Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
ljMiHZ8MwZ.exe

Overview

General Information

Sample name:ljMiHZ8MwZ.exe
renamed because original name is a hash value
Original sample name:4153363158f713a02e405d251823c0c3.exe
Analysis ID:1581021
MD5:4153363158f713a02e405d251823c0c3
SHA1:35168f14fa36d3f8d15614cb25a78415015691d1
SHA256:a040d59da6528f88ded3b130199a23f33f01e9b049b89c0cceaabc5c6984bb26
Tags:exeRedLineStealeruser-abuse_ch
Infos:

Detection

RedLine
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected RedLine Stealer
.NET source code contains potential unpacker
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Process Tree

  • System is w10x64
  • ljMiHZ8MwZ.exe (PID: 7348 cmdline: "C:\Users\user\Desktop\ljMiHZ8MwZ.exe" MD5: 4153363158F713A02E405D251823C0C3)
    • ljMiHZ8MwZ.exe (PID: 7532 cmdline: "C:\Users\user\Desktop\ljMiHZ8MwZ.exe" MD5: 4153363158F713A02E405D251823C0C3)
      • conhost.exe (PID: 7544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
RedLine StealerRedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["45.137.22.250:55615"], "Bot Id": "cheat"}

Yara Signatures

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_RedLine_1Yara detected RedLine StealerJoe Security
    dump.pcapJoeSecurity_RedLineYara detected RedLine StealerJoe Security

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      00000002.00000002.1874957650.0000000000402000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
        00000002.00000002.1874957650.0000000000402000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_RedLineYara detected RedLine StealerJoe Security
          00000002.00000002.1874957650.0000000000402000.00000040.00000400.00020000.00000000.sdmpWindows_Trojan_RedLineStealer_f54632ebunknownunknown
          • 0x133ca:$a4: get_ScannedWallets
          • 0x12228:$a5: get_ScanTelegram
          • 0x1304e:$a6: get_ScanGeckoBrowsersPaths
          • 0x10e6a:$a7: <Processes>k__BackingField
          • 0xed7c:$a8: <GetWindowsVersion>g__HKLM_GetString|11_0
          • 0x1079e:$a9: <ScanFTP>k__BackingField
          00000000.00000002.1741731894.00000000041F8000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
            00000000.00000002.1741731894.00000000041F8000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_RedLineYara detected RedLine StealerJoe Security
              Click to see the 8 entries

              Unpacked PEs

              SourceRuleDescriptionAuthorStrings
              0.2.ljMiHZ8MwZ.exe.41f8af0.1.unpackJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
                0.2.ljMiHZ8MwZ.exe.41f8af0.1.unpackJoeSecurity_RedLineYara detected RedLine StealerJoe Security
                  0.2.ljMiHZ8MwZ.exe.41f8af0.1.unpackWindows_Trojan_RedLineStealer_f54632ebunknownunknown
                  • 0x117ca:$a4: get_ScannedWallets
                  • 0x10628:$a5: get_ScanTelegram
                  • 0x1144e:$a6: get_ScanGeckoBrowsersPaths
                  • 0xf26a:$a7: <Processes>k__BackingField
                  • 0xd17c:$a8: <GetWindowsVersion>g__HKLM_GetString|11_0
                  • 0xeb9e:$a9: <ScanFTP>k__BackingField
                  0.2.ljMiHZ8MwZ.exe.41f8af0.1.unpackinfostealer_win_redline_stringsFinds Redline samples based on characteristic stringsSekoia.io
                  • 0xfbcb:$gen01: ChromeGetRoamingName
                  • 0xfbff:$gen02: ChromeGetLocalName
                  • 0xfc28:$gen03: get_UserDomainName
                  • 0x11e67:$gen04: get_encrypted_key
                  • 0x113e3:$gen05: browserPaths
                  • 0x1172b:$gen06: GetBrowsers
                  • 0x11061:$gen07: get_InstalledInputLanguages
                  • 0xe84f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION
                  • 0x6938:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}
                  • 0x7318:$spe6: windows-1251, CommandLine:
                  • 0x125bd:$spe9: *wallet*
                  • 0xd00c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20
                  • 0xd107:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0
                  • 0xd464:$typ03: A937C899247696B6565665BE3BD09607F49A2042
                  • 0xd571:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2
                  • 0xd6f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63
                  • 0xd098:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60
                  • 0xd0c1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280
                  • 0xd25f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301
                  • 0xd59a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2
                  • 0xd639:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
                  0.2.ljMiHZ8MwZ.exe.41f8af0.1.unpackMALWARE_Win_RedLineDetects RedLine infostealerditekSHen
                  • 0xe68a:$u7: RunPE
                  • 0x11d41:$u8: DownloadAndEx
                  • 0x7330:$pat14: , CommandLine:
                  • 0x11279:$v2_1: ListOfProcesses
                  • 0xe88b:$v2_2: get_ScanVPN
                  • 0xe92e:$v2_2: get_ScanFTP
                  • 0xf61e:$v2_2: get_ScanDiscord
                  • 0x1060c:$v2_2: get_ScanSteam
                  • 0x10628:$v2_2: get_ScanTelegram
                  • 0x106ce:$v2_2: get_ScanScreen
                  • 0x11416:$v2_2: get_ScanChromeBrowsersPaths
                  • 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths
                  • 0x11709:$v2_2: get_ScanBrowsers
                  • 0x117ca:$v2_2: get_ScannedWallets
                  • 0x117f0:$v2_2: get_ScanWallets
                  • 0x11810:$v2_3: GetArguments
                  • 0xfed9:$v2_4: VerifyUpdate
                  • 0x147ea:$v2_4: VerifyUpdate
                  • 0x11bca:$v2_5: VerifyScanRequest
                  • 0x112c6:$v2_6: GetUpdates
                  • 0x147cb:$v2_6: GetUpdates
                  Click to see the 20 entries

                  Sigma Signatures

                  ⊘No Sigma rule has matched

                  Suricata Signatures

                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2024-12-26T17:42:14.044425+010020450001Malware Command and Control Activity Detected45.137.22.25055615192.168.2.449733TCP
                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2024-12-26T17:42:18.234335+010020450011Malware Command and Control Activity Detected45.137.22.25055615192.168.2.449733TCP
                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2024-12-26T17:42:08.895593+010028496621Malware Command and Control Activity Detected192.168.2.44973345.137.22.25055615TCP
                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2024-12-26T17:42:14.359736+010028493511Malware Command and Control Activity Detected192.168.2.44973345.137.22.25055615TCP
                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2024-12-26T17:42:18.634917+010028493521Malware Command and Control Activity Detected192.168.2.44973745.137.22.25055615TCP
                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2024-12-26T17:42:08.895593+010018000001Malware Command and Control Activity Detected192.168.2.44973345.137.22.25055615TCP

                  Joe Sandbox Signatures

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection

                  barindex
                  Found malware configuration
                  Source: 0.2.ljMiHZ8MwZ.exe.41f8af0.1.raw.unpackMalware Configuration Extractor: RedLine {"C2 url": ["45.137.22.250:55615"], "Bot Id": "cheat"}
                  Multi AV Scanner detection for submitted file
                  Source: ljMiHZ8MwZ.exeVirustotal: Detection: 34%Perma Link
                  Source: ljMiHZ8MwZ.exeReversingLabs: Detection: 65%
                  AI detected suspicious sample
                  Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                  Machine Learning detection for sample
                  Source: ljMiHZ8MwZ.exeJoe Sandbox ML: detected
                  Source: ljMiHZ8MwZ.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                  Source: ljMiHZ8MwZ.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                  Source: Binary string: WINLOA~1.PDBwinload_prod.pdbF@ source: ljMiHZ8MwZ.exe, 00000002.00000002.1875228155.0000000000FB3000.00000004.00000020.00020000.00000000.sdmp

                  Networking

                  barindex
                  Suricata IDS alerts for network traffic
                  Source: Network trafficSuricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.4:49733 -> 45.137.22.250:55615
                  Source: Network trafficSuricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.4:49733 -> 45.137.22.250:55615
                  Source: Network trafficSuricata IDS: 2849352 - Severity 1 - ETPRO MALWARE RedLine - SetEnvironment Request : 192.168.2.4:49737 -> 45.137.22.250:55615
                  Source: Network trafficSuricata IDS: 2045000 - Severity 1 - ET MALWARE RedLine Stealer - CheckConnect Response : 45.137.22.250:55615 -> 192.168.2.4:49733
                  Source: Network trafficSuricata IDS: 2849351 - Severity 1 - ETPRO MALWARE RedLine - EnvironmentSettings Request : 192.168.2.4:49733 -> 45.137.22.250:55615
                  Source: Network trafficSuricata IDS: 2045001 - Severity 1 - ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound : 45.137.22.250:55615 -> 192.168.2.4:49733
                  C2 URLs / IPs found in malware configuration
                  Source: Malware configuration extractorURLs: 45.137.22.250:55615
                  Uses known network protocols on non-standard ports
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 55615
                  Source: unknownNetwork traffic detected: HTTP traffic on port 55615 -> 49733
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 55615
                  Source: unknownNetwork traffic detected: HTTP traffic on port 55615 -> 49733
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 55615
                  Source: unknownNetwork traffic detected: HTTP traffic on port 55615 -> 49737
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 55615
                  Source: unknownNetwork traffic detected: HTTP traffic on port 55615 -> 49737
                  Source: unknownNetwork traffic detected: HTTP traffic on port 55615 -> 49737
                  Source: global trafficTCP traffic: 192.168.2.4:49733 -> 45.137.22.250:55615
                  Source: global trafficHTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 45.137.22.250:55615Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 45.137.22.250:55615Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
                  Source: global trafficHTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 45.137.22.250:55615Content-Length: 983075Expect: 100-continueAccept-Encoding: gzip, deflate
                  Source: global trafficHTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 45.137.22.250:55615Content-Length: 983067Expect: 100-continueAccept-Encoding: gzip, deflate
                  Source: Joe Sandbox ViewASN Name: ROOTLAYERNETNL ROOTLAYERNETNL
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: unknownTCP traffic detected without corresponding DNS query: 45.137.22.250
                  Source: global trafficDNS traffic detected: DNS query: api.ip.sb
                  Source: unknownHTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 45.137.22.250:55615Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.00000000031EC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://45.137.22.250:5
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002EF5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://45.137.22.250:55615
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002E61000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://45.137.22.250:55615/
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002EF5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.datacontract.org/2004/07/
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002E61000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002EB0000.00000004.00000800.00020000.00000000.sdmp, ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002EDC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002E61000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002E61000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002E61000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002E61000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002EF5000.00000004.00000800.00020000.00000000.sdmp, ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002EDC000.00000004.00000800.00020000.00000000.sdmp, ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002FF7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002E61000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/0
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002E61000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002E61000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002E61000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002E61000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002EF5000.00000004.00000800.00020000.00000000.sdmp, ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002EDC000.00000004.00000800.00020000.00000000.sdmp, ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002FF7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002E61000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.00000000031EC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Endpoint/SetEnviron
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002EF5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002E61000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002E61000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002E61000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.kr
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1743045301.0000000005B14000.00000004.00000020.00020000.00000000.sdmp, ljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.kr
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                  Source: tmp96FD.tmp.2.dr, tmpD0D4.tmp.2.dr, tmpD0B3.tmp.2.dr, tmp971F.tmp.2.dr, tmp9762.tmp.2.dr, tmp9741.tmp.2.dr, tmp9752.tmp.2.dr, tmp9731.tmp.2.dr, tmp96FE.tmp.2.dr, tmpD103.tmp.2.dr, tmp970E.tmp.2.dr, tmp9720.tmp.2.drString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002EB0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.ip.sb
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002EB0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.ip.sb/geoip
                  Source: ljMiHZ8MwZ.exe, ljMiHZ8MwZ.exe, 00000002.00000002.1874957650.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
                  Source: ljMiHZ8MwZ.exe, ljMiHZ8MwZ.exe, 00000002.00000002.1874957650.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
                  Source: tmp96FD.tmp.2.dr, tmpD0D4.tmp.2.dr, tmpD0B3.tmp.2.dr, tmp971F.tmp.2.dr, tmp9762.tmp.2.dr, tmp9741.tmp.2.dr, tmp9752.tmp.2.dr, tmp9731.tmp.2.dr, tmp96FE.tmp.2.dr, tmpD103.tmp.2.dr, tmp970E.tmp.2.dr, tmp9720.tmp.2.drString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
                  Source: tmp96FD.tmp.2.dr, tmpD0D4.tmp.2.dr, tmpD0B3.tmp.2.dr, tmp971F.tmp.2.dr, tmp9762.tmp.2.dr, tmp9741.tmp.2.dr, tmp9752.tmp.2.dr, tmp9731.tmp.2.dr, tmp96FE.tmp.2.dr, tmpD103.tmp.2.dr, tmp970E.tmp.2.dr, tmp9720.tmp.2.drString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
                  Source: tmp96FD.tmp.2.dr, tmpD0D4.tmp.2.dr, tmpD0B3.tmp.2.dr, tmp971F.tmp.2.dr, tmp9762.tmp.2.dr, tmp9741.tmp.2.dr, tmp9752.tmp.2.dr, tmp9731.tmp.2.dr, tmp96FE.tmp.2.dr, tmpD103.tmp.2.dr, tmp970E.tmp.2.dr, tmp9720.tmp.2.drString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
                  Source: tmp96FD.tmp.2.dr, tmpD0D4.tmp.2.dr, tmpD0B3.tmp.2.dr, tmp971F.tmp.2.dr, tmp9762.tmp.2.dr, tmp9741.tmp.2.dr, tmp9752.tmp.2.dr, tmp9731.tmp.2.dr, tmp96FE.tmp.2.dr, tmpD103.tmp.2.dr, tmp970E.tmp.2.dr, tmp9720.tmp.2.drString found in binary or memory: https://duckduckgo.com/ac/?q=
                  Source: tmp96FD.tmp.2.dr, tmpD0D4.tmp.2.dr, tmpD0B3.tmp.2.dr, tmp971F.tmp.2.dr, tmp9762.tmp.2.dr, tmp9741.tmp.2.dr, tmp9752.tmp.2.dr, tmp9731.tmp.2.dr, tmp96FE.tmp.2.dr, tmpD103.tmp.2.dr, tmp970E.tmp.2.dr, tmp9720.tmp.2.drString found in binary or memory: https://duckduckgo.com/chrome_newtab
                  Source: tmp96FD.tmp.2.dr, tmpD0D4.tmp.2.dr, tmpD0B3.tmp.2.dr, tmp971F.tmp.2.dr, tmp9762.tmp.2.dr, tmp9741.tmp.2.dr, tmp9752.tmp.2.dr, tmp9731.tmp.2.dr, tmp96FE.tmp.2.dr, tmpD103.tmp.2.dr, tmp970E.tmp.2.dr, tmp9720.tmp.2.drString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
                  Source: ljMiHZ8MwZ.exe, ljMiHZ8MwZ.exe, 00000002.00000002.1874957650.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/ip%appdata%
                  Source: tmp96FD.tmp.2.dr, tmpD0D4.tmp.2.dr, tmpD0B3.tmp.2.dr, tmp971F.tmp.2.dr, tmp9762.tmp.2.dr, tmp9741.tmp.2.dr, tmp9752.tmp.2.dr, tmp9731.tmp.2.dr, tmp96FE.tmp.2.dr, tmpD103.tmp.2.dr, tmp970E.tmp.2.dr, tmp9720.tmp.2.drString found in binary or memory: https://www.ecosia.org/newtab/
                  Source: tmp96FD.tmp.2.dr, tmpD0D4.tmp.2.dr, tmpD0B3.tmp.2.dr, tmp971F.tmp.2.dr, tmp9762.tmp.2.dr, tmp9741.tmp.2.dr, tmp9752.tmp.2.dr, tmp9731.tmp.2.dr, tmp96FE.tmp.2.dr, tmpD103.tmp.2.dr, tmp970E.tmp.2.dr, tmp9720.tmp.2.drString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

