Edit tour

Windows Analysis Report
CxfUzjqyxz.exe

Overview

General Information

Sample name:	CxfUzjqyxz.exe renamed because original name is a hash value
Original sample name:	094c83270e926b418dd431978ae802d8.exe
Analysis ID:	1614189
MD5:	094c83270e926b418dd431978ae802d8
SHA1:	0ddbf017e6313f004f0c7b66ee7e2706564f16e1
SHA256:	4e2af86db2326d23ede094f504645213dd0f26f0e86b5059b6cf9bd5a8115dea
Tags:	exeRedLineStealeruser-abuse_ch
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

C2 URLs / IPs found in malware configuration

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

CxfUzjqyxz.exe (PID: 3636 cmdline: "C:\Users\user\Desktop\CxfUzjqyxz.exe" MD5: 094C83270E926B418DD431978AE802D8)

conhost.exe (PID: 6784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["91.92.136.87:26264"], "Bot Id": "cheat"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
CxfUzjqyxz.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
CxfUzjqyxz.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
CxfUzjqyxz.exe	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
CxfUzjqyxz.exe	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x119cb:$gen01: ChromeGetRoamingName 0x119ff:$gen02: ChromeGetLocalName 0x11a28:$gen03: get_UserDomainName 0x13c67:$gen04: get_encrypted_key 0x131e3:$gen05: browserPaths 0x1352b:$gen06: GetBrowsers 0x12e61:$gen07: get_InstalledInputLanguages 0x1064f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x8738:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x9118:$spe6: windows-1251, CommandLine: 0x143bb:$spe9: wallet 0xee0c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xef07:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xf264:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xf371:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xf4f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xee98:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xeec1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xf05f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xf39a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xf439:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
CxfUzjqyxz.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ea:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cb:$v2_6: GetUpdates

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\tmpF189.tmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\tmpF189.tmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\tmpF189.tmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
C:\Users\user\AppData\Local\Temp\tmpF189.tmp	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x119cb:$gen01: ChromeGetRoamingName 0x119ff:$gen02: ChromeGetLocalName 0x11a28:$gen03: get_UserDomainName 0x13c67:$gen04: get_encrypted_key 0x131e3:$gen05: browserPaths 0x1352b:$gen06: GetBrowsers 0x12e61:$gen07: get_InstalledInputLanguages 0x1064f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x8738:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x9118:$spe6: windows-1251, CommandLine: 0x143bb:$spe9: wallet 0xee0c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xef07:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xf264:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xf371:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xf4f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xee98:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xeec1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xf05f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xf39a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xf439:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
C:\Users\user\AppData\Local\Temp\tmpF189.tmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ea:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cb:$v2_6: GetUpdates

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2194965851.00000000029A0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2196268630.0000000003962000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2196268630.0000000003962000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2196268630.0000000003962000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x136fa:$a4: get_ScannedWallets 0x12558:$a5: get_ScanTelegram 0x1337e:$a6: get_ScanGeckoBrowsersPaths 0x1119a:$a7: <Processes>k__BackingField 0xf0ac:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x10ace:$a9: <ScanFTP>k__BackingField
00000000.00000000.2051840927.00000000004B2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.2051840927.00000000004B2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000000.2051840927.00000000004B2000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x133ca:$a4: get_ScannedWallets 0x12228:$a5: get_ScanTelegram 0x1304e:$a6: get_ScanGeckoBrowsersPaths 0x10e6a:$a7: <Processes>k__BackingField 0xed7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1079e:$a9: <ScanFTP>k__BackingField
Process Memory Space: CxfUzjqyxz.exe PID: 3636	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: CxfUzjqyxz.exe PID: 3636	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: CxfUzjqyxz.exe PID: 3636	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x5db4ca:$a4: get_ScannedWallets 0x6d0eef:$a4: get_ScannedWallets 0x5da371:$a5: get_ScanTelegram 0x6cfd96:$a5: get_ScanTelegram 0x5db153:$a6: get_ScanGeckoBrowsersPaths 0x6d0b78:$a6: get_ScanGeckoBrowsersPaths 0x5d9004:$a7: <Processes>k__BackingField 0x6cea29:$a7: <Processes>k__BackingField 0x5d6537:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x6cbf5c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x5d8938:$a9: <ScanFTP>k__BackingField 0x6ce35d:$a9: <ScanFTP>k__BackingField
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.CxfUzjqyxz.exe.4b0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.CxfUzjqyxz.exe.4b0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.0.CxfUzjqyxz.exe.4b0000.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
0.0.CxfUzjqyxz.exe.4b0000.0.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x119cb:$gen01: ChromeGetRoamingName 0x119ff:$gen02: ChromeGetLocalName 0x11a28:$gen03: get_UserDomainName 0x13c67:$gen04: get_encrypted_key 0x131e3:$gen05: browserPaths 0x1352b:$gen06: GetBrowsers 0x12e61:$gen07: get_InstalledInputLanguages 0x1064f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x8738:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x9118:$spe6: windows-1251, CommandLine: 0x143bb:$spe9: wallet 0xee0c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xef07:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xf264:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xf371:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xf4f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xee98:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xeec1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xf05f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xf39a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xf439:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.0.CxfUzjqyxz.exe.4b0000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ea:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cb:$v2_6: GetUpdates
0.2.CxfUzjqyxz.exe.3962130.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.CxfUzjqyxz.exe.3962130.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.CxfUzjqyxz.exe.3962130.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x117ca:$a4: get_ScannedWallets 0x10628:$a5: get_ScanTelegram 0x1144e:$a6: get_ScanGeckoBrowsersPaths 0xf26a:$a7: <Processes>k__BackingField 0xd17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xeb9e:$a9: <ScanFTP>k__BackingField
0.2.CxfUzjqyxz.exe.3962130.0.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0xfbcb:$gen01: ChromeGetRoamingName 0xfbff:$gen02: ChromeGetLocalName 0xfc28:$gen03: get_UserDomainName 0x11e67:$gen04: get_encrypted_key 0x113e3:$gen05: browserPaths 0x1172b:$gen06: GetBrowsers 0x11061:$gen07: get_InstalledInputLanguages 0xe84f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x6938:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x7318:$spe6: windows-1251, CommandLine: 0x125bb:$spe9: wallet 0xd00c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xd107:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xd464:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xd571:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xd6f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xd098:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xd0c1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xd25f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xd59a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xd639:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.2.CxfUzjqyxz.exe.3962130.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe68a:$u7: RunPE 0x11d41:$u8: DownloadAndEx 0x7330:$pat14: , CommandLine: 0x11279:$v2_1: ListOfProcesses 0xe88b:$v2_2: get_ScanVPN 0xe92e:$v2_2: get_ScanFTP 0xf61e:$v2_2: get_ScanDiscord 0x1060c:$v2_2: get_ScanSteam 0x10628:$v2_2: get_ScanTelegram 0x106ce:$v2_2: get_ScanScreen 0x11416:$v2_2: get_ScanChromeBrowsersPaths 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths 0x11709:$v2_2: get_ScanBrowsers 0x117ca:$v2_2: get_ScannedWallets 0x117f0:$v2_2: get_ScanWallets 0x11810:$v2_3: GetArguments 0xfed9:$v2_4: VerifyUpdate 0x147ea:$v2_4: VerifyUpdate 0x11bca:$v2_5: VerifyScanRequest 0x112c6:$v2_6: GetUpdates 0x147cb:$v2_6: GetUpdates
0.2.CxfUzjqyxz.exe.3962130.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.CxfUzjqyxz.exe.3962130.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.CxfUzjqyxz.exe.3962130.0.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
0.2.CxfUzjqyxz.exe.3962130.0.raw.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x119cb:$gen01: ChromeGetRoamingName 0x119ff:$gen02: ChromeGetLocalName 0x11a28:$gen03: get_UserDomainName 0x13c67:$gen04: get_encrypted_key 0x131e3:$gen05: browserPaths 0x1352b:$gen06: GetBrowsers 0x12e61:$gen07: get_InstalledInputLanguages 0x1064f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x8738:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x9118:$spe6: windows-1251, CommandLine: 0x143bb:$spe9: wallet 0xee0c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xef07:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xf264:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xf371:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xf4f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xee98:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xeec1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xf05f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xf39a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xf439:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.2.CxfUzjqyxz.exe.3962130.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ea:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cb:$v2_6: GetUpdates
Click to see the 10 entries

Suricata Signatures

ET MALWARE RedLine Stealer - CheckConnect Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-13T12:32:19.371533+0100	2045000	1	Malware Command and Control Activity Detected	91.92.136.87	26264	192.168.2.5	49704	TCP

ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-13T12:32:23.373259+0100	2045001	1	Malware Command and Control Activity Detected	91.92.136.87	26264	192.168.2.5	49704	TCP

ETPRO MALWARE RedLine - CheckConnect Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-13T12:32:14.360759+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.5	49704	91.92.136.87	26264	TCP

ETPRO MALWARE RedLine - EnvironmentSettings Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-13T12:32:19.626445+0100	2849351	1	Malware Command and Control Activity Detected	192.168.2.5	49704	91.92.136.87	26264	TCP

ETPRO MALWARE RedLine - SetEnvironment Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-13T12:32:23.794497+0100	2849352	1	Malware Command and Control Activity Detected	192.168.2.5	49706	91.92.136.87	26264	TCP

Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-13T12:32:14.360759+0100	1800000	1	Malware Command and Control Activity Detected	192.168.2.5	49704	91.92.136.87	26264	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: CxfUzjqyxz.exe

Avira: detected

Found malware configuration

Source: CxfUzjqyxz.exe

Malware Configuration Extractor: RedLine {"C2 url": ["91.92.136.87:26264"], "Bot Id": "cheat"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\tmpF189.tmp

ReversingLabs: Detection: 86%

Multi AV Scanner detection for submitted file

Source: CxfUzjqyxz.exe	ReversingLabs: Detection: 86%
Source: CxfUzjqyxz.exe	Virustotal: Detection: 83%			Perma Link

Source: unknown

HTTPS traffic detected: 104.26.13.31:443 -> 192.168.2.5:49705 version: TLS 1.0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.5:49704 -> 91.92.136.87:26264
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.5:49704 -> 91.92.136.87:26264
Source: Network traffic	Suricata IDS: 2849352 - Severity 1 - ETPRO MALWARE RedLine - SetEnvironment Request : 192.168.2.5:49706 -> 91.92.136.87:26264
Source: Network traffic	Suricata IDS: 2045000 - Severity 1 - ET MALWARE RedLine Stealer - CheckConnect Response : 91.92.136.87:26264 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2849351 - Severity 1 - ETPRO MALWARE RedLine - EnvironmentSettings Request : 192.168.2.5:49704 -> 91.92.136.87:26264
Source: Network traffic	Suricata IDS: 2045001 - Severity 1 - ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound : 91.92.136.87:26264 -> 192.168.2.5:49704

