents\GTA San Andreas User Files\SAMP\USERDATA.DAT
		C:\\Users\FD1HVy\AppData\Local\Google
		C:\\Users\Default User\Desktop
		C:\\Users\Default.migrated\AppData\Roaming\FileZilla\recentservers.xml
		C:\\Users\Default\AppData\Roaming\Psi+\profiles
		C:\\Users\Default User\AppData\Roaming\FileZilla\sitemanager.xml
		C:\\Users\Default.migrated\AppData\Roaming\.purple\accounts.xml
		C:\\Users\Default User\AppData\Roaming\FileZilla\recentservers.xml
		C:\\Users\Default User\AppData\Roaming\Psi+\profiles
		C:\\Users\Public\AppData\Roaming
		C:\\Users\Default.migrated\AppData\Roaming\Authy Desktop\Local Storage\leveldb
		C:\\Users\Default.migrated\Documents\GTA San Andreas User Files\SAMP\chatlog.txt
		C:\Users\FD1HVy\AppData\Local\Temp\WODWMSVHIINCVIWHDSKW\SEBDPRYPBG.BBMDTYCIC
		C:\\Users\Public\AppData\Roaming\FileZilla\recentservers.xml
		C:\\Users\FD1HVy\AppData\Roaming\Mozilla
		C:\\Users\Default\AppData\Roaming\Mozilla\Firefox\Profiles
		C:\\Users\Default\AppData\Local\NordVPN
		C:\\Users\Default\AppData\Roaming
		C:\\Users
		C:\\Users\Public\AppData\Roaming\Psi+\profiles
		C:\Users\FD1HVy\Desktop\vMjO4l2fj1uvRlHw.exe
		C:\\Users\FD1HVy\AppData\Local\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\LocalCache
		C:\\Users\Default.migrated\Documents\GTA San Andreas User Files\SAMP\USERDATA.DAT
		C:\\Users\Default.migrated\AppData\Roaming\Mozilla\Firefox\Profiles
		C:\Users\FD1HVy\AppData\Local\Temp\WODWMSVHIINCVIWHDSKW
		C:\\Users\Default\Documents\GTA San Andreas User Files\SAMP\chatlog.txt
		C:\\Users\All Users\AppData\Roaming\FileZilla\recentservers.xml
		C:\\Users\Default\AppData\Roaming\Psi\profiles
		C:\\Users\Default User\AppData\Roaming\discord\Local Storage\leveldb\
		C:\\Users\FD1HVy\AppData\Local\Application Data

	MD5 hashes:
		e3a002935a782f75c8ac7f3f0505d7f2
		fe9c95315eb59fbf16835e7f10476453
		164f4ab18544aae9d15a13d4515bd3dc
		c15d5d108e4b864760f877490875f7a1
		5437864c133f53e6a43fc8678fee8ca9
		3bede0d18bc45f433e846b52a7337f98
		c2ab6992976dabee5c3da36cb11ce933
		e8af740fbd1c52f0eb5d39deceb363b4
		70e12cac31a061c18c2330867a11905a
		8e7107bddd95522257907508a7f913a4
		3fc640a45710bd566ae2803c6a23d25a
		5c2161fc7b16d12b45b3e53d56fad16a
		577e5cf6c9eaa3e8b7a7181e9eeda7b8
		18eefae24fa50e035de17d074b8b8097

	SHA1 hashes:
		933cf6fd1466505acd481220a56daed3587f769a
		5f1629753f79dba76210a669affa6996b25efa90
		7fe45695b13603ffe9d7e173940b4ae3b7f1d0ae
		06a317f3d6519cf226db3ab029a212293d318a1b
		490060d53743d4a0c5018c6ce1ccd4a32e9540e9
		2fafa69081c3099e6826e6dc7aa6a038d93fe521
		929d13577d3e4580b2ad0dfa8630b4ee1c2652ce
		08601effeb5c842d9151d3559cbaaf41c1c101ee
		c0b7fdd7176d82e499587abce3bd02da5dd77774
		716c603f5ce48315a81254eecd440db928aa5b0a
		383ed41171772885ecedac3639de19c6d4024b57
		5ec603207a726efa249b6ef575b2d03c64e928fd
		78c8d3bdd34ba554fd077b0a126f01c6e877b1ae
		4b36bb3248c5286f4378d6c36f85c300cfcc9c0a