                  System Summary

                  barindex
                  Malicious sample detected (through community Yara rule)
                  Source: 0.2.ljMiHZ8MwZ.exe.41f8af0.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
                  Source: 0.2.ljMiHZ8MwZ.exe.41f8af0.1.unpack, type: UNPACKEDPEMatched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
                  Source: 0.2.ljMiHZ8MwZ.exe.41f8af0.1.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
                  Source: 0.2.ljMiHZ8MwZ.exe.4210910.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
                  Source: 0.2.ljMiHZ8MwZ.exe.4210910.2.unpack, type: UNPACKEDPEMatched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
                  Source: 0.2.ljMiHZ8MwZ.exe.4210910.2.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
                  Source: 2.2.ljMiHZ8MwZ.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
                  Source: 2.2.ljMiHZ8MwZ.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
                  Source: 2.2.ljMiHZ8MwZ.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
                  Source: 0.2.ljMiHZ8MwZ.exe.4210910.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
                  Source: 0.2.ljMiHZ8MwZ.exe.4210910.2.raw.unpack, type: UNPACKEDPEMatched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
                  Source: 0.2.ljMiHZ8MwZ.exe.4210910.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
                  Source: 0.2.ljMiHZ8MwZ.exe.41f8af0.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
                  Source: 0.2.ljMiHZ8MwZ.exe.41f8af0.1.raw.unpack, type: UNPACKEDPEMatched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
                  Source: 0.2.ljMiHZ8MwZ.exe.41f8af0.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
                  Source: 00000002.00000002.1874957650.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
                  Source: 00000000.00000002.1741731894.00000000041F8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
                  Source: Process Memory Space: ljMiHZ8MwZ.exe PID: 7348, type: MEMORYSTRMatched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
                  Source: Process Memory Space: ljMiHZ8MwZ.exe PID: 7532, type: MEMORYSTRMatched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeCode function: 0_2_017AE7140_2_017AE714
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeCode function: 0_2_05777D600_2_05777D60
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeCode function: 0_2_057707100_2_05770710
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeCode function: 0_2_057707030_2_05770703
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeCode function: 0_2_05777D430_2_05777D43
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeCode function: 0_2_05D4773C0_2_05D4773C
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeCode function: 0_2_05D481980_2_05D48198
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeCode function: 0_2_0918E3C80_2_0918E3C8
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeCode function: 0_2_0918FA700_2_0918FA70
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeCode function: 2_2_013AE7B02_2_013AE7B0
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeCode function: 2_2_013ADC902_2_013ADC90
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeCode function: 2_2_067596302_2_06759630
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeCode function: 2_2_067544682_2_06754468
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeCode function: 2_2_0675D5282_2_0675D528
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeCode function: 2_2_067512102_2_06751210
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeCode function: 2_2_067533202_2_06753320
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeCode function: 2_2_0675DA302_2_0675DA30
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1743846238.0000000007910000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameMontero.dll8 vs ljMiHZ8MwZ.exe
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1740881931.000000000142E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs ljMiHZ8MwZ.exe
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1741731894.00000000042A3000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMontero.dll8 vs ljMiHZ8MwZ.exe
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1741731894.00000000041F8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameImplosions.exe4 vs ljMiHZ8MwZ.exe
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1744242261.00000000090B0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameCaptive.dll" vs ljMiHZ8MwZ.exe
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1741421631.0000000003111000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameImplosions.exe4 vs ljMiHZ8MwZ.exe
                  Source: ljMiHZ8MwZ.exe, 00000000.00000000.1685132825.0000000000E42000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameCsdp.exe. vs ljMiHZ8MwZ.exe
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.00000000031EC000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamefirefox.exe0 vs ljMiHZ8MwZ.exe
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.00000000031EC000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilename vs ljMiHZ8MwZ.exe
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.00000000031EC000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: $^q,\\StringFileInfo\\000004B0\\OriginalFilename vs ljMiHZ8MwZ.exe
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.00000000031EC000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamechrome.exe< vs ljMiHZ8MwZ.exe
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.00000000031EC000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: $^q,\\StringFileInfo\\040904B0\\OriginalFilename vs ljMiHZ8MwZ.exe
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.00000000031EC000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameIEXPLORE.EXE.MUID vs ljMiHZ8MwZ.exe
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.00000000031EC000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameIEXPLORE.EXED vs ljMiHZ8MwZ.exe
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.00000000031EC000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: $^q,\\StringFileInfo\\080904B0\\OriginalFilename vs ljMiHZ8MwZ.exe
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.00000000031EC000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsedge.exe> vs ljMiHZ8MwZ.exe
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002EF5000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilename vs ljMiHZ8MwZ.exe
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1874957650.0000000000402000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: OriginalFilenameImplosions.exe4 vs ljMiHZ8MwZ.exe
                  Source: ljMiHZ8MwZ.exeBinary or memory string: OriginalFilenameCsdp.exe. vs ljMiHZ8MwZ.exe
                  Source: ljMiHZ8MwZ.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                  Source: 0.2.ljMiHZ8MwZ.exe.41f8af0.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
                  Source: 0.2.ljMiHZ8MwZ.exe.41f8af0.1.unpack, type: UNPACKEDPEMatched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
                  Source: 0.2.ljMiHZ8MwZ.exe.41f8af0.1.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
                  Source: 0.2.ljMiHZ8MwZ.exe.4210910.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
                  Source: 0.2.ljMiHZ8MwZ.exe.4210910.2.unpack, type: UNPACKEDPEMatched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
                  Source: 0.2.ljMiHZ8MwZ.exe.4210910.2.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
                  Source: 2.2.ljMiHZ8MwZ.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
                  Source: 2.2.ljMiHZ8MwZ.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
                  Source: 2.2.ljMiHZ8MwZ.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
                  Source: 0.2.ljMiHZ8MwZ.exe.4210910.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
                  Source: 0.2.ljMiHZ8MwZ.exe.4210910.2.raw.unpack, type: UNPACKEDPEMatched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
                  Source: 0.2.ljMiHZ8MwZ.exe.4210910.2.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
                  Source: 0.2.ljMiHZ8MwZ.exe.41f8af0.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
                  Source: 0.2.ljMiHZ8MwZ.exe.41f8af0.1.raw.unpack, type: UNPACKEDPEMatched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
                  Source: 0.2.ljMiHZ8MwZ.exe.41f8af0.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
                  Source: 00000002.00000002.1874957650.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
                  Source: 00000000.00000002.1741731894.00000000041F8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
                  Source: Process Memory Space: ljMiHZ8MwZ.exe PID: 7348, type: MEMORYSTRMatched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
                  Source: Process Memory Space: ljMiHZ8MwZ.exe PID: 7532, type: MEMORYSTRMatched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
                  Source: ljMiHZ8MwZ.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                  Source: 0.2.ljMiHZ8MwZ.exe.7910000.4.raw.unpack, oxFBU42wJTr2UTVcBS.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                  Source: 0.2.ljMiHZ8MwZ.exe.7910000.4.raw.unpack, qyyPq296Qkh0EGin1j.csSecurity API names: _0020.SetAccessControl
                  Source: 0.2.ljMiHZ8MwZ.exe.7910000.4.raw.unpack, qyyPq296Qkh0EGin1j.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                  Source: 0.2.ljMiHZ8MwZ.exe.7910000.4.raw.unpack, qyyPq296Qkh0EGin1j.csSecurity API names: _0020.AddAccessRule
                  Source: 0.2.ljMiHZ8MwZ.exe.42d2a58.0.raw.unpack, qyyPq296Qkh0EGin1j.csSecurity API names: _0020.SetAccessControl
                  Source: 0.2.ljMiHZ8MwZ.exe.42d2a58.0.raw.unpack, qyyPq296Qkh0EGin1j.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                  Source: 0.2.ljMiHZ8MwZ.exe.42d2a58.0.raw.unpack, qyyPq296Qkh0EGin1j.csSecurity API names: _0020.AddAccessRule
                  Source: 0.2.ljMiHZ8MwZ.exe.42d2a58.0.raw.unpack, oxFBU42wJTr2UTVcBS.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                  Source: 0.2.ljMiHZ8MwZ.exe.432ec78.3.raw.unpack, oxFBU42wJTr2UTVcBS.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                  Source: 0.2.ljMiHZ8MwZ.exe.432ec78.3.raw.unpack, qyyPq296Qkh0EGin1j.csSecurity API names: _0020.SetAccessControl
                  Source: 0.2.ljMiHZ8MwZ.exe.432ec78.3.raw.unpack, qyyPq296Qkh0EGin1j.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                  Source: 0.2.ljMiHZ8MwZ.exe.432ec78.3.raw.unpack, qyyPq296Qkh0EGin1j.csSecurity API names: _0020.AddAccessRule
                  Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@4/47@1/1
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ljMiHZ8MwZ.exe.logJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeMutant created: NULL
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeMutant created: \Sessions\1\BaseNamedObjects\KnHlURODBTv
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7544:120:WilError_03
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeFile created: C:\Users\user\AppData\Local\Temp\tmp5D0B.tmpJump to behavior
                  Source: ljMiHZ8MwZ.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                  Source: ljMiHZ8MwZ.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId=&apos;1&apos;
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId=&apos;1&apos;
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                  Source: tmp5D2E.tmp.2.dr, tmp5D3E.tmp.2.dr, tmp5D2C.tmp.2.dr, tmp5D0B.tmp.2.dr, tmp5D2D.tmp.2.dr, tmp5D1B.tmp.2.drBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                  Source: ljMiHZ8MwZ.exeVirustotal: Detection: 34%
                  Source: ljMiHZ8MwZ.exeReversingLabs: Detection: 65%
                  Source: unknownProcess created: C:\Users\user\Desktop\ljMiHZ8MwZ.exe "C:\Users\user\Desktop\ljMiHZ8MwZ.exe"
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess created: C:\Users\user\Desktop\ljMiHZ8MwZ.exe "C:\Users\user\Desktop\ljMiHZ8MwZ.exe"
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess created: C:\Users\user\Desktop\ljMiHZ8MwZ.exe "C:\Users\user\Desktop\ljMiHZ8MwZ.exe"Jump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: version.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: dwrite.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: textshaping.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: windowscodecs.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: iconcodecservice.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: version.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: rasapi32.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: rasman.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: rtutils.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: dhcpcsvc6.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: dhcpcsvc.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: dnsapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: winnsi.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: rasadhlp.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: fwpuclnt.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: schannel.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: mskeyprotect.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: ncryptsslp.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: wbemcomn.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: ntmarta.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeSection loaded: windowscodecs.dllJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
                  Source: Window RecorderWindow detected: More than 3 window changes detected
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                  Source: ljMiHZ8MwZ.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                  Source: ljMiHZ8MwZ.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                  Source: Binary string: WINLOA~1.PDBwinload_prod.pdbF@ source: ljMiHZ8MwZ.exe, 00000002.00000002.1875228155.0000000000FB3000.00000004.00000020.00020000.00000000.sdmp