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 91.92.136.87:26264

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 26264
Source: unknown	Network traffic detected: HTTP traffic on port 26264 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 26264
Source: unknown	Network traffic detected: HTTP traffic on port 26264 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 26264 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 26264
Source: unknown	Network traffic detected: HTTP traffic on port 26264 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 26264
Source: unknown	Network traffic detected: HTTP traffic on port 26264 -> 49706

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 91.92.136.87:26264

Source: global traffic	HTTP traffic detected: GET /geoip HTTP/1.1Host: api.ip.sbConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 91.92.136.87:26264Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 91.92.136.87:26264Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 91.92.136.87:26264Content-Length: 1171890Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 91.92.136.87:26264Content-Length: 1171882Expect: 100-continueAccept-Encoding: gzip, deflate

Source: Joe Sandbox View

IP Address: 104.26.13.31 104.26.13.31

Source: Joe Sandbox View

ASN Name: BELCLOUDBG BELCLOUDBG

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown

HTTPS traffic detected: 104.26.13.31:443 -> 192.168.2.5:49705 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.136.87

Source: global traffic

HTTP traffic detected: GET /geoip HTTP/1.1Host: api.ip.sbConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: api.ip.sb

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 91.92.136.87:26264Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: CxfUzjqyxz.exe, 00000000.00000002.2194965851.00000000029C9000.00000004.00000800.00020000.00000000.sdmp, CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.92.136.87:26264
Source: CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.92.136.87:26264/
Source: CxfUzjqyxz.exe, 00000000.00000002.2194965851.00000000029C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.92.136.87:26264P$
Source: CxfUzjqyxz.exe, 00000000.00000002.2194965851.00000000029C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
Source: CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/0
Source: CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: CxfUzjqyxz.exe, 00000000.00000002.2194965851.00000000029C9000.00000004.00000800.00020000.00000000.sdmp, CxfUzjqyxz.exe, 00000000.00000002.2194965851.00000000029A0000.00000004.00000800.00020000.00000000.sdmp, CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: CxfUzjqyxz.exe, 00000000.00000002.2194965851.00000000029C9000.00000004.00000800.00020000.00000000.sdmp, CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: tmp451F.tmp.0.dr, tmp7C40.tmp.0.dr, tmp7C50.tmp.0.dr, tmp7C72.tmp.0.dr, tmp454F.tmp.0.dr, tmp451E.tmp.0.dr, tmp4560.tmp.0.dr, tmpDB1.tmp.0.dr, tmp7C61.tmp.0.dr, tmpB2D5.tmp.0.dr, tmpDF0.tmp.0.dr, tmpB2D6.tmp.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: CxfUzjqyxz.exe, tmpF189.tmp.0.dr	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: CxfUzjqyxz.exe, tmpF189.tmp.0.dr	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: tmp451F.tmp.0.dr, tmp7C40.tmp.0.dr, tmp7C50.tmp.0.dr, tmp7C72.tmp.0.dr, tmp454F.tmp.0.dr, tmp451E.tmp.0.dr, tmp4560.tmp.0.dr, tmpDB1.tmp.0.dr, tmp7C61.tmp.0.dr, tmpB2D5.tmp.0.dr, tmpDF0.tmp.0.dr, tmpB2D6.tmp.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tmp451F.tmp.0.dr, tmp7C40.tmp.0.dr, tmp7C50.tmp.0.dr, tmp7C72.tmp.0.dr, tmp454F.tmp.0.dr, tmp451E.tmp.0.dr, tmp4560.tmp.0.dr, tmpDB1.tmp.0.dr, tmp7C61.tmp.0.dr, tmpB2D5.tmp.0.dr, tmpDF0.tmp.0.dr, tmpB2D6.tmp.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: tmp451F.tmp.0.dr, tmp7C40.tmp.0.dr, tmp7C50.tmp.0.dr, tmp7C72.tmp.0.dr, tmp454F.tmp.0.dr, tmp451E.tmp.0.dr, tmp4560.tmp.0.dr, tmpDB1.tmp.0.dr, tmp7C61.tmp.0.dr, tmpB2D5.tmp.0.dr, tmpDF0.tmp.0.dr, tmpB2D6.tmp.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: tmp451F.tmp.0.dr, tmp7C40.tmp.0.dr, tmp7C50.tmp.0.dr, tmp7C72.tmp.0.dr, tmp454F.tmp.0.dr, tmp451E.tmp.0.dr, tmp4560.tmp.0.dr, tmpDB1.tmp.0.dr, tmp7C61.tmp.0.dr, tmpB2D5.tmp.0.dr, tmpDF0.tmp.0.dr, tmpB2D6.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: tmp451F.tmp.0.dr, tmp7C40.tmp.0.dr, tmp7C50.tmp.0.dr, tmp7C72.tmp.0.dr, tmp454F.tmp.0.dr, tmp451E.tmp.0.dr, tmp4560.tmp.0.dr, tmpDB1.tmp.0.dr, tmp7C61.tmp.0.dr, tmpB2D5.tmp.0.dr, tmpDF0.tmp.0.dr, tmpB2D6.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: tmp451F.tmp.0.dr, tmp7C40.tmp.0.dr, tmp7C50.tmp.0.dr, tmp7C72.tmp.0.dr, tmp454F.tmp.0.dr, tmp451E.tmp.0.dr, tmp4560.tmp.0.dr, tmpDB1.tmp.0.dr, tmp7C61.tmp.0.dr, tmpB2D5.tmp.0.dr, tmpDF0.tmp.0.dr, tmpB2D6.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: CxfUzjqyxz.exe, tmpF189.tmp.0.dr	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: tmp451F.tmp.0.dr, tmp7C40.tmp.0.dr, tmp7C50.tmp.0.dr, tmp7C72.tmp.0.dr, tmp454F.tmp.0.dr, tmp451E.tmp.0.dr, tmp4560.tmp.0.dr, tmpDB1.tmp.0.dr, tmp7C61.tmp.0.dr, tmpB2D5.tmp.0.dr, tmpDF0.tmp.0.dr, tmpB2D6.tmp.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: tmp451F.tmp.0.dr, tmp7C40.tmp.0.dr, tmp7C50.tmp.0.dr, tmp7C72.tmp.0.dr, tmp454F.tmp.0.dr, tmp451E.tmp.0.dr, tmp4560.tmp.0.dr, tmpDB1.tmp.0.dr, tmp7C61.tmp.0.dr, tmpB2D5.tmp.0.dr, tmpDF0.tmp.0.dr, tmpB2D6.tmp.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705

System Summary

Malicious sample detected (through community Yara rule)

Source: CxfUzjqyxz.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: CxfUzjqyxz.exe, type: SAMPLE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: CxfUzjqyxz.exe, type: SAMPLE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.0.CxfUzjqyxz.exe.4b0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.0.CxfUzjqyxz.exe.4b0000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.0.CxfUzjqyxz.exe.4b0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.CxfUzjqyxz.exe.3962130.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.CxfUzjqyxz.exe.3962130.0.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.CxfUzjqyxz.exe.3962130.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.CxfUzjqyxz.exe.3962130.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.CxfUzjqyxz.exe.3962130.0.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.CxfUzjqyxz.exe.3962130.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000000.00000002.2196268630.0000000003962000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 00000000.00000000.2051840927.00000000004B2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: CxfUzjqyxz.exe PID: 3636, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: C:\Users\user\AppData\Local\Temp\tmpF189.tmp, type: DROPPED	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: C:\Users\user\AppData\Local\Temp\tmpF189.tmp, type: DROPPED	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: C:\Users\user\AppData\Local\Temp\tmpF189.tmp, type: DROPPED	Matched rule: Detects RedLine infostealer Author: ditekSHen

Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Code function: 0_2_00F9E7B0	0_2_00F9E7B0
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Code function: 0_2_00F9DC90	0_2_00F9DC90
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Code function: 0_2_06229628	0_2_06229628
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Code function: 0_2_06224468	0_2_06224468
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Code function: 0_2_06221210	0_2_06221210
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Code function: 0_2_06223311	0_2_06223311
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Code function: 0_2_0622DD00	0_2_0622DD00
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Code function: 0_2_0622D108	0_2_0622D108

Source: CxfUzjqyxz.exe, 00000000.00000002.2194965851.00000000029C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs CxfUzjqyxz.exe
Source: CxfUzjqyxz.exe, 00000000.00000002.2196268630.0000000003962000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs CxfUzjqyxz.exe
Source: CxfUzjqyxz.exe, 00000000.00000002.2194338830.0000000000B1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs CxfUzjqyxz.exe
Source: CxfUzjqyxz.exe, 00000000.00000000.2051840927.00000000004B2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs CxfUzjqyxz.exe
Source: CxfUzjqyxz.exe	Binary or memory string: OriginalFilenameImplosions.exe4 vs CxfUzjqyxz.exe

Source: CxfUzjqyxz.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: CxfUzjqyxz.exe, type: SAMPLE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: CxfUzjqyxz.exe, type: SAMPLE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.0.CxfUzjqyxz.exe.4b0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.0.CxfUzjqyxz.exe.4b0000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.0.CxfUzjqyxz.exe.4b0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.CxfUzjqyxz.exe.3962130.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.CxfUzjqyxz.exe.3962130.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.CxfUzjqyxz.exe.3962130.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.CxfUzjqyxz.exe.3962130.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.CxfUzjqyxz.exe.3962130.0.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.CxfUzjqyxz.exe.3962130.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000000.00000002.2196268630.0000000003962000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 00000000.00000000.2051840927.00000000004B2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: CxfUzjqyxz.exe PID: 3636, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Temp\tmpF189.tmp, type: DROPPED	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Temp\tmpF189.tmp, type: DROPPED	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: C:\Users\user\AppData\Local\Temp\tmpF189.tmp, type: DROPPED	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/100@1/2

Source: C:\Users\user\Desktop\CxfUzjqyxz.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6784:120:WilError_03

Source: C:\Users\user\Desktop\CxfUzjqyxz.exe

File created: C:\Users\user\AppData\Local\Temp\tmpB6F7.tmp

Jump to behavior

Source: CxfUzjqyxz.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Users\user\Desktop\CxfUzjqyxz.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\CxfUzjqyxz.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002DC2000.00000004.00000800.00020000.00000000.sdmp, tmpE91E.tmp.0.dr, tmpE90E.tmp.0.dr, tmpD5B5.tmp.0.dr, tmpE90C.tmp.0.dr, tmpD5F5.tmp.0.dr, tmpB306.tmp.0.dr, tmpB2F6.tmp.0.dr, tmpD594.tmp.0.dr, tmpD5C5.tmp.0.dr, tmpD606.tmp.0.dr, tmpD5A4.tmp.0.dr, tmpE90D.tmp.0.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: CxfUzjqyxz.exe	ReversingLabs: Detection: 86%
Source: CxfUzjqyxz.exe	Virustotal: Detection: 83%