	SHA256 hashes:
		fcbf28e532103aee92e2e1d0ca8e96e7c1387fb6654566078362623a0c893129
		cd184b370c98dc7906d4bfd958ac0a22b64e0b70d0e096f0c655d6428d264932
		62e2a4e55f4a335fadaa542ff834be3e3d938c7a4c6ed5334b408966737ed887
		cdad85eefaeee766286a12d8c4039c819a3515170da3070967a7f5198119b35a
		c2b96838c24b59490a318b4165ae8231b9ed2f7e1b0cb61391c7816ff0f859f9
		037369299fe8f3e3755fd3d7b421ae7676b1d713d948a4bf02ac138aaea55748
		c8944acce930591044bae29b93f05a9dc7efa86485c22d9cc8ee2f7e0b062192
		d7f1e913d2c0c2636321dafc1577cb3be3ca9367506f8839caaba9fd880ca6c2
		87e70ca6d3c456d9be944716af6c5be3e30ec066e1834a74ad04e4b0d3acfa6e
		912c041f1f45b8b817f94c84c15433a40463a8a56d6978cf08b7ed28996050a7
		a4402460a449cb88a3609f4ec17ea0210090c329c26139b71d625dc2877dc6c7
		f542d91096288d712dbdb38a061f9afd3784a2708377533955d45aaff69e71cd
		3572cde06e5415a27803b68d3978291db97ac8308bdc51076fbacf02af659beb
		b31f08999b8b1ea2a49fc8b2acb18bc14e9effe2660b2af4065e9a277a7bbaea

	SSDEEP hashes:
		96:YG98nNwSct0rt0Jt09BPHl8onelgN8IzzlIwPHqbqbdRiKbXbAZWYAa3GNtWzpJt:198888QNbeSWINDIaIzpJJRN3rBa2
		24:r+iw5Uc5Q2yZTPaFpEvg3obNmQMOypv6UoF:yrec5FgPOpEveoJNCoUc
		24:rid5UcYQ2yZTPaFpEvg3obNmQMOypv6UoF:+decYFgPOpEveoJNCoUc
		6:q39NqxtyhKDIQ+QcpSHeIIQTUrmSziXDVUk5GUnKtZKdE7xRPzL72RHNx3zAGZEH:U+xU0fT+gRZUiBns0dcz2Hz3zA+SD
		24:LLUH0KL7G0TMJHUyyJtmCm0XKY6lOKQAE9V8MffD4fOzeCmly6Uwc6FZW:Uz+JH3yJUheCVE9V8MX0PFlNU12ZW
		24576:+g82xK1QMAEYzfqRzq5x2ORBYHWNvxEx88u/SK04ozttKQV2cihnpk96hDI:+P2IlY7pDBLxt/SN4qKDPnpk9os
		48:T1L/ecVTgPOpEveoJZFrU1cQBAxPsuNfRlc9:FHSNDJAAvfbc
		96:Ze3Zht6YnMvqI738Hsa/NTIdEFaEdUDSuKn8Y/qBOnxjyWTJereWb3Ds4Blr:ZkZLHMEhTJMb3D
		3:vGWJ3uopHrsJXOWXcVUcd7s3AEmtVNof4iCLHK0v:F+opYZOQcVFdm+f6QrLHKW
		24:oJZHUFVZ5Kk/aRFVZ5Kk8hoFVZ5KkPrBVS5vuK:oJZ0jZUkSRjZUkiojZUkPrXSluK
		48:TS4aecVTgPOpEveoJZFrU1cQBAxPsuNfRlc9:mpSNDJAAvfbc
		192:VD/ApAhREKxiHpWXC1elNknfedN2F8870P98aA2ymwCtQMABwC7p:VDopgREIcrelKfe3WRmsM0p
		24576:Nb5TuDkP3KYRiKOQ1vDcsnz6nlXzo+tX0//:NVTuDK6YF1rzuhsqQ/
		192:lD/ApAhREKxiHpWXC1elNknfedN2F8870P98aA2ymwCtQMABwC7p:lDopgREIcrelKfe3WRmsM0p