                  Data Obfuscation

                  barindex
                  .NET source code contains potential unpacker
                  Source: 0.2.ljMiHZ8MwZ.exe.7910000.4.raw.unpack, qyyPq296Qkh0EGin1j.cs.Net Code: cirREBtbBH System.Reflection.Assembly.Load(byte[])
                  Source: 0.2.ljMiHZ8MwZ.exe.432ec78.3.raw.unpack, qyyPq296Qkh0EGin1j.cs.Net Code: cirREBtbBH System.Reflection.Assembly.Load(byte[])
                  Source: 0.2.ljMiHZ8MwZ.exe.42d2a58.0.raw.unpack, qyyPq296Qkh0EGin1j.cs.Net Code: cirREBtbBH System.Reflection.Assembly.Load(byte[])
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeCode function: 0_2_05D45AE2 push esp; retf 0_2_05D45AE9
                  Source: ljMiHZ8MwZ.exeStatic PE information: section name: .text entropy: 7.678717951671746
                  Source: 0.2.ljMiHZ8MwZ.exe.7910000.4.raw.unpack, fveyHcscgRsunRk5tw.csHigh entropy of concatenated method names: 'OdIHVklGB7', 'A0hHUGFMQ8', 'di7HHgDVU3', 'WPhHuZdIF0', 'jecHQtuy81', 'S8EHnCMkGg', 'Dispose', 'LaqemtE7ag', 'lEmeWMFu5u', 'wvpeg8N1fq'
                  Source: 0.2.ljMiHZ8MwZ.exe.7910000.4.raw.unpack, h3TbBgPKWJM3k3GmXI.csHigh entropy of concatenated method names: 'Bv0Hj9P4vN', 'PoCHI7bXh9', 'tP0HorBdxk', 'IZFHkKqDSB', 'UFwH4dBZ5o', 'ogmHfMfU7I', 'tblHCCM6eU', 'nwbHBP7FxE', 'SsyHNnx5Wn', 'DvtHYPC36J'
                  Source: 0.2.ljMiHZ8MwZ.exe.7910000.4.raw.unpack, oxFBU42wJTr2UTVcBS.csHigh entropy of concatenated method names: 'gdZWZTamEN', 'cYxWGfDJ6P', 'rqsWvqG85K', 'Q24WMioCkT', 'rNOW5G1gr6', 'jSLWrW6foE', 'SR2WsFrbym', 'hWXW8tYt4w', 'JI0WPWFWqv', 'lU8Wh0W6ir'
                  Source: 0.2.ljMiHZ8MwZ.exe.7910000.4.raw.unpack, qGWQwo3dZPjlkLfaXEb.csHigh entropy of concatenated method names: 'YktuhfmIYi', 'LD9uzApOq9', 'e62bXRuxUF', 'wm5bICyysQdvmS0Q4XK', 'z8lOOUyLLHyT7DMV13X', 'bHiac7yXndI6kdjUemP', 'hl7PP7yYada2wJVpExC'
                  Source: 0.2.ljMiHZ8MwZ.exe.7910000.4.raw.unpack, UFuoQeCdlpIA3uNJJl.csHigh entropy of concatenated method names: 'vDVamV7Xnr', 'vJOag5ovPb', 'JaoapdFwQR', 'D7QphduMc9', 'I2ipzGUjRU', 'gt4aXushGK', 'gITa3pQxCc', 'UwGaKQRs84', 'acQadBXrkB', 'SoUaRkv0wZ'
                  Source: 0.2.ljMiHZ8MwZ.exe.7910000.4.raw.unpack, fRMpebh3HnJSGfKfL5.csHigh entropy of concatenated method names: 'ALF7gxHoIM', 'aPJ7DUGyTh', 'zHi7pDRhFN', 'KDK7aqetw2', 'dLQ7Hk0QyX', 'Sg079EB4Xj', 'Next', 'Next', 'Next', 'NextBytes'
                  Source: 0.2.ljMiHZ8MwZ.exe.7910000.4.raw.unpack, qBd4H5tgmR5ZnW4Vei.csHigh entropy of concatenated method names: 'SutDAJlYvu', 'ROiDTD7a6p', 'mTmgouYxdA', 'L8LgkWOIJ0', 'W3Ag4urpy0', 'DrNgfaG3pJ', 'YTHgCpg8YQ', 'DeXgBstkRy', 'pSJgNqq9kK', 'CsugYjNTct'
                  Source: 0.2.ljMiHZ8MwZ.exe.7910000.4.raw.unpack, EuOpUCriLBxCLqaAMU.csHigh entropy of concatenated method names: 'vOfU8JiVtS', 'kejUh5P7hq', 'SsmeXP6x2t', 'QJie3NWrSU', 'GF1USGkmOm', 'WiyUJ3iYo2', 'WsjULLBDQN', 'kxpUZuaE8e', 'h6cUGQhmVq', 'hBvUvt1s7r'
                  Source: 0.2.ljMiHZ8MwZ.exe.7910000.4.raw.unpack, CmxdKqWHRvJdY9P2C6.csHigh entropy of concatenated method names: 'Dispose', 'dsu3PnRk5t', 'rm3KI9Ogld', 'Qc9iynxKxx', 'xPb3h5Y0G1', 'lEh3zmDCB4', 'ProcessDialogKey', 'BLgKX3TbBg', 'bWJK3M3k3G', 'fXIKKmRMpe'
                  Source: 0.2.ljMiHZ8MwZ.exe.7910000.4.raw.unpack, KxSlmh3RWIExw3kFaGD.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'z08bHsNTZt', 'ecEb7Gibds', 'qkVbu8Vsq1', 'yOpbbc5rbG', 'kJ0bQvpgRT', 'eCebiuG1RS', 'ywtbnw3DD6'
                  Source: 0.2.ljMiHZ8MwZ.exe.7910000.4.raw.unpack, xGWxxQzs6QMPuKRFe2.csHigh entropy of concatenated method names: 'Aa47OyMdV0', 'LFy72Jn1d0', 'K3o7xmxHL9', 'n0x7jyVL10', 'TvY7ICrcs6', 'TgC7kWqNRO', 'DvN74adREW', 'pbF7nn2tWa', 'QTQ7wEuCWn', 'VlA7FUj0xI'
                  Source: 0.2.ljMiHZ8MwZ.exe.7910000.4.raw.unpack, biOSFH33IeY62QRJA5u.csHigh entropy of concatenated method names: 'QlJ7hp51tX', 'MG57zf7uE8', 'JcnuXUOOQD', 'fA8u3qOCi4', 'FSLuKS6IhR', 'rOoudh4wZt', 'ITfuRayqui', 'inZulFFGL1', 'jZNumyFrVi', 'b7UuWxWnYF'
                  Source: 0.2.ljMiHZ8MwZ.exe.7910000.4.raw.unpack, G5HkYS3K1F7W131Parx.csHigh entropy of concatenated method names: 'ToString', 'VWUu29M9nH', 'MVbuxhGMUF', 'iJ8utawXTD', 'JRLujRBLdW', 'qDkuIy5ybl', 'jxiuo8mK8k', 'wY9ukYXNFp', 'P7KdVQyQjg5MX7td4nQ', 'tHGhUAyF7lc1PN7P3jK'
                  Source: 0.2.ljMiHZ8MwZ.exe.7910000.4.raw.unpack, qYwR0TMDtDIN8pqpVU.csHigh entropy of concatenated method names: 'BD7U66QRgG', 'nAxUqfollF', 'ToString', 'wlwUm64e64', 'mhHUWUVW0m', 'zHcUgC0Lhx', 'rNTUDVxSBj', 'FU6UpWpA6U', 'FBeUas9IZb', 'a0oU99NcCK'
                  Source: 0.2.ljMiHZ8MwZ.exe.7910000.4.raw.unpack, LXtXutRj3L0weLOGZY.csHigh entropy of concatenated method names: 'F8c3axFBU4', 'xJT39r2UTV', 'eGN364ahiv', 'us03qOUBd4', 'g4V3VeivHo', 'mSo31uYakG', 'yxG1MyehurFOIaCjcr', 'QK6o1mHaIraxp3BFvG', 'Fv933fjTu5', 'jX53dwsoay'
                  Source: 0.2.ljMiHZ8MwZ.exe.7910000.4.raw.unpack, UeK7EHGFSG5neVbdSw.csHigh entropy of concatenated method names: 'nbNVs063IM', 'XPBV8TMQUC', 'dUEVPT2A0j', 'ht3VhZ13r1', 'p525tGkInunKOMT2f6S', 'QHQbV4kYEaXYvcxiYYR', 'bClmjgknsESuy7o594T'
                  Source: 0.2.ljMiHZ8MwZ.exe.7910000.4.raw.unpack, mKU4ufKcuQsUByve7r.csHigh entropy of concatenated method names: 'VItECekKP', 'IqC0W8elS', 'UpHOa6EJf', 'P4NTtkGB1', 'IY6xDZZ3I', 'fIKtwLipq', 'w5Etjeu7NULWdSieki', 'RvXf0NPgYG12aGGDNY', 'f4ae92gPt', 'JYY7gfda3'
                  Source: 0.2.ljMiHZ8MwZ.exe.7910000.4.raw.unpack, HdUXMlxGN4ahivbs0O.csHigh entropy of concatenated method names: 'uhSg0nX4tU', 'uhdgOdZPyk', 'xR2g2QEytr', 'YUtgxoWcVD', 'L7PgVvKeVs', 'XN5g1erWgM', 'CFpgUHOUVG', 'y7yge176mP', 'DaMgHipFIa', 'XNXg73fxNs'
                  Source: 0.2.ljMiHZ8MwZ.exe.7910000.4.raw.unpack, YBBGBdLdRgRLbm4owH.csHigh entropy of concatenated method names: 'xJnc2OJVPr', 'HGMcxjHCrF', 'FKEcjp1Lfs', 'bDucIDDW7G', 'lDxckPRHCp', 'Kfvc47gPNf', 'GwDcC0Wj3c', 'bekcBNIuZy', 'a3ocYmRbPR', 'tpEcSZ6mhr'
                  Source: 0.2.ljMiHZ8MwZ.exe.7910000.4.raw.unpack, SHo6SojuYakG6IgwZL.csHigh entropy of concatenated method names: 'KXOpl6bCye', 'd9ypW5gmQX', 'gyWpDflitr', 'qZLpap8reC', 'Xxcp9K9coy', 'kBwD5BnHfP', 'rftDrFd5BB', 'hhTDsv73gI', 'sEtD8aUT80', 'NJ7DPla2TT'
                  Source: 0.2.ljMiHZ8MwZ.exe.7910000.4.raw.unpack, qyyPq296Qkh0EGin1j.csHigh entropy of concatenated method names: 'euPdl7mcaD', 'GFpdm8cMPX', 'ARXdWkGCMc', 'J1xdglQem5', 'o1rdDC7DXT', 'GfCdpo0y6C', 'TqadaJe7Qc', 'C0ad9cnMHI', 'aXfdy2Hn7t', 'AVvd6CwsdW'
                  Source: 0.2.ljMiHZ8MwZ.exe.7910000.4.raw.unpack, whT9VAvWrWdOTj3EWO.csHigh entropy of concatenated method names: 'ToString', 'HV41S9wE0x', 'zBN1IqjnDN', 'aBO1otoC4M', 'Plr1ko0y1i', 'IZB14hmjai', 'j2w1fjqtJA', 'M9a1CtUvUE', 'BbA1BLpqst', 'ogf1Nkre7A'
                  Source: 0.2.ljMiHZ8MwZ.exe.7910000.4.raw.unpack, Ko28UW3XlevF8QFhQ37.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'D8F7SHgxen', 'lke7Jp3es7', 'U1G7LW9wfa', 'JxR7Z5LvDG', 'Eqe7G2j9V1', 'wMK7vU1pZh', 'Mlo7MJmBYk'