Source: C:\Users\user\Desktop\CxfUzjqyxz.exe

File read: C:\Users\user\Desktop\CxfUzjqyxz.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\CxfUzjqyxz.exe "C:\Users\user\Desktop\CxfUzjqyxz.exe"
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: tmp2B02.tmp.0.dr

LNK file: ..\..\..\..\..\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: tmpF189.tmp.0.dr

Static PE information: 0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]

Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Code function: 0_2_0622E5C0 push es; ret		0_2_0622E5D0
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Code function: 0_2_06221810 push es; ret		0_2_06221820

Source: C:\Users\user\Desktop\CxfUzjqyxz.exe

File created: C:\Users\user\AppData\Local\Temp\tmpF189.tmp

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 26264
Source: unknown	Network traffic detected: HTTP traffic on port 26264 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 26264
Source: unknown	Network traffic detected: HTTP traffic on port 26264 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 26264 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 26264
Source: unknown	Network traffic detected: HTTP traffic on port 26264 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 26264
Source: unknown	Network traffic detected: HTTP traffic on port 26264 -> 49706

Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\CxfUzjqyxz.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\CxfUzjqyxz.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Memory allocated: F90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Memory allocated: 2950000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Memory allocated: 2790000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Window / User API: threadDelayed 2699			Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Window / User API: threadDelayed 6318			Jump to behavior

Source: C:\Users\user\Desktop\CxfUzjqyxz.exe TID: 3160	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe TID: 6428	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe TID: 6608	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\CxfUzjqyxz.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: tmp5467.tmp.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: tmp5467.tmp.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: tmp5467.tmp.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: tmp5467.tmp.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: tmp5467.tmp.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: tmp5467.tmp.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: tmp5467.tmp.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: tmp5467.tmp.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: tmp5467.tmp.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: tmp5467.tmp.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: tmp5467.tmp.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: tmp5467.tmp.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: tmp5467.tmp.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: tmp5467.tmp.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: tmp5467.tmp.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: CxfUzjqyxz.exe, 00000000.00000002.2194338830.0000000000BE1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: tmp5467.tmp.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: tmp5467.tmp.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: tmp5467.tmp.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: tmp5467.tmp.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: tmp5467.tmp.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: tmp5467.tmp.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: tmp5467.tmp.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: tmp5467.tmp.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: tmp5467.tmp.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: tmp5467.tmp.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: tmp5467.tmp.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: tmp5467.tmp.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: tmp5467.tmp.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: tmp5467.tmp.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: tmp5467.tmp.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: tmp5467.tmp.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\CxfUzjqyxz.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\CxfUzjqyxz.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\CxfUzjqyxz.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Queries volume information: C:\Users\user\Desktop\CxfUzjqyxz.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\CxfUzjqyxz.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: CxfUzjqyxz.exe, type: SAMPLE
Source: Yara match	File source: 0.0.CxfUzjqyxz.exe.4b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CxfUzjqyxz.exe.3962130.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CxfUzjqyxz.exe.3962130.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2194965851.00000000029A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196268630.0000000003962000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2051840927.00000000004B2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CxfUzjqyxz.exe PID: 3636, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\tmpF189.tmp, type: DROPPED

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\CxfUzjqyxz.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: CxfUzjqyxz.exe, type: SAMPLE
Source: Yara match	File source: 0.0.CxfUzjqyxz.exe.4b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CxfUzjqyxz.exe.3962130.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CxfUzjqyxz.exe.3962130.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2196268630.0000000003962000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2051840927.00000000004B2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CxfUzjqyxz.exe PID: 3636, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\tmpF189.tmp, type: DROPPED

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: CxfUzjqyxz.exe, type: SAMPLE
Source: Yara match	File source: 0.0.CxfUzjqyxz.exe.4b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CxfUzjqyxz.exe.3962130.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CxfUzjqyxz.exe.3962130.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2194965851.00000000029A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196268630.0000000003962000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2051840927.00000000004B2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CxfUzjqyxz.exe PID: 3636, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\tmpF189.tmp, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	1 OS Credential Dumping	321 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Data from Local System	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
CxfUzjqyxz.exe	86%	ReversingLabs	ByteCode-MSIL.Infostealer.RedLine
CxfUzjqyxz.exe	83%	Virustotal		Browse
CxfUzjqyxz.exe	100%	Avira	HEUR/AGEN.1305500

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\tmpF189.tmp	86%	ReversingLabs	ByteCode-MSIL.Infostealer.RedLine

Source	Detection	Scanner	Label
http://91.92.136.87:26264P$	0%	Avira URL Cloud	safe
http://91.92.136.87:26264	0%	Avira URL Cloud	safe
91.92.136.87:26264	0%	Avira URL Cloud	safe
http://91.92.136.87:26264/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ip.sb.cdn.cloudflare.net	104.26.13.31	true	false		high
api.ip.sb	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ip.sb/geoip	false		high
http://91.92.136.87:26264/	true	Avira URL Cloud: safe	unknown
91.92.136.87:26264	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://91.92.136.87:26264P$	CxfUzjqyxz.exe, 00000000.00000002.2194965851.00000000029C9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/ip%appdata%	CxfUzjqyxz.exe, tmpF189.tmp.0.dr	false		high
https://duckduckgo.com/chrome_newtab	tmp451F.tmp.0.dr, tmp7C40.tmp.0.dr, tmp7C50.tmp.0.dr, tmp7C72.tmp.0.dr, tmp454F.tmp.0.dr, tmp451E.tmp.0.dr, tmp4560.tmp.0.dr, tmpDB1.tmp.0.dr, tmp7C61.tmp.0.dr, tmpB2D5.tmp.0.dr, tmpDF0.tmp.0.dr, tmpB2D6.tmp.0.dr	false		high
https://duckduckgo.com/ac/?q=	tmp451F.tmp.0.dr, tmp7C40.tmp.0.dr, tmp7C50.tmp.0.dr, tmp7C72.tmp.0.dr, tmp454F.tmp.0.dr, tmp451E.tmp.0.dr, tmp4560.tmp.0.dr, tmpDB1.tmp.0.dr, tmp7C61.tmp.0.dr, tmpB2D5.tmp.0.dr, tmpDF0.tmp.0.dr, tmpB2D6.tmp.0.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	tmp451F.tmp.0.dr, tmp7C40.tmp.0.dr, tmp7C50.tmp.0.dr, tmp7C72.tmp.0.dr, tmp454F.tmp.0.dr, tmp451E.tmp.0.dr, tmp4560.tmp.0.dr, tmpDB1.tmp.0.dr, tmp7C61.tmp.0.dr, tmpB2D5.tmp.0.dr, tmpDF0.tmp.0.dr, tmpB2D6.tmp.0.dr	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/CheckConnectResponse	CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.datacontract.org/2004/07/	CxfUzjqyxz.exe, 00000000.00000002.2194965851.00000000029C9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/EnvironmentSettings	CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	CxfUzjqyxz.exe, tmpF189.tmp.0.dr	false		high
http://schemas.xmlsoap.org/soap/envelope/	CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	tmp451F.tmp.0.dr, tmp7C40.tmp.0.dr, tmp7C50.tmp.0.dr, tmp7C72.tmp.0.dr, tmp454F.tmp.0.dr, tmp451E.tmp.0.dr, tmp4560.tmp.0.dr, tmpDB1.tmp.0.dr, tmp7C61.tmp.0.dr, tmpB2D5.tmp.0.dr, tmpDF0.tmp.0.dr, tmpB2D6.tmp.0.dr	false		high
http://tempuri.org/	CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/CheckConnect	CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	tmp451F.tmp.0.dr, tmp7C40.tmp.0.dr, tmp7C50.tmp.0.dr, tmp7C72.tmp.0.dr, tmp454F.tmp.0.dr, tmp451E.tmp.0.dr, tmp4560.tmp.0.dr, tmpDB1.tmp.0.dr, tmp7C61.tmp.0.dr, tmpB2D5.tmp.0.dr, tmpDF0.tmp.0.dr, tmpB2D6.tmp.0.dr	false		high
https://www.ecosia.org/newtab/	tmp451F.tmp.0.dr, tmp7C40.tmp.0.dr, tmp7C50.tmp.0.dr, tmp7C72.tmp.0.dr, tmp454F.tmp.0.dr, tmp451E.tmp.0.dr, tmp4560.tmp.0.dr, tmpDB1.tmp.0.dr, tmp7C61.tmp.0.dr, tmpB2D5.tmp.0.dr, tmpDF0.tmp.0.dr, tmpB2D6.tmp.0.dr	false		high
http://tempuri.org/Endpoint/VerifyUpdateResponse	CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/SetEnvironment	CxfUzjqyxz.exe, 00000000.00000002.2194965851.00000000029C9000.00000004.00000800.00020000.00000000.sdmp, CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/SetEnvironmentResponse	CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/GetUpdates	CxfUzjqyxz.exe, 00000000.00000002.2194965851.00000000029C9000.00000004.00000800.00020000.00000000.sdmp, CxfUzjqyxz.exe, 00000000.00000002.2194965851.00000000029A0000.00000004.00000800.00020000.00000000.sdmp, CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	tmp451F.tmp.0.dr, tmp7C40.tmp.0.dr, tmp7C50.tmp.0.dr, tmp7C72.tmp.0.dr, tmp454F.tmp.0.dr, tmp451E.tmp.0.dr, tmp4560.tmp.0.dr, tmpDB1.tmp.0.dr, tmp7C61.tmp.0.dr, tmpB2D5.tmp.0.dr, tmpDF0.tmp.0.dr, tmpB2D6.tmp.0.dr	false		high
https://api.ipify.orgcookies//settinString.Removeg	CxfUzjqyxz.exe, tmpF189.tmp.0.dr	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/GetUpdatesResponse	CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	tmp451F.tmp.0.dr, tmp7C40.tmp.0.dr, tmp7C50.tmp.0.dr, tmp7C72.tmp.0.dr, tmp454F.tmp.0.dr, tmp451E.tmp.0.dr, tmp4560.tmp.0.dr, tmpDB1.tmp.0.dr, tmp7C61.tmp.0.dr, tmpB2D5.tmp.0.dr, tmpDF0.tmp.0.dr, tmpB2D6.tmp.0.dr	false		high
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/VerifyUpdate	CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/0	CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	false		high
http://91.92.136.87:26264	CxfUzjqyxz.exe, 00000000.00000002.2194965851.00000000029C9000.00000004.00000800.00020000.00000000.sdmp, CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	tmp451F.tmp.0.dr, tmp7C40.tmp.0.dr, tmp7C50.tmp.0.dr, tmp7C72.tmp.0.dr, tmp454F.tmp.0.dr, tmp451E.tmp.0.dr, tmp4560.tmp.0.dr, tmpDB1.tmp.0.dr, tmp7C61.tmp.0.dr, tmpB2D5.tmp.0.dr, tmpDF0.tmp.0.dr, tmpB2D6.tmp.0.dr	false		high
http://schemas.xmlsoap.org/soap/actor/next	CxfUzjqyxz.exe, 00000000.00000002.2194965851.0000000002951000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.13.31	api.ip.sb.cdn.cloudflare.net	United States		13335	CLOUDFLARENETUS	false
91.92.136.87	unknown	Cyprus		44901	BELCLOUDBG	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1614189
Start date and time:	2025-02-13 12:31:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	CxfUzjqyxz.exe renamed because original name is a hash value
Original Sample Name:	094c83270e926b418dd431978ae802d8.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@2/100@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 29 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 13.107.253.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:32:20	API Interceptor	47x Sleep call for process: CxfUzjqyxz.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.13.31	VKJITO.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	ip.sb/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ip.sb.cdn.cloudflare.net	1w5RpHuliE.exe	Get hash	malicious	Amadey, GCleaner, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoader, Vidar	Browse	172.67.75.172
	SecuriteInfo.com.Win32.Evo-gen.12305.7160.exe	Get hash	malicious	RedLine	Browse	104.26.13.31
	rH3TpuMpZn.exe	Get hash	malicious	ScreenConnect Tool, Amadey, LummaC Stealer, PureLog Stealer, Quasar, RedLine, Vidar	Browse	104.26.12.31
	Ryay9q4aDy.exe	Get hash	malicious	ScreenConnect Tool, Amadey, LummaC Stealer, RedLine	Browse	104.26.13.31
	random.exe	Get hash	malicious	RedLine	Browse	104.26.12.31
	random.exe	Get hash	malicious	Amadey, Credential Flusher, GCleaner, KeyLogger, LummaC Stealer, PureLog Stealer, RedLine	Browse	104.26.13.31
	random.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RedLine, Vidar, XWorm, Xmrig	Browse	104.26.13.31
	3WSFIhTu1M.exe	Get hash	malicious	RedLine	Browse	104.26.13.31
	https://je.engl6.shop/webro-DPD-notificare/	Get hash	malicious	Unknown	Browse	172.67.75.172
	https://tt.vg/notificareDPD02	Get hash	malicious	Unknown	Browse	172.67.75.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BELCLOUDBG	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	185.203.118.250
	B6EGeOHEFm.exe	Get hash	malicious	Phemedrone Stealer	Browse	86.104.15.60
	Q60ZbERXWZ.exe	Get hash	malicious	Phemedrone Stealer	Browse	86.104.15.60
	XCubQJqiz7.exe	Get hash	malicious	Phemedrone Stealer	Browse	86.104.15.60
	upd.ps1	Get hash	malicious	Phemedrone Stealer	Browse	86.104.15.60
	DBp7mBJwqD.exe	Get hash	malicious	Phemedrone Stealer	Browse	86.104.15.60
	rhqubIGcyN.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	185.244.181.140
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Clipboard Hijacker, Cryptbot, MicroClip, Neoreklami, RedLine	Browse	185.244.181.140
	jYDYjpSbvf.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, LummaC Stealer, RedLine, SmokeLoader, Stealc	Browse	185.244.181.140
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	185.244.181.140
CLOUDFLARENETUS	https://symphex.com/wp-includes/	Get hash	malicious	Captcha Phish, HTMLPhisher	Browse	104.16.79.73
	https://storage.googleapis.com/salesflow25/eranewmar.html#?Z289MSZzMT0yMDQ5OTM3JnMyPTM0ODY1OTg4MCZzMz1HTEI=	Get hash	malicious	Unknown	Browse	188.114.97.3
	Pegasuslogistics JEK194 - New Client Review 9889frTmC343578627284.htm	Get hash	malicious	Unknown	Browse	104.21.96.1
	Fizet#U00e9si_szelv#U00e9ny,png.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	SecuriteInfo.com.Win32.MalwareX-gen.10190.17746.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	https://forms.office.com/e/AZqcTu03uu	Get hash	malicious	Unknown	Browse	104.17.25.14
	SecuriteInfo.com.Win32.Evo-gen.7075.31767.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.74.51
	https://bestil.lsm824.com/3-g0uf-3r9vh-3hrg.html#support@dotcloud.co.za	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://eur01.safelinks.protection.outlook.com/ap/w-59584e83/?url=https%3A%2F%2Finnerworks621-my.sharepoint.com%2F%3Aw%3A%2Fg%2Fpersonal%2Ffbayoumi_iwexpress_com%2FEV18-ULK3bBFgswwIocxhGgB_RycisFJYnuNE85X0INcoQ%3Fe%3DPJWGhb&data=05%7C02%7Cm.schwarzfaerber%40gutmann.de%7Cba71d958cbce4017fe2b08dd4c1498cf%7Cb8afaafb131d4ce28085e6ff7718d438%7C0%7C0%7C638750373515189602%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=jFoC7e8%2BnChKZDPYgfO8Z0D6BEVH0spDWEnRRVzuauE%3D&reserved=0	Get hash	malicious	Unknown	Browse	104.21.16.1
	https://innerworks621-my.sharepoint.com/:w:/g/personal/fbayoumi_iwexpress_com/EV18-ULK3bBFgswwIocxhGgB_RycisFJYnuNE85X0INcoQ?rtime=X7A0bhVM3Ug	Get hash	malicious	Unknown	Browse	172.64.41.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Fizet#U00e9si_szelv#U00e9ny,png.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.13.31
	SecuriteInfo.com.Win32.MalwareX-gen.10190.17746.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.13.31
	Ziraat Bankasi Swift Mesaji.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	104.26.13.31
	12022025_PI.exe	Get hash	malicious	Snake Keylogger	Browse	104.26.13.31
	Halkbank_Ekstre_08#U202658.12.02.25.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.13.31
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130 TUBITAK SAGE 2025#U20134312_PDF.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.13.31
	7TPq5dje3B.exe	Get hash	malicious	MassLogger RAT	Browse	104.26.13.31
	Hesap Hareketleri 12-02-2025.exe	Get hash	malicious	MassLogger RAT	Browse	104.26.13.31
	New Purches Order.exe	Get hash	malicious	Snake Keylogger	Browse	104.26.13.31
	dhl.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.26.13.31