                  Source: 0.2.ljMiHZ8MwZ.exe.7910000.4.raw.unpack, c0npjGZVC8QoekSSiE.csHigh entropy of concatenated method names: 'oZ7VYCnT0c', 'JNAVJ2y6N2', 'BTqVZ9vKHe', 'rroVGn95O6', 'DtiVIgGoL5', 'l39VoG98lM', 'fLoVkVeIkQ', 'WcPV4I0S9L', 'mTyVffQVVl', 'muOVCunoqX'
                  Source: 0.2.ljMiHZ8MwZ.exe.7910000.4.raw.unpack, bD37EoNqtrph9p0XKi.csHigh entropy of concatenated method names: 'ELqaw0Q2pj', 'sKiaFEIPPu', 'ahvaEBSRyN', 'YSVa0Z019T', 'CtZaAwGRaF', 'hXiaOM8Ifk', 'cQaaTGXP8U', 'z1Ha2oD9Jw', 'BdPax0uMoO', 'yk7at26fk1'
                  Source: 0.2.ljMiHZ8MwZ.exe.432ec78.3.raw.unpack, fveyHcscgRsunRk5tw.csHigh entropy of concatenated method names: 'OdIHVklGB7', 'A0hHUGFMQ8', 'di7HHgDVU3', 'WPhHuZdIF0', 'jecHQtuy81', 'S8EHnCMkGg', 'Dispose', 'LaqemtE7ag', 'lEmeWMFu5u', 'wvpeg8N1fq'
                  Source: 0.2.ljMiHZ8MwZ.exe.432ec78.3.raw.unpack, h3TbBgPKWJM3k3GmXI.csHigh entropy of concatenated method names: 'Bv0Hj9P4vN', 'PoCHI7bXh9', 'tP0HorBdxk', 'IZFHkKqDSB', 'UFwH4dBZ5o', 'ogmHfMfU7I', 'tblHCCM6eU', 'nwbHBP7FxE', 'SsyHNnx5Wn', 'DvtHYPC36J'
                  Source: 0.2.ljMiHZ8MwZ.exe.432ec78.3.raw.unpack, oxFBU42wJTr2UTVcBS.csHigh entropy of concatenated method names: 'gdZWZTamEN', 'cYxWGfDJ6P', 'rqsWvqG85K', 'Q24WMioCkT', 'rNOW5G1gr6', 'jSLWrW6foE', 'SR2WsFrbym', 'hWXW8tYt4w', 'JI0WPWFWqv', 'lU8Wh0W6ir'
                  Source: 0.2.ljMiHZ8MwZ.exe.432ec78.3.raw.unpack, qGWQwo3dZPjlkLfaXEb.csHigh entropy of concatenated method names: 'YktuhfmIYi', 'LD9uzApOq9', 'e62bXRuxUF', 'wm5bICyysQdvmS0Q4XK', 'z8lOOUyLLHyT7DMV13X', 'bHiac7yXndI6kdjUemP', 'hl7PP7yYada2wJVpExC'
                  Source: 0.2.ljMiHZ8MwZ.exe.432ec78.3.raw.unpack, UFuoQeCdlpIA3uNJJl.csHigh entropy of concatenated method names: 'vDVamV7Xnr', 'vJOag5ovPb', 'JaoapdFwQR', 'D7QphduMc9', 'I2ipzGUjRU', 'gt4aXushGK', 'gITa3pQxCc', 'UwGaKQRs84', 'acQadBXrkB', 'SoUaRkv0wZ'
                  Source: 0.2.ljMiHZ8MwZ.exe.432ec78.3.raw.unpack, fRMpebh3HnJSGfKfL5.csHigh entropy of concatenated method names: 'ALF7gxHoIM', 'aPJ7DUGyTh', 'zHi7pDRhFN', 'KDK7aqetw2', 'dLQ7Hk0QyX', 'Sg079EB4Xj', 'Next', 'Next', 'Next', 'NextBytes'
                  Source: 0.2.ljMiHZ8MwZ.exe.432ec78.3.raw.unpack, qBd4H5tgmR5ZnW4Vei.csHigh entropy of concatenated method names: 'SutDAJlYvu', 'ROiDTD7a6p', 'mTmgouYxdA', 'L8LgkWOIJ0', 'W3Ag4urpy0', 'DrNgfaG3pJ', 'YTHgCpg8YQ', 'DeXgBstkRy', 'pSJgNqq9kK', 'CsugYjNTct'
                  Source: 0.2.ljMiHZ8MwZ.exe.432ec78.3.raw.unpack, EuOpUCriLBxCLqaAMU.csHigh entropy of concatenated method names: 'vOfU8JiVtS', 'kejUh5P7hq', 'SsmeXP6x2t', 'QJie3NWrSU', 'GF1USGkmOm', 'WiyUJ3iYo2', 'WsjULLBDQN', 'kxpUZuaE8e', 'h6cUGQhmVq', 'hBvUvt1s7r'
                  Source: 0.2.ljMiHZ8MwZ.exe.432ec78.3.raw.unpack, CmxdKqWHRvJdY9P2C6.csHigh entropy of concatenated method names: 'Dispose', 'dsu3PnRk5t', 'rm3KI9Ogld', 'Qc9iynxKxx', 'xPb3h5Y0G1', 'lEh3zmDCB4', 'ProcessDialogKey', 'BLgKX3TbBg', 'bWJK3M3k3G', 'fXIKKmRMpe'
                  Source: 0.2.ljMiHZ8MwZ.exe.432ec78.3.raw.unpack, KxSlmh3RWIExw3kFaGD.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'z08bHsNTZt', 'ecEb7Gibds', 'qkVbu8Vsq1', 'yOpbbc5rbG', 'kJ0bQvpgRT', 'eCebiuG1RS', 'ywtbnw3DD6'
                  Source: 0.2.ljMiHZ8MwZ.exe.432ec78.3.raw.unpack, xGWxxQzs6QMPuKRFe2.csHigh entropy of concatenated method names: 'Aa47OyMdV0', 'LFy72Jn1d0', 'K3o7xmxHL9', 'n0x7jyVL10', 'TvY7ICrcs6', 'TgC7kWqNRO', 'DvN74adREW', 'pbF7nn2tWa', 'QTQ7wEuCWn', 'VlA7FUj0xI'
                  Source: 0.2.ljMiHZ8MwZ.exe.432ec78.3.raw.unpack, biOSFH33IeY62QRJA5u.csHigh entropy of concatenated method names: 'QlJ7hp51tX', 'MG57zf7uE8', 'JcnuXUOOQD', 'fA8u3qOCi4', 'FSLuKS6IhR', 'rOoudh4wZt', 'ITfuRayqui', 'inZulFFGL1', 'jZNumyFrVi', 'b7UuWxWnYF'
                  Source: 0.2.ljMiHZ8MwZ.exe.432ec78.3.raw.unpack, G5HkYS3K1F7W131Parx.csHigh entropy of concatenated method names: 'ToString', 'VWUu29M9nH', 'MVbuxhGMUF', 'iJ8utawXTD', 'JRLujRBLdW', 'qDkuIy5ybl', 'jxiuo8mK8k', 'wY9ukYXNFp', 'P7KdVQyQjg5MX7td4nQ', 'tHGhUAyF7lc1PN7P3jK'
                  Source: 0.2.ljMiHZ8MwZ.exe.432ec78.3.raw.unpack, qYwR0TMDtDIN8pqpVU.csHigh entropy of concatenated method names: 'BD7U66QRgG', 'nAxUqfollF', 'ToString', 'wlwUm64e64', 'mhHUWUVW0m', 'zHcUgC0Lhx', 'rNTUDVxSBj', 'FU6UpWpA6U', 'FBeUas9IZb', 'a0oU99NcCK'
                  Source: 0.2.ljMiHZ8MwZ.exe.432ec78.3.raw.unpack, LXtXutRj3L0weLOGZY.csHigh entropy of concatenated method names: 'F8c3axFBU4', 'xJT39r2UTV', 'eGN364ahiv', 'us03qOUBd4', 'g4V3VeivHo', 'mSo31uYakG', 'yxG1MyehurFOIaCjcr', 'QK6o1mHaIraxp3BFvG', 'Fv933fjTu5', 'jX53dwsoay'
                  Source: 0.2.ljMiHZ8MwZ.exe.432ec78.3.raw.unpack, UeK7EHGFSG5neVbdSw.csHigh entropy of concatenated method names: 'nbNVs063IM', 'XPBV8TMQUC', 'dUEVPT2A0j', 'ht3VhZ13r1', 'p525tGkInunKOMT2f6S', 'QHQbV4kYEaXYvcxiYYR', 'bClmjgknsESuy7o594T'
                  Source: 0.2.ljMiHZ8MwZ.exe.432ec78.3.raw.unpack, mKU4ufKcuQsUByve7r.csHigh entropy of concatenated method names: 'VItECekKP', 'IqC0W8elS', 'UpHOa6EJf', 'P4NTtkGB1', 'IY6xDZZ3I', 'fIKtwLipq', 'w5Etjeu7NULWdSieki', 'RvXf0NPgYG12aGGDNY', 'f4ae92gPt', 'JYY7gfda3'
                  Source: 0.2.ljMiHZ8MwZ.exe.432ec78.3.raw.unpack, HdUXMlxGN4ahivbs0O.csHigh entropy of concatenated method names: 'uhSg0nX4tU', 'uhdgOdZPyk', 'xR2g2QEytr', 'YUtgxoWcVD', 'L7PgVvKeVs', 'XN5g1erWgM', 'CFpgUHOUVG', 'y7yge176mP', 'DaMgHipFIa', 'XNXg73fxNs'
                  Source: 0.2.ljMiHZ8MwZ.exe.432ec78.3.raw.unpack, YBBGBdLdRgRLbm4owH.csHigh entropy of concatenated method names: 'xJnc2OJVPr', 'HGMcxjHCrF', 'FKEcjp1Lfs', 'bDucIDDW7G', 'lDxckPRHCp', 'Kfvc47gPNf', 'GwDcC0Wj3c', 'bekcBNIuZy', 'a3ocYmRbPR', 'tpEcSZ6mhr'
                  Source: 0.2.ljMiHZ8MwZ.exe.432ec78.3.raw.unpack, SHo6SojuYakG6IgwZL.csHigh entropy of concatenated method names: 'KXOpl6bCye', 'd9ypW5gmQX', 'gyWpDflitr', 'qZLpap8reC', 'Xxcp9K9coy', 'kBwD5BnHfP', 'rftDrFd5BB', 'hhTDsv73gI', 'sEtD8aUT80', 'NJ7DPla2TT'
                  Source: 0.2.ljMiHZ8MwZ.exe.432ec78.3.raw.unpack, qyyPq296Qkh0EGin1j.csHigh entropy of concatenated method names: 'euPdl7mcaD', 'GFpdm8cMPX', 'ARXdWkGCMc', 'J1xdglQem5', 'o1rdDC7DXT', 'GfCdpo0y6C', 'TqadaJe7Qc', 'C0ad9cnMHI', 'aXfdy2Hn7t', 'AVvd6CwsdW'
                  Source: 0.2.ljMiHZ8MwZ.exe.432ec78.3.raw.unpack, whT9VAvWrWdOTj3EWO.csHigh entropy of concatenated method names: 'ToString', 'HV41S9wE0x', 'zBN1IqjnDN', 'aBO1otoC4M', 'Plr1ko0y1i', 'IZB14hmjai', 'j2w1fjqtJA', 'M9a1CtUvUE', 'BbA1BLpqst', 'ogf1Nkre7A'
                  Source: 0.2.ljMiHZ8MwZ.exe.432ec78.3.raw.unpack, Ko28UW3XlevF8QFhQ37.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'D8F7SHgxen', 'lke7Jp3es7', 'U1G7LW9wfa', 'JxR7Z5LvDG', 'Eqe7G2j9V1', 'wMK7vU1pZh', 'Mlo7MJmBYk'
                  Source: 0.2.ljMiHZ8MwZ.exe.432ec78.3.raw.unpack, c0npjGZVC8QoekSSiE.csHigh entropy of concatenated method names: 'oZ7VYCnT0c', 'JNAVJ2y6N2', 'BTqVZ9vKHe', 'rroVGn95O6', 'DtiVIgGoL5', 'l39VoG98lM', 'fLoVkVeIkQ', 'WcPV4I0S9L', 'mTyVffQVVl', 'muOVCunoqX'
                  Source: 0.2.ljMiHZ8MwZ.exe.432ec78.3.raw.unpack, bD37EoNqtrph9p0XKi.csHigh entropy of concatenated method names: 'ELqaw0Q2pj', 'sKiaFEIPPu', 'ahvaEBSRyN', 'YSVa0Z019T', 'CtZaAwGRaF', 'hXiaOM8Ifk', 'cQaaTGXP8U', 'z1Ha2oD9Jw', 'BdPax0uMoO', 'yk7at26fk1'
                  Source: 0.2.ljMiHZ8MwZ.exe.42d2a58.0.raw.unpack, fveyHcscgRsunRk5tw.csHigh entropy of concatenated method names: 'OdIHVklGB7', 'A0hHUGFMQ8', 'di7HHgDVU3', 'WPhHuZdIF0', 'jecHQtuy81', 'S8EHnCMkGg', 'Dispose', 'LaqemtE7ag', 'lEmeWMFu5u', 'wvpeg8N1fq'
                  Source: 0.2.ljMiHZ8MwZ.exe.42d2a58.0.raw.unpack, h3TbBgPKWJM3k3GmXI.csHigh entropy of concatenated method names: 'Bv0Hj9P4vN', 'PoCHI7bXh9', 'tP0HorBdxk', 'IZFHkKqDSB', 'UFwH4dBZ5o', 'ogmHfMfU7I', 'tblHCCM6eU', 'nwbHBP7FxE', 'SsyHNnx5Wn', 'DvtHYPC36J'
                  Source: 0.2.ljMiHZ8MwZ.exe.42d2a58.0.raw.unpack, oxFBU42wJTr2UTVcBS.csHigh entropy of concatenated method names: 'gdZWZTamEN', 'cYxWGfDJ6P', 'rqsWvqG85K', 'Q24WMioCkT', 'rNOW5G1gr6', 'jSLWrW6foE', 'SR2WsFrbym', 'hWXW8tYt4w', 'JI0WPWFWqv', 'lU8Wh0W6ir'
                  Source: 0.2.ljMiHZ8MwZ.exe.42d2a58.0.raw.unpack, qGWQwo3dZPjlkLfaXEb.csHigh entropy of concatenated method names: 'YktuhfmIYi', 'LD9uzApOq9', 'e62bXRuxUF', 'wm5bICyysQdvmS0Q4XK', 'z8lOOUyLLHyT7DMV13X', 'bHiac7yXndI6kdjUemP', 'hl7PP7yYada2wJVpExC'
                  Source: 0.2.ljMiHZ8MwZ.exe.42d2a58.0.raw.unpack, UFuoQeCdlpIA3uNJJl.csHigh entropy of concatenated method names: 'vDVamV7Xnr', 'vJOag5ovPb', 'JaoapdFwQR', 'D7QphduMc9', 'I2ipzGUjRU', 'gt4aXushGK', 'gITa3pQxCc', 'UwGaKQRs84', 'acQadBXrkB', 'SoUaRkv0wZ'
                  Source: 0.2.ljMiHZ8MwZ.exe.42d2a58.0.raw.unpack, fRMpebh3HnJSGfKfL5.csHigh entropy of concatenated method names: 'ALF7gxHoIM', 'aPJ7DUGyTh', 'zHi7pDRhFN', 'KDK7aqetw2', 'dLQ7Hk0QyX', 'Sg079EB4Xj', 'Next', 'Next', 'Next', 'NextBytes'
                  Source: 0.2.ljMiHZ8MwZ.exe.42d2a58.0.raw.unpack, qBd4H5tgmR5ZnW4Vei.csHigh entropy of concatenated method names: 'SutDAJlYvu', 'ROiDTD7a6p', 'mTmgouYxdA', 'L8LgkWOIJ0', 'W3Ag4urpy0', 'DrNgfaG3pJ', 'YTHgCpg8YQ', 'DeXgBstkRy', 'pSJgNqq9kK', 'CsugYjNTct'
                  Source: 0.2.ljMiHZ8MwZ.exe.42d2a58.0.raw.unpack, EuOpUCriLBxCLqaAMU.csHigh entropy of concatenated method names: 'vOfU8JiVtS', 'kejUh5P7hq', 'SsmeXP6x2t', 'QJie3NWrSU', 'GF1USGkmOm', 'WiyUJ3iYo2', 'WsjULLBDQN', 'kxpUZuaE8e', 'h6cUGQhmVq', 'hBvUvt1s7r'
                  Source: 0.2.ljMiHZ8MwZ.exe.42d2a58.0.raw.unpack, CmxdKqWHRvJdY9P2C6.csHigh entropy of concatenated method names: 'Dispose', 'dsu3PnRk5t', 'rm3KI9Ogld', 'Qc9iynxKxx', 'xPb3h5Y0G1', 'lEh3zmDCB4', 'ProcessDialogKey', 'BLgKX3TbBg', 'bWJK3M3k3G', 'fXIKKmRMpe'
                  Source: 0.2.ljMiHZ8MwZ.exe.42d2a58.0.raw.unpack, KxSlmh3RWIExw3kFaGD.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'z08bHsNTZt', 'ecEb7Gibds', 'qkVbu8Vsq1', 'yOpbbc5rbG', 'kJ0bQvpgRT', 'eCebiuG1RS', 'ywtbnw3DD6'
                  Source: 0.2.ljMiHZ8MwZ.exe.42d2a58.0.raw.unpack, xGWxxQzs6QMPuKRFe2.csHigh entropy of concatenated method names: 'Aa47OyMdV0', 'LFy72Jn1d0', 'K3o7xmxHL9', 'n0x7jyVL10', 'TvY7ICrcs6', 'TgC7kWqNRO', 'DvN74adREW', 'pbF7nn2tWa', 'QTQ7wEuCWn', 'VlA7FUj0xI'
                  Source: 0.2.ljMiHZ8MwZ.exe.42d2a58.0.raw.unpack, biOSFH33IeY62QRJA5u.csHigh entropy of concatenated method names: 'QlJ7hp51tX', 'MG57zf7uE8', 'JcnuXUOOQD', 'fA8u3qOCi4', 'FSLuKS6IhR', 'rOoudh4wZt', 'ITfuRayqui', 'inZulFFGL1', 'jZNumyFrVi', 'b7UuWxWnYF'
                  Source: 0.2.ljMiHZ8MwZ.exe.42d2a58.0.raw.unpack, G5HkYS3K1F7W131Parx.csHigh entropy of concatenated method names: 'ToString', 'VWUu29M9nH', 'MVbuxhGMUF', 'iJ8utawXTD', 'JRLujRBLdW', 'qDkuIy5ybl', 'jxiuo8mK8k', 'wY9ukYXNFp', 'P7KdVQyQjg5MX7td4nQ', 'tHGhUAyF7lc1PN7P3jK'
                  Source: 0.2.ljMiHZ8MwZ.exe.42d2a58.0.raw.unpack, qYwR0TMDtDIN8pqpVU.csHigh entropy of concatenated method names: 'BD7U66QRgG', 'nAxUqfollF', 'ToString', 'wlwUm64e64', 'mhHUWUVW0m', 'zHcUgC0Lhx', 'rNTUDVxSBj', 'FU6UpWpA6U', 'FBeUas9IZb', 'a0oU99NcCK'
                  Source: 0.2.ljMiHZ8MwZ.exe.42d2a58.0.raw.unpack, LXtXutRj3L0weLOGZY.csHigh entropy of concatenated method names: 'F8c3axFBU4', 'xJT39r2UTV', 'eGN364ahiv', 'us03qOUBd4', 'g4V3VeivHo', 'mSo31uYakG', 'yxG1MyehurFOIaCjcr', 'QK6o1mHaIraxp3BFvG', 'Fv933fjTu5', 'jX53dwsoay'
                  Source: 0.2.ljMiHZ8MwZ.exe.42d2a58.0.raw.unpack, UeK7EHGFSG5neVbdSw.csHigh entropy of concatenated method names: 'nbNVs063IM', 'XPBV8TMQUC', 'dUEVPT2A0j', 'ht3VhZ13r1', 'p525tGkInunKOMT2f6S', 'QHQbV4kYEaXYvcxiYYR', 'bClmjgknsESuy7o594T'
                  Source: 0.2.ljMiHZ8MwZ.exe.42d2a58.0.raw.unpack, mKU4ufKcuQsUByve7r.csHigh entropy of concatenated method names: 'VItECekKP', 'IqC0W8elS', 'UpHOa6EJf', 'P4NTtkGB1', 'IY6xDZZ3I', 'fIKtwLipq', 'w5Etjeu7NULWdSieki', 'RvXf0NPgYG12aGGDNY', 'f4ae92gPt', 'JYY7gfda3'
                  Source: 0.2.ljMiHZ8MwZ.exe.42d2a58.0.raw.unpack, HdUXMlxGN4ahivbs0O.csHigh entropy of concatenated method names: 'uhSg0nX4tU', 'uhdgOdZPyk', 'xR2g2QEytr', 'YUtgxoWcVD', 'L7PgVvKeVs', 'XN5g1erWgM', 'CFpgUHOUVG', 'y7yge176mP', 'DaMgHipFIa', 'XNXg73fxNs'
                  Source: 0.2.ljMiHZ8MwZ.exe.42d2a58.0.raw.unpack, YBBGBdLdRgRLbm4owH.csHigh entropy of concatenated method names: 'xJnc2OJVPr', 'HGMcxjHCrF', 'FKEcjp1Lfs', 'bDucIDDW7G', 'lDxckPRHCp', 'Kfvc47gPNf', 'GwDcC0Wj3c', 'bekcBNIuZy', 'a3ocYmRbPR', 'tpEcSZ6mhr'
                  Source: 0.2.ljMiHZ8MwZ.exe.42d2a58.0.raw.unpack, SHo6SojuYakG6IgwZL.csHigh entropy of concatenated method names: 'KXOpl6bCye', 'd9ypW5gmQX', 'gyWpDflitr', 'qZLpap8reC', 'Xxcp9K9coy', 'kBwD5BnHfP', 'rftDrFd5BB', 'hhTDsv73gI', 'sEtD8aUT80', 'NJ7DPla2TT'
                  Source: 0.2.ljMiHZ8MwZ.exe.42d2a58.0.raw.unpack, qyyPq296Qkh0EGin1j.csHigh entropy of concatenated method names: 'euPdl7mcaD', 'GFpdm8cMPX', 'ARXdWkGCMc', 'J1xdglQem5', 'o1rdDC7DXT', 'GfCdpo0y6C', 'TqadaJe7Qc', 'C0ad9cnMHI', 'aXfdy2Hn7t', 'AVvd6CwsdW'
                  Source: 0.2.ljMiHZ8MwZ.exe.42d2a58.0.raw.unpack, whT9VAvWrWdOTj3EWO.csHigh entropy of concatenated method names: 'ToString', 'HV41S9wE0x', 'zBN1IqjnDN', 'aBO1otoC4M', 'Plr1ko0y1i', 'IZB14hmjai', 'j2w1fjqtJA', 'M9a1CtUvUE', 'BbA1BLpqst', 'ogf1Nkre7A'
                  Source: 0.2.ljMiHZ8MwZ.exe.42d2a58.0.raw.unpack, Ko28UW3XlevF8QFhQ37.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'D8F7SHgxen', 'lke7Jp3es7', 'U1G7LW9wfa', 'JxR7Z5LvDG', 'Eqe7G2j9V1', 'wMK7vU1pZh', 'Mlo7MJmBYk'
                  Source: 0.2.ljMiHZ8MwZ.exe.42d2a58.0.raw.unpack, c0npjGZVC8QoekSSiE.csHigh entropy of concatenated method names: 'oZ7VYCnT0c', 'JNAVJ2y6N2', 'BTqVZ9vKHe', 'rroVGn95O6', 'DtiVIgGoL5', 'l39VoG98lM', 'fLoVkVeIkQ', 'WcPV4I0S9L', 'mTyVffQVVl', 'muOVCunoqX'
                  Source: 0.2.ljMiHZ8MwZ.exe.42d2a58.0.raw.unpack, bD37EoNqtrph9p0XKi.csHigh entropy of concatenated method names: 'ELqaw0Q2pj', 'sKiaFEIPPu', 'ahvaEBSRyN', 'YSVa0Z019T', 'CtZaAwGRaF', 'hXiaOM8Ifk', 'cQaaTGXP8U', 'z1Ha2oD9Jw', 'BdPax0uMoO', 'yk7at26fk1'