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2666
Entropy (8bit):	5.345804351520589
Encrypted:	false
SSDEEP:	48:MOfHK5HKxHKdHK8THaAHKzecYHKh3oPtHo6nmHKtXooBHKoHzHZHpH8HKx1qHxLU:vq5qxqdqolqztYqh3oPtI6mq7qoT5JcE
MD5:	7ADCF08EB89A57934E566936815936CF
SHA1:	C164331AA17656919323F4464BC1FC1EB1B8CA90
SHA-256:	848A610C0FC09EF83A3DFC86A453C9B6F81DAA2A89779529254577F818E68933
SHA-512:	54EB0F3313760BC4C88C736C5CE57B1890BBCD00376445B3BFC3BB17C6ACBCE22700491D96B6E7E926892555B2AC0C62F0C31557F0E00C00EA38D225228212D3
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\a3127677749631df61e96a8400ddcb87\System.Runtime.Serialization.ni.dll",0..2,"System.ServiceModel.Internals, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral,

C:\Users\user\AppData\Local\Temp\tmp1EE8.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1EE9.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1F09.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1F29.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1F3A.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1F4B.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2AFA.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.514693737970008
Encrypted:	false
SSDEEP:	6:QyqRsioTA5wmHOlRaQmZWGokJqAMhAlWygDAlLwkAl2FlRaQmZWGokJISlfY:QZsiL5wmHOlDmo0qmWvclLwr2FlDmo0I
MD5:	9E36CC3537EE9EE1E3B10FA4E761045B
SHA1:	7726F55012E1E26CC762C9982E7C6C54CA7BB303
SHA-256:	4B9D687AC625690FD026ED4B236DAD1CAC90EF69E7AD256CC42766A065B50026
SHA-512:	5F92493C533D3ADD10B4CE2A364624817EBD10E32DAA45EE16593E913073602DB5E339430A3F7D2C44ABF250E96CA4E679F1F09F8CA807D58A47CF3D5C9C3790
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.8.3.....

C:\Users\user\AppData\Local\Temp\tmp2AFB.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\Temp\tmp2AFC.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\Temp\tmp2AFD.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692024230831571
Encrypted:	false
SSDEEP:	24:RXklo22NBtmSOCPX4hQpKZCuvImjwxwo1:v22NBtxOCYQ0EuwmMxz
MD5:	086908C2D2FAA8C9284EAB6D70682A47
SHA1:	1BCA47E5FFEC5FD3CE416A922BC3F905C8FE27C4
SHA-256:	40C76F418FBB2A515AF4DEC81E501CEB725FD4C916D50FCA1A82B9F5ABC1DCCF
SHA-512:	02C48E3CDA1DC748CD3F30B2384D515B50C1DFD63651554AD3D4562B1A47F5446098DCED47A0766D184DDB30B3F158ABEC5877C9CA28AB191CEBB0782C26B230
Malicious:	false
Preview:	EIVQSAOTAQGMTJLIEKHIWADNDLJLEWUUXVGOFMOKPHABQUHVNBFVSKQIGVIHICGEEXRLSTKQNZUKOHPLLTCYQSLQJMPWPWNUJFUONDXMYCCUPDUBYMPUSUKUOWWSWDLZMDWKNMUKNPKBXAJATSGOQUAMHMZDCDDJRHKOUEDMLSCIOXAHAUFDQKBUBESAKMMFMHDLSSVUQLOZXARPGPMGAAKVDEITBYGGXWIGUIJRVXQOBOIOJWPYSPHZBHWQTMDCUFCWBQSAZNRUOPCLATAERLBPATETXMFUGXBEGMNPKKEZVSRLCYPFEPWIAEINAMGSOXLYWMUKYSQACPSUTGHDCTFLXKAMLOCGYHCMAETHVZNZOCWWUHYAPHFILDNLLBMLSLXIMOFGWTDVLWPHHRGGAWSIGNXEJRIBIBLWFBUASCLZPUIVDERXYLWTNLLRLTFZJTTDGFOEYPFXIPHFKEXHOGEHSFYCCCTGNFQFYETBADKAEAOXYXJWDJWNZPEOBJZTKPLJPPMICDOWUIVDKBQQMHETDORVKZPOWTAZRBAQYYQHBNHIWFZXBILGKHZBLSQJJEIYBHUIDAOEXERQEUMMKBWDXSMLJVAZJQPZARLOBNSTUDCVKLCVBPTKTJWSMPMKSFOQPINFTNEGPVSYCWOXABSGFFKRQDFQEIJWDUMZKILALUHYQZGZOLYMKSAOZGUYCKJOJLYINHVKCTZVXLYIYPGOQZQQAGXVWEBSURTQECDRXYKQAJBEKDNSIHNBZCUBIKPKVWLUOFFCIZSKQBAAPGFMBASMUOKLLGWEHHMYDJCOQEKOBYLYWOOZLBASOJJYLIHZKUGUKHZQBIAVUPYHYEWAYGUFNARHCUKTFMLHSFLRVAELAFCQHPEFUSGNONWLLYQVUVSVEKHDRXJHDSSFJATGDRCTMICJWPFPKKLXECKUXREXEAQNPOBPRKFYRWIWXEWLAPUSHGKXWYYIJNUMGQHBJPMOYZIXPGOJLOQG

C:\Users\user\AppData\Local\Temp\tmp2AFE.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\Temp\tmp2AFF.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\Temp\tmp2B00.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\Temp\tmp2B01.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690071120548773
Encrypted:	false
SSDEEP:	24:Hpi2eIMaeHmnj0AhtUkcnKCORSCQH8qvLrUo:Hs2e4njIkc6xQH8qvv5
MD5:	8F49644C9029260CF4D4802C90BA5CED
SHA1:	0A49DD925EF88BDEA0737A4151625525E247D315
SHA-256:	C666CACFDB412CE2BC653F9E2F19484DE94216D950F8C304D1F1F8ADD2EE32CE
SHA-512:	CA63EE1758AFE40FB8569FB3FF5A52BED8A593DC163F5F2462CEBFE1EA4F3F7AB4561435912279C4371944F7C63068D7474AB9F38492F34567E10E5188338C7E
Malicious:	false
Preview:	EWZCVGNOWTCRGCAHGHIARWHBREQUWUMDZTEFKOZTBZKDHTGWOMOMXQJLCILTVOXJTWXEZRFVVOJJDUXCZNNWMUHQTYLHFYPOOBFJLGZGDSYZASNMWULDKVPIBSBESQVOBWTJCIQCCRZOQSMEFZAEOCFIPUXIHTROYFKQUTFSAUWBWISJHTVIQQEEIJVJHOBGZOPHDRBICMJCZJYKKJVLBUSHZHJSFDMYEGPBFRDSFIJIUADWYUWFSOFGQCFBFZHQMDWRKPFVNPDGQDAXYWPQENYPVCKPJTHAOXRLVMNFIOJBVFWANBCOTBENTFVQZCFBFDBMQUHCCCHMMQUOWSBCZYACVCNJFQKUCOMHGVNGGVDACUHMUYLJZQAKUNMISIRRZWDKBKSCPQEZJBHYOZZAXJVBHPFZNDXVHGWHNSVWMYZWRVIDTUCEOPZZRDVHTZKWHATLUHBDJSDWLCXQNXOWYUDQGZJKCAXDTIVXTBCQYHDKCAAFPJFSMAIFXPBWZRPFPKSDNBTLCMBJVBNHSANLTYRSVYQCPKAVQBYOUIOKJPCSLSZRHROXWWPPNZAAXTNVEINHTCLXLDMDBKYPOGMKCUIRVICNSACARZMRYFMXNDTHABPDGEHGCEAXGZZZNHYOCNFJZCIJNBBNBGAUMIROJJYSLPZARPCRZNPUZHXYZLDLXFPTCUWDLYNUMOSJWAOBYFOHEOOAGSALYXBYBYNOLNVRWYGBMDREEFNSPFBRMCNZKOZYEFYTGCMVSCLNGPIPBUDCPAMQEHOAUUBIQZZVXLYZWJOMBCITZXNLTEPYYRLUUAPJTGKEVKMNIMNQWNLLBUVLJOYGWJXXREBMWKGHQSRPNVJAECVNLXPVKWNPACZWFRCNSRBCRVPAPFJGUCNKUOOMSEURPZQJTKWTBOYFSFQOBHOUCLHWYMZMDGTXJBELWCWSQGBSNYBSEAJYTJCJQBKRUPJLBACULNATKEWAJTPTTOUKYDWVFZCDBMMO

C:\Users\user\AppData\Local\Temp\tmp2B02.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Icon number=0, Archive, ctime=Wed Oct 4 12:47:39 2023, mtime=Wed Oct 4 12:48:07 2023, atime=Wed Oct 4 12:47:39 2023, length=53161064, window=hide
Category:	dropped
Size (bytes):	2455
Entropy (8bit):	3.949629168829945
Encrypted:	false
SSDEEP:	48:8xG2dOIe59QOuizNuKfdCZxCdCMOXudSdMh5p7AjjvA:8LKnNuG4uPh56
MD5:	577A1B3CA8C7F993484C0D629939D48C
SHA1:	65D8CEDD0F4880D3325E3CEFE230E26E3B700A78
SHA-256:	A7E4968A37467C155E084F23F9F97A0892B4C34B248E550B65F79E91AD3165DC
SHA-512:	0DEEBEC87AB3A1FC8F5CACB7E115DC55786862BBE079807635DAF1146AB56C26CB3B6F12853693D7D72FC51D6775E82EBEFA3F978DB888BD4B3CD8D8C00FAF4A
Malicious:	false
Preview:	L..................F.@.. ...k..V.....<.g.....<8W....h,+.....................5....P.O. .:i.....+00.../C:\.....................1.....DW-F..PROGRA~2.........O.IDW&l....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....j.1.....DW.n..MICROS~2..R......DW.CDW.n....B.....................)W%.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.....N.1.....DW.n..root..:......DW.nDW.n............................*.r.o.o.t.....Z.1.....DW.n..Office16..B......DW.nDW.n.....<......................Y.O.f.f.i.c.e.1.6.....\.2.h,+.DW.m .EXCEL.EXE.D......DW.mDW.n....o'....................ii8.E.X.C.E.L...E.X.E.......n...............-.......m............F.......C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE..>.E.a.s.i.l.y. .d.i.s.c.o.v.e.r.,. .v.i.s.u.a.l.i.z.e.,. .a.n.d. .s.h.a.r.e. .i.n.s.i.g.h.t.s. .f.r.o.m. .y.o.u.r. .d.a.t.a...K.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\.r.o.o.t.\.O.f.f

C:\Users\user\AppData\Local\Temp\tmp2B13.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\Temp\tmp2B14.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\Temp\tmp2B15.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\Temp\tmp2B16.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6957997909429325
Encrypted:	false
SSDEEP:	24:kKnyV7BxweFQl79j+hRxUY//oWt/yeHEMcXJn25feaqrZZqW+LRJvy:kKnY7wGQlSxH/9kM0Jn25grZgRJa
MD5:	4F49714E789620AEDB7B9565DC949466
SHA1:	5917AC09E3D5074BFF8E1289865CAFF6403D1E82
SHA-256:	A9D5D3D8BE1D9E0187DA4AF85AFF3E2D1D6DE977D13EDA76900C96D98A8F073B
SHA-512:	61F147FA2B300AC2E3A42445F1283A47C805B756F36730CDCD4DB5A711BE43EFA471C7ECFB865908791852D1AAF365284BD4DE01F0EA0BF9DCD416A853C804E9
Malicious:	false
Preview:	NYMMPCEIMABCZIWJTJBTGSCCAGUWVTYLYWSVBSDZXQVJYUDCVLRURABBOBVCVDMKRKSRCSPXNAWPZJIOBULMRNUUOMOQGMWJLMZDBRBKAATADQPXHJFNCLPVAYDJHNDQMYWKBXYCBZJQANHQXCJPZQWORFXISYXSVTGTQJXNOUHRMKMJWJYCVNYAJFLKQVPGEYIUPPSZIHLNRGNCVNQBEZHDSJLAAKTOQOPFKISQUVSYIJUTXMPMVSFBVQNNFUXQRBBZWPVQFKOIAVQQMWQKLBSRPGKOQWZJAMBIDYJLYFILNAEEJCLRGBXDTSTBTNJDUXNFJBEZUDHSQUEENVIJUBNKGOLASBWAZBYYZZCOGWIJLRICWMFOAHSZVHCPRGDQXQUHZNZAIBOSXNAEYXAGWDBIHQGHOMKGZVYJDFBRWFKGJWGGPPTKNYWOHJZEIWRXWBERKQREQFMJHAKYHJCBTJJONCVMKTRJZVEWZOAKRUZLPQOXEQLKYATRQESEWRXETALDGKSHWFGQVXVYWPZEUDKTVGFGTXHQNKYUTVLNVAJFDYFPLRACHLYNSSVZZIAKKEEENZFLNPGNCVKMHGOYMQEBOXNMEXNXHUPMZAMZZQVDPFGLUSJHKGQWGKDPXMSIYPGNIXUXSJQFAXJLLSOUEANCWYAHDTOQTEKVGNOWSZINVNYZYIYNTVHHTDVGBTBPYPINRBPJYKHMRFCGSMCNFESVFMQIFPOJDAJGZEYTMLYQIIYRBVNEZSIWWOKGVIVGLXAQUNYDTWHGEWOLDMZRPSOAJKFXVJJTTIAJVLZGIFIWTHVZZGQOVGNSYXTJVFSXNDQLHICPBSAZIKIPLGSRTCKFEGRKNLTONCJFACYIGQPYUHVPNPUUGOOGHBAMCKOGYKVNNBSVPYVHZVJCMTDSHLBWEDMSWSFZAIRFDEYBDVHTWHABAXCAQCTXQRIUHVQFAEPMNYIWIBWVEEZTZGQTPDYRFAGKUGAEBSQFYYQG

C:\Users\user\AppData\Local\Temp\tmp2B17.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\Temp\tmp2B28.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\Temp\tmp2B29.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697771666106845
Encrypted:	false
SSDEEP:	24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
MD5:	D910958AF930D9DCA27D8F529EC053D0
SHA1:	321478679C760C347743149A323469AD4BFEA87D
SHA-256:	C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
SHA-512:	0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
Malicious:	false
Preview:	TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

C:\Users\user\AppData\Local\Temp\tmp2B2A.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697771666106845
Encrypted:	false
SSDEEP:	24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
MD5:	D910958AF930D9DCA27D8F529EC053D0
SHA1:	321478679C760C347743149A323469AD4BFEA87D
SHA-256:	C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
SHA-512:	0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
Malicious:	false
Preview:	TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