                  Hooking and other Techniques for Hiding and Protection

                  barindex
                  Uses known network protocols on non-standard ports
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 55615
                  Source: unknownNetwork traffic detected: HTTP traffic on port 55615 -> 49733
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 55615
                  Source: unknownNetwork traffic detected: HTTP traffic on port 55615 -> 49733
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 55615
                  Source: unknownNetwork traffic detected: HTTP traffic on port 55615 -> 49737
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 55615
                  Source: unknownNetwork traffic detected: HTTP traffic on port 55615 -> 49737
                  Source: unknownNetwork traffic detected: HTTP traffic on port 55615 -> 49737
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                  Malware Analysis System Evasion

                  barindex
                  Yara detected AntiVM3
                  Source: Yara matchFile source: Process Memory Space: ljMiHZ8MwZ.exe PID: 7348, type: MEMORYSTR
                  Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
                  Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeMemory allocated: 17A0000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeMemory allocated: 3110000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeMemory allocated: 5110000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeMemory allocated: 9330000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeMemory allocated: A330000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeMemory allocated: A540000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeMemory allocated: B540000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeMemory allocated: 13A0000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeMemory allocated: 2E60000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeMemory allocated: 2C70000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeWindow / User API: threadDelayed 1316Jump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeWindow / User API: threadDelayed 8365Jump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exe TID: 7368Thread sleep time: -922337203685477s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exe TID: 7744Thread sleep time: -31359464925306218s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1743846238.0000000007910000.00000004.08000000.00040000.00000000.sdmp, ljMiHZ8MwZ.exe, 00000000.00000002.1741731894.00000000042A3000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: mKU4ufKcuQsUByve7rdGifh134lxgMSiHuBPKrbPlcdILT9DBisIs8LXtXutRj3L0weLOGZYOvgDLvlIuWaHtj4c6onR5ufim1TusAStd8roCmxdKqWHRvJdY9P2C6UserControlSystem.Windows.FormsRajN0UgjoygJBEeacrUITypeEditorSystem.Drawing.DesignSystem.DrawingUoB2qHDX9aTV4KNpvmEnumJa92gPptpOjiMw1MkYOgfda3aHma5cOApc7NqyyPq296Qkh0EGin1jaAHAXU6TOKSHsItCekMulticastDelegatecPkqCWq8elSP3JBGEmP5pHa6cEJfJ4NtkGB1DZl76dVMrkY6DZZ3ImHKwLip1qWWjhjw5wRaerWWqdUG5WmofljShXmNNd9aegiqeJYA1sgrmElWpXHIIvxbStWSQ6Nqlq3K70SNA85KZUHbTtBkyNugKLPuu0AGfynF9t9kbbEXdDLO9M6rruJRCxQmSq7fXYlu6DnudeaGi5Q5BiDcNPvSFkKqEonKD3jfZUbQNkwEOxkQwJLT36txv3DHsjNBXrFNOBQGRxWOIsjjFtv9EfjTu5rfJc6UMOaX5w0soayuX1Sqyrvk16DeAQ76dOfLt3q8CbEkx7OcEo45sYRyHSy6MtKRTRQ761NRoTt8oxFBU42wJTr2UTVcBSHdUXMlxGN4ahivbs0OqBd4H5tgmR5ZnW4VeiSHo6SojuYakG6IgwZLsUAIOdIcSLdRicLlbIX20XssoluT29qFK7Ile48P9lk1yt1w0l7YPERuxfOi4N3h5FDagi8rzrJtLHf02N11alqrhwUFuoQeCdlpIA3uNJJllUNJeVBrbJ1j7kjRgQbD37EoNqtrph9p0XKioVryvvYdQj7id7651qNr58I0StO1AvChb1yyEventArgsLeXIV6JlxYG286jECPApplicationExceptionYBBGBdLdRgRLbm4owHc0npjGZVC8QoekSSiEUeK7EHGFSG5neVbdSwwhT9VAvWrWdOTj3EWOqYwR0TMDtDIN8pqpVUeST8V05Lk8UgBG2UPKEuOpUCriLBxCLqaAMUfveyHcscgRsunRk5twFormXb5Y0G81yEhmDCB4ALh3TbBgPKWJM3k3GmXIfRMpebh3HnJSGfKfL5RandomxGWxxQzs6QMPuKRFe2Ko28UW3XlevF8QFhQ37ExpandableObjectConverterSystem.ComponentModelbiOSFH33IeY62QRJA5uG5HkYS3K1F7W131ParxqGWQwo3dZPjlkLfaXEbKxSlmh3RWIExw3kFaGD<Module>{0E8AD44F-B4A1-4840-98C6-7AC987A82628}Mk6DYM3lSyNJikYKa2qJ2JoNQ3mpCYYwsxJOGStOChuT3DZIFp33gldyx<PrivateImplementationDetails>{A8B78495-69A5-4CBF-8D75-C5304FB59F70}__StaticArrayInitTypeSize=256__StaticArrayInitTypeSize=40__StaticArrayInitTypeSize=30__StaticArrayInitTypeSize=32__StaticArrayInitTypeSize=16__StaticArrayInitTypeSize=64__StaticArrayInitTypeSize=18
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1875228155.0000000000FFB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1743846238.0000000007910000.00000004.08000000.00040000.00000000.sdmp, ljMiHZ8MwZ.exe, 00000000.00000002.1741731894.00000000042A3000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: UeK7EHGFSG5neVbdSw
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess information queried: ProcessInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess token adjusted: DebugJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess token adjusted: DebugJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeMemory allocated: page read and write | page guardJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeProcess created: C:\Users\user\Desktop\ljMiHZ8MwZ.exe "C:\Users\user\Desktop\ljMiHZ8MwZ.exe"Jump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Users\user\Desktop\ljMiHZ8MwZ.exe VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Users\user\Desktop\ljMiHZ8MwZ.exe VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1883517176.00000000066BE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

                  Stealing of Sensitive Information

                  barindex
                  Yara detected RedLine Stealer
                  Source: Yara matchFile source: dump.pcap, type: PCAP
                  Source: Yara matchFile source: 0.2.ljMiHZ8MwZ.exe.41f8af0.1.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.ljMiHZ8MwZ.exe.4210910.2.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 2.2.ljMiHZ8MwZ.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.ljMiHZ8MwZ.exe.4210910.2.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.ljMiHZ8MwZ.exe.41f8af0.1.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000002.00000002.1874957650.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.1741731894.00000000041F8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: ljMiHZ8MwZ.exe PID: 7348, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: ljMiHZ8MwZ.exe PID: 7532, type: MEMORYSTR
                  Found many strings related to Crypto-Wallets (likely being stolen)
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1741731894.00000000041F8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: [^\u0020-\u007F]ProcessIdname_on_cardencrypted_valuehttps://ipinfo.io/ip%appdata%\logins{0}\FileZilla\recentservers.xml%appdata%\discord\Local Storage\leveldb\tdataAtomicWalletv10/C \EtFile.IOhereuFile.IOm\walFile.IOletsESystem.UItherSystem.UIeumElectrum[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}profiles\Windows\valueexpiras21ation_moas21nth
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000003000000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: $^q1C:\Users\user\AppData\Roaming\Electrum\wallets\*
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1741731894.00000000041F8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlite*ssfn*ExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxe*Winhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry*.vstring.ReplacedfJaxxpathBSJB
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1741731894.00000000041F8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlite*ssfn*ExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxe*Winhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry*.vstring.ReplacedfJaxxpathBSJB
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000003000000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: \Ethereum\wallets
                  Source: ljMiHZ8MwZ.exe, 00000000.00000002.1741731894.00000000041F8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlite*ssfn*ExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxe*Winhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry*.vstring.ReplacedfJaxxpathBSJB
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000003000000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: Ethereum
                  Source: ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000003000000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: $^q5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*
                  Tries to harvest and steal browser information (history, passwords, etc)
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqliteJump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
                  Tries to steal Crypto Currency Wallets
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeFile opened: C:\Users\user\AppData\Roaming\atomic\Jump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\wallets\Jump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\wallets\Jump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeFile opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\Jump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\Jump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\Jump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\Jump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeFile opened: C:\Users\user\AppData\Roaming\Guarda\Jump to behavior
                  Source: C:\Users\user\Desktop\ljMiHZ8MwZ.exeFile opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\Jump to behavior
                  Source: Yara matchFile source: 0.2.ljMiHZ8MwZ.exe.41f8af0.1.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.ljMiHZ8MwZ.exe.4210910.2.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 2.2.ljMiHZ8MwZ.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.ljMiHZ8MwZ.exe.4210910.2.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.ljMiHZ8MwZ.exe.41f8af0.1.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000002.00000002.1874957650.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.1741731894.00000000041F8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: ljMiHZ8MwZ.exe PID: 7348, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: ljMiHZ8MwZ.exe PID: 7532, type: MEMORYSTR

                  Remote Access Functionality

                  barindex
                  Yara detected RedLine Stealer
                  Source: Yara matchFile source: dump.pcap, type: PCAP
                  Source: Yara matchFile source: 0.2.ljMiHZ8MwZ.exe.41f8af0.1.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.ljMiHZ8MwZ.exe.4210910.2.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 2.2.ljMiHZ8MwZ.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.ljMiHZ8MwZ.exe.4210910.2.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.ljMiHZ8MwZ.exe.41f8af0.1.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000002.00000002.1874957650.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.1741731894.00000000041F8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: ljMiHZ8MwZ.exe PID: 7348, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: ljMiHZ8MwZ.exe PID: 7532, type: MEMORYSTR

                  Mitre Att&ck Matrix

                  ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                  Gather Victim Identity InformationAcquire InfrastructureValid Accounts221
                  Windows Management Instrumentation                  		1
                  DLL Side-Loading                  		11
                  Process Injection                  		1
                  Masquerading                  		1
                  OS Credential Dumping                  		231
                  Security Software Discovery                  		Remote Services1
                  Archive Collected Data                  		1
                  Encrypted Channel                  		Exfiltration Over Other Network MediumAbuse Accessibility Features
                  CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
                  DLL Side-Loading                  		1
                  Disable or Modify Tools                  		LSASS Memory1
                  Process Discovery                  		Remote Desktop Protocol3
                  Data from Local System                  		11
                  Non-Standard Port                  		Exfiltration Over BluetoothNetwork Denial of Service
                  Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)241
                  Virtualization/Sandbox Evasion                  		Security Account Manager241
                  Virtualization/Sandbox Evasion                  		SMB/Windows Admin SharesData from Network Shared Drive2
                  Non-Application Layer Protocol                  		Automated ExfiltrationData Encrypted for Impact
                  Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
                  Process Injection                  		NTDS1
                  Application Window Discovery                  		Distributed Component Object ModelInput Capture12
                  Application Layer Protocol                  		Traffic DuplicationData Destruction
                  Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script2
                  Obfuscated Files or Information                  		LSA Secrets113
                  System Information Discovery                  		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                  Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts12
                  Software Packing                  		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                  DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                  DLL Side-Loading                  		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

                  Behavior Graph

                  Hide Legend

                  Legend:

                  • Process
                  • Signature
                  • Created File
                  • DNS/IP Info
                  • Is Dropped
                  • Is Windows Process
                  • Number of created Registry Values
                  • Number of created Files
                  • Visual Basic
                  • Delphi
                  • Java
                  • .Net C# or VB.NET
                  • C, C++ or other language
                  • Is malicious
                  • Internet

                  Screenshots

                  Thumbnails

                  This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                  windows-stand

                  Antivirus, Machine Learning and Genetic Malware Detection

                  Initial Sample

                  SourceDetectionScannerLabelLink
                  ljMiHZ8MwZ.exe35%VirustotalBrowse
                  ljMiHZ8MwZ.exe66%ReversingLabsByteCode-MSIL.Trojan.Remcos
                  ljMiHZ8MwZ.exe100%Joe Sandbox ML

                  Dropped Files

                  ⊘No Antivirus matches

                  Unpacked PE Files

                  ⊘No Antivirus matches

                  Domains

                  ⊘No Antivirus matches

                  URLs

                  SourceDetectionScannerLabelLink
                  http://45.137.22.250:556150%Avira URL Cloudsafe
                  https://api.ipify.orgcookies//settinString.Removeg0%Avira URL Cloudsafe
                  http://45.137.22.250:50%Avira URL Cloudsafe
                  45.137.22.250:556150%Avira URL Cloudsafe
                  http://45.137.22.250:55615/0%Avira URL Cloudsafe

                  Domains and IPs

                  Contacted Domains

                  NameIPActiveMaliciousAntivirus DetectionReputation
                  api.ip.sb
                  		unknown
                  		unknownfalse
                    		high

                    Contacted URLs

                    NameMaliciousAntivirus DetectionReputation
                    45.137.22.250:55615true
                    • Avira URL Cloud: safe
                    		unknown
                    http://45.137.22.250:55615/true
                    • Avira URL Cloud: safe
                    		unknown