C:\Users\user\AppData\Local\Temp\tmp451E.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp451F.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp454F.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4560.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5436.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5447.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5467.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5488.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp7C40.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp7C50.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp7C61.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp7C72.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8916.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB2D5.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB2D6.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB2F6.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB306.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB6F7.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\Temp\tmpB6F8.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\Temp\tmpB6F9.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\Temp\tmpB6FA.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\Temp\tmpB70B.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\Temp\tmpB70C.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\Temp\tmpB70D.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\Temp\tmpB70E.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\Temp\tmpB70F.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\Temp\tmpB71F.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\Temp\tmpB720.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\Temp\tmpB721.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\Temp\tmpB722.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\Temp\tmpB723.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\Temp\tmpB734.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\Temp\tmpB735.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\Temp\tmpB736.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\Temp\tmpB737.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6957997909429325
Encrypted:	false
SSDEEP:	24:kKnyV7BxweFQl79j+hRxUY//oWt/yeHEMcXJn25feaqrZZqW+LRJvy:kKnY7wGQlSxH/9kM0Jn25grZgRJa
MD5:	4F49714E789620AEDB7B9565DC949466
SHA1:	5917AC09E3D5074BFF8E1289865CAFF6403D1E82
SHA-256:	A9D5D3D8BE1D9E0187DA4AF85AFF3E2D1D6DE977D13EDA76900C96D98A8F073B
SHA-512:	61F147FA2B300AC2E3A42445F1283A47C805B756F36730CDCD4DB5A711BE43EFA471C7ECFB865908791852D1AAF365284BD4DE01F0EA0BF9DCD416A853C804E9
Malicious:	false
Preview:	NYMMPCEIMABCZIWJTJBTGSCCAGUWVTYLYWSVBSDZXQVJYUDCVLRURABBOBVCVDMKRKSRCSPXNAWPZJIOBULMRNUUOMOQGMWJLMZDBRBKAATADQPXHJFNCLPVAYDJHNDQMYWKBXYCBZJQANHQXCJPZQWORFXISYXSVTGTQJXNOUHRMKMJWJYCVNYAJFLKQVPGEYIUPPSZIHLNRGNCVNQBEZHDSJLAAKTOQOPFKISQUVSYIJUTXMPMVSFBVQNNFUXQRBBZWPVQFKOIAVQQMWQKLBSRPGKOQWZJAMBIDYJLYFILNAEEJCLRGBXDTSTBTNJDUXNFJBEZUDHSQUEENVIJUBNKGOLASBWAZBYYZZCOGWIJLRICWMFOAHSZVHCPRGDQXQUHZNZAIBOSXNAEYXAGWDBIHQGHOMKGZVYJDFBRWFKGJWGGPPTKNYWOHJZEIWRXWBERKQREQFMJHAKYHJCBTJJONCVMKTRJZVEWZOAKRUZLPQOXEQLKYATRQESEWRXETALDGKSHWFGQVXVYWPZEUDKTVGFGTXHQNKYUTVLNVAJFDYFPLRACHLYNSSVZZIAKKEEENZFLNPGNCVKMHGOYMQEBOXNMEXNXHUPMZAMZZQVDPFGLUSJHKGQWGKDPXMSIYPGNIXUXSJQFAXJLLSOUEANCWYAHDTOQTEKVGNOWSZINVNYZYIYNTVHHTDVGBTBPYPINRBPJYKHMRFCGSMCNFESVFMQIFPOJDAJGZEYTMLYQIIYRBVNEZSIWWOKGVIVGLXAQUNYDTWHGEWOLDMZRPSOAJKFXVJJTTIAJVLZGIFIWTHVZZGQOVGNSYXTJVFSXNDQLHICPBSAZIKIPLGSRTCKFEGRKNLTONCJFACYIGQPYUHVPNPUUGOOGHBAMCKOGYKVNNBSVPYVHZVJCMTDSHLBWEDMSWSFZAIRFDEYBDVHTWHABAXCAQCTXQRIUHVQFAEPMNYIWIBWVEEZTZGQTPDYRFAGKUGAEBSQFYYQG

C:\Users\user\AppData\Local\Temp\tmpB738.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692024230831571
Encrypted:	false
SSDEEP:	24:RXklo22NBtmSOCPX4hQpKZCuvImjwxwo1:v22NBtxOCYQ0EuwmMxz
MD5:	086908C2D2FAA8C9284EAB6D70682A47
SHA1:	1BCA47E5FFEC5FD3CE416A922BC3F905C8FE27C4
SHA-256:	40C76F418FBB2A515AF4DEC81E501CEB725FD4C916D50FCA1A82B9F5ABC1DCCF
SHA-512:	02C48E3CDA1DC748CD3F30B2384D515B50C1DFD63651554AD3D4562B1A47F5446098DCED47A0766D184DDB30B3F158ABEC5877C9CA28AB191CEBB0782C26B230
Malicious:	false
Preview:	EIVQSAOTAQGMTJLIEKHIWADNDLJLEWUUXVGOFMOKPHABQUHVNBFVSKQIGVIHICGEEXRLSTKQNZUKOHPLLTCYQSLQJMPWPWNUJFUONDXMYCCUPDUBYMPUSUKUOWWSWDLZMDWKNMUKNPKBXAJATSGOQUAMHMZDCDDJRHKOUEDMLSCIOXAHAUFDQKBUBESAKMMFMHDLSSVUQLOZXARPGPMGAAKVDEITBYGGXWIGUIJRVXQOBOIOJWPYSPHZBHWQTMDCUFCWBQSAZNRUOPCLATAERLBPATETXMFUGXBEGMNPKKEZVSRLCYPFEPWIAEINAMGSOXLYWMUKYSQACPSUTGHDCTFLXKAMLOCGYHCMAETHVZNZOCWWUHYAPHFILDNLLBMLSLXIMOFGWTDVLWPHHRGGAWSIGNXEJRIBIBLWFBUASCLZPUIVDERXYLWTNLLRLTFZJTTDGFOEYPFXIPHFKEXHOGEHSFYCCCTGNFQFYETBADKAEAOXYXJWDJWNZPEOBJZTKPLJPPMICDOWUIVDKBQQMHETDORVKZPOWTAZRBAQYYQHBNHIWFZXBILGKHZBLSQJJEIYBHUIDAOEXERQEUMMKBWDXSMLJVAZJQPZARLOBNSTUDCVKLCVBPTKTJWSMPMKSFOQPINFTNEGPVSYCWOXABSGFFKRQDFQEIJWDUMZKILALUHYQZGZOLYMKSAOZGUYCKJOJLYINHVKCTZVXLYIYPGOQZQQAGXVWEBSURTQECDRXYKQAJBEKDNSIHNBZCUBIKPKVWLUOFFCIZSKQBAAPGFMBASMUOKLLGWEHHMYDJCOQEKOBYLYWOOZLBASOJJYLIHZKUGUKHZQBIAVUPYHYEWAYGUFNARHCUKTFMLHSFLRVAELAFCQHPEFUSGNONWLLYQVUVSVEKHDRXJHDSSFJATGDRCTMICJWPFPKKLXECKUXREXEAQNPOBPRKFYRWIWXEWLAPUSHGKXWYYIJNUMGQHBJPMOYZIXPGOJLOQG

C:\Users\user\AppData\Local\Temp\tmpB749.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\Temp\tmpB74A.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697771666106845
Encrypted:	false
SSDEEP:	24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
MD5:	D910958AF930D9DCA27D8F529EC053D0
SHA1:	321478679C760C347743149A323469AD4BFEA87D
SHA-256:	C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
SHA-512:	0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
Malicious:	false
Preview:	TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

C:\Users\user\AppData\Local\Temp\tmpB75A.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\Temp\tmpD594.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD5A4.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD5B5.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD5C5.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD5F5.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD606.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpDB1.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpDF0.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE90C.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE90D.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE90E.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE91E.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE92F.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE94F.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE96F.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF128.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\Temp\tmpF129.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\Temp\tmpF12A.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\Temp\tmpF12B.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\Temp\tmpF12C.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\Temp\tmpF12D.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\Temp\tmpF13E.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\Temp\tmpF13F.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\Temp\tmpF14F.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\Users\user\AppData\Local\Temp\tmpF150.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\Temp\tmpF151.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Local\Temp\tmpF152.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\Temp\tmpF163.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\Temp\tmpF164.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\Temp\tmpF165.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Local\Temp\tmpF176.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\Temp\tmpF177.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6957997909429325
Encrypted:	false
SSDEEP:	24:kKnyV7BxweFQl79j+hRxUY//oWt/yeHEMcXJn25feaqrZZqW+LRJvy:kKnY7wGQlSxH/9kM0Jn25grZgRJa
MD5:	4F49714E789620AEDB7B9565DC949466
SHA1:	5917AC09E3D5074BFF8E1289865CAFF6403D1E82
SHA-256:	A9D5D3D8BE1D9E0187DA4AF85AFF3E2D1D6DE977D13EDA76900C96D98A8F073B
SHA-512:	61F147FA2B300AC2E3A42445F1283A47C805B756F36730CDCD4DB5A711BE43EFA471C7ECFB865908791852D1AAF365284BD4DE01F0EA0BF9DCD416A853C804E9
Malicious:	false
Preview:	NYMMPCEIMABCZIWJTJBTGSCCAGUWVTYLYWSVBSDZXQVJYUDCVLRURABBOBVCVDMKRKSRCSPXNAWPZJIOBULMRNUUOMOQGMWJLMZDBRBKAATADQPXHJFNCLPVAYDJHNDQMYWKBXYCBZJQANHQXCJPZQWORFXISYXSVTGTQJXNOUHRMKMJWJYCVNYAJFLKQVPGEYIUPPSZIHLNRGNCVNQBEZHDSJLAAKTOQOPFKISQUVSYIJUTXMPMVSFBVQNNFUXQRBBZWPVQFKOIAVQQMWQKLBSRPGKOQWZJAMBIDYJLYFILNAEEJCLRGBXDTSTBTNJDUXNFJBEZUDHSQUEENVIJUBNKGOLASBWAZBYYZZCOGWIJLRICWMFOAHSZVHCPRGDQXQUHZNZAIBOSXNAEYXAGWDBIHQGHOMKGZVYJDFBRWFKGJWGGPPTKNYWOHJZEIWRXWBERKQREQFMJHAKYHJCBTJJONCVMKTRJZVEWZOAKRUZLPQOXEQLKYATRQESEWRXETALDGKSHWFGQVXVYWPZEUDKTVGFGTXHQNKYUTVLNVAJFDYFPLRACHLYNSSVZZIAKKEEENZFLNPGNCVKMHGOYMQEBOXNMEXNXHUPMZAMZZQVDPFGLUSJHKGQWGKDPXMSIYPGNIXUXSJQFAXJLLSOUEANCWYAHDTOQTEKVGNOWSZINVNYZYIYNTVHHTDVGBTBPYPINRBPJYKHMRFCGSMCNFESVFMQIFPOJDAJGZEYTMLYQIIYRBVNEZSIWWOKGVIVGLXAQUNYDTWHGEWOLDMZRPSOAJKFXVJJTTIAJVLZGIFIWTHVZZGQOVGNSYXTJVFSXNDQLHICPBSAZIKIPLGSRTCKFEGRKNLTONCJFACYIGQPYUHVPNPUUGOOGHBAMCKOGYKVNNBSVPYVHZVJCMTDSHLBWEDMSWSFZAIRFDEYBDVHTWHABAXCAQCTXQRIUHVQFAEPMNYIWIBWVEEZTZGQTPDYRFAGKUGAEBSQFYYQG

C:\Users\user\AppData\Local\Temp\tmpF178.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\Temp\tmpF179.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\Temp\tmpF189.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	97792
Entropy (8bit):	5.960608101924351
Encrypted:	false
SSDEEP:	1536:9qs+XqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed203tmulgS6pY:r0gzWHY3+zi0ZbYe1g0ujyzdmY
MD5:	094C83270E926B418DD431978AE802D8
SHA1:	0DDBF017E6313F004F0C7B66EE7E2706564F16E1
SHA-256:	4E2AF86DB2326D23EDE094F504645213DD0F26F0E86B5059B6CF9BD5A8115DEA
SHA-512:	9D7DD275DE9B57FD27AE5D8EBCC9A7D4842ED0C0BC8E16E9D1A16B0F7429FEC562D771FECA9C36C9B27C54127215C00CEA772EB3248E7059351F6BAA1C0A61C7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\tmpF189.tmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\tmpF189.tmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\tmpF189.tmp, Author: unknown Rule: infostealer_win_redline_strings, Description: Finds Redline samples based on characteristic strings, Source: C:\Users\user\AppData\Local\Temp\tmpF189.tmp, Author: Sekoia.io Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: C:\Users\user\AppData\Local\Temp\tmpF189.tmp, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 86%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..t............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text...4s... ...t.................. ..`.rsrc................v..............@..@.reloc...............\|..............@..B........................H...........,.......C....................................................0.. .......s......~....%-.&~..........s....%.....(...+o.....8.....o............%........%.....(....s.....%.......%.....(....s.....%.......%.....(....s.....(....o.....8F.....(.....s......s,.......~....}....~.........s....(....o....}......{...........%.....(....s....o....,.......%.....(....s......+O..>.....%.....(....s....r...p~....(....(....o....-...{....(....+...{....(........(....:V......o........(....o

C:\Users\user\AppData\Local\Temp\tmpF189.tmp:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\tmpF18A.tmp

Download File

Process:	C:\Users\user\Desktop\CxfUzjqyxz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.700739677288544
Encrypted:	false
SSDEEP:	24:ppydEKvTSBiqFHi8v+wyNV+fxloGJjN3y5j1xTEC3ugbIvso8wFjas:rmEKvMiYC8Wwyr88GFAH/UvsuZl
MD5:	57582F5B6AE65D8DFCBD4A26382C6138
SHA1:	DC27AD5E54D1BDCCA4EC0D54ED1FB5A3235E9842
SHA-256:	7918D6E76741E42934BB32547E2D7EA395304AEA3383C0E6B7FCF82ACE125749
SHA-512:	6D75F68E608CB12378605F06C74F2F0414486072CC25961A1EA421B94EA5827F92110B902C2190E04AAE2D79152B0AB9B5B1ACECDCAAADD93A6F25028DD1E060
Malicious:	false
Preview:	CZQKSDDMWRVXFLQDZCLIIZCHKUTASMCLXARWUFPBFEESBCKPMBKHTZOAVUSGWGQBPZXNCLVHGKNWOAOTOSOFYOKUZEGHVYFBBGTMFWOOTOTSLTKZBTPTBZMUKYOSGWCRRYGDZWOEMUMCRRCZIEIYJAYGXMDKNOLEIKRXPEZKZGIXGYJYIBDXPZGYVGHMUCSHXXAYXQQNWIVOLMGKTXTGEAEKAOKQQSCTUWFEFQMLQUREMQDBYWFEQOMAJXVXIMMKWJJFKSSTMQZNWPBIQBZROXFYPWCYBVRMKUOGMEJJHYTWCOZYZXVANCHSTYZHRBVSORLGLSOWPDGEBVMQLDWKSLQFPEZDXWPZYNPSNTKGPNKUHFMAEGDWSDLCDNYFQZWURNIMQZDJNJPPOXINSGMUVHRDBWXOXDRPWKGITAKUVBIDIBIWIIANONNQUMKNATQWTVSOUCLOFKCCAISNABSKDPLNCYIQIFQMVEHZLIAFYDDSJJTQSUEVQKACGQHHXCYTZJABESDNXLIPGYKWXJZQWYJMSZUZHKYCGKQIKCYIWZOHAVHKCRNACDVNLPEXUPOQVKBGVFKCQDKJPNALRMAYMZRBAGMTICYZEFMXXYLDXTMKSZLDKSKSRQTDUDGFZXFQEHEDXVFBYBNEOVKFLNIRSTGZDIJXNRZEZFJHNPZDGPGECJTHNVMTSURANVWOVRBTYGZGIPOXWTRIHNKWFKCTXVVKOFHISZVHNVVRXJGJEZEJDSCKNIDUQYQWFNDXBQQJAYENVZXKXVUERYEPFEGNWBAJHHQSAFTHXGXMHUHJVQEYGVKPBTQMWUEZMBBSFENGBBVZIYHLXFRDPALQUURINJMTQGTPGJRGIWXIXWOPVDTWDBDNJJVXOPMTWAGMWQFUPMRROBBTRTOQBMZKPGWTYPWAVOKTSPLMOWJJDVZIIDATCEGNLHPVRONAQJFLFUZXJVRXMCGQNRKTYBRGRMKBPVPQSPFOIOHXGEGDHOJP