                    URLs from Memory and Binaries

                    NameSourceMaliciousAntivirus DetectionReputation
                    https://duckduckgo.com/chrome_newtabtmp96FD.tmp.2.dr, tmpD0D4.tmp.2.dr, tmpD0B3.tmp.2.dr, tmp971F.tmp.2.dr, tmp9762.tmp.2.dr, tmp9741.tmp.2.dr, tmp9752.tmp.2.dr, tmp9731.tmp.2.dr, tmp96FE.tmp.2.dr, tmpD103.tmp.2.dr, tmp970E.tmp.2.dr, tmp9720.tmp.2.drfalse
                      		high
                      http://www.fontbureau.com/designersGljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpfalse
                        		high
                        https://duckduckgo.com/ac/?q=tmp96FD.tmp.2.dr, tmpD0D4.tmp.2.dr, tmpD0B3.tmp.2.dr, tmp971F.tmp.2.dr, tmp9762.tmp.2.dr, tmp9741.tmp.2.dr, tmp9752.tmp.2.dr, tmp9731.tmp.2.dr, tmp96FE.tmp.2.dr, tmpD103.tmp.2.dr, tmp970E.tmp.2.dr, tmp9720.tmp.2.drfalse
                          		high
                          http://www.fontbureau.com/designers/?ljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            http://www.founder.com.cn/cn/bTheljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              http://schemas.xmlsoap.org/ws/2004/08/addressing/faultXljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002E61000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                http://www.fontbureau.com/designers?ljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  http://tempuri.org/Endpoint/EnvironmentSettingsljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002E61000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    https://api.ip.sb/geoipljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002EB0000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      http://schemas.xmlsoap.org/soap/envelope/ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002EB0000.00000004.00000800.00020000.00000000.sdmp, ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002EDC000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        http://www.tiro.comljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          http://tempuri.org/ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002EF5000.00000004.00000800.00020000.00000000.sdmp, ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002EDC000.00000004.00000800.00020000.00000000.sdmp, ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002FF7000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		high
                                            https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=tmp96FD.tmp.2.dr, tmpD0D4.tmp.2.dr, tmpD0B3.tmp.2.dr, tmp971F.tmp.2.dr, tmp9762.tmp.2.dr, tmp9741.tmp.2.dr, tmp9752.tmp.2.dr, tmp9731.tmp.2.dr, tmp96FE.tmp.2.dr, tmpD103.tmp.2.dr, tmp970E.tmp.2.dr, tmp9720.tmp.2.drfalse
                                              		high
                                              http://www.fontbureau.com/designersljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                http://www.goodfont.co.krljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://tempuri.org/Endpoint/VerifyUpdateResponseljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002E61000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://45.137.22.250:55615ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002EF5000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    http://tempuri.org/Endpoint/SetEnvironmentljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002EF5000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://tempuri.org/Endpoint/SetEnvironmentResponseljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002E61000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://www.sajatypeworks.comljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://tempuri.org/Endpoint/GetUpdatesljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002EF5000.00000004.00000800.00020000.00000000.sdmp, ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002EDC000.00000004.00000800.00020000.00000000.sdmp, ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002FF7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://www.typography.netDljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://www.founder.com.cn/cn/cTheljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://www.galapagosdesign.com/staff/dennis.htmljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://api.ipify.orgcookies//settinString.RemovegljMiHZ8MwZ.exe, ljMiHZ8MwZ.exe, 00000002.00000002.1874957650.0000000000402000.00000040.00000400.00020000.00000000.sdmptrue
                                                                  • Avira URL Cloud: safe
                                                                  		unknown
                                                                  https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchtmp96FD.tmp.2.dr, tmpD0D4.tmp.2.dr, tmpD0B3.tmp.2.dr, tmp971F.tmp.2.dr, tmp9762.tmp.2.dr, tmp9741.tmp.2.dr, tmp9752.tmp.2.dr, tmp9731.tmp.2.dr, tmp96FE.tmp.2.dr, tmpD103.tmp.2.dr, tmp970E.tmp.2.dr, tmp9720.tmp.2.drfalse
                                                                    		high
                                                                    http://www.galapagosdesign.com/DPleaseljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      http://tempuri.org/Endpoint/VerifyUpdateljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002E61000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://tempuri.org/0ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002E61000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://www.fonts.comljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://www.sandoll.co.krljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://www.urwpp.deDPleaseljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://www.zhongyicts.com.cnljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002E61000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://www.sakkal.comljMiHZ8MwZ.exe, 00000000.00000002.1743045301.0000000005B14000.00000004.00000020.00020000.00000000.sdmp, ljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://ipinfo.io/ip%appdata%ljMiHZ8MwZ.exe, ljMiHZ8MwZ.exe, 00000002.00000002.1874957650.0000000000402000.00000040.00000400.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://www.apache.org/licenses/LICENSE-2.0ljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://www.fontbureau.comljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://www.google.com/images/branding/product/ico/googleg_lodp.icotmp96FD.tmp.2.dr, tmpD0D4.tmp.2.dr, tmpD0B3.tmp.2.dr, tmp971F.tmp.2.dr, tmp9762.tmp.2.dr, tmp9741.tmp.2.dr, tmp9752.tmp.2.dr, tmp9731.tmp.2.dr, tmp96FE.tmp.2.dr, tmpD103.tmp.2.dr, tmp970E.tmp.2.dr, tmp9720.tmp.2.drfalse
                                                                                              		high
                                                                                              http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymousljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002E61000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://tempuri.org/Endpoint/CheckConnectResponseljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002E61000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  http://schemas.datacontract.org/2004/07/ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002EF5000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://api.ip.sb/geoip%USERPEnvironmentROFILE%ljMiHZ8MwZ.exe, ljMiHZ8MwZ.exe, 00000002.00000002.1874957650.0000000000402000.00000040.00000400.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://api.ip.sbljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002EB0000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=tmp96FD.tmp.2.dr, tmpD0D4.tmp.2.dr, tmpD0B3.tmp.2.dr, tmp971F.tmp.2.dr, tmp9762.tmp.2.dr, tmp9741.tmp.2.dr, tmp9752.tmp.2.dr, tmp9731.tmp.2.dr, tmp96FE.tmp.2.dr, tmpD103.tmp.2.dr, tmp970E.tmp.2.dr, tmp9720.tmp.2.drfalse
                                                                                                          		high
                                                                                                          http://tempuri.org/Endpoint/CheckConnectljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002E61000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://www.ecosia.org/newtab/tmp96FD.tmp.2.dr, tmpD0D4.tmp.2.dr, tmpD0B3.tmp.2.dr, tmp971F.tmp.2.dr, tmp9762.tmp.2.dr, tmp9741.tmp.2.dr, tmp9752.tmp.2.dr, tmp9731.tmp.2.dr, tmp96FE.tmp.2.dr, tmpD103.tmp.2.dr, tmp970E.tmp.2.dr, tmp9720.tmp.2.drfalse
                                                                                                              		high
                                                                                                              http://tempuri.org/Endpoint/SetEnvironljMiHZ8MwZ.exe, 00000002.00000002.1876392407.00000000031EC000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                http://www.carterandcone.comlljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://ac.ecosia.org/autocomplete?q=tmp96FD.tmp.2.dr, tmpD0D4.tmp.2.dr, tmpD0B3.tmp.2.dr, tmp971F.tmp.2.dr, tmp9762.tmp.2.dr, tmp9741.tmp.2.dr, tmp9752.tmp.2.dr, tmp9731.tmp.2.dr, tmp96FE.tmp.2.dr, tmpD103.tmp.2.dr, tmp970E.tmp.2.dr, tmp9720.tmp.2.drfalse
                                                                                                                    		high
                                                                                                                    http://www.fontbureau.com/designers/cabarga.htmlNljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      http://www.founder.com.cn/cnljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        http://www.fontbureau.com/designers/frere-user.htmlljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          http://schemas.xmlsoap.org/ws/2004/08/addressingljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002E61000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            http://tempuri.org/Endpoint/GetUpdatesResponseljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002E61000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              http://www.jiyu-kobo.co.jp/ljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                http://tempuri.org/Endpoint/EnvironmentSettingsResponseljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002E61000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  http://www.fontbureau.com/designers8ljMiHZ8MwZ.exe, 00000000.00000002.1743316362.0000000007322000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    http://45.137.22.250:5ljMiHZ8MwZ.exe, 00000002.00000002.1876392407.00000000031EC000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                    • Avira URL Cloud: safe
                                                                                                                                    		unknown
                                                                                                                                    https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=tmp96FD.tmp.2.dr, tmpD0D4.tmp.2.dr, tmpD0B3.tmp.2.dr, tmp971F.tmp.2.dr, tmp9762.tmp.2.dr, tmp9741.tmp.2.dr, tmp9752.tmp.2.dr, tmp9731.tmp.2.dr, tmp96FE.tmp.2.dr, tmpD103.tmp.2.dr, tmp970E.tmp.2.dr, tmp9720.tmp.2.drfalse
                                                                                                                                      		high
                                                                                                                                      http://schemas.xmlsoap.org/soap/actor/nextljMiHZ8MwZ.exe, 00000002.00000002.1876392407.0000000002E61000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                        		high

                                                                                                                                        World Map of Contacted IPs

                                                                                                                                        • No. of IPs < 25%
                                                                                                                                        • 25% < No. of IPs < 50%
                                                                                                                                        • 50% < No. of IPs < 75%
                                                                                                                                        • 75% < No. of IPs

                                                                                                                                        Public IPs

                                                                                                                                        IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                        45.137.22.250
                                                                                                                                        		unknownNetherlands
                                                                                                                                        		51447ROOTLAYERNETNLtrue

                                                                                                                                        General Information

                                                                                                                                        Joe Sandbox version:41.0.0 Charoite
                                                                                                                                        Analysis ID:1581021
                                                                                                                                        Start date and time:2024-12-26 17:41:09 +01:00
                                                                                                                                        Joe Sandbox product:CloudBasic
                                                                                                                                        Overall analysis duration:0h 5m 49s
                                                                                                                                        Hypervisor based Inspection enabled:false
                                                                                                                                        Report type:full
                                                                                                                                        Cookbook file name:default.jbs
                                                                                                                                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                        Number of analysed new started processes analysed:8
                                                                                                                                        Number of new started drivers analysed:0
                                                                                                                                        Number of existing processes analysed:0
                                                                                                                                        Number of existing drivers analysed:0
                                                                                                                                        Number of injected processes analysed:0
                                                                                                                                        Technologies:
                                                                                                                                        • HCA enabled
                                                                                                                                        • EGA enabled
                                                                                                                                        • AMSI enabled
                                                                                                                                        Analysis Mode:default
                                                                                                                                        Analysis stop reason:Timeout
                                                                                                                                        Sample name:ljMiHZ8MwZ.exe
                                                                                                                                        renamed because original name is a hash value
                                                                                                                                        Original Sample Name:4153363158f713a02e405d251823c0c3.exe
                                                                                                                                        Detection:MAL
                                                                                                                                        Classification:mal100.troj.spyw.evad.winEXE@4/47@1/1
                                                                                                                                        EGA Information:
                                                                                                                                        • Successful, ratio: 100%
                                                                                                                                        HCA Information:
                                                                                                                                        • Successful, ratio: 95%
                                                                                                                                        • Number of executed functions: 96
                                                                                                                                        • Number of non-executed functions: 7
                                                                                                                                        Cookbook Comments:
                                                                                                                                        • Found application associated with file extension: .exe

                                                                                                                                        Warnings

                                                                                                                                        • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                                                                                                                        • Excluded IPs from analysis (whitelisted): 172.67.75.172, 104.26.13.31, 104.26.12.31, 184.28.90.27, 20.12.23.50, 13.107.246.63
                                                                                                                                        • Excluded domains from analysis (whitelisted): api.ip.sb.cdn.cloudflare.net, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                        • Not all processes where analyzed, report is missing behavior information
                                                                                                                                        • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                                                        • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                        • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                        • Report size getting too big, too many NtQueryValueKey calls found.

                                                                                                                                        Simulations

                                                                                                                                        Behavior and APIs

                                                                                                                                        TimeTypeDescription
                                                                                                                                        11:42:03API Interceptor52x Sleep call for process: ljMiHZ8MwZ.exe modified

                                                                                                                                        Joe Sandbox View / Context

                                                                                                                                        IPs

                                                                                                                                        ⊘No context

                                                                                                                                        Domains

                                                                                                                                        ⊘No context

                                                                                                                                        ASNs

                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                        ROOTLAYERNETNLaYf5ibGObB.exeGet hashmaliciousRedLineBrowse
                                                                                                                                        • 185.222.58.90
                                                                                                                                        K3xL5Xy0XS.exeGet hashmaliciousRedLineBrowse
                                                                                                                                        • 185.222.58.90
                                                                                                                                        Invoice-BL. Payment TT $ 16945.99.exeGet hashmaliciousRedLineBrowse
                                                                                                                                        • 45.137.22.164
                                                                                                                                        MfzXU6tKOq.exeGet hashmaliciousPureLog Stealer, RedLineBrowse
                                                                                                                                        • 185.222.58.82
                                                                                                                                        lWnSA7IyVc.exeGet hashmaliciousPureLog Stealer, RedLineBrowse
                                                                                                                                        • 185.222.58.229
                                                                                                                                        8ZVd2S51fr.exeGet hashmaliciousRedLineBrowse
                                                                                                                                        • 185.222.58.241
                                                                                                                                        Purchase Order Purchase Order Purchase Order Purchase Order.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                                                                                        • 185.222.57.90
                                                                                                                                        Purchase Order Purchase Order Purchase Order Purchase Order.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                                                                                        • 185.222.57.90
                                                                                                                                        9dOKGgFNL2.exeGet hashmaliciousRedLineBrowse
                                                                                                                                        • 45.137.22.126
                                                                                                                                        RFQ List and airflight 2024.pif.exeGet hashmaliciousPureLog StealerBrowse
                                                                                                                                        • 45.137.22.174

                                                                                                                                        JA3 Fingerprints

                                                                                                                                        ⊘No context

                                                                                                                                        Dropped Files

                                                                                                                                        ⊘No context

                                                                                                                                        Created / dropped Files

                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ljMiHZ8MwZ.exe.log

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1216
                                                                                                                                        Entropy (8bit):5.34331486778365
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
                                                                                                                                        MD5:1330C80CAAC9A0FB172F202485E9B1E8
                                                                                                                                        SHA1:86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
                                                                                                                                        SHA-256:B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
                                                                                                                                        SHA-512:75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
                                                                                                                                        Malicious:true
                                                                                                                                        Reputation:high, very likely benign file
                                                                                                                                        Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp42E5.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):114688
                                                                                                                                        Entropy (8bit):0.9746603542602881
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                        MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                        SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                        SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                        SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                        Malicious:false
                                                                                                                                        Reputation:high, very likely benign file
                                                                                                                                        Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp42F6.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):114688
                                                                                                                                        Entropy (8bit):0.9746603542602881
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                        MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                        SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                        SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                        SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                        Malicious:false
                                                                                                                                        Reputation:high, very likely benign file
                                                                                                                                        Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp4306.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):114688
                                                                                                                                        Entropy (8bit):0.9746603542602881
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                        MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                        SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                        SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                        SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp4317.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):114688
                                                                                                                                        Entropy (8bit):0.9746603542602881
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                        MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                        SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                        SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                        SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp4318.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):114688
                                                                                                                                        Entropy (8bit):0.9746603542602881
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                        MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                        SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                        SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                        SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp4329.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):114688
                                                                                                                                        Entropy (8bit):0.9746603542602881
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                        MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                        SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                        SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                        SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp4339.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):98304
                                                                                                                                        Entropy (8bit):0.08235737944063153
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                                                                                                        MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                                                                                                        SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                                                                                                        SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                                                                                                        SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp58D2.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1026
                                                                                                                                        Entropy (8bit):4.694985340190863
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:fGg1AbmVALQm72DOg+8XDQzjmyhdsENw8TRlrlGpKTkA+oBK:fv1AiVAUmyDruzj37sENjlSKAA+oU
                                                                                                                                        MD5:C9386BC43BF8FA274422EB8AC6BAE1A9
                                                                                                                                        SHA1:2CBDE59ADA19F0389A4C482667EC370D68F51049
                                                                                                                                        SHA-256:F0CC9B94627F910F2A6307D911B1DDD7D1DB69BAD6068EF3331549F3A0877446
                                                                                                                                        SHA-512:7AACA07E8A4B34E0F75B16B6F30686AC3FB2D5CBDAD92E5934819F969BAFF59385FB8F997334313EA5938FD955D6175C4548D6B1F915D652D9D9201C9418EF83
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:DVWHKMNFNNSXRPFRFSVVCQPXSKWHKPJJHYQWYYFONAJQSCOHZADBHUOWOSPDVAOIQVOBHGMIENZQZLABYDKWXGSUQNSEINIQSVMZZWTJLYMGYBQHIJSUWZKJPGBZUGFOXNAMLQTVGWDCYDMNHGVRTUWNHIWXJNQONTAXVVVCFDLWYDVWNMKHRFTZAVEQPXZHSEXPEHWUHPJZDMDXPYEJBYWZOQETVPLRKQRCYTAXMNRBOUJSCYZOUPOBJUWFDMUYFBXCBLZHFHONIURELJQVLWAJRIQCHHASBUAREPSIMJIZDUKJCHMMSSWSEDFHFQOUVYZORWJIUACXUVQKUMLXTQIKDBVNZOHJYYECOBYPNRILKERBHKZPVUSQLHAQRTPWCRMZADYONIIOVUWOBVHAUGZVAGTZTZBMHSOOQORENTXCJFMVWMGLOOXBDWANXXJQQTBDTWOSPFMFVQKLNTSHOPQMHYRYZMWDXVFGWFOSCSFMKCDDHTOQHBTQAFQTXPUHHEAKYRCQIODCCSHRSAJQEFRHCQLQVVMUHWOHHQJPSHCNKRLIRESUXLZIYSWDHHYZVRKLAGFLVTEJQHEEMVUUEQKQMTBDXFGSROZTNPLCVTEEZGUUCQUEKNMQFATATJRARXQQMZYEVACDAXILYPEHYTJOQWSFAJEGHIDIXMKDXPATNSATPECIMRBZNBXXVMGPLMVEKCUOXJWFGQSTWPMTEMRCYGXECVTNKYROYRYTPRDPCFGGKUUBXXSDFZEJCQRIRFLCNMPMLIGUCYPHMWYVAIPAAPHTQAYFSJWLSCZICIXZHXNKAKRHJVENGZTUTVWSNYDDYMWQHHAITLUZXNORBLYTBVCEBWBMSVZXNZMKYFPRFPLFCUSJUWNKQJIZRVZASPVFSUSBYQZZWKEORBDDRCYRBTIMTLHDTZRQUKYJIWHXVJYPEZSDLWZVPZGEYQPCSGGVJXXBUCNBXKQPZTMTVPZUETYYLRJEDWIHAZMS

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp58E2.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1026
                                                                                                                                        Entropy (8bit):4.692693183518806
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
                                                                                                                                        MD5:78F042E25B7FAF970F75DFAA81955268
                                                                                                                                        SHA1:F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
                                                                                                                                        SHA-256:E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
                                                                                                                                        SHA-512:CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp58F3.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1026
                                                                                                                                        Entropy (8bit):4.695685570184741
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
                                                                                                                                        MD5:A28F7445BB3D064C83EB9DBC98091F76
                                                                                                                                        SHA1:D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
                                                                                                                                        SHA-256:10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
                                                                                                                                        SHA-512:42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp5D0B.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):40960
                                                                                                                                        Entropy (8bit):0.8553638852307782
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                        MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                        SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                        SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                        SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp5D1B.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):40960
                                                                                                                                        Entropy (8bit):0.8553638852307782
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                        MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                        SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                        SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                        SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp5D2C.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):40960
                                                                                                                                        Entropy (8bit):0.8553638852307782
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                        MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                        SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                        SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                        SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp5D2D.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):40960
                                                                                                                                        Entropy (8bit):0.8553638852307782
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                        MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                        SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                        SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                        SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp5D2E.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):40960
                                                                                                                                        Entropy (8bit):0.8553638852307782
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                        MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                        SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                        SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                        SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp5D3E.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):40960
                                                                                                                                        Entropy (8bit):0.8553638852307782
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                        MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                        SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                        SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                        SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp7B42.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):98304
                                                                                                                                        Entropy (8bit):0.08235737944063153
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                                                                                                        MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                                                                                                        SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                                                                                                        SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                                                                                                        SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp8ED9.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1026
                                                                                                                                        Entropy (8bit):4.701757898321461
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
                                                                                                                                        MD5:520219000D5681B63804A2D138617B27
                                                                                                                                        SHA1:2C7827C354FD7A58FB662266B7E3008AFB42C567
                                                                                                                                        SHA-256:C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
                                                                                                                                        SHA-512:C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp8EDA.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1026
                                                                                                                                        Entropy (8bit):4.694985340190863
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:fGg1AbmVALQm72DOg+8XDQzjmyhdsENw8TRlrlGpKTkA+oBK:fv1AiVAUmyDruzj37sENjlSKAA+oU
                                                                                                                                        MD5:C9386BC43BF8FA274422EB8AC6BAE1A9
                                                                                                                                        SHA1:2CBDE59ADA19F0389A4C482667EC370D68F51049
                                                                                                                                        SHA-256:F0CC9B94627F910F2A6307D911B1DDD7D1DB69BAD6068EF3331549F3A0877446
                                                                                                                                        SHA-512:7AACA07E8A4B34E0F75B16B6F30686AC3FB2D5CBDAD92E5934819F969BAFF59385FB8F997334313EA5938FD955D6175C4548D6B1F915D652D9D9201C9418EF83
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:DVWHKMNFNNSXRPFRFSVVCQPXSKWHKPJJHYQWYYFONAJQSCOHZADBHUOWOSPDVAOIQVOBHGMIENZQZLABYDKWXGSUQNSEINIQSVMZZWTJLYMGYBQHIJSUWZKJPGBZUGFOXNAMLQTVGWDCYDMNHGVRTUWNHIWXJNQONTAXVVVCFDLWYDVWNMKHRFTZAVEQPXZHSEXPEHWUHPJZDMDXPYEJBYWZOQETVPLRKQRCYTAXMNRBOUJSCYZOUPOBJUWFDMUYFBXCBLZHFHONIURELJQVLWAJRIQCHHASBUAREPSIMJIZDUKJCHMMSSWSEDFHFQOUVYZORWJIUACXUVQKUMLXTQIKDBVNZOHJYYECOBYPNRILKERBHKZPVUSQLHAQRTPWCRMZADYONIIOVUWOBVHAUGZVAGTZTZBMHSOOQORENTXCJFMVWMGLOOXBDWANXXJQQTBDTWOSPFMFVQKLNTSHOPQMHYRYZMWDXVFGWFOSCSFMKCDDHTOQHBTQAFQTXPUHHEAKYRCQIODCCSHRSAJQEFRHCQLQVVMUHWOHHQJPSHCNKRLIRESUXLZIYSWDHHYZVRKLAGFLVTEJQHEEMVUUEQKQMTBDXFGSROZTNPLCVTEEZGUUCQUEKNMQFATATJRARXQQMZYEVACDAXILYPEHYTJOQWSFAJEGHIDIXMKDXPATNSATPECIMRBZNBXXVMGPLMVEKCUOXJWFGQSTWPMTEMRCYGXECVTNKYROYRYTPRDPCFGGKUUBXXSDFZEJCQRIRFLCNMPMLIGUCYPHMWYVAIPAAPHTQAYFSJWLSCZICIXZHXNKAKRHJVENGZTUTVWSNYDDYMWQHHAITLUZXNORBLYTBVCEBWBMSVZXNZMKYFPRFPLFCUSJUWNKQJIZRVZASPVFSUSBYQZZWKEORBDDRCYRBTIMTLHDTZRQUKYJIWHXVJYPEZSDLWZVPZGEYQPCSGGVJXXBUCNBXKQPZTMTVPZUETYYLRJEDWIHAZMS

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp8EEA.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1026
                                                                                                                                        Entropy (8bit):4.692693183518806
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
                                                                                                                                        MD5:78F042E25B7FAF970F75DFAA81955268
                                                                                                                                        SHA1:F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
                                                                                                                                        SHA-256:E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
                                                                                                                                        SHA-512:CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp8F1A.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1026
                                                                                                                                        Entropy (8bit):4.695685570184741
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
                                                                                                                                        MD5:A28F7445BB3D064C83EB9DBC98091F76
                                                                                                                                        SHA1:D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
                                                                                                                                        SHA-256:10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
                                                                                                                                        SHA-512:42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp8F1B.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):1026
                                                                                                                                        Entropy (8bit):4.701757898321461
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
                                                                                                                                        MD5:520219000D5681B63804A2D138617B27
                                                                                                                                        SHA1:2C7827C354FD7A58FB662266B7E3008AFB42C567
                                                                                                                                        SHA-256:C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
                                                                                                                                        SHA-512:C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp96FD.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):106496
                                                                                                                                        Entropy (8bit):1.1358696453229276
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                        MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                        SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                        SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                        SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp96FE.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):106496
                                                                                                                                        Entropy (8bit):1.1358696453229276
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                        MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                        SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                        SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                        SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp970E.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):106496
                                                                                                                                        Entropy (8bit):1.1358696453229276
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                        MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                        SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                        SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                        SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp971F.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):106496
                                                                                                                                        Entropy (8bit):1.1358696453229276
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                        MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                        SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                        SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                        SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp9720.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):106496
                                                                                                                                        Entropy (8bit):1.1358696453229276
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                        MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                        SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                        SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                        SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp9731.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):106496
                                                                                                                                        Entropy (8bit):1.1358696453229276
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                        MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                        SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                        SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                        SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp9741.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):106496
                                                                                                                                        Entropy (8bit):1.1358696453229276
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                        MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                        SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                        SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                        SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp9752.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):106496
                                                                                                                                        Entropy (8bit):1.1358696453229276
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                        MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                        SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                        SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                        SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp9762.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):106496
                                                                                                                                        Entropy (8bit):1.1358696453229276
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                        MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                        SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                        SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                        SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp9F8.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):49152
                                                                                                                                        Entropy (8bit):0.8180424350137764
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                        MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                        SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                        SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                        SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmp9F9.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):49152
                                                                                                                                        Entropy (8bit):0.8180424350137764
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                        MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                        SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                        SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                        SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmpA09.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):49152
                                                                                                                                        Entropy (8bit):0.8180424350137764
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                        MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                        SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                        SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                        SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmpA0A.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):49152
                                                                                                                                        Entropy (8bit):0.8180424350137764
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                        MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                        SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                        SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                        SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmpA0B.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):49152
                                                                                                                                        Entropy (8bit):0.8180424350137764
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                        MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                        SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                        SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                        SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmpA1C.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):114688
                                                                                                                                        Entropy (8bit):0.9746603542602881
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                        MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                        SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                        SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                        SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmpA2C.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                        Category:dropped
                                                                                                                                        Size (bytes):114688
                                                                                                                                        Entropy (8bit):0.9746603542602881
                                                                                                                                        Encrypted:false
                                                                                                                                        SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                        MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                        SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                        SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                        SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                        Malicious:false
                                                                                                                                        Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                        C:\Users\user\AppData\Local\Temp\tmpA3D.tmp

                                                                                                                                        Download File
                                                                                                                                        Process:C:\Users\user\Desktop\ljMiHZ8MwZ.exe
                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                        Categor