Static File Info

General

File type:
Entropy (8bit):	5.960608101924351
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	CxfUzjqyxz.exe
File size:	97'792 bytes
MD5:	094c83270e926b418dd431978ae802d8
SHA1:	0ddbf017e6313f004f0c7b66ee7e2706564f16e1
SHA256:	4e2af86db2326d23ede094f504645213dd0f26f0e86b5059b6cf9bd5a8115dea
SHA512:	9d7dd275de9b57fd27ae5d8ebcc9a7d4842ed0c0bc8e16e9d1a16b0f7429fec562d771feca9c36c9b27c54127215c00cea772eb3248e7059351f6baa1c0a61c7
SSDEEP:	1536:9qs+XqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed203tmulgS6pY:r0gzWHY3+zi0ZbYe1g0ujyzdmY
TLSH:	10A35D3067AC9F19EAFD1B74B4B2012043F0E48A9091FB4B4DC154E61FA7B866957EF2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..t............... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-02-13T12:32:14.360759+0100	1800000	Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect	1	192.168.2.5	49704	91.92.136.87	26264	TCP
2025-02-13T12:32:14.360759+0100	2849662	ETPRO MALWARE RedLine - CheckConnect Request	1	192.168.2.5	49704	91.92.136.87	26264	TCP
2025-02-13T12:32:19.371533+0100	2045000	ET MALWARE RedLine Stealer - CheckConnect Response	1	91.92.136.87	26264	192.168.2.5	49704	TCP
2025-02-13T12:32:19.626445+0100	2849351	ETPRO MALWARE RedLine - EnvironmentSettings Request	1	192.168.2.5	49704	91.92.136.87	26264	TCP
2025-02-13T12:32:23.373259+0100	2045001	ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound	1	91.92.136.87	26264	192.168.2.5	49704	TCP
2025-02-13T12:32:23.794497+0100	2849352	ETPRO MALWARE RedLine - SetEnvironment Request	1	192.168.2.5	49706	91.92.136.87	26264	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 13, 2025 12:32:13.611644983 CET	49704	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:13.616668940 CET	26264	49704	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:13.616771936 CET	49704	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:13.630816936 CET	49704	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:13.635667086 CET	26264	49704	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:13.986027956 CET	49704	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:13.991219044 CET	26264	49704	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:14.308043957 CET	26264	49704	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:14.360759020 CET	49704	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:19.366511106 CET	49704	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:19.366554976 CET	49704	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:19.371532917 CET	26264	49704	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:19.371582985 CET	26264	49704	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:19.574582100 CET	26264	49704	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:19.626445055 CET	49704	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:19.722876072 CET	26264	49704	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:19.722897053 CET	26264	49704	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:19.722908974 CET	26264	49704	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:19.722920895 CET	26264	49704	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:19.722935915 CET	26264	49704	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:19.722943068 CET	49704	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:19.722973108 CET	49704	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:19.767039061 CET	49704	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:19.799338102 CET	49705	443	192.168.2.5	104.26.13.31
Feb 13, 2025 12:32:19.799381971 CET	443	49705	104.26.13.31	192.168.2.5
Feb 13, 2025 12:32:19.799488068 CET	49705	443	192.168.2.5	104.26.13.31
Feb 13, 2025 12:32:19.816405058 CET	49705	443	192.168.2.5	104.26.13.31
Feb 13, 2025 12:32:19.816426992 CET	443	49705	104.26.13.31	192.168.2.5
Feb 13, 2025 12:32:20.287722111 CET	443	49705	104.26.13.31	192.168.2.5
Feb 13, 2025 12:32:20.287831068 CET	49705	443	192.168.2.5	104.26.13.31
Feb 13, 2025 12:32:20.404766083 CET	49705	443	192.168.2.5	104.26.13.31
Feb 13, 2025 12:32:20.404793024 CET	443	49705	104.26.13.31	192.168.2.5
Feb 13, 2025 12:32:20.405194998 CET	443	49705	104.26.13.31	192.168.2.5
Feb 13, 2025 12:32:20.454593897 CET	49705	443	192.168.2.5	104.26.13.31
Feb 13, 2025 12:32:20.748780012 CET	49705	443	192.168.2.5	104.26.13.31
Feb 13, 2025 12:32:20.795330048 CET	443	49705	104.26.13.31	192.168.2.5
Feb 13, 2025 12:32:21.112916946 CET	443	49705	104.26.13.31	192.168.2.5
Feb 13, 2025 12:32:21.113018990 CET	443	49705	104.26.13.31	192.168.2.5
Feb 13, 2025 12:32:21.113075018 CET	49705	443	192.168.2.5	104.26.13.31
Feb 13, 2025 12:32:21.118089914 CET	49705	443	192.168.2.5	104.26.13.31
Feb 13, 2025 12:32:23.368009090 CET	49704	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.368470907 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.373259068 CET	26264	49704	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.373289108 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.373356104 CET	49704	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.373404026 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.383028030 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.387810946 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.736974955 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.742014885 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.742033005 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.742041111 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.742060900 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.742070913 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.742079020 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.742083073 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.742093086 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.742095947 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.742108107 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.742120028 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.742284060 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.742294073 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.742304087 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.742341995 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.742360115 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.747006893 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.747015953 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.747041941 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.747051001 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.747061014 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.747083902 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.747102976 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.747112989 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.747147083 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.747185946 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.794368029 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.794497013 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.842514992 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.842582941 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.848459005 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.848654985 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.853615999 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.853626013 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.853703976 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.853713036 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.853720903 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.853738070 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.853739977 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.853770971 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.853800058 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.853825092 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.853841066 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.853857994 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.853866100 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.853883982 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.853890896 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.853899956 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.853914022 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.853933096 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.853940964 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.853944063 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.853975058 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.853991985 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.854000092 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.854027987 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.854034901 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.854053974 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.854059935 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.854073048 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.854085922 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.854105949 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.854111910 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.854132891 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.854146004 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.854154110 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.854171038 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.854216099 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.854226112 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.854268074 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.854283094 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.854312897 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.854334116 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.854337931 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.854377031 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.854376078 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.854424000 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.858614922 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.858668089 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.858695030 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.858731985 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.858736038 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.858771086 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.858781099 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.858788967 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.858829021 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.858859062 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.858902931 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.858916044 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.858942986 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.858959913 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.858974934 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.859040976 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.859087944 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.859091043 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.859143972 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.859174013 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.859203100 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.859225035 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.859236002 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.859249115 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.859281063 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.859287024 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.859338999 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.859386921 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.859416962 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.859441042 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.859445095 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.859462976 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.859497070 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.859524965 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.859543085 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.859554052 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.859571934 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.859581947 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.859600067 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.859625101 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.859636068 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.859664917 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.859688997 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.859693050 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.859711885 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.859720945 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.859740019 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.859747887 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.859767914 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.859776020 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.859792948 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.859803915 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.859822989 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.859848022 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.859857082 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.859884977 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.859903097 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.859914064 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.859932899 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.859941959 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.859963894 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.859970093 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.859987974 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.859997988 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.860016108 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.860027075 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.860038042 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.860054970 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.860074043 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.860083103 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.860101938 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.860110998 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.860130072 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.860138893 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.860158920 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.860167980 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.860188961 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.860197067 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.860215902 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.860224009 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.860241890 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.860266924 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.860275030 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.860304117 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.860322952 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.860332012 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.860351086 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.860359907 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.860378981 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.860388994 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.860408068 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.860416889 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.860434055 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.860445023 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.860471964 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.860472918 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.860495090 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.860502005 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.860524893 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.860528946 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.860551119 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.860557079 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.860574007 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.860585928 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.860610008 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.860614061 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.860637903 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.860765934 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.863518953 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.863590002 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.863660097 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.863689899 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.863713980 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.863738060 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.863742113 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.863770008 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.863790035 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.863801956 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.863817930 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.863831043 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.863852024 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.863874912 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.863925934 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.863954067 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.863976955 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.863982916 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.864003897 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.864011049 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.864032984 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.864038944 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.864058971 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.864068031 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.864085913 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.864095926 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.864118099 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.864123106 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.864136934 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.864152908 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.864171982 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.864181042 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.864203930 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.864216089 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.864228010 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.864264965 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.865545034 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.865575075 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.865598917 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.865602970 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.865624905 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.865648985 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.865660906 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.865689993 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.865710020 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.865717888 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.865739107 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.865746975 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.865761995 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.865775108 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.865802050 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.865803003 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.865818024 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.865852118 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.865853071 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.865883112 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.865905046 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.865911961 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.865930080 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.865940094 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.865958929 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.865967989 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.865991116 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.865995884 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.866008997 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.866024017 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.866050005 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.866059065 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.866077900 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.866087914 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.866108894 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.866116047 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.866134882 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.866142988 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.866162062 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.866170883 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.866189957 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.866215944 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.866231918 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.866260052 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.866281033 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.866288900 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.866308928 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.866317987 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.866334915 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.866345882 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.866363049 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.866374969 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.866395950 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.866401911 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.866420031 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.866430044 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.866450071 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.866460085 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.866477966 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.866487980 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.866506100 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.866516113 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.866533995 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.866544962 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.866561890 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.866571903 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.866591930 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.866601944 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.866622925 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.866630077 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.866650105 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.866657972 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.866676092 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.866700888 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.866713047 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.866741896 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.866760969 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.866770029 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.866789103 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.866799116 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.866817951 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.866827965 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.866852045 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.866864920 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.866875887 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.866894007 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.866919041 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.866923094 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.866938114 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.866955996 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.866971016 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.866983891 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867002964 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867013931 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867032051 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867042065 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867062092 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867070913 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867088079 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867099047 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867119074 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867129087 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867150068 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867160082 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867176056 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867187977 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867207050 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867217064 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867233038 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867244959 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867261887 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867296934 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867316961 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867342949 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867342949 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867377996 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867396116 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867405891 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867413998 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867434978 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867458105 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867481947 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867487907 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867536068 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867538929 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867568016 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867585897 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867595911 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867615938 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867624044 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867640972 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867651939 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867671967 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867681026 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867697954 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867708921 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867732048 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867737055 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867749929 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867763996 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867784977 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867793083 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867810965 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867820978 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867840052 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867849112 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867867947 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867877007 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867894888 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867904902 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867921114 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867925882 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867933035 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867942095 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867947102 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867959976 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867968082 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867970943 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867979050 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867985010 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.867990017 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.867995977 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.868000984 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.868005991 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.868016005 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.868016005 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.868024111 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.868029118 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.868038893 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.868040085 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.868053913 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.868062973 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.868072033 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.868079901 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.868081093 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.868089914 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.868098974 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.868099928 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.868108034 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.868118048 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.868127108 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.868134975 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.868138075 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.868144989 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.868154049 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.868158102 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.868163109 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.868177891 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.868189096 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.868196964 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.868633032 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.868686914 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.869066000 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869076967 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869126081 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.869179010 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869188070 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869195938 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869206905 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869219065 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.869227886 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869236946 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869246006 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869246960 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.869255066 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869259119 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.869318962 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.869324923 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869335890 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869344950 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869354010 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869365931 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.869405031 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869405985 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.869416952 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869426966 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869435072 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869441986 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.869445086 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869457006 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869462967 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.869477987 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869487047 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869502068 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.869508982 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869515896 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.869519949 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869529963 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869534016 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.869539022 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869549990 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869554043 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.869559050 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869563103 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.869573116 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.869576931 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869586945 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869587898 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.869595051 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869601011 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.869606972 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869612932 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.869616985 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.869621992 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.869632006 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.869659901 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.870217085 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.870228052 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.870280981 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.872956991 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.872967958 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873013020 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873025894 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873045921 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.873069048 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.873086929 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.873162031 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873183012 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873188972 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873191118 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873193026 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873194933 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873197079 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873198032 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873204947 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.873214960 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873218060 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873223066 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873224974 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873244047 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873255014 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873284101 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.873303890 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873312950 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873332977 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.873347044 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.873363018 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873372078 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.873373985 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873385906 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873394966 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873402119 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.873413086 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.873420954 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.873435974 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.873449087 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.873482943 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873492002 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873501062 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873511076 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873521090 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873529911 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873538017 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.873538017 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873548031 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873555899 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.873567104 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873568058 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.873575926 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873584032 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873588085 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.873593092 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873603106 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.873616934 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873626947 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873635054 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.873653889 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.873668909 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.873692036 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873701096 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873703957 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873711109 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873718977 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873747110 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873753071 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.873755932 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873764038 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873780012 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873780966 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.873789072 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873800039 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.873806953 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873816013 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873816013 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.873830080 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.873850107 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.873862982 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.873908043 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873917103 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873923063 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873931885 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873939991 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873948097 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.873967886 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.873980999 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.874001026 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874001980 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.874010086 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874018908 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874028921 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874041080 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874048948 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.874074936 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874094963 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.874116898 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874126911 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874131918 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.874162912 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.874190092 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.874257088 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874265909 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874274015 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874283075 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874289989 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874293089 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.874304056 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.874320984 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.874330044 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874337912 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.874340057 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874378920 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.874460936 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874492884 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874501944 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874509096 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874514103 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.874527931 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.874553919 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.874571085 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874579906 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874587059 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874597073 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874604940 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874613047 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874615908 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.874620914 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874630928 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874636889 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.874639034 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874646902 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874655008 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874654055 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.874663115 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874671936 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874674082 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.874682903 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874696016 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.874701977 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874710083 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874715090 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.874720097 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874728918 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874730110 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.874737978 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874747038 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874756098 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874758005 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.874763966 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874775887 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.874794960 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.874806881 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874809027 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.874818087 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874825954 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874844074 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874845982 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.874852896 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874862909 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874865055 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.874871969 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874880075 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874888897 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874902010 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874906063 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874907017 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.874908924 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874917030 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874926090 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874931097 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.874943018 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874953032 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.874959946 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.874994040 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875000954 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875010014 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875019073 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875027895 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875037909 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875042915 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875051975 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875065088 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875085115 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875101089 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875102997 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875113010 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875119925 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875129938 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875139952 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875148058 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875148058 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875159025 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875165939 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875169039 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875174999 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875194073 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875201941 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875204086 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875219107 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875230074 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875233889 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875242949 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875256062 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875278950 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875300884 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875309944 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875327110 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875334978 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875346899 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875366926 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875375986 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875375986 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875385046 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875392914 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875403881 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875416994 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875418901 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875427961 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875441074 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875466108 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875469923 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875473976 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875510931 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875519037 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875526905 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875534058 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875566959 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875579119 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875582933 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875587940 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875597954 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875614882 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875622988 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875627041 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875632048 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875641108 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875648022 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875649929 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875657082 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875673056 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875706911 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875741005 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875750065 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875756979 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875765085 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875772953 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875778913 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875780106 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875802994 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875808001 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875817060 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875821114 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875827074 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875837088 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875850916 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875878096 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.875911951 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875921011 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875927925 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.875952959 CET	49706	26264	192.168.2.5	91.92.136.87
Feb 13, 2025 12:32:23.876039028 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876107931 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876141071 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876172066 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876183033 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876260042 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876267910 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876334906 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876343012 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876351118 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876358986 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876367092 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876374960 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876384020 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876391888 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876399040 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876408100 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876424074 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876430988 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876439095 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876455069 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876462936 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876511097 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876519918 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876527071 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876537085 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876552105 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876559973 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876575947 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876583099 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876593113 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876631975 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876640081 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876646996 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876662970 CET	26264	49706	91.92.136.87	192.168.2.5
Feb 13, 2025 12:32:23.876669884 CET	26264	49706	91.92.136.87	192.168.2.5
Feb

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report CxfUzjqyxz.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\CxfUzjqyxz.exe.log

C:\Users\user\AppData\Local\Temp\tmp1EE8.tmp

C:\Users\user\AppData\Local\Temp\tmp1EE9.tmp

C:\Users\user\AppData\Local\Temp\tmp1F09.tmp

C:\Users\user\AppData\Local\Temp\tmp1F29.tmp

C:\Users\user\AppData\Local\Temp\tmp1F3A.tmp

C:\Users\user\AppData\Local\Temp\tmp1F4B.tmp

C:\Users\user\AppData\Local\Temp\tmp2AFA.tmp

C:\Users\user\AppData\Local\Temp\tmp2AFB.tmp

C:\Users\user\AppData\Local\Temp\tmp2AFC.tmp

C:\Users\user\AppData\Local\Temp\tmp2AFD.tmp

C:\Users\user\AppData\Local\Temp\tmp2AFE.tmp

C:\Users\user\AppData\Local\Temp\tmp2AFF.tmp

C:\Users\user\AppData\Local\Temp\tmp2B00.tmp

Windows Analysis Report
CxfUzjqyxz.